@atlashub/smartstack-cli 4.80.0 → 5.0.0

package/templates/skills/apex/references/checks/seed-checks.sh

@@ -1,610 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# POST-CHECK: Seed Data — Navigation, Roles, Permissions
-# C1-C2, C10, C15-C23, C32-C35, C44-C48, C53: Navigation completeness, role matrix, idempotency, translations
-
-FAIL=false
-
-# POST-CHECK C1: Navigation routes must be full paths starting with /
-SEED_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*.cs" 2>/dev/null)
-if [ -n "$SEED_FILES" ]; then
-  BAD_ROUTES=$(grep -Pn 'NavigationApplication\.Create\(|NavigationModule\.Create\(|NavigationSection\.Create\(|NavigationResource\.Create\(' $SEED_FILES | grep -v '"/[a-z]' || true)
-  if [ -n "$BAD_ROUTES" ]; then
-    echo "WARNING: Navigation routes must be full paths starting with /"
-    echo "$BAD_ROUTES"
-    echo "Expected: \"/human-resources\" NOT \"humanresources\""
-  fi
-fi
-
-# POST-CHECK C2: Seed data must not use deterministic/sequential/fixed GUIDs
-SEED_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*.cs" 2>/dev/null)
-if [ -n "$SEED_FILES" ]; then
-  BAD_GUIDS=$(grep -Pn 'GenerateDeterministicGuid|GenerateGuid\(int|11111111-1111-1111-1111-' $SEED_FILES 2>/dev/null || true)
-  if [ -n "$BAD_GUIDS" ]; then
-    echo "WARNING: Seed data must use Guid.NewGuid(), not deterministic/sequential/fixed GUIDs"
-    echo "$BAD_GUIDS"
-  fi
-fi
-
-# POST-CHECK C10: Routes seed data must match frontend application routes
-SEED_ROUTES=$(grep -Poh 'Route\s*=\s*"([^"]+)"' $(find src/ -path "*/Seeding/Data/*" -name "*NavigationSeedData.cs" 2>/dev/null) 2>/dev/null | grep -oP '"[^"]+"' | tr -d '"' | sort -u || true)
-APP_TSX=$(find src/ -name "App.tsx" -not -path "*/node_modules/*" 2>/dev/null | head -1)
-if [ -n "$APP_TSX" ] && [ -n "$SEED_ROUTES" ]; then
-  FRONTEND_PATHS=$(grep -oP "path:\s*'([^']+)'" "$APP_TSX" | grep -oP "'[^']+'" | tr -d "'" | sort -u || true)
-  if [ -n "$FRONTEND_PATHS" ]; then
-    MISMATCH_FOUND=false
-    for SEED_ROUTE in $SEED_ROUTES; do
-      DEPTH=$(echo "$SEED_ROUTE" | tr '/' '\n' | grep -c '.')
-      if [ "$DEPTH" -lt 3 ]; then continue; fi
-      SEED_SUFFIX=$(echo "$SEED_ROUTE" | sed 's|^/[^/]*/||')
-      SEED_NORM=$(echo "$SEED_SUFFIX" | tr '[:upper:]' '[:lower:]' | tr -d '-')
-      MATCH_FOUND=false
-      for FE_PATH in $FRONTEND_PATHS; do
-        FE_BASE=$(echo "$FE_PATH" | sed 's|/list$||;s|/new$||;s|/:id.*||;s|/create$||')
-        FE_NORM=$(echo "$FE_BASE" | tr '[:upper:]' '[:lower:]' | tr -d '-')
-        if [ "$SEED_NORM" = "$FE_NORM" ]; then
-          MATCH_FOUND=true
-          break
-        fi
-      done
-      if [ "$MATCH_FOUND" = false ]; then
-        echo "CRITICAL: Seed data route has no matching frontend route: $SEED_ROUTE"
-        MISMATCH_FOUND=true
-      fi
-    done
-    if [ "$MISMATCH_FOUND" = true ]; then
-      echo "Fix: Ensure every NavigationSeedData route has a corresponding PageRegistry.register() entry in componentRegistry.generated.ts (or route entry in App.tsx for legacy projects)"
-      FAIL=true
-    fi
-  fi
-fi
-
-# POST-CHECK C15: RolePermission seed data must NOT use deterministic role GUIDs
-SEED_ALL_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*.cs" 2>/dev/null)
-SEED_CONST_FILES=$(find src/ -path "*/Seeding/*" -name "SeedConstants.cs" 2>/dev/null)
-if [ -n "$SEED_ALL_FILES" ]; then
-  BAD_ROLE_GUID=$(grep -Pn 'DeterministicGuid\("role:' $SEED_ALL_FILES $SEED_CONST_FILES 2>/dev/null || true)
-  if [ -n "$BAD_ROLE_GUID" ]; then
-    echo "WARNING: Deterministic GUID for role detected (e.g., DeterministicGuid(\"role:admin\"))"
-    echo "System roles are pre-seeded by SmartStack core with their own IDs"
-    echo "Fix: In SeedRolePermissionsAsync(), look up roles by Code:"
-    echo "  var roles = await context.Roles.Where(r => r.IsSystem || r.ApplicationId != null).ToListAsync(ct);"
