@descix/cli 1.0.7 → 1.0.9

package/lib/commands/briefer/sources/identifiers.js

@@ -1,214 +0,0 @@
-/**
- * §1 — Identifiers & invariants extractor (M2 implementation).
- *
- * Per WS-DESCIX-BRIEFER-CLI scope doc §2.2 §1, this extractor reads:
- *   - Domain pattern from provision-platform-lb.js:120 (host construction)
- *   - GCS path pattern from provision-platform-lb.js:123 (pathPrefix)
- *   - product_id === app_id invariant from hydrateUtils.js
- *   - Agentic-app / communities-as-apps invariant from the BEAST CEO record
- *     `apps/unk-beast/kb/Org/agentic-app-invariant-2026-05-26.jsonl`
- *   - the AI (model, thinking) precedence chain from geminiInteractions.js::resolveModelThinkingPair()
- *
- * Extraction method: regex+checksum-of-surrounding-lines (NOT AST).
- * Per scope §9.1 third-order question, decision documented 2026-05-26: regex
- * keeps the CLI dep-light; AST may be added per-extractor later if needed.
- *
- * HARD-FAIL behavior:
- *   - Missing source file → BRIEFER-SRC-NOT-FOUND
- *   - Regex pattern doesn't match → BRIEFER-SRC-NOT-FOUND
- *   - Pattern matches outside expected line range → BRIEFER-PARSE-FAIL
- *   - BEAST agentic-app record missing → BRIEFER-SRC-NOT-FOUND (a hard
- *     invariant — this is the CEO-broadcast canonical record)
- */
-import {
-  readSourceFile,
-  findInLines,
-  makeCitation,
-  sliceRange
-} from '../util/source-reader.js';
-import { BrieferExtractorError, BRIEFER_ERROR_CODES } from '../errors.js';
-// The (model, thinking) precedence chain in words, from its ONE owner. The briefer
-// QUOTES the served contract rather than paraphrasing it — a briefer paraphrase of a
-// chain is exactly how the old five-step list outlived the code it described.
-import { MODEL_THINKING_CHAIN } from '@descix/platform-api/mcp-tools';
-
-export const SECTION = {
-  number: 1,
-  heading: '1. Identifiers & invariants',
-  sourceFiles: [
-    'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/provision-platform-lb.js',
-    'DeSciX/DeSciX_Core/descix-platform-api/src/entitlements/index.js',
-    'DeSciX/DeSciX_Cloud/microservice/services/geminiInteractions.js',
-    'apps/unk-beast/kb/Org/agentic-app-invariant-2026-05-26.jsonl'
-  ]
-};
-
-const MESH_FILE = 'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/provision-platform-lb.js';
-const HYDRATE_FILE = 'DeSciX/DeSciX_Core/descix-platform-api/src/entitlements/index.js';
-const GEMINI_FILE = 'DeSciX/DeSciX_Cloud/microservice/services/geminiInteractions.js';
-const AGENTIC_RECORD = 'apps/unk-beast/kb/Org/agentic-app-invariant-2026-05-26.jsonl';
-
-export async function extract({ env, cliPaths } = {}) {
-  if (!env) {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.NOT_IMPLEMENTED,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: 'extractor argument',
-      expected: 'env (dev|demo|prod) provided by caller',
-      recovery: 'Pass {env} from the briefer entry point.'
-    });
-  }
-  if (!cliPaths) {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.NOT_IMPLEMENTED,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: 'extractor argument',
-      expected: 'cliPaths provided by caller',
-      recovery: 'Pass {cliPaths} from the briefer entry point.'
-    });
-  }
-
-  // ── Source 1: provision-platform-lb.js — domain + gcsPath patterns ──
-  const mesh = await readSourceFile({
-    cliPaths,
-    relPath: MESH_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-
-  // Host pattern: canonical line shifted to L214 after WS-DESCIX-SINGLETON-PROVISIONER
-  // (CEO-D-2026-05-26-SINGLETON-PROVISIONER-UNIFIED, 2026-05-26) added the
-  // SINGLETON_APPS branch + buildSingletonMatcher helper near top of file. The
-  // line is the canonical UNIFORM host formula (which a singleton override then
-  // shadows via `effectiveHost` for daita) — briefer extractor still keys on
-  // this exact construct as the platform routing invariant. Range expanded to
-  // 100-350 to tolerate NEG helpers + matcher builders in provision-platform-lb.js.
