@descix/cli 1.0.7 → 1.0.9

package/lib/commands/briefer/sources/routing.js

@@ -1,275 +0,0 @@
-/**
- * §3 — Request routing extractor (M2 implementation).
- *
- * This is THE highest-scrutiny section per the 2026-05-25 audit. The earlier
- * cruft about "Gateway extracts productId + Firestore lookup" lives in V2_docs
- * prose; this extractor pulls the CANONICAL routing model from code:
- *   - provision-platform-lb.js — platform LB (core NEG + apex/peer hosts)
- *   - serviceManifestManager.js — proxyToExternalService dispatch
- *   - apiFront.js — invoke() dispatch (internal + external command split)
- *   - app-sdk dev/gateway.js + createViteProxyConfig.js — local dev mirror
- *   - Live `gcloud compute url-maps describe descix-discord-app-lb`
- *     when gcloud is available and --env=demo|prod
- *
- * --env=dev is HARD-REJECTED in this extractor (per scope §2.1) — DEV has no
- * LB URL map, so routing facts from gcloud cannot be verified.
- */
-import {
-  readSourceFile,
-  findInLines,
-  makeCitation,
-  sliceRange,
-  probeGcloudJson
-} from '../util/source-reader.js';
-import { BrieferExtractorError, BRIEFER_ERROR_CODES } from '../errors.js';
-
-export const SECTION = {
-  number: 3,
-  heading: '3. Request routing — the single canonical model',
-  sourceFiles: [
-    'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/provision-platform-lb.js',
-    'DeSciX/DeSciX_Cloud/microservice/services/serviceManifestManager.js',
-    'DeSciX/DeSciX_Cloud/microservice/services/apiFront.js',
-    'DeSciX/DeSciX_Core/descix-app-sdk/src/dev/gateway.js',
-    'DeSciX/DeSciX_Core/descix-app-sdk/src/dev/createViteProxyConfig.js'
-  ]
-};
-
-const LB_FILE = 'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/provision-platform-lb.js';
-const SMM_FILE = 'DeSciX/DeSciX_Cloud/microservice/services/serviceManifestManager.js';
-const APIFRONT_FILE = 'DeSciX/DeSciX_Cloud/microservice/services/apiFront.js';
-const GATEWAY_FILE = 'DeSciX/DeSciX_Core/descix-app-sdk/src/dev/gateway.js';
-const PROXY_CONFIG_FILE = 'DeSciX/DeSciX_Core/descix-app-sdk/src/dev/createViteProxyConfig.js';
-
-export async function extract({ env, cliPaths } = {}) {
-  if (!env) {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.NOT_IMPLEMENTED,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: 'extractor argument',
-      expected: 'env (demo|prod) provided by caller',
-      recovery: 'Pass {env} from the briefer entry point.'
-    });
-  }
-  // M2 hard-reject --env=dev for the routing extractor specifically.
-  // Per scope §2.1: DEV does not have an LB URL map, querying it would
-  // produce a malformed briefer. Other extractors that don't need gcloud
-  // may still accept dev; this rejection lives in routing.js.
-  if (env === 'dev') {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.PARSE_FAIL,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: 'env argument',
-      expected: 'demo or prod (the envs with a live LB URL map)',
-      recovery: 'DEV has no LB URL map; use --env=demo or --env=prod for routing extraction. Other sections may run with --env=dev independently.',
-      detail: `Got --env=dev. DEV has no descix-discord-app-lb URL map to verify routing against.`
-    });
-  }
-  if (!cliPaths) {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.NOT_IMPLEMENTED,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: 'extractor argument',
-      expected: 'cliPaths provided by caller',
-      recovery: 'Pass {cliPaths} from the briefer entry point.'