-    echo "  var role = roles.FirstOrDefault(r => r.Code == mapping.RoleCode);"
-    echo "$BAD_ROLE_GUID"
-  fi
-fi
-
-ROLE_PERM_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*RolesSeedData.cs" 2>/dev/null)
-if [ -n "$ROLE_PERM_FILES" ]; then
-  BAD_ROLE_REF=$(grep -Pn 'GenerateRoleGuid|GetAdminRoleId|GetManagerRoleId|GetViewerRoleId|GetContributorRoleId' $ROLE_PERM_FILES 2>/dev/null || true)
-  if [ -n "$BAD_ROLE_REF" ]; then
-    echo "WARNING: RolesSeedData uses hardcoded role GUID helpers instead of Code-based lookup"
-    echo "Fix: Use RoleCode string (e.g., 'admin') and resolve in SeedRolePermissionsAsync()"
-    echo "$BAD_ROLE_REF"
-  fi
-fi
-
-# POST-CHECK C16: Cross-tenant entities must use Guid? TenantId
-for entity in $(find src/ -path "*/Domain/*" -name "*.cs" ! -name "I*.cs" 2>/dev/null); do
-  if grep -q "IOptionalTenantEntity\|IScopedTenantEntity" "$entity"; then
-    if grep -q "public Guid TenantId" "$entity" && ! grep -q "public Guid? TenantId" "$entity"; then
-      echo "CRITICAL: Entity with IOptionalTenantEntity/IScopedTenantEntity must use Guid? TenantId (nullable)"
-      FAIL=true
-    fi
-  fi
-done
-
-# POST-CHECK C17: Scoped entities must have EntityScope property
-for entity in $(find src/ -path "*/Domain/*" -name "*.cs" ! -name "I*.cs" 2>/dev/null); do
-  if grep -q "IScopedTenantEntity" "$entity"; then
-    if ! grep -q "EntityScope\|Scope" "$entity"; then
-      echo "CRITICAL: Entity with IScopedTenantEntity must have EntityScope Scope property"
-      FAIL=true
-    fi
-  fi
-done
-
-# POST-CHECK C18: Permissions.cs static constants must exist (BLOCKING)
-CTRL_FILES=$(find src/ -path "*/Controllers/*" -name "*Controller.cs" 2>/dev/null)
-if [ -n "$CTRL_FILES" ]; then
-  PERM_REFS=$(grep -ohP 'Permissions\.\w+\.\w+' $CTRL_FILES 2>/dev/null | sed 's/Permissions\.\([^.]*\)\..*/\1/' | sort -u || true)
-  for MODULE in $PERM_REFS; do
-    PERM_FILE=$(find src/ -name "Permissions.cs" -exec grep -l "static class $MODULE" {} \; 2>/dev/null || true)
-    if [ -z "$PERM_FILE" ]; then
-      echo "BLOCKING: Controller references Permissions.${MODULE}.* but no Permissions.cs defines static class ${MODULE}"
-      echo "Fix: Create Application/Authorization/Permissions.cs with: public static class ${MODULE} { public const string Read = \"...\"; ... }"
-      FAIL=true
-    fi
-  done
-fi
-
-# POST-CHECK C19: ApplicationRolesSeedData.cs must exist (BLOCKING)
-ROLE_SEED=$(find src/ -path "*/Seeding/Data/*" -name "*RolesSeedData.cs" 2>/dev/null | head -1)
-if [ -n "$ROLE_SEED" ]; then
-  APP_ROLE_SEED=$(find src/ -path "*/Seeding/Data/ApplicationRolesSeedData.cs" 2>/dev/null | head -1)
-  if [ -z "$APP_ROLE_SEED" ]; then
-    echo "BLOCKING: RolesSeedData exists but ApplicationRolesSeedData.cs NOT FOUND"
-    echo "ApplicationRolesSeedData defines the 4 application-scoped roles (admin, manager, contributor, viewer)"
-    echo "Without it, SeedRolesAsync() has no role entries to create → RBAC broken"
-    echo "Fix: Create src/Infrastructure/Persistence/Seeding/Data/ApplicationRolesSeedData.cs"
-    FAIL=true
-  fi
-fi
-
-# POST-CHECK C20: Section route completeness (NavigationSection → frontend route + permissions)
-SECTION_SEED_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*NavigationSectionSeedData.cs" 2>/dev/null)
-APP_TSX=$(find src/ -name "App.tsx" -not -path "*/node_modules/*" 2>/dev/null | head -1)
-if [ -n "$SECTION_SEED_FILES" ] && [ -n "$APP_TSX" ]; then
-  SECTION_ROUTES=$(grep -Poh '"/[a-z][a-z0-9/-]+"' $SECTION_SEED_FILES 2>/dev/null | tr -d '"' | sort -u || true)
-  for SECTION_ROUTE in $SECTION_ROUTES; do
-    SECTION_SEG=$(echo "$SECTION_ROUTE" | rev | cut -d'/' -f1 | rev)
-    if ! grep -q "'$SECTION_SEG'" "$APP_TSX" && ! grep -q "\"$SECTION_SEG\"" "$APP_TSX"; then
-      echo "WARNING: NavigationSection seed data route has no matching frontend route: $SECTION_ROUTE"