-  const hostMatch = findInLines({
-    lines: mesh.lines,
-    regex: /const\s+host\s*=\s*env\s*===\s*['"]prod['"]\s*\?/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${MESH_FILE}:214 (uniform host pattern; CEO-D-2026-05-26-LB-ROUTING-UNIFORM)`,
-    expected: `const host = env === 'prod' ? ... : ... construct`,
-    recovery: `Re-locate the host construct in ${MESH_FILE} and update sources/identifiers.js.`,
-    expectedRange: [100, 350]
-  });
-
-  // gcsPath pattern: canonical line shifted to L223 after WS-DESCIX-SINGLETON-PROVISIONER.
-  // This is the non-singleton (uniform) pathPrefix; the singleton override
-  // (pathPrefixSingletonOverride) is a few lines below. Range matches hostMatch.
-  const gcsMatch = findInLines({
-    lines: mesh.lines,
-    regex: /const\s+pathPrefix\s*=\s*`\/\$\{env\}\/\$\{app\}\/site`/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${MESH_FILE}:223 (uniform gcsPath pattern; singleton override at ~L228)`,
-    expected: 'const pathPrefix = `/${env}/${app}/site` (template literal)',
-    recovery: `Re-locate the gcsPath construct in ${MESH_FILE}.`,
-    expectedRange: [100, 350]
-  });
-
-  // ── Source 2: hydrateUtils.js — product_id===app_id invariant ──
-  const hydrate = await readSourceFile({
-    cliPaths,
-    relPath: HYDRATE_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-
-  const hydrateMatch = findInLines({
-    lines: hydrate.lines,
-    regex: /hydrateCommunityIdFromProducts/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${HYDRATE_FILE} (hydrateCommunityIdFromProducts definition)`,
-    expected: 'hydrateCommunityIdFromProducts function declaration',
-    recovery: `Verify hydrateCommunityIdFromProducts is still exported from ${HYDRATE_FILE}.`
-  });
-
-  // ── Source 3: geminiInteractions.js — the (model, thinking) pair owner ──
-  const gemini = await readSourceFile({
-    cliPaths,
-    relPath: GEMINI_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-
-  const resolverMatch = findInLines({
-    lines: gemini.lines,
-    regex: /export\s+function\s+resolveModelThinkingPair\b/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${GEMINI_FILE} (resolveModelThinkingPair)`,
-    expected: 'export function resolveModelThinkingPair(...)',
-    recovery: `resolveModelThinkingPair has been moved or renamed. Re-locate and update the extractor.`
-  });
-  // Capture the resolver body — from the export to the next closing brace at
-  // column 0. We'll scan forward a bounded window and slice for the briefer.
-  const resolverEnd = findResolverEnd(gemini.lines, resolverMatch.lineNumber);
-  const resolverBody = sliceRange(gemini.lines, resolverMatch.lineNumber, resolverEnd);
-
-  // ── Source 4: BEAST CEO record — agentic-app invariant ──
-  const beast = await readSourceFile({
-    cliPaths,
-    relPath: AGENTIC_RECORD,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-  // The record is JSONL; the canonical claim is one of the question/answer
-  // chunks. We don't parse the JSONL — we just verify the record EXISTS and
-  // SHA the whole file for citation purposes. The CEO broadcast title is the
-  // contract; the briefer prose embeds it verbatim.
