Fix repo boundary violations

Author: hrabanazviking

REPO_BOUNDARY.md

@@ -0,0 +1,23 @@
+# Repository Boundary
+
+This repository contains one active packaged product and several dormant or reference code islands. The active product must stay independently installable, testable, and importable without importing those islands directly.
+
+## Active Runtime Path
+
+The active runtime is `mythic_vibe_cli/`.
+
+Code under this path may import the Python standard library, declared package dependencies, and other modules inside `mythic_vibe_cli/`. It must not directly import dormant top-level repository packages such as `ai`, `core`, `systems`, `sessions`, `imports`, `yggdrasil`, `mindspark_thoughtform`, `ollama`, `whisper`, or `chatterbox`.
+
+## Dormant Islands
+
+Dormant islands remain source, reference, research, or optional integration material until an adapter makes the boundary explicit. Optional integrations must be reached through a small module inside `mythic_vibe_cli/`, guarded by configuration or feature flags, and documented by an ADR when the boundary is non-trivial.
+
+## Required Checks
+
+Before merging boundary-sensitive work, run:
+
+```bash
+mythic-vibe doctor --repo-boundary --path .
+```
+
+The command verifies this file, the active product boundary docs, dormant island docs, and the ADRs that define the import rules.

mythic_vibe_cli/ai/providers/yggdrasil.py

@@ -23,8 +23,11 @@
 
 from __future__ import annotations
 
+import importlib
 import os
+import sys
 from dataclasses import dataclass, field
+from pathlib import Path
 from typing import Any
 
 from .base import (
@@ -38,6 +41,48 @@
 
 ISLAND_ENABLED_ENV = "MYTHIC_ISLAND_YGGDRASIL_ENABLED"
 _TRUTHY = {"1", "true", "yes", "on"}
+_REPO_ROOT = Path(__file__).resolve().parents[3]
+
+
+def _module_is_from_dormant_repo_path(module: Any, package_name: str) -> bool:
+    raw_path = getattr(module, "__file__", "") or ""
+    if not raw_path:
+        return False
+    try:
+        path = Path(raw_path).resolve()
+        return path.is_relative_to(_REPO_ROOT / package_name)
+    except (OSError, ValueError):
+        return False
+
+
+def _import_external_package(package_name: str) -> Any:
+    existing = sys.modules.get(package_name)
+    if existing is not None:
+        if _module_is_from_dormant_repo_path(existing, package_name):
+            raise ImportError(
+                f"{package_name} resolves to dormant repo path, not an external package"
+            )
+        return existing
+
+    spec = importlib.util.find_spec(package_name)
+    if spec is None:
+        raise ImportError(f"{package_name} package not found")
+    origin = spec.origin or ""
+    search_locations = list(spec.submodule_search_locations or [])
+    for raw_path in [origin, *search_locations]:
+        if not raw_path:
+            continue
+        try:
+            path = Path(raw_path).resolve()
+        except (OSError, ValueError):
+            continue
+        if path == _REPO_ROOT / package_name or path.is_relative_to(
+            _REPO_ROOT / package_name
+        ):
+            raise ImportError(
+                f"{package_name} resolves to dormant repo path, not an external package"
+            )
+    return importlib.import_module(package_name)
 
 
 def is_island_enabled() -> bool:
@@ -62,21 +107,19 @@ def _try_import_yggdrasil() -> Any | None:
     available so the operator can install whichever one their
     deployment ships."""
     try:
-        import yggdrasil  # type: ignore[import-not-found]
+        return _import_external_package("yggdrasil")
     except ImportError:
         return None
-    return yggdrasil
 
 
 def _try_import_wyrdforge() -> Any | None:
     """Best-effort try-import for the canonical published WYRD
     package. Returns the ``wyrdforge`` module object, or ``None``
     when the package isn't on ``sys.path``. Phase F.2 (additive)."""
     try:
-        import wyrdforge  # type: ignore[import-not-found]
+        return _import_external_package("wyrdforge")
     except ImportError:
         return None
-    return wyrdforge
 
 
 @dataclass

mythic_vibe_cli/voice/transcribe.py

@@ -25,7 +25,9 @@
 
 from __future__ import annotations
 
+import importlib
 import os
+import sys
 import tempfile
 import wave
 from dataclasses import dataclass, field
@@ -41,6 +43,7 @@
 DEFAULT_MIC_SAMPLE_RATE = 16_000
 DEFAULT_MIC_CHANNELS = 1
 DEFAULT_MIC_DURATION = 5.0
+_REPO_ROOT = Path(__file__).resolve().parents[2]
 
 
 class MissingExtraError(RuntimeError):
@@ -56,6 +59,48 @@ def __init__(self, extra: str, install_hint: str) -> None:
         self.install_hint = install_hint
 
