@atlashub/smartstack-cli 4.80.0 → 5.0.0

package/templates/skills/development/backend/seed-data/cli/scaffold-seed/validate.ts

@@ -0,0 +1,63 @@
+/**
+ * cli:scaffold-seed — validate.ts
+ */
+import { ScaffoldSeedInputSchema, type ScaffoldSeedInput, type ValidationResult } from './types.js'
+
+export function validateStructure(raw: unknown): ValidationResult {
+  const result = ScaffoldSeedInputSchema.safeParse(raw)
+  if (result.success) return { valid: true, errors: [], warnings: [] }
+  const errors = result.error.issues.map(i => `[${i.path.join('.')}] ${i.message}`)
+  return { valid: false, errors, warnings: [] }
+}
+
+export function validateBusinessRules(spec: ScaffoldSeedInput): ValidationResult {
+  const errors: string[] = []
+  const warnings: string[] = []
+
+  // Application-level entries are now seeded by scaffold-core-seed (Phase 0).
+  // If a caller still passes one here, warn — they likely meant to call
+  // scaffold-core-seed instead. Empty navigation is the new normal for
+  // ref-data-only providers.
+  const apps = spec.navigation.filter(n => n.level === 'application')
+  if (apps.length > 0) {
+    warnings.push(
+      `scaffold-seed received ${apps.length} application-level navigation entry/entries — these belong to scaffold-core-seed (Phase 0). Module-level scaffold-seed should only carry section/resource overrides or reference data.`,
+    )
+  }
+
+  // Permissions should reference existing sections
+  const sectionCodes = new Set(spec.navigation.filter(n => n.level === 'section').map(n => n.code))
+  for (const perm of spec.permissions) {
+    if (!sectionCodes.has(perm.sectionCode)) {
+      warnings.push(`Permission ${perm.path} references unknown section: ${perm.sectionCode}`)
+    }
+  }
+
+  // Role permissions should reference existing roles and permissions
+  const roleCodes = new Set(spec.roles.map(r => r.code))
+  const permPaths = new Set(spec.permissions.map(p => p.path))
+  for (const rp of spec.rolePermissions) {
+    if (!roleCodes.has(rp.roleCode)) {
+      warnings.push(`Role-permission references unknown role: ${rp.roleCode}`)
+    }
+    if (!permPaths.has(rp.permissionPath)) {
+      warnings.push(`Role-permission references unknown permission: ${rp.permissionPath}`)
+    }
+  }
+
+  // Test users must reference existing roles. Hard error since Phase 5 needs
+  // these to log in by role — a silent warning would manifest as 401s in tests.
+  for (const tu of spec.testUsers) {
+    if (!roleCodes.has(tu.roleCode)) {
+      errors.push(`Test user references unknown role: ${tu.roleCode}. Add the role to spec.roles or fix the typo.`)
+    }
+  }
+
+  return { valid: errors.length === 0, errors, warnings }
+}
+
+export function validate(raw: unknown): ValidationResult {
+  const structural = validateStructure(raw)
+  if (!structural.valid) return structural
+  return validateBusinessRules(raw as ScaffoldSeedInput)
+}

package/templates/skills/development/backend/structure/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: dotnet-structure
+description: .NET Clean Architecture 4-layer SmartStack
+group: A
+allowed-tools: [Read, Glob, Grep]
+---
+
+# Skill: .NET Clean Architecture SmartStack
+
+## 4-Layer Architecture
+
+```
+{App}.Domain/          # Entities, value objects, enums
+{App}.Application/     # Services, DTOs, validators
+{App}.Infrastructure/  # EF Core, repositories, external services
+{App}.Api/             # Controllers, Program.cs, appsettings
+```
+
+## Project References
+```
+Domain  ←──  Application  ←──  Api
+   ↑              ↑
+   └──  Infrastructure  ──→  Api
+```
+
+## Dual-DbContext
+- `ExtensionsDbContext` inherits from SmartStack `ApplicationDbContext`
+- `IExtensionsDbContext` inherits from `IApplicationDbContext`
+
+## Program.cs — 4 Mandatory Calls
+```csharp
+builder.Services.AddSmartStack(builder.Configuration);
+await app.InitializeSmartStackAsync();
+app.UseSmartStack();
+app.MapSmartStack();
+```
+
+## Directory.Build.props
+```xml
+<TargetFramework>net10.0</TargetFramework>
+<Nullable>enable</Nullable>
+<ImplicitUsings>enable</ImplicitUsings>
+```
+
+## Standard Ports
+- API HTTP: `localhost:5142` / HTTPS: `localhost:7142`
+- Frontend dev: `localhost:3000`

package/templates/skills/development/debug/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: debug
+description: Diagnose and auto-fix SmartStack dev-runner issues (backend + frontend)
+group: DEBUG
+allowed-tools: [Read, Edit, Write, Glob, Grep, Bash]  # Bash: diagnostic commands
+---
+
+# Skill: Debug — SmartStack Dev-Runner Auto-Fix
+
+## Role
+
+You are a debugging agent for a SmartStack app (backend .NET + frontend React+Vite).