-    });
-  }
-
-  // ── Source 1: provision-platform-lb.js — platform LB standup ──
-  const lb = await readSourceFile({
-    cliPaths,
-    relPath: LB_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-
-  const ensureCoreNegMatch = findInLines({
-    lines: lb.lines,
-    regex: /function\s+ensureCoreNeg\s*\(/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${LB_FILE} (ensureCoreNeg)`,
-    expected: 'function ensureCoreNeg(envCfg, dryRun)',
-    recovery: `Re-locate ensureCoreNeg in ${LB_FILE}.`,
-    expectedRange: [80, 140]
-  });
-
-  const singletonMatcherMatch = findInLines({
-    lines: lb.lines,
-    regex: /function\s+buildSingletonMatcher\s*\(/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${LB_FILE} (buildSingletonMatcher)`,
-    expected: 'function buildSingletonMatcher(...)',
-    recovery: `Re-locate buildSingletonMatcher in ${LB_FILE}.`
-  });
-
-  const apiFrontRuleMatch = findInLines({
-    lines: lb.lines,
-    regex: /['"`]\/apifront['"`]/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${LB_FILE} (command-broker /apifront rule)`,
-    expected: `'/apifront' in buildCommandBrokerRules`,
-    recovery: `Re-locate the /apifront command-broker rule.`
-  });
-
-  // ── Source 2: serviceManifestManager.js — proxyToExternalService ──
-  const smm = await readSourceFile({
-    cliPaths,
-    relPath: SMM_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-
-  const proxyMatch = findInLines({
-    lines: smm.lines,
-    regex: /export\s+async\s+function\s+proxyToExternalService\s*\(/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${SMM_FILE}:685-765 (proxyToExternalService)`,
-    expected: 'export async function proxyToExternalService(commandName, params, sessionToken = null, req = null)',
-    recovery: `Re-locate proxyToExternalService in ${SMM_FILE}.`,
-    expectedRange: [650, 800]
-  });
-
-  // ── Source 3: apiFront.js — invoke() dispatch ──
-  const apiFront = await readSourceFile({
-    cliPaths,
-    relPath: APIFRONT_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-
-  const invokeMatch = findInLines({
-    lines: apiFront.lines,
-    regex: /static\s+async\s+invoke\s*\(\s*commandName/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${APIFRONT_FILE}:83-186 (CommandHandler.invoke + _invokeExternalCommand)`,
-    expected: 'static async invoke(commandName, params, req, res)',
-    recovery: `Re-locate CommandHandler.invoke in ${APIFRONT_FILE}.`,
-    expectedRange: [50, 200]
-  });
-  const externalDispatchMatch = findInLines({
-    lines: apiFront.lines,
-    regex: /static\s+async\s+_invokeExternalCommand\s*\(/,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    source: `${APIFRONT_FILE} (_invokeExternalCommand)`,
-    expected: 'static async _invokeExternalCommand(commandName, params, req)',
-    recovery: `Re-locate _invokeExternalCommand in ${APIFRONT_FILE}.`
-  });
-
-  // ── Source 4: app-sdk gateway.js + createViteProxyConfig.js ──
-  const gateway = await readSourceFile({
-    cliPaths,
-    relPath: GATEWAY_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-  const proxyConfig = await readSourceFile({
-    cliPaths,
-    relPath: PROXY_CONFIG_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-
-  // ── M3: live gcloud probe (HARD-FAIL on demo/prod, skipped on dev) ──
-  // routing.js already hard-rejects --env=dev above (no LB URL map in DEV),
-  // so this probe ALWAYS runs for demo/prod and MUST succeed. probeGcloudJson
-  // throws BRIEFER-GCLOUD-FAIL with an actionable recovery message otherwise.
-  let gcloudBlock = '';
-  let gcloudCitation = null;
-  const lbProbe = await probeGcloudJson({
-    command: ['compute', 'url-maps', 'describe', 'descix-discord-app-lb', '--format=json'],
-    env,
-    section: `§${SECTION.number} ${SECTION.heading}`,
-    anchor: 'lb-url-map',
-    expected: 'JSON describing the descix-discord-app-lb URL map',
-    recovery: `Run 'gcloud auth login' and 'gcloud config set project descix'. If the URL map does not exist for env=${env}, that is a real platform-state issue — investigate before regenerating the briefer.`
-  });
-  // lbProbe is non-null for demo/prod (dev is rejected upstream).