-      echo "Expected path segment '$SECTION_SEG' in App.tsx application route block"
-      echo "Fix: Add section child routes to the module's children array in App.tsx"
-    fi
-  done
-fi
-
-CTRL_FILES=$(find src/ -path "*/Controllers/*" -name "*Controller.cs" 2>/dev/null)
-if [ -n "$CTRL_FILES" ]; then
-  for f in $CTRL_FILES; do
-    SECTION_NAVROUTE=$(grep -oP 'NavRoute\("[a-z-]+\.[a-z-]+' "$f" 2>/dev/null)
-    if [ -n "$SECTION_NAVROUTE" ] && ! grep -q "\[RequirePermission" "$f"; then
-      echo "CRITICAL: Controller has [NavRoute] but no [RequirePermission]: $f"
-      echo "Fix: Add [RequirePermission(Permissions.{Section}.{Action})] on each endpoint"
-      FAIL=true
-    fi
-  done
-fi
-
-PERM_FILE=$(find src/ -name "Permissions.cs" -path "*/Authorization/*" 2>/dev/null | head -1)
-if [ -n "$SECTION_SEED_FILES" ] && [ -n "$PERM_FILE" ]; then
-  SECTION_CODES=$(grep -oP 'Code\s*=\s*"([a-z]+)"' $SECTION_SEED_FILES 2>/dev/null | grep -oP '"[^"]+"' | tr -d '"' | sort -u || true)
-  for CODE in $SECTION_CODES; do
-    PASCAL=$(echo "$CODE" | sed 's/^./\U&/')
-    if ! grep -q "static class $PASCAL" "$PERM_FILE" 2>/dev/null; then
-      echo "WARNING: Section '$CODE' in seed data has no matching Permissions.$PASCAL static class"
-      echo "Fix: Add section-level permissions via MCP generate_permissions with 3-segment navRoute (app.module.section)"
-    fi
-  done
-fi
-
-# POST-CHECK C21: FORBIDDEN route patterns — /detail/:id (WARNING)
-SEED_NAV_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*NavigationSeedData.cs" -o -name "*NavigationSectionSeedData.cs" 2>/dev/null)
-if [ -n "$SEED_NAV_FILES" ]; then
-  BAD_ROUTES=$(grep -Pn 'Route\s*=\s*.*"[^"]*/(detail)["/]' $SEED_NAV_FILES 2>/dev/null | grep -v '//.*Route' || true)
-  if [ -n "$BAD_ROUTES" ]; then
-    echo "WARNING: FORBIDDEN route pattern in seed data"
-    echo "  - 'detail' is an implicit route — do NOT use /detail/:id as section route"
-    echo "$BAD_ROUTES"
-  fi
-fi
-
-APP_TSX=$(find src/ -name "App.tsx" -not -path "*/node_modules/*" 2>/dev/null | head -1)
-if [ -n "$APP_TSX" ]; then
-  BAD_FE=$(grep -Pn "path:\s*['\"](?:list|detail)" "$APP_TSX" 2>/dev/null || true)
-  if [ -n "$BAD_FE" ]; then
-    echo "WARNING: FORBIDDEN frontend route path"
-    echo "  - list = index: true (no 'list' path segment)"
-    echo "  - detail = ':id' (no 'detail' path segment)"
-    echo "$BAD_FE"
-  fi
-fi
-
-# POST-CHECK C22: Permission path segment count (WARNING)
-PERM_FILES=$(find src/ -path "*/Seeding/Data/*" -name "PermissionsSeedData.cs" 2>/dev/null)
-if [ -n "$PERM_FILES" ]; then
-  while IFS= read -r line; do
-    PATH_VAL=$(echo "$line" | grep -oP '"[^"]*\.[^"]*"' | tr -d '"' || true)
-    if [ -n "$PATH_VAL" ]; then
-      DOTS=$(echo "$PATH_VAL" | tr -cd '.' | wc -c)
-      if echo "$PATH_VAL" | grep -qP '\.\*$'; then
-        continue
-      elif [ "$DOTS" -lt 2 ] || [ "$DOTS" -gt 4 ]; then
-        echo "WARNING: Permission path has unexpected segment count ($((DOTS+1)) segments): $PATH_VAL"
-      fi
-    fi
-  done < <(grep -n 'Path\s*=' $PERM_FILES 2>/dev/null)
-fi
-
-# POST-CHECK C23: IClientSeedDataProvider must have 4 methods + DI registration (BLOCKING)
-PROVIDER=$(find src/ -path "*/Seeding/*SeedDataProvider.cs" 2>/dev/null | head -1)
-if [ -n "$PROVIDER" ]; then
-  METHODS_FOUND=0
-  for METHOD in SeedNavigationAsync SeedRolesAsync SeedPermissionsAsync SeedRolePermissionsAsync; do
-    if grep -q "$METHOD" "$PROVIDER"; then
-      METHODS_FOUND=$((METHODS_FOUND + 1))
-    else
-      echo "BLOCKING: IClientSeedDataProvider missing method: $METHOD in $PROVIDER"
-      FAIL=true
-    fi
-  done
-  if [ "$METHODS_FOUND" -lt 4 ]; then
-    echo "Fix: IClientSeedDataProvider must implement all 4 methods: SeedNavigationAsync, SeedRolesAsync, SeedPermissionsAsync, SeedRolePermissionsAsync"
-  fi
-