+You operate inside the **client project worktree**. Your job is to **diagnose** failures
+observed during `dotnet run` / `npm run dev` and **fix them in place** — edit files, run
+commands, verify. No narration, no questions, no waiting: execute, verify, repeat.
+
+## Mode de fonctionnement
+
+Tu es invoqué via `claude -p` (non-interactif). **Jamais de plan mode, jamais de question** :
+il n'y a personne pour valider. Exécute directement.
+
+1. **Analyser** les logs/erreurs fournis
+2. **Exécuter** les corrections immédiatement — Edit/Write/Bash (pas d'ExitPlanMode, pas d'AskUserQuestion)
+3. **Vérifier** que la correction fonctionne (relancer dotnet build / npm run dev / curl /health)
+4. **Boucler** si nouvelle erreur détectée (max 3 itérations)
+5. **Rapporter** la liste des fichiers modifiés + résultat de vérification en fin de run
+
+## Routage
+
+Selon le domaine de l'erreur, charger le skill spécialisé :
+
+| Symptôme | Skill à consulter |
+|----------|---------------------|
+| Backend .NET crash, exit code, build fails, /health unreachable | `backend/SKILL.md` |
+| EF Core migrations, connection string, DB auth | `backend/SKILL.md` |
+| JWT errors (`JwtBearer not configured`, `Invalid token`, `401 on authenticated routes`) | `backend/SKILL.md` (config JWT côté API) |
+| CORS errors (`Access-Control-Allow-Origin missing`, `OPTIONS preflight 405`, `401 sur OPTIONS`) | `backend/SKILL.md` (CORS policy dans Program.cs) |
+| Frontend 404 sur /, "Cannot read properties", Vite port conflict, React render error | `frontend/SKILL.md` |
+| Page blanche / spinner infini sans erreur console | `frontend/SKILL.md` étape 7 (PageRegistry / componentKey mismatch) |
+| `/api/navigation/menu` renvoie 401, frontend en boucle de login | Vérifier JWT côté backend, puis tokens côté frontend |
+| Les deux, ou inconnu | Commencer par backend puis frontend |
+
+## Règles invariantes
+
+- **Jamais de `git push`, `git force`, `npm install` sans validation**
+- **Toujours lire le fichier avant de le modifier** (éviter écrasement aveugle)
+- **Ne pas toucher aux fichiers `*.bak`** (backups d'auto-repair Studio)
+- **Respecter l'architecture SmartStack** (Clean 4-layer backend, 5-layer frontend)
+- **Un fix = un commit** (laisser l'utilisateur committer)
+- **Après chaque fix, relancer la commande qui a échoué** pour vérifier
+
+## Sortie attendue
+
+Après exécution du plan :
+1. Liste des fichiers modifiés
+2. Output de la commande de vérification (ex: `dotnet build` exit 0, `curl http://localhost:5142/health` → 200)
+3. Commit message suggéré : `fix(debug): <résumé>` — l'utilisateur commit lui-même
+
+## Références
+
+- Patterns d'erreurs courants : voir `debug/backend/SKILL.md`
+- Commandes de diagnostic : voir `debug/frontend/SKILL.md`

package/templates/skills/development/debug/audit-bug/SKILL.md

@@ -0,0 +1,185 @@
+---
+name: audit-bug
+description: Refine a user-reported bug — rephrase, classify, and cross-reference the code in the current worktree.
+group: DEBUG
+allowed-tools: [Read, Glob, Grep]
+---
+
+# Skill: Audit Bug — User Report Refinement
+
+## Role
+
+You are a bug triage assistant. A user of the SmartStack Studio just reported a bug while testing their generated app. Your job is to take that raw report and produce a **structured, actionable bug record** grounded in the actual code of the worktree.