-  const beastSha = makeCitation({
-    file: AGENTIC_RECORD,
-    lines: `1-${beast.lines.length}`,
-    anchor: 'AGENTIC-APP-INHERITANCE-INVARIANT-2026-05-26',
-    fileLines: beast.lines
-  }).sha;
-
-  // ── Render the briefer markdown ──
-  const hostLine = mesh.lines[hostMatch.lineNumber - 1].trim();
-  const gcsLine = mesh.lines[gcsMatch.lineNumber - 1].trim();
-
-  const markdown = [
-    `- **Apps are the central unit. Everything is an agentic app.** Communities are themselves agentic apps that share IP with other apps in the same community. The platform is fundamentally an agentic-app store, not a generic SaaS platform with apps bolted on. — \`${AGENTIC_RECORD}\` (CEO broadcast \`AGENTIC-APP-INHERITANCE-INVARIANT-2026-05-26\`, sha=\`${beastSha}\`)`,
-    `- \`app_id\` is a globally unique slug (e.g., \`daita\`, \`powch\`, \`egpt\`). Same value across DEV, DEMO, PROD. Never contains the environment.`,
-    `- \`community_id\` is operational metadata stored INSIDE \`Products/{app_id}\`. Never parsed from URL. Never trusted from client.`,
-    `- \`product_id === app_id\` — the same opaque slug. Server re-derives \`community_id\` from \`Products/{app_id}\` via \`hydrateCommunityIdFromProducts()\`. — \`${HYDRATE_FILE}:${hydrateMatch.lineNumber}\``,
-    `- Domain pattern: \`{app_id}.{env}.descix.net\` for DEV/DEMO; \`{app_id}.descix.net\` for PROD. — \`${MESH_FILE}:${hostMatch.lineNumber}\``,
-    '  ```js',
-    `  ${hostLine}`,
-    '  ```',
-    `- GCS path: \`{env}/{app_id}/site/\`. Flat — no community in the path. — \`${MESH_FILE}:${gcsMatch.lineNumber}\``,
-    '  ```js',
-    `  ${gcsLine}`,
-    '  ```',
-    `- Wildcard TLS cert: \`*.descix.net\` plus per-env wildcards. ONE cert. No per-app cert provisioning.`,
-    `- **AI (model, thinking) precedence.** ${MODEL_THINKING_CHAIN} Owner: \`resolveModelThinkingPair()\` in \`${GEMINI_FILE}:${resolverMatch.lineNumber}\` — the ONE resolver; the model chain and the thinking chain used to be separate and could assemble a pair no config declared.`,
-    '  ```js',
-    indentBlock(resolverBody, '  '),
-    '  ```'
-  ].join('\n');
-
-  const citations = [
-    makeCitation({ file: MESH_FILE, lines: String(hostMatch.lineNumber), anchor: 'host pattern', fileLines: mesh.lines }),
-    makeCitation({ file: MESH_FILE, lines: String(gcsMatch.lineNumber), anchor: 'gcsPath pattern', fileLines: mesh.lines }),
-    makeCitation({ file: HYDRATE_FILE, lines: String(hydrateMatch.lineNumber), anchor: 'hydrateCommunityIdFromProducts', fileLines: hydrate.lines }),
-    makeCitation({ file: GEMINI_FILE, lines: `${resolverMatch.lineNumber}-${resolverEnd}`, anchor: 'resolveModelThinkingPair', fileLines: gemini.lines }),
-    { file: AGENTIC_RECORD, lines: `1-${beast.lines.length}`, anchor: 'AGENTIC-APP-INHERITANCE-INVARIANT-2026-05-26', sha: beastSha }
-  ];
-
-  return { markdown, citations };
-}
-
-/**
- * Walk forward from the `export function resolveModelThinkingPair` line until we hit
- * a closing brace at column 0. Bounded scan window of 80 lines so a runaway
- * regex on a refactored file doesn't drag the whole file into the briefer.
- */
-function findResolverEnd(lines, startLine) {
-  const MAX = Math.min(lines.length, startLine + 80);
-  for (let i = startLine; i < MAX; i++) {
-    if (lines[i] === '}') return i + 1;
-  }
-  // If we don't find a clean close, fall back to startLine+30 — we want some
-  // body in the briefer even if the resolver was reformatted; --check will
-  // catch the SHA change.
-  return Math.min(lines.length, startLine + 30);
-}
-
-function indentBlock(block, indent) {
-  return block.split('\n').map(l => indent + l).join('\n');
-}

package/lib/commands/briefer/sources/microservice-deploy.js

@@ -1,267 +0,0 @@
-/**
- * §4 — Microservice deploy extractor (M2 implementation).
- *
- * Per-app microservice deploy (broker-first model), CONSOLIDATED onto a
- * single canonical path for both apps (WS-DEPLOY-HARDENING item 6 —
- * Powch's divergent `microservice/scripts/deploy.sh` is now a hard-fail
- * deprecation stub, not a second deploy implementation):
- *   1. `gcloud run deploy {app}-{env}` — deploy-service-env.sh → lib/cloud-run-deploy.js
- *   2. `descix microservice register` — Firestore manifest (or self-register on boot)
- *
- * No per-app LB/NEG step for non-core apps. Core platform app NEGs at env standup via provision-platform-lb.js.