-  DI_FILE=$(find src/ -name "DependencyInjection.cs" -path "*/Infrastructure/*" 2>/dev/null | head -1)
-  if [ -n "$DI_FILE" ]; then
-    if ! grep -q "IClientSeedDataProvider" "$DI_FILE"; then
-      echo "BLOCKING: IClientSeedDataProvider not registered in DependencyInjection.cs"
-      echo "Fix: Add services.AddScoped<IClientSeedDataProvider, {App}SeedDataProvider>()"
-      FAIL=true
-    fi
-  fi
-fi
-
-# POST-CHECK C32: Translation seed data must have idempotency guard (CRITICAL)
-PROVIDER=$(find src/ -path "*/Seeding/*SeedDataProvider.cs" 2>/dev/null | head -1)
-if [ -n "$PROVIDER" ]; then
-  TRANSLATION_ADDS=$(grep -c "NavigationTranslations.Add" "$PROVIDER" 2>/dev/null || true)
-  TRANSLATION_GUARDS=$(grep -c "NavigationTranslations.AnyAsync" "$PROVIDER" 2>/dev/null || true)
-
-  if [ "$TRANSLATION_ADDS" -gt 0 ] && [ "$TRANSLATION_GUARDS" -eq 0 ]; then
-    echo "CRITICAL: Translation seed data inserts without idempotency guard in $PROVIDER"
-    echo "Fix: Before each NavigationTranslations.Add block, check existence:"
-    echo "  if (!await context.NavigationTranslations.AnyAsync("
-    echo "      t => t.EntityId == mod1Entity.Id  // actual DB ID, NOT seed-time GUID"
-    echo "           && t.EntityType == NavigationEntityType.Module, ct))"
-    echo "  { foreach (var t in ...) { context.NavigationTranslations.Add(...); } }"
-    echo "The unique index IX_nav_Translations_EntityType_EntityId_LanguageCode will crash on duplicates."
-    FAIL=true
-  fi
-fi
-
-# POST-CHECK C33: Resource seed data must use actual section IDs from DB (CRITICAL)
-PROVIDER=$(find src/ -path "*/Seeding/*SeedDataProvider.cs" 2>/dev/null | head -1)
-if [ -n "$PROVIDER" ]; then
-  if grep -Pn 'NavigationResource\.Create\(' "$PROVIDER" | grep -q 'resEntry\.SectionId\|secEntry\.Id'; then
-    echo "CRITICAL: Resource seed data uses seed-time GUID as SectionId in $PROVIDER"
-    echo "NavigationSection.Create() generates its own ID — seed-time GUIDs do NOT exist in nav_Sections."
-    echo "Fix: Query actual section from DB before creating resources:"
-    echo "  var actualSection = await context.NavigationSections"
-    echo "      .FirstAsync(s => s.Code == secEntry.Code && s.ModuleId == modEntity.Id, ct);"
-    echo "  NavigationResource.Create(actualSection.Id, ...)  // NOT secEntry.Id or resEntry.SectionId"
-    FAIL=true
-  fi
-fi
-
-# POST-CHECK C34: NavRoute segments must use kebab-case for multi-word codes (BLOCKING)
-CTRL_FILES=$(find src/ -path "*/Controllers/*" -name "*Controller.cs" 2>/dev/null)
-if [ -n "$CTRL_FILES" ]; then
-  for f in $CTRL_FILES; do
-    NAVROUTE_VAL=$(grep -oP 'NavRoute\("([^"]+)"\)' "$f" 2>/dev/null | grep -oP '"[^"]+"' | tr -d '"' || true)
-    if [ -n "$NAVROUTE_VAL" ]; then
-      for SEG in $(echo "$NAVROUTE_VAL" | tr '.' '\n'); do
-        if echo "$SEG" | grep -qP '^[a-z]{10,}$'; then
-          echo "BLOCKING: NavRoute segment '$SEG' in $f appears to be concatenated multi-word without hyphens"
-          echo "  Full NavRoute: $NAVROUTE_VAL"
-          echo "  Fix: Use kebab-case: e.g., 'humanresources' → 'human-resources'"
-          echo "  SmartStack convention (from SmartStack.app): 'support-client.my-tickets'"
-          FAIL=true
-        fi
-      done
-    fi
-  done
-fi
-
-SEED_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*NavigationSeedData.cs" -o -name "NavigationApplicationSeedData.cs" 2>/dev/null)
-if [ -n "$SEED_FILES" ]; then
-  CODES=$(grep -oP 'Code\s*=\s*"([^"]+)"' $SEED_FILES 2>/dev/null | grep -oP '"[^"]+"' | tr -d '"' | sort -u || true)
-  for CODE in $CODES; do
-    if echo "$CODE" | grep -qP '^[a-z]{10,}$'; then
-      echo "BLOCKING: Navigation seed data Code '$CODE' appears to be concatenated multi-word without hyphens"
-      echo "  Fix: Use kebab-case: e.g., 'humanresources' → 'human-resources'"
-      FAIL=true
-    fi
-  done
-fi
-
-# POST-CHECK C35: Permission codes must use kebab-case matching NavRoute codes (BLOCKING)