+
+You do **not fix** anything. You do **not modify files**. You only **read** and **classify**.
+
+## Input (injected in the system prompt)
+
+- `BUG_TITLE` — one-line title typed by the user
+- `BUG_DESCRIPTION` — free-form description (may be empty)
+- `BRANCH_NAME` — git branch the bug was filed on
+- `SEVERITY` — severity the user picked (`critical` | `major` | `minor`)
+
+You are executing inside the **client project worktree** (SmartStack-generated app). Use `Read`, `Glob`, `Grep` freely to cross-reference the report with the actual code.
+
+## Pre-injected runtime evidence (when present)
+
+When the bug was filed from DevRunner with an active runtime session, the
+system prompt contains a block shaped like:
+
+```
+--- RUNTIME LOG TAIL (from DevRunner at bug report time) ---
+[backend] fail: …
+[backend] at Xxx.Application.Commands.…Handle(…) in /…/Command.cs:line 40
+[frontend] warning: Cannot read properties of undefined …
+…
+```
+
+(Or `--- RUNTIME CAPTURE (from failing UI test) ---` for bugs auto-filed by
+Phase 5 — same idea, different source.)
+
+**Treat this block as the strongest evidence available** — stronger than any
+Grep hit. It's what the user actually saw at the moment the bug reproduced.
+Rules:
+
+- Start your investigation by scanning this block for file:line references
+  in the stack trace. Those locations go **directly** into your findings,
+  each backed by "Evidence — log tail line N shows `…` at file:line".
+- If the block quotes an HTTP status / exception type verbatim (e.g.
+  `InvalidOperationException: Tenant context is required`, `HTTP 400`),
+  mirror that exact phrase in your finding `reason` so fix-bug can grep it.
+- A finding whose `reason` cites a log-tail stack frame ≈ automatic
+  `Verdict: CONFIRMED`. You still read the code at that line to sanity-check
+  the hypothesis, but the log tail IS the evidence.
+- When the block is absent, you fall back to the normal playbook (the bug
+  was filed without a live session, or the session had no logs yet).
+
+## What to produce
+
+Produce **exactly one JSON object** at the end of your response, inside a fenced ```json block. No prose before or after. The schema:
+
+```json
+{
+  "refinedTitle": "Clear one-line title, action-oriented, 8-15 words",
+  "refinedDescription": "Reformulated description — 2-4 short paragraphs. Include: observed behavior, expected behavior, likely area of the codebase (if you found it). Keep the user's intent intact; don't invent symptoms.",
+  "category": "ui | api | data | config | performance | other",
+  "suggestedSeverity": "critical | major | minor",
+  "severityRationale": "One sentence explaining why you agree or disagree with the user's severity.",
+  "findings": [
+    {
+      "file": "src/frontend/components/... or src/backend/... (relative path)",
+      "line": 42,
+      "reason": "Why this location is related to the reported bug (1-2 sentences)."
+    }
+  ]
+}
+```
+
+### Rules for each field
+
+- **refinedTitle** — Keep the user's intent but tighten the phrasing. Start with the symptom, not "Bug:". Bad: "Problem with save button." Good: "Save button on Employee form does not persist changes".
+- **refinedDescription** — Strictly reformulate; never invent new symptoms. If the user didn't say something, don't claim it. If you found the code area, mention it; otherwise stay descriptive. Preserve any URLs, error codes, or reproduction steps.
+- **category** — Pick ONE:
+  - `ui` — visual/layout glitch, missing state, wrong copy, accessibility
+  - `api` — 4xx/5xx, missing endpoint, auth failure, request/response shape
+  - `data` — DB/migration/EF issue, wrong data returned, FK broken, permissions wrong
+  - `config` — env var missing, build config wrong, port conflict, docker
+  - `performance` — slow render, memory leak, N+1 query, blocking I/O
+  - `other` — genuinely none of the above
+- **suggestedSeverity** — Your own assessment based on what you found in the code. May differ from `SEVERITY`.
+- **severityRationale** — One sentence. E.g. "Agree — blocks core employee workflow" or "Downgraded to minor — only affects the unused archive view".