 
+def _module_is_from_dormant_repo_path(module: Any, package_name: str) -> bool:
+    raw_path = getattr(module, "__file__", "") or ""
+    if not raw_path:
+        return False
+    try:
+        path = Path(raw_path).resolve()
+        return path.is_relative_to(_REPO_ROOT / package_name)
+    except (OSError, ValueError):
+        return False
+
+
+def _import_external_package(package_name: str) -> Any:
+    existing = sys.modules.get(package_name)
+    if existing is not None:
+        if _module_is_from_dormant_repo_path(existing, package_name):
+            raise ImportError(
+                f"{package_name} resolves to dormant repo path, not an external package"
+            )
+        return existing
+
+    spec = importlib.util.find_spec(package_name)
+    if spec is None:
+        raise ImportError(f"{package_name} package not found")
+    origin = spec.origin or ""
+    search_locations = list(spec.submodule_search_locations or [])
+    candidate_paths = [origin, *search_locations]
+    for raw_path in candidate_paths:
+        if not raw_path:
+            continue
+        try:
+            path = Path(raw_path).resolve()
+        except (OSError, ValueError):
+            continue
+        if path == _REPO_ROOT / package_name or path.is_relative_to(
+            _REPO_ROOT / package_name
+        ):
+            raise ImportError(
+                f"{package_name} resolves to dormant repo path, not an external package"
+            )
+    return importlib.import_module(package_name)
+
+
 @dataclass(frozen=True)
 class TranscriptionRequest:
     """Input payload. ``source_path`` is the only required field —
@@ -189,14 +234,13 @@ class WhisperTranscriber:
 
     def __post_init__(self) -> None:
         try:
-            import whisper  # type: ignore[import-not-found]
+            self._module = _import_external_package("whisper")
         except ImportError as exc:
             raise MissingExtraError(
                 "openai-whisper",
                 "Install with `pip install openai-whisper`. "
                 "Note: whisper requires ffmpeg on PATH for audio decoding.",
             ) from exc
-        self._module = whisper
 
     def transcribe(self, request: TranscriptionRequest) -> TranscriptionResult:
         if self._module is None:  # pragma: no cover — __post_init__ guards

mythic_vibe_cli/voice/tts.py

@@ -34,7 +34,7 @@
 from dataclasses import dataclass, field
 from typing import Any, Protocol, runtime_checkable
 
-from .transcribe import MissingExtraError
+from .transcribe import MissingExtraError, _import_external_package
 
 
 TTS_ENABLED_ENV = "MYTHIC_VOICE_TTS_ENABLED"
@@ -168,13 +168,12 @@ class ChatterboxEngine:
 
     def __post_init__(self) -> None:
         try:
-            import chatterbox  # type: ignore[import-not-found]
+            self._module = _import_external_package("chatterbox")
         except ImportError as exc:
             raise MissingExtraError(
                 "chatterbox",
                 "Install with `pip install chatterbox` (open-source TTS).",
             ) from exc
-        self._module = chatterbox
 
     # ---- Additive 2026-05-02: Modern Chatterbox API adapter ------------
     #

tests/test_island_isolation.py

@@ -13,6 +13,7 @@
 from __future__ import annotations
 
 import os
+from pathlib import Path
 import unittest
 from unittest import mock
 
@@ -212,6 +213,19 @@ def test_missing_yggdrasil_dep_does_not_block_other_providers(self) -> None:
             self.assertIn("copy-paste", providers)
             self.assertTrue(providers["copy-paste"].validate_config().configured)
 
+    def test_yggdrasil_try_import_does_not_load_dormant_repo_island(self) -> None:
+        from mythic_vibe_cli.ai.providers.yggdrasil import _try_import_yggdrasil
+
+        module = _try_import_yggdrasil()
+        if module is None:
+            return
+
+        raw_path = getattr(module, "__file__", "")
+        self.assertTrue(raw_path)
+        module_path = Path(raw_path).resolve()
+        repo_root = Path(__file__).resolve().parents[1]
+        self.assertFalse(module_path.is_relative_to(repo_root / "yggdrasil"))
+
     def test_missing_mindspark_dep_does_not_block_other_providers(self) -> None:
         from mythic_vibe_cli.ai.providers.mindspark import MindSparkProvider
         from mythic_vibe_cli.ai.registry import ProviderRegistry