- */
-import {
-  readSourceFile,
-  findInLines,
-  makeCitation,
-  sliceRange,
-  probeGcloudJson
-} from '../util/source-reader.js';
-import { BrieferExtractorError, BRIEFER_ERROR_CODES } from '../errors.js';
-
-export const SECTION = {
-  number: 4,
-  heading: '4. Microservice deploy — current state',
-  sourceFiles: [
-    'DeSciX/DeSciX_Powch/microservice/scripts/deploy.sh',
-    'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/deploy-service-env.sh',
-    'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/lib/cloud-run-deploy.js',
-    'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/provision-platform-lb.js',
-    'DeSciX/DeSciX_Core/descix-cli/bin/descix.js'
-  ]
-};
-
-const POWCH_DEPLOY = 'DeSciX/DeSciX_Powch/microservice/scripts/deploy.sh';
-const CLOUD_DEPLOY = 'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/deploy-service-env.sh';
-const CLOUD_RUN_LIB = 'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/lib/cloud-run-deploy.js';
-const LB_FILE = 'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/provision-platform-lb.js';
-const CLI_FILE = 'DeSciX/DeSciX_Core/descix-cli/bin/descix.js';
-
-export async function extract({ env, cliPaths } = {}) {
-  if (!env) {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.NOT_IMPLEMENTED,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: 'extractor argument',
-      expected: 'env (dev|demo|prod) provided by caller',
-      recovery: 'Pass {env} from the briefer entry point.'
-    });
-  }
-  if (!cliPaths) {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.NOT_IMPLEMENTED,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: 'extractor argument',
-      expected: 'cliPaths provided by caller',
-      recovery: 'Pass {cliPaths} from the briefer entry point.'
-    });
-  }
-
-  // ── Step 1: gcloud run deploy — Cloud canonical lib is the SOLE source of
-  // this fact. Powch's per-app deploy.sh was RETIRED to a hard-fail
-  // DEPRECATION stub (WS-DEPLOY-HARDENING item 6) — deploy is now
-  // CONSOLIDATED onto deploy-service-env.sh → cloud-run-deploy.js for both
-  // apps. We still read the Powch file, but only to ground-truth its
-  // retirement marker (fail-loud if the stub itself drifts) — not to
-  // extract a second `gcloud run deploy` invocation. ──
-  const powch = await readSourceFile({
-    cliPaths,
-    relPath: POWCH_DEPLOY,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-  const powchRun = findInLines({
-    lines: powch.lines,
-    regex: /^echo\s+"DEPRECATED:/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${POWCH_DEPLOY} (retirement stub marker)`,
-    expected: 'echo "DEPRECATED: ..." — the WS-DEPLOY-HARDENING item 6 retirement stub',
-    recovery: `Re-locate the DEPRECATED marker in ${POWCH_DEPLOY}. If the script has been deleted outright, remove this Powch reference from the §4 extractor entirely (single canonical deploy path already covered by CLOUD_RUN_LIB).`
-  });
-  const powchDeployEndMatch = findInLines({
-    lines: powch.lines,
-    regex: /^exit\s+1/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${POWCH_DEPLOY} (retirement stub exit)`,
-    expected: 'exit 1 — the stub hard-fails rather than deploying',
-    recovery: `Re-locate the exit 1 in ${POWCH_DEPLOY}.`
-  });
-  const powchDeployEnd = powchDeployEndMatch.lineNumber;
-  const powchDeployBlock = sliceRange(powch.lines, powchRun.lineNumber, powchDeployEnd);
-
-  // Cloud-side deploy: bash script shells out to shared lib (deployToCloudRun)
-  const cloud = await readSourceFile({
-    cliPaths,
-    relPath: CLOUD_DEPLOY,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-  findInLines({
-    lines: cloud.lines,
-    regex: /deployToCloudRun/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${CLOUD_DEPLOY} (deployToCloudRun import)`,
-    expected: 'deploy-service-env.sh invokes deployToCloudRun from lib/cloud-run-deploy.js',
-    recovery: `Re-locate deployToCloudRun in ${CLOUD_DEPLOY}.`
-  });
-
-  const cloudRunLib = await readSourceFile({
-    cliPaths,
-    relPath: CLOUD_RUN_LIB,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-  const cloudRun = findInLines({
-    lines: cloudRunLib.lines,
-    regex: /gcloud run deploy \$\{serviceName\}/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${CLOUD_RUN_LIB} (gcloud run deploy invocation)`,
-    expected: 'gcloud run deploy ${serviceName} ... in cloud-run-deploy.js',
-    recovery: `Re-locate the gcloud run deploy in ${CLOUD_RUN_LIB}.`
-  });
-  const cloudDeployEnd = findContinuationEnd(cloudRunLib.lines, cloudRun.lineNumber);
-  const cloudDeployBlock = sliceRange(cloudRunLib.lines, cloudRun.lineNumber, cloudDeployEnd);
-
-  // Platform LB (env standup only — not per-app)
-  const lb = await readSourceFile({
-    cliPaths,
-    relPath: LB_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-  const ensureCoreNegMatch = findInLines({
-    lines: lb.lines,
-    regex: /function\s+ensureCoreNeg\s*\(/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${LB_FILE} (ensureCoreNeg)`,
-    expected: 'function ensureCoreNeg(envCfg, dryRun)',
-    recovery: `Re-locate ensureCoreNeg in ${LB_FILE}.`
-  });
-
-  // ── Step 2: descix microservice register CLI command ──
-  const cli = await readSourceFile({
-    cliPaths,
-    relPath: CLI_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-  // Per-line scan: find `.command('register')` whose preceding non-empty line
-  // contains `microserviceCommand`. Disambiguates from program.command('register-delegate')
-  // which also exists.