+- **findings** — **0 to 5 entries max.** Only include locations where a
+  **validated hypothesis** points to the cause. Each entry must be a real
+  file you opened with `Read` or saw through `Grep`. The `reason` field
+  must state the hypothesis AND the evidence that supports it — not just
+  "looks related". See *Evidence discipline* below. Empty array is fine
+  if nothing crosses that bar.
+
+## Evidence discipline (hard rule, time-boxed)
+
+You have a tight budget (≤ 2 min, read-only tools). Within that budget,
+**never write a finding based on a guess**. For each candidate location,
+internalise this mini-check before including it:
+
+> **Hypothesis** — one sentence stating what's broken (e.g. "Save button
+>   `onClick` never fires because of stale `isDirty` guard line 85").
+> **Evidence** — the concrete observation that supports it (the exact
+>   code snippet you read, the grep hit, the pattern matching the error
+>   message verbatim).
+> **Verdict** — CONFIRMED or SUSPECTED. Only CONFIRMED findings go in
+>   the JSON. SUSPECTED items stay in your head.
+
+Ban these shortcuts:
+- "Probably" / "seems to" / "likely" in the `reason` — replace with the
+  observation or drop the finding.
+- Pattern-matching on filename alone (e.g. "it's in Contacts*.tsx so
+  probably there") — open the file and confirm.
+- Echoing the bug text as a finding ("the save button doesn't work, see
+  SaveButton.tsx") — that's not evidence, that's restating the report.
+
+If a hypothesis needs runtime / DB proof you can't get (you only have
+read tools), **state this explicitly in `severityRationale` or as a
+finding with `reason` starting with "Suspected — requires runtime repro:
+…"**. Better to hand the fix-bug skill a short list of validated leads
+than a long list of plausible guesses.
+
+## Investigation playbook
+
+Run this sequence (stop early if the first passes already pinpoint the area):
+
+1. **Keyword grep** — Take 3-5 distinctive terms from the bug title/description (e.g. "save", "employee", "500") and `Grep` them across `src/`. Narrow by frontend/backend based on symptoms.
+2. **Component/endpoint lookup** — If the bug mentions a screen, find the `.tsx` in `src/frontend/components/` or `src/frontend/pages/`. If it mentions an action/endpoint, find the controller in `src/backend/` or the matching `*Controller.cs`.
+3. **Data flow trace** — For data bugs: check the entity in `Domain/Entities/`, the migration in `Migrations/`, and the service in `Infrastructure/Services/`.
+4. **Logs hint** — If the description quotes an error message verbatim (e.g. `"Cannot read properties of undefined"`, `"ConstraintException"`), grep for a line that would emit it.
+5. **SmartStack convention check** — If the bug smells like a convention violation (blank page, 403 on a valid user, permission format mismatch, missing i18n key, predictable GUIDs in seed), cross-reference `development/audit/SKILL.md` and add the relevant `findings[]` entries pointing at the convention violation (not just the surface symptom).
+6. **Dynamic routing check** — If the bug is a blank page / silent spinner, cross-reference `development/debug/frontend/SKILL.md` étape 7 (PageRegistry / componentKey). Include the matching componentKey as a finding even if no TSX line is the obvious culprit.
+
+### Category-specific layer checks
+
+Once you've narrowed by category, touch the right layers (time permitting):
+
+| Category | Layers to sample (first + most likely cause) |
+|---|---|
+| `ui` | Component `.tsx` (event handlers, conditional render) → form/store hooks → i18n keys (for missing labels). |
+| `api` | Controller action → `[RequirePermission]` + `Permissions.cs` enum → MediatR `ValidationBehavior` / `AuthorizationBehavior` → Handler → Repository. A 400/401/403 rarely originates in the handler. |
+| `data` | EF `ModelSnapshot` (schema source of truth) → Migration file → Seed provider → Entity configuration (`IsRequired`, `HasDefaultValue`). Don't propose a migration without reading the snapshot. |
+| `config` | `appsettings*.json` → `Program.cs` DI wiring → `launchSettings.json` / `.env*`. Look for the exact key the error message mentions. |
+| `performance` | Service method → EF query (Include, AsNoTracking, N+1) → caching (IMemoryCache/Redis). |
+
+Pick AT MOST 2 layers to sample per bug — time-box rules.
+
+## Constraints
+
+- **Time-boxed**: aim for ≤ 2 minutes of investigation. Don't rabbit-hole. A partial but honest report beats an exhaustive one.