-CTRL_FILES=$(find src/ -path "*/Controllers/*" -name "*Controller.cs" 2>/dev/null)
-if [ -n "$CTRL_FILES" ]; then
-  for f in $CTRL_FILES; do
-    PERM_VALS=$(grep -oP 'RequirePermission\("([^"]+)"\)' "$f" 2>/dev/null | grep -oP '"[^"]+"' | tr -d '"' || true)
-    for PERM in $PERM_VALS; do
-      SEGMENTS=$(echo "$PERM" | tr '.' '\n' | head -n -1)
-      for SEG in $SEGMENTS; do
-        if echo "$SEG" | grep -qP '^[a-z]{10,}$'; then
-          echo "BLOCKING: Permission code segment '$SEG' in $f appears concatenated without hyphens"
-          echo "  Full permission: $PERM"
-          echo "  Fix: Use kebab-case: e.g., 'humanresources' → 'human-resources'"
-          echo "  SmartStack convention: 'support-client.my-tickets.read'"
-          FAIL=true
-        fi
-      done
-    done
-  done
-fi
-
-PERM_FILES=$(find src/ -path "*/Authorization/Permissions.cs" 2>/dev/null)
-if [ -n "$PERM_FILES" ]; then
-  for f in $PERM_FILES; do
-    CONST_VALS=$(grep -oP '=\s*"([^"]+)"' "$f" 2>/dev/null | grep -oP '"[^"]+"' | tr -d '"' || true)
-    for PERM in $CONST_VALS; do
-      SEGMENTS=$(echo "$PERM" | tr '.' '\n' | head -n -1)
-      for SEG in $SEGMENTS; do
-        if echo "$SEG" | grep -qP '^[a-z]{10,}$'; then
-          echo "BLOCKING: Permissions.cs constant segment '$SEG' in $f appears concatenated without hyphens"
-          echo "  Full permission: $PERM"
-          echo "  Fix: Use kebab-case: e.g., 'humanresources' → 'human-resources'"
-          FAIL=true
-        fi
-      done
-    done
-  done
-fi
-
-SEED_PERM_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*PermissionsSeedData.cs" 2>/dev/null)
-if [ -n "$SEED_PERM_FILES" ]; then
-  PATHS=$(grep -oP '"[a-z][a-z0-9.-]+\.(read|create|update|delete|\*)"' $SEED_PERM_FILES 2>/dev/null | tr -d '"' || true)
-  for PERM in $PATHS; do
-    SEGMENTS=$(echo "$PERM" | tr '.' '\n' | head -n -1)
-    for SEG in $SEGMENTS; do
-      if echo "$SEG" | grep -qP '^[a-z]{10,}$'; then
-        echo "BLOCKING: PermissionsSeedData path segment '$SEG' appears concatenated without hyphens"
-        echo "  Full permission path: $PERM"
-        echo "  Fix: Use kebab-case matching NavRoute: 'humanresources' → 'human-resources'"
-        FAIL=true
-      fi
-    done
-  done
-fi
-
-# POST-CHECK C44: RolesSeedData must map standard role-permission matrix (CRITICAL)
-ROLE_SEED_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*RolesSeedData.cs" ! -name "ApplicationRolesSeedData.cs" 2>/dev/null)
-if [ -n "$ROLE_SEED_FILES" ]; then
-  FAIL_C44=false
-  for f in $ROLE_SEED_FILES; do
-    BASENAME=$(basename "$f")
-    if [ "$BASENAME" = "ApplicationRolesSeedData.cs" ]; then continue; fi
-
-    HAS_ADMIN_WILDCARD=$(grep -Pc '(admin|Admin).*\*' "$f" 2>/dev/null || true)
-    if [ "$HAS_ADMIN_WILDCARD" -eq 0 ]; then
-      HAS_ADMIN_ACCESS=$(grep -Pc '(admin|Admin).*(Access|Wildcard|IsWildcard)' "$f" 2>/dev/null || true)
-      if [ "$HAS_ADMIN_ACCESS" -eq 0 ]; then
-        echo "CRITICAL: Admin role missing wildcard (*) permission in $f"
-        echo "Fix: Admin must map to wildcard permission (navRoute.*) or use IsWildcard=true"
-        FAIL_C44=true
-      fi
-    fi
-
-    VIEWER_WRITE=$(grep -Pc '(viewer|Viewer).*(\.delete|\.create|\.update|Delete|Create|Update)' "$f" 2>/dev/null || true)
-    if [ "$VIEWER_WRITE" -gt 0 ]; then
-      echo "CRITICAL: Viewer role has write permissions (create/update/delete) in $f"
-      echo "Fix: Viewer must only have read permission. Remove create/update/delete mappings."
-      FAIL_C44=true
-    fi
-
-    MANAGER_DELETE=$(grep -Pc '(manager|Manager).*(\.delete|Delete)' "$f" 2>/dev/null || true)
-    if [ "$MANAGER_DELETE" -gt 0 ]; then
-      echo "WARNING: Manager role has delete permission in $f"
-      echo "SmartStack standard: Manager = CRU (no delete). Verify this is intentional."