-  const hostRuleCount = (lbProbe.json.hostRules || []).length;
-  const pathMatcherCount = (lbProbe.json.pathMatchers || []).length;
-  const fingerprint = lbProbe.json.fingerprint || 'unknown';
-  gcloudBlock = [
-    '',
-    '**Live LB state** (live `gcloud compute url-maps describe descix-discord-app-lb` at regen time):',
-    `- Host rules: \`${hostRuleCount}\``,
-    `- Path matchers: \`${pathMatcherCount}\``,
-    `- URL map fingerprint: \`${fingerprint}\``,
-    `- Probed: \`${lbProbe.citation.probe}\` (env=\`${env}\`)`,
-    ''
-  ].join('\n');
-  gcloudCitation = lbProbe.citation;
-
-  const singletonBlockEnd = findFunctionEnd(lb.lines, singletonMatcherMatch.lineNumber);
-  const singletonBlock = sliceRange(lb.lines, singletonMatcherMatch.lineNumber, singletonBlockEnd);
-
-  // ── Render the section markdown ──
-  const markdown = [
-    `Broker-first mesh (WS-MESH-BROKER-ONLY): sites call \`/apifront\`; Core validates entitlements and dispatches via Firestore \`ServiceManifests\`. **No NEG on routine deploy for non-core apps.** No runtime LB lookup for new apps.`,
-    ``,
-    `Platform LB (\`descix-discord-app-lb\`) is provisioned at platform standup by \`deploy-backend-env.sh\` → \`provision-platform-lb.js\` (re-run after \`deploy-service-env.sh powch\` for powch NEG):`,
-    ``,
-    `- **daita** broker NEG: \`apifront-http-{env}-neg\` → \`{env}-api-backend\` → Cloud Function \`apiFront-http-{env}\` — \`${LB_FILE}:${ensureCoreNegMatch.lineNumber}\``,
-    `- Apex singleton (\`daita\`): \`demo.descix.net\` / \`descix.net\` → GCS \`/{env}/daita/site/\` + \`/apifront\`, \`/mcp\`, \`/api\` → daita broker — \`${LB_FILE}:${singletonMatcherMatch.lineNumber}\``,
-    `- **powch** core platform NEG: \`powch-{env}-neg\` → \`powch-{env}-backend\` → Cloud Run \`powch-{env}\` — \`${LB_FILE} (ensureCloudRunAppNeg)\``,
-    `- Platform peer host (\`powch.{env}.descix.net\`): GCS site + \`/apifront\`, \`/mcp\` → daita broker; \`/api/*\` → powch NEG`,
-    ``,
-    `Singleton matcher construction (verbatim from \`${LB_FILE}\` L${singletonMatcherMatch.lineNumber}-${singletonBlockEnd}):`,
-    ``,
-    '```js',
-    singletonBlock,
-    '```',
-    ``,
-    `Runtime dispatch: central CF reads \`externalCommandRegistry\` and calls \`proxyToExternalService()\`. — \`${SMM_FILE}:${proxyMatch.lineNumber}\`, \`${APIFRONT_FILE}:${invokeMatch.lineNumber} (invoke), ${externalDispatchMatch.lineNumber} (_invokeExternalCommand)\``,
-    gcloudBlock,
-    `**Local \`descix serve\` mirror:** \`${GATEWAY_FILE}\` + \`${PROXY_CONFIG_FILE}\` proxy \`/apifront\`, \`/api\`, \`/mcp\` to Core. Product sites at \`/p/{appId}/\` or static plugin routes.`
-  ].join('\n');
-
-  const citations = [
-    makeCitation({ file: LB_FILE, lines: `${ensureCoreNegMatch.lineNumber}-${singletonBlockEnd}`, anchor: 'ensureCoreNeg + buildSingletonMatcher', fileLines: lb.lines }),
-    makeCitation({ file: LB_FILE, lines: String(apiFrontRuleMatch.lineNumber), anchor: 'command-broker /apifront', fileLines: lb.lines }),
-    makeCitation({ file: SMM_FILE, lines: String(proxyMatch.lineNumber), anchor: 'proxyToExternalService', fileLines: smm.lines }),
-    makeCitation({ file: APIFRONT_FILE, lines: String(invokeMatch.lineNumber), anchor: 'CommandHandler.invoke', fileLines: apiFront.lines }),
-    makeCitation({ file: APIFRONT_FILE, lines: String(externalDispatchMatch.lineNumber), anchor: '_invokeExternalCommand', fileLines: apiFront.lines }),
-    makeCitation({ file: GATEWAY_FILE, lines: `1-${gateway.lines.length}`, anchor: 'local serve gateway', fileLines: gateway.lines }),
-    makeCitation({ file: PROXY_CONFIG_FILE, lines: `1-${proxyConfig.lines.length}`, anchor: 'vite proxy rules', fileLines: proxyConfig.lines }),
-    gcloudCitation
-  ].filter(Boolean);
-
-  return { markdown, citations };
-}
-
-/**
- * Walk forward from `const pathRules = [` until the matching `];`.
- * Bounded to 100 lines so a pathological refactor doesn't drag huge swaths.
