From b29f2ff62d6324a23763fae6755259046db55ce0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Ren=C3=A9=20White=20Enciso?=
 <jrenewhite@gmail.com>
Date: Wed, 25 Feb 2026 16:48:50 -0600
Subject: [PATCH] chore(blueprint-platform): add cross-repo project reference
 guard

---
 .../workspace-cross-repo-reference-guard.md   | 34 +++++++++++++++++++
 tools/validate-no-cross-repo-projectrefs.sh   | 33 ++++++++++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 docs/architecture/workspace-cross-repo-reference-guard.md
 create mode 100755 tools/validate-no-cross-repo-projectrefs.sh

diff --git a/docs/architecture/workspace-cross-repo-reference-guard.md b/docs/architecture/workspace-cross-repo-reference-guard.md
new file mode 100644
index 0000000..8341fc0
--- /dev/null
+++ b/docs/architecture/workspace-cross-repo-reference-guard.md
@@ -0,0 +1,34 @@
+# Workspace Cross-Repo ProjectReference Guard
+
+## Purpose
+
+Prevent regression of cross-repo source coupling by failing fast when any `.csproj` in `greenfield/` references a project outside its own repository root.
+
+## Script Location
+
+- `tools/validate-no-cross-repo-projectrefs.sh`
+
+## Usage
+
+Run from within `greenfield/blueprint-platform`:
+
+```bash
+./tools/validate-no-cross-repo-projectrefs.sh
+```
+
+Run from the workspace root:
+
+```bash
+greenfield/blueprint-platform/tools/validate-no-cross-repo-projectrefs.sh
+```
+
+## Behavior
+
+- Exit code `0`: no cross-repo `ProjectReference` entries found.
+- Exit code `1`: one or more violations were found and listed.
+
+## Enforcement Guidance
+
+- Execute this guard before merge to `development`.
+- Keep only intra-repo `ProjectReference` entries.
+- Use package references for cross-repo consumption.
diff --git a/tools/validate-no-cross-repo-projectrefs.sh b/tools/validate-no-cross-repo-projectrefs.sh
new file mode 100755
index 0000000..a36bb65
--- /dev/null
+++ b/tools/validate-no-cross-repo-projectrefs.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+workspace_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
+greenfield_root="$workspace_root/greenfield"
+
+python3 - "$greenfield_root" <<'PY'
+import pathlib
+import re
+import sys
+
+greenfield = pathlib.Path(sys.argv[1]).resolve()
+violations = []
+
+for csproj in greenfield.rglob("*.csproj"):
+    text = csproj.read_text(encoding="utf-8")
+    repo_root = csproj.parents[2].resolve()
+    for match in re.finditer(r'<ProjectReference\s+Include="([^"]+)"', text):
+        include = match.group(1).replace("\\", "/")
+        target = (csproj.parent / include).resolve()
+        if not str(target).startswith(str(repo_root)):
+            violations.append((csproj.relative_to(greenfield), include, target))
+
+if violations:
+    print(f"FAILED: found {len(violations)} cross-repo ProjectReference entries")
+    for src, include, target in sorted(violations):
+        if str(target).startswith(str(greenfield)):
+            target = target.relative_to(greenfield)
+        print(f"- {src} -> {include} -> {target}")
+    raise SystemExit(1)
+
+print("PASSED: no cross-repo ProjectReference entries found")
+PY