-    fi
-  done
-  if [ "$FAIL_C44" = true ]; then
-    FAIL=true
-  fi
-fi
-
-# POST-CHECK C45: PermissionAction enum must use valid typed values only (BLOCKING)
-SEED_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*.cs" 2>/dev/null)
-if [ -n "$SEED_FILES" ]; then
-  FAIL_C45=false
-  for f in $SEED_FILES; do
-    ENUM_PARSE=$(grep -Pn 'Enum\.Parse<PermissionAction>' "$f" 2>/dev/null || true)
-    if [ -n "$ENUM_PARSE" ]; then
-      echo "BLOCKING: Enum.Parse<PermissionAction> detected — runtime crash risk: $f"
-      echo "$ENUM_PARSE"
-      echo "Fix: Use typed enum directly: PermissionAction.Read (NOT Enum.Parse<PermissionAction>(\"Read\"))"
-      FAIL_C45=true
-    fi
-
-    INVALID_CAST=$(grep -Pn '\(PermissionAction\)\s*([1-9]\d{1,}|[2-9]\d)' "$f" 2>/dev/null || true)
-    if [ -n "$INVALID_CAST" ]; then
-      echo "BLOCKING: Invalid PermissionAction cast detected (value > 10): $f"
-      echo "$INVALID_CAST"
-      echo "Valid values: Access(0), Read(1), Create(2), Update(3), Delete(4), Export(5), Import(6), Approve(7), Reject(8), Assign(9), Execute(10)"
-      FAIL_C45=true
-    fi
-  done
-  if [ "$FAIL_C45" = true ]; then
-    FAIL=true
-  fi
-fi
-
-# POST-CHECK C46: Navigation translation completeness — 4 languages per level (WARNING)
-NAV_SEED_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*NavigationSeedData.cs" ! -name "*Application*" 2>/dev/null)
-if [ -n "$NAV_SEED_FILES" ]; then
-  FAIL_C46=false
-  for f in $NAV_SEED_FILES; do
-    HAS_FR=$(grep -c '"fr"' "$f" 2>/dev/null || true)
-    HAS_EN=$(grep -c '"en"' "$f" 2>/dev/null || true)
-    HAS_IT=$(grep -c '"it"' "$f" 2>/dev/null || true)
-    HAS_DE=$(grep -c '"de"' "$f" 2>/dev/null || true)
-
-    if [ "$HAS_FR" -eq 0 ] || [ "$HAS_EN" -eq 0 ] || [ "$HAS_IT" -eq 0 ] || [ "$HAS_DE" -eq 0 ]; then
-      echo "WARNING: Missing language(s) in navigation translations: $f"
-      echo "  fr=$HAS_FR, en=$HAS_EN, it=$HAS_IT, de=$HAS_DE (all must be > 0)"
-      echo "Fix: Add NavigationTranslationSeedEntry for all 4 languages (fr, en, it, de)"
-      FAIL_C46=true
-    fi
-
-    HAS_SECTION_ENTRIES=$(grep -c 'GetSectionEntries' "$f" 2>/dev/null || true)
-    HAS_SECTION_TRANSLATIONS=$(grep -c 'GetSectionTranslationEntries' "$f" 2>/dev/null || true)
-    if [ "$HAS_SECTION_ENTRIES" -gt 0 ] && [ "$HAS_SECTION_TRANSLATIONS" -eq 0 ]; then
-      echo "WARNING: Sections defined but GetSectionTranslationEntries() missing: $f"
-      echo "Fix: Add GetSectionTranslationEntries() with 4 languages per section (ref core-seed-data.md §2b)"
-      FAIL_C46=true
-    fi
-
-    HAS_RESOURCE_ENTRIES=$(grep -c 'GetResourceEntries' "$f" 2>/dev/null || true)
-    HAS_RESOURCE_TRANSLATIONS=$(grep -Pc 'ResourceTranslation|GetResourceTranslation|NavigationEntityType\.Resource.*LanguageCode' "$f" 2>/dev/null || true)
-    if [ "$HAS_RESOURCE_ENTRIES" -gt 0 ] && [ "$HAS_RESOURCE_TRANSLATIONS" -eq 0 ]; then
-      echo "WARNING: Resources defined but resource translations missing: $f"
-      echo "Fix: Add resource translation entries with 4 languages per resource (ref core-seed-data.md §2b)"
-      FAIL_C46=true
-    fi
-  done
-fi
-
-# POST-CHECK C47: Person Extension entities must not duplicate User fields (WARNING)
-ENTITY_FILES=$(find src/ -path "*/Domain/Entities/*" -name "*.cs" 2>/dev/null)
-if [ -n "$ENTITY_FILES" ]; then
-  FAIL_C47=false
-  for f in $ENTITY_FILES; do
-    HAS_USERID=$(grep -P 'public\s+Guid\s+UserId\s*\{' "$f" 2>/dev/null || true)
-    if [ -z "$HAS_USERID" ]; then continue; fi
-
-    IS_MANDATORY=$(grep -P 'public\s+Guid\s+UserId\s*\{' "$f" 2>/dev/null | grep -v 'Guid?' || true)
-    if [ -z "$IS_MANDATORY" ]; then continue; fi
-
-    if ! grep -q "ITenantEntity" "$f"; then continue; fi
-
-    PERSON_FIELDS=$(grep -Pn 'public\s+string\S*\s+(FirstName|LastName|Email|PhoneNumber)\s*\{' "$f" 2>/dev/null || true)