-  let registerLine = -1;
-  for (let i = 1; i < cli.lines.length; i++) {
-    if (/\.command\(['"]register['"]\)/.test(cli.lines[i])) {
-      // Look back up to 3 lines for a `microserviceCommand` anchor.
-      for (let j = i - 1; j >= Math.max(0, i - 3); j--) {
-        if (/microserviceCommand/.test(cli.lines[j])) {
-          registerLine = i + 1;
-          break;
-        }
-      }
-      if (registerLine !== -1) break;
-    }
-  }
-  if (registerLine === -1) {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.SRC_NOT_FOUND,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: `${CLI_FILE}:3080-3236 (descix microservice register)`,
-      expected: "microserviceCommand followed by .command('register') in bin/descix.js",
-      recovery: `Re-locate the microservice register command in ${CLI_FILE}.`,
-      detail: "Scanned bin/descix.js — no line matches `.command('register')` within 3 lines of `microserviceCommand`."
-    });
-  }
-  const registerMatch = { lineNumber: registerLine };
-
-  // KNOWN GAP toggle: scan for `.command('deploy')` whose preceding 3 lines
-  // contain a `microserviceCommand` anchor (mirror the register-detect pattern).
-  // If found, the gap is closed; if absent, gap text is rendered.
-  let gapToggleClosed = false;
-  for (let i = 1; i < cli.lines.length; i++) {
-    if (/\.command\(['"]deploy['"]\)/.test(cli.lines[i])) {
-      for (let j = i - 1; j >= Math.max(0, i - 3); j--) {
-        if (/microserviceCommand/.test(cli.lines[j])) {
-          gapToggleClosed = true;
-          break;
-        }
-      }
-      if (gapToggleClosed) break;
-    }
-  }
-
-  // ── M3: live Cloud Run probe (HARD-FAIL on demo/prod, skipped on dev) ──
-  const probeCitations = [];
-  let runProbeNote = '';
-  if (env === 'dev') {
-    runProbeNote = '\n_DEV: gcloud probes skipped (local dev — no Cloud Run services to probe)._\n';
-  } else {
-    const runProbe = await probeGcloudJson({
-      command: ['run', 'services', 'list', '--region=us-central1', `--filter=metadata.name~^.*-${env}$`, '--format=json'],
-      env,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      anchor: 'cloud-run-services-list',
-      expected: `JSON array of Cloud Run services matching \`-${env}$\` in us-central1`,
-      recovery: `Run 'gcloud auth login' and 'gcloud config set project descix'. The Cloud Run services cross-check is required for env=${env}.`
-    });
-    const services = (runProbe.json || [])
-      .map(svc => ({
-        name: (svc.metadata && svc.metadata.name) || '(unknown)',
-        region: (svc.metadata && svc.metadata.labels && svc.metadata.labels['cloud.googleapis.com/location']) || 'us-central1'
-      }));
-    const names = services.map(s => '\`' + s.name + '\`').join(', ');
-    runProbeNote = `\n**Live Cloud Run state** (probed \`${runProbe.citation.probe}\`, env=\`${env}\`):\n- Services found: \`${services.length}\`\n- Names: ${names || '_(none)_'}\n`;
-    probeCitations.push(runProbe.citation);
-  }
-
-  // ── Render the markdown ──
-  const lines = [
-    `Today (regen target: \`${env}\`), per-app microservice deploy is **2 steps** (broker-first — no NEG for non-core apps):`,
-    ``,