+- **No fixes**: you do not have Edit/Write tools. If you spot the bug clearly, note it in `findings[].reason`, do not suggest the diff.
+- **No external lookups**: don't fetch URLs or external docs. Only the worktree.
+- **Output format is strict**: the calling code parses the JSON block directly. Any text outside the ```json block is discarded, so put nothing important there.
+
+## Example output
+
+Input:
+```
+BUG_TITLE: Bouton Save cassé
+BUG_DESCRIPTION: Quand je clique sur Save dans le formulaire Employé, rien ne se passe
+BRANCH_NAME: feature/hr-employees
+SEVERITY: major
+```
+
+Expected output (note how `reason` states hypothesis + evidence, not guess):
+
+```json
+{
+  "refinedTitle": "Save button on Employee form does not trigger any action",
+  "refinedDescription": "Clicking the Save button in the Employee form has no visible effect — no API call, no validation message, no navigation. Expected behavior: the form should POST to the create/update endpoint and either show a success toast or display validation errors.\n\nLikely area: the onClick handler in the Employee form component, or a disabled state that swallows the click silently.",
+  "category": "ui",
+  "suggestedSeverity": "major",
+  "severityRationale": "Agree — blocks the core create/update employee workflow with no user-visible feedback.",
+  "findings": [
+    {
+      "file": "src/frontend/components/employees/EmployeeForm.tsx",
+      "line": 87,
+      "reason": "Hypothesis: onClick handler undefined when form is not dirty. Evidence (read lines 80-92): `const handleSubmit = isDirty ? submit : undefined;` — Save button passes `handleSubmit` directly, so a non-dirty form yields `onClick={undefined}` = silent no-op. Verdict: CONFIRMED."
+    }
+  ]
+}
+```

package/templates/skills/development/debug/backend/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: debug-backend
+description: Diagnose and auto-fix SmartStack .NET backend failures
+group: DEBUG
+allowed-tools: [Read, Edit, Write, Glob, Grep, Bash]  # Bash: diagnostic commands
+---
+
+# Skill: Debug Backend — .NET + EF Core + Kestrel
+
+## Contexte
+
+Tu opères dans le worktree d'un projet SmartStack client. Le backend est un projet
+.NET 10 avec structure Clean 4 layers (Domain / Application / Infrastructure / Api).
+Le dev-runner du Studio spawn `dotnet run --no-build --no-launch-profile --urls http://localhost:{port}`.
+
+## Plan d'exécution
+
+### Étape 1 — Build
+
+```bash
+cd src/{AppCode}.Api
+dotnet build --nologo --verbosity normal
+```
+
+**Analyser la sortie** :
+- **Exit 0 + "Build succeeded"** → passer à l'étape 2
+- **Exit ≠ 0 + "Build FAILED"** → parser les erreurs MSBuild (lignes `error CS####`), identifier le fichier+ligne, corriger, relancer
+
+**Erreurs de build courantes** :
+| Erreur | Cause | Fix |
+|--------|-------|-----|
+| `CS0246: The type or namespace name 'X' could not be found` | Using manquant / référence projet absente | Ajouter `using` ou `<ProjectReference>` dans .csproj |
+| `CS0117: 'X' does not contain a definition for 'Y'` | Propriété renommée / version lib différente | Vérifier l'API du package, adapter l'appel |
+| `MSB3026: Impossible de copier ... locked by ...` | Process .Api.exe orphelin | `Get-Process | Where-Object Name -like '*{AppCode}.Api*' | Stop-Process -Force` |
+| `NETSDK1045: .NET SDK 10 is required` | SDK incorrect | `dotnet --list-sdks` pour vérifier, installer .NET 10 |
+
+### Étape 2 — Run + health check
+
+```bash
+dotnet run --no-build --no-launch-profile --urls http://localhost:5142 --project src/{AppCode}.Api
+```
+
+En parallèle dans un autre terminal :
+```bash
+# Attendre 10s puis tester
+curl -fsS http://localhost:5142/health || curl -fsS http://localhost:5142/
+```
+
+**Erreurs de runtime courantes** :
+
+| Symptôme dans logs | Cause | Fix |
+|--------------------|-------|-----|