-    if [ -n "$PERSON_FIELDS" ]; then
-      echo "WARNING: Mandatory person extension entity duplicates User fields: $f"
-      echo "  Entity has non-nullable UserId (mandatory variant) — person fields come from User"
-      echo "$PERSON_FIELDS"
-      echo "  Fix: Remove FirstName/LastName/Email/PhoneNumber — use Display* from User join in ResponseDto"
-      echo "  See references/person-extension-pattern.md section 2"
-      FAIL_C47=true
-    fi
-  done
-fi
-
-# POST-CHECK C48: Person Extension service must Include(User) (CRITICAL)
-ENTITY_FILES=$(find src/ -path "*/Domain/Entities/*" -name "*.cs" 2>/dev/null)
-if [ -n "$ENTITY_FILES" ]; then
-  FAIL_C48=false
-  for f in $ENTITY_FILES; do
-    HAS_USERID=$(grep -P 'public\s+Guid\??\s+UserId\s*\{' "$f" 2>/dev/null || true)
-    if [ -z "$HAS_USERID" ]; then continue; fi
-    if ! grep -q "ITenantEntity" "$f"; then continue; fi
-
-    HAS_USER_NAV=$(grep -P 'public\s+User\?\s+User\s*\{' "$f" 2>/dev/null || true)
-    if [ -z "$HAS_USER_NAV" ]; then continue; fi
-
-    ENTITY_NAME=$(basename "$f" .cs)
-    SERVICE_FILE=$(find src/ -path "*/Services/*" -name "${ENTITY_NAME}Service.cs" ! -name "I${ENTITY_NAME}Service.cs" 2>/dev/null | head -1)
-    if [ -z "$SERVICE_FILE" ]; then continue; fi
-
-    HAS_INCLUDE=$(grep -P 'Include.*User' "$SERVICE_FILE" 2>/dev/null || true)
-    if [ -z "$HAS_INCLUDE" ]; then
-      echo "CRITICAL: Service for Person Extension entity must Include(x => x.User): $SERVICE_FILE"
-      echo "  Entity: $f has UserId FK + User navigation property"
-      echo "  Fix: Add .Include(x => x.User) to all queries in $SERVICE_FILE"
-      echo "  Without Include, Display* fields will always be null"
-      echo "  See references/person-extension-pattern.md section 5"
-      FAIL_C48=true
-    fi
-  done
-  if [ "$FAIL_C48" = true ]; then
-    FAIL=true
-  fi
-fi
-
-# POST-CHECK C53: Enum serialization — JsonStringEnumConverter required (BLOCKING)
-PROGRAM_CS=$(find src/ -name "Program.cs" -path "*/Api/*" 2>/dev/null | head -1)
-HAS_GLOBAL_CONVERTER=false
-if [ -n "$PROGRAM_CS" ] && grep -q "JsonStringEnumConverter" "$PROGRAM_CS" 2>/dev/null; then
-  HAS_GLOBAL_CONVERTER=true
-fi
-
-if [ "$HAS_GLOBAL_CONVERTER" = false ]; then
-  ENUM_FILES=$(find src/ -path "*/Domain/Enums/*" -name "*.cs" 2>/dev/null)
-  if [ -n "$ENUM_FILES" ]; then
-    for f in $ENUM_FILES; do
-      if grep -q "public enum" "$f" && ! grep -q "JsonStringEnumConverter" "$f"; then
-        echo "BLOCKING: Enum missing [JsonConverter(typeof(JsonStringEnumConverter))]: $f"
-        echo "  Frontend sends enum values as strings but C# deserializes as int by default"
-        echo "  Fix: Add [JsonConverter(typeof(JsonStringEnumConverter))] on the enum"
-        echo "  Or: Add JsonStringEnumConverter globally in Program.cs"
-        FAIL=true
-      fi
-    done
-  fi
-fi
-
-# POST-CHECK C63: Reserved section codes must NOT be seeded as visible menu items (BLOCKING)
-# Reserved codes: detail, create, edit, *-detail
-# These are internal route targets resolved by DynamicRouter convention, NOT sidebar menu items.
-SEED_NAV_FILES=$(find src/ -path "*/Seeding/Data/*" \( -name "*NavigationSeedData.cs" -o -name "*NavigationModuleSeedData.cs" \) 2>/dev/null)
-if [ -n "$SEED_NAV_FILES" ]; then
-  for f in $SEED_NAV_FILES; do
-    for RESERVED in detail create edit; do
-      # Pattern A: SectionData record — new("detail", ...)
-      MATCHES=$(grep -Pn "new\s*\(\s*\"${RESERVED}\"" "$f" 2>/dev/null || true)
-      if [ -n "$MATCHES" ]; then
-        echo "BLOCKING: Reserved section code '${RESERVED}' seeded as menu item in $f"
-        echo "$MATCHES"
-        echo "  Reserved codes (detail, create, edit) are internal route targets, NOT sidebar menu items."
