Cross-module import bypasses public module surface

How to fix

1. Export the supported symbol from the target module public entrypoint.
2. Change consumers to import from that entrypoint.
3. If the symbol should stay internal, move the behavior into the owning module.

What it means

A cross-module import points at an internal file rather than the target module's declared public surface. Component metadata can provide the larger app, service, or library context around that module.

Why it matters

Public surfaces keep module internals changeable without breaking consumers.

Common causes

• The needed symbol is not exported by the public entrypoint.
• A developer used an auto-import to an internal path.
• The public entrypoint is out of date.

Example bad pattern

import { SessionPolicy } from '../identity/internal/session-policy'

Example good pattern

import { SessionPolicy } from '../identity'

Related files/config

• .archpilot/architecture.json
• .archpilot/contracts/*.json

Related CLI commands

• archpilot validate
• archpilot validate --ci

VS Code / Inspector action

Use the finding location to replace internal imports with the declared public entrypoint.