-    `**Step 1.** \`gcloud run deploy {app}-{env} ...\` — deploys the Cloud Run service (via \`deploy-service-env.sh\` → \`lib/cloud-run-deploy.js\`; CLI: \`descix microservice deploy\`). This is now the SOLE deploy path for **both** apps — Powch's own \`deploy.sh\` was retired to a hard-fail deprecation stub (WS-DEPLOY-HARDENING item 6) that points callers at this canonical path.`,
-    `- Reference (Cloud canonical — sole source of the \`gcloud run deploy\` fact): \`${CLOUD_RUN_LIB}:${cloudRun.lineNumber}\``,
-    `- Reference (Powch retirement stub, not a second deploy path): \`${POWCH_DEPLOY}:${powchRun.lineNumber}\``,
-    ``,
-    'Verbatim from `' + CLOUD_RUN_LIB + '` (shared deploy lib):',
-    ``,
-    '```bash',
-    cloudDeployBlock,
-    '```',
-    ``,
-    `**Step 2.** \`descix microservice register\` — writes manifest to Firestore \`ServiceManifests\` so Core dispatches via \`proxyToExternalService\`. Self-registration on boot is equivalent. — \`${CLI_FILE}:${registerMatch.lineNumber}\``,
-    ``,
-    `**Platform LB (core platform apps at standup):** \`deploy-backend-env.sh\` → \`provision-platform-lb.js\` — daita broker NEG + powch NEG + apex/peer URL map. \`deploy-service-env.sh powch\` re-runs provision for powch NEG. — \`${LB_FILE}:${ensureCoreNegMatch.lineNumber}\``,
-    ``
-  ];
-
-  if (gapToggleClosed) {
-    lines.push(
-      `**GAP CLOSED:** \`descix microservice deploy\` exists in the CLI as of this regen — it chains the three steps above. (Detected via grep on \`bin/descix.js\`.)`
-    );
-  } else {
-    lines.push(
-      `**KNOWN GAP:** there is NO \`descix microservice deploy\` command that chains all three. Step 2 today is a manual admin-script invocation, not a CLI subcommand. Closing this gap is part of WS-DESCIX-BRIEFER-CLI scope (or a sibling workstream). _Detected dynamically: grep on \`bin/descix.js\` returned no \`microserviceCommand.command('deploy')\` declaration._`
-    );
-  }
-  if (runProbeNote) lines.push(runProbeNote);
-
-  const markdown = lines.join('\n');
-
-  const citations = [
-    makeCitation({ file: POWCH_DEPLOY, lines: `${powchRun.lineNumber}-${powchDeployEnd}`, anchor: 'DEPRECATED stub (Powch — consolidated onto Cloud canonical path)', fileLines: powch.lines }),
-    makeCitation({ file: CLOUD_RUN_LIB, lines: `${cloudRun.lineNumber}-${cloudDeployEnd}`, anchor: 'gcloud run deploy (Cloud canonical lib)', fileLines: cloudRunLib.lines }),
-    makeCitation({ file: CLOUD_DEPLOY, lines: 'deployToCloudRun', anchor: 'deploy-service-env.sh → lib', fileLines: cloud.lines }),
-    makeCitation({ file: LB_FILE, lines: String(ensureCoreNegMatch.lineNumber), anchor: 'provision-platform-lb.js ensureCoreNeg', fileLines: lb.lines }),
-    makeCitation({ file: CLI_FILE, lines: String(registerMatch.lineNumber), anchor: 'descix microservice register', fileLines: cli.lines }),
-    ...probeCitations
-  ];
-
-  return { markdown, citations };
-}
-
-/**
- * For shell line-continuations (`\\` at line-end), walk forward until the
- * continuation chain ends. Returns the line number of the LAST line in the
- * block (1-indexed).
- */
-function findContinuationEnd(lines, startLine) {
-  let i = startLine - 1;
-  while (i < lines.length - 1 && /\\\s*$/.test(lines[i])) {
-    i++;
-  }
-  return i + 1;
-}