-        echo "  Fix: Remove this section entry. DynamicRouter resolves /:id, /create, /:id/edit by convention."
-        FAIL=true
-      fi
-      # Pattern B: NavigationSectionSeedEntry — Code = "detail"
-      MATCHES=$(grep -Pn "Code\s*=\s*\"${RESERVED}\"" "$f" 2>/dev/null || true)
-      if [ -n "$MATCHES" ]; then
-        # Check if IsActive = false is nearby (acceptable)
-        HAS_INACTIVE=$(grep -A 10 "Code\s*=\s*\"${RESERVED}\"" "$f" | grep -P "IsActive\s*=\s*false" 2>/dev/null || true)
-        if [ -z "$HAS_INACTIVE" ]; then
-          echo "BLOCKING: Reserved section code '${RESERVED}' seeded with IsActive=true in $f"
-          echo "$MATCHES"
-          echo "  Fix: Remove this section, or set IsActive = false."
-          FAIL=true
-        fi
-      fi
-    done
-    # Check for *-detail codes (e.g., department-detail)
-    DETAIL_SUFFIX=$(grep -Pn "new\s*\(\s*\"[a-z]+-detail\"" "$f" 2>/dev/null || true)
-    if [ -z "$DETAIL_SUFFIX" ]; then
-      DETAIL_SUFFIX=$(grep -Pn "Code\s*=\s*\"[a-z]+-detail\"" "$f" 2>/dev/null || true)
-    fi
-    if [ -n "$DETAIL_SUFFIX" ]; then
-      echo "BLOCKING: Section code with '-detail' suffix seeded as menu item in $f"
-      echo "$DETAIL_SUFFIX"
-      echo "  Detail routes are the /:id route of their parent section."
-      echo "  Fix: Remove this section entry. Use parent section's /:id route instead."
-      FAIL=true
-    fi
-  done
-fi
-
-# POST-CHECK C66: ApplicationZone enum removed in v3.46 (BLOCKING)
-# Detects any leftover reference to the removed ApplicationZone enum or Zone column.
-SEED_FILES=$(find src/ -path "*/Seeding/Data/*" -name "*.cs" 2>/dev/null)
-DOMAIN_FILES=$(find src/ -path "*/Domain/Navigation/*" -name "*.cs" 2>/dev/null)
-INFRA_FILES=$(find src/ -path "*/Infrastructure/Persistence/Configurations/Navigation/*" -name "*.cs" 2>/dev/null)
-APP_FILES=$(find src/ -path "*/Application/Navigation/*" -name "*.cs" 2>/dev/null)
-ALL_NAV_FILES="$SEED_FILES $DOMAIN_FILES $INFRA_FILES $APP_FILES"
-if [ -n "$ALL_NAV_FILES" ]; then
-  BAD_ZONE=$(grep -Pn 'ApplicationZone\.\w+|public\s+ApplicationZone\s+Zone|HasColumnName\("Zone"\)|Zone\s*=\s*ApplicationZone' $ALL_NAV_FILES 2>/dev/null || true)
-  if [ -n "$BAD_ZONE" ]; then
-    echo "BLOCKING (C66): ApplicationZone enum has been removed in SmartStack v3.46."
-    echo "Replace by IsPersonal (bool, true => myspace scope) and/or IsOpen (bool, true => bypass permissions)."
-    echo "$BAD_ZONE"
-    echo "Fix: NavigationApplication.Create(code, label, ..., isOpen: false, isPersonal: false)"
-    echo "Reference: templates/skills/apex/references/core-seed-data.md (v3.46+ section)"
-    FAIL=true
-  fi
-fi
-
-# POST-CHECK C67: Legacy domain-specific layouts removed in v3.46 (BLOCKING)
-# AdminLayout / BusinessLayout / UserLayout / HRLayout / SalesLayout no longer exist.
-TSX_FILES=$(find web/ -name "*.tsx" -not -path "*/node_modules/*" 2>/dev/null; find src/ -name "*.tsx" -not -path "*/node_modules/*" 2>/dev/null)
-if [ -n "$TSX_FILES" ]; then
-  BAD_LAYOUT=$(grep -PnH '<\s*(AdminLayout|BusinessLayout|UserLayout|HRLayout|SalesLayout)\b|from\s+["'\''][^"'\'']*\/(AdminLayout|BusinessLayout|UserLayout|HRLayout|SalesLayout)["'\'']' $TSX_FILES 2>/dev/null || true)
-  if [ -n "$BAD_LAYOUT" ]; then
-    echo "BLOCKING (C67): Legacy layouts (AdminLayout/BusinessLayout/UserLayout/HRLayout/SalesLayout) have been removed in v3.46."
-    echo "Use AppLayout — the sole shell for authenticated application routes."
-    echo "$BAD_LAYOUT"
-    echo "Fix: Replace by <AppLayout /> (no domain-specific shell anymore)."
-    echo "Reference: templates/skills/application/references/frontend-route-naming.md"
-    FAIL=true
-  fi
-fi
-
-if [ "$FAIL" = true ]; then
-  exit 1
-fi