+| `System.InvalidOperationException: The endpoint Http is missing the required 'Url' parameter` | `Kestrel:Endpoints:Http` sans `Url` dans appsettings.json | Ajouter `"Url": "http://localhost:5142"` ou **supprimer** la section `Kestrel:Endpoints` (le --urls CLI suffit) |
+| `Microsoft.Data.SqlClient.SqlException: A network-related ... error` | SQL Server pas lancé | `Get-Service MSSQL* | Where Status -eq Running` — démarrer via `Start-Service MSSQLSERVER` |
+| `Microsoft.Data.SqlClient.SqlException: Login failed` | ConnectionString invalide | Vérifier `ConnectionStrings:DefaultConnection` dans appsettings.Development.json |
+| `System.InvalidOperationException: No migrations configuration ...` | Migration EF Core absente | `dotnet ef migrations add Initial --project src/{AppCode}.Infrastructure --startup-project src/{AppCode}.Api` |
+| `The migration '...' has already been applied` | DB désynchronisée | **⚠ DESTRUCTIF**: `dotnet ef database drop --force` détruit les données locales. NE PAS exécuter sans confirmation utilisateur explicite. Alternative non-destructive: `dotnet ef migrations list --startup-project src/{AppCode}.Api` pour voir l'état, puis `dotnet ef database update 0 --startup-project src/{AppCode}.Api` pour revenir à l'état vide, puis `dotnet ef database update` |
+| `Unhandled exception. System.Reflection.TargetInvocationException` | DI container — service manquant | Chercher `AddScoped`/`AddSingleton` manquant dans `Program.cs` ou `DependencyInjection.cs` |
+| `JwtBearer Authentication was not configured` | Jwt.Secret vide | Vérifier `Jwt:Secret` dans appsettings.json |
+| `Application started. Press Ctrl+C to shut down.` + `/health` retourne ECONNREFUSED | Backend écoute ailleurs | Chercher `Now listening on:` pour voir le vrai port |
+
+### Étape 3 — Vérifier
+
+**3a. L'endpoint /health répond ?**
+```bash
+curl -I http://localhost:5142/health
+```
+
+- HTTP 200 / 204 / 404 → passer à 3b
+- ECONNREFUSED → backend mort, reboucler sur étape 2
+
+**3b. La DB répond via l'API ?** (critical — port binding OK ≠ app fonctionnelle)
+```bash
+# L'endpoint /health de SmartStack doit inclure un check DB. Vérifier le corps:
+curl -fsS http://localhost:5142/health
+# Attendu: {"status":"Healthy", ...} ou équivalent incluant une entrée DB
+```
+
+Si `/health` retourne 200 mais que la clé `database`/`db`/`sqlServer` est absente ou `Unhealthy` :
+- ConnectionString incorrecte → vérifier `appsettings.Development.json`
+- SQL Server en panne → `Get-Service MSSQL* | Where Status -eq Running`
+- Permissions DB manquantes → user de la connection string n'a pas accès à la DB
+
+**3c. L'API de navigation répond ?** (requis pour que le frontend charge)
+```bash
+# Sans token JWT, attendre 401. Avec token valide, attendre JSON.
+curl -I http://localhost:5142/api/navigation/menu
+# 401 → OK (endpoint existe, auth requise)
+# 404 → routing cassé, controllers pas mappés
+# 500 → exception à investiguer (seed non lancé ? DB vide ?)
+```
+
+## Fichiers clés à vérifier
+
+```
+src/{AppCode}.Api/
+├── Program.cs                     # 4 calls SmartStack : AddSmartStack, InitializeSmartStackAsync, UseSmartStack, MapSmartStack
+├── appsettings.json               # ConnectionStrings, Jwt, Kestrel (⚠ pas d'Endpoints:Url vide)
+├── appsettings.Development.json   # Overrides dev
+└── Properties/launchSettings.json # applicationUrl (ignoré par --no-launch-profile mais reste une référence)
+
+src/{AppCode}.Infrastructure/
+└── Migrations/                    # Doit contenir au moins une migration Initial
+```
+
+## Validation finale
+
+Avant de dire "fixé" :
+1. `dotnet build --nologo` → exit 0, 0 errors
+2. `dotnet run --no-build --no-launch-profile --urls http://localhost:5142` tourne
+3. `curl http://localhost:5142/health` → HTTP 2xx/4xx (pas 0)
+4. Pas de stack trace dans les 50 dernières lignes de stdout
+
+Si un fix modifie le schéma DB, suggérer à l'utilisateur de créer une migration EF Core.