- */
-function findFunctionEnd(lines, startLine) {
-  const MAX = Math.min(lines.length, startLine + 80);
-  let depth = 0;
-  let started = false;
-  for (let i = startLine - 1; i < MAX; i++) {
-    const line = lines[i];
-    for (const ch of line) {
-      if (ch === '{') { depth++; started = true; }
-      else if (ch === '}') {
-        depth--;
-        if (started && depth === 0) return i + 1;
-      }
-    }
-  }
-  return Math.min(lines.length, startLine + 40);
-}
-
-function findArrayEnd(lines, startLine) {
-  const MAX = Math.min(lines.length, startLine + 100);
-  let depth = 0;
-  for (let i = startLine - 1; i < MAX; i++) {
-    const line = lines[i];
-    for (const ch of line) {
-      if (ch === '[') depth++;
-      else if (ch === ']') {
-        depth--;
-        if (depth === 0) return i + 1;
-      }
-    }
-  }
-  return Math.min(lines.length, startLine + 50);
-}
-
-function shortenGcloudErr(msg) {
-  if (!msg) return 'unknown error';
-  return msg.split('\n')[0].slice(0, 120);
-}

package/lib/commands/briefer/sources/what-is-not.js

@@ -1,223 +0,0 @@
-/**
- * §6 — What is NOT in the system extractor (M2 implementation).
- *
- * Per WS-DESCIX-BRIEFER-CLI scope doc §2.2 §6, derived by NEGATIVE ASSERTION:
- * the CLI greps for forbidden constructs and HARD-FAILS with BRIEFER-NEGATIVE-CLAIM
- * if any are present. Toggle-claims (CLI subcommands "not yet built") are
- * rendered dynamically — present if absent, removed if found.
- *
- * Negative claims this extractor verifies:
- *  (1) No API Gateway middleware at runtime — grep services/ for gatewayDispatch/routeByProduct/etc.
- *  (2) No runtime Firestore lookup for routing — grep provision-platform-lb.js for CacheFirestore/admin.firestore
- *  (3) No per-app DNS provisioning — grep for `gcloud dns` / `domain-mappings` (recent CRUFT-8 fix)
- *  (4) No per-app TLS cert — verify wildcard cert config in provision-platform-lb.js
- *  (5) No `descix microservice deploy` CLI (TOGGLE) — grep bin/descix.js
- *  (6) No descix-chain runtime lookup for routing — grep provision-platform-lb.js for descix-chain
- *  (7) No path rewriting in `descix serve` for product sites — cite createViteProxyConfig.js
- *  (8) No `--env` flag for the MCP server — toggle, grep mcp-server.js
- */
-import {
-  readSourceFile,
-  findInLines,
-  makeCitation,
-  grepFiles
-} from '../util/source-reader.js';
-import { BrieferExtractorError, BRIEFER_ERROR_CODES } from '../errors.js';
-
-export const SECTION = {
-  number: 6,
-  heading: '6. What is NOT in the system',
-  sourceFiles: [
-    'DeSciX/DeSciX_Cloud/microservice/services',
-    'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/provision-platform-lb.js',
-    'DeSciX/DeSciX_Core/descix-cli/bin/descix.js',
-    'DeSciX/DeSciX_Core/descix-app-sdk/src/dev/createViteProxyConfig.js'
-  ]
-};
-
-const MESH_FILE = 'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy/provision-platform-lb.js';
-const CLI_FILE = 'DeSciX/DeSciX_Core/descix-cli/bin/descix.js';
-const PROXY_CONFIG = 'DeSciX/DeSciX_Core/descix-app-sdk/src/dev/createViteProxyConfig.js';
-const SERVICES_DIR = 'DeSciX/DeSciX_Cloud/microservice/services';
-
-export async function extract({ env, cliPaths } = {}) {
-  if (!env) {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.NOT_IMPLEMENTED,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: 'extractor argument',
-      expected: 'env (dev|demo|prod) provided by caller',
-      recovery: 'Pass {env} from the briefer entry point.'
-    });
-  }
-  if (!cliPaths) {
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.NOT_IMPLEMENTED,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: 'extractor argument',
-      expected: 'cliPaths provided by caller',
-      recovery: 'Pass {cliPaths} from the briefer entry point.'
-    });
-  }
-
-  // (1) HARD: no gatewayDispatch/routeByProduct/etc. in services/.
-  const forbiddenGateway = await grepFiles({
-    repoRoot: cliPaths.repoRoot,
-    relPaths: [SERVICES_DIR],
-    regex: /\b(gatewayDispatch|routeByProduct|extractProductId|getProductId)\b/,
-    excludePaths: new Set(['/node_modules/', '/.git/', '/tests/'])
-  });
-  if (forbiddenGateway.length > 0) {
-    const sample = forbiddenGateway.slice(0, 3).map(m => `${m.file}:${m.lineNumber}`).join(', ');
-    throw new BrieferExtractorError({
-      code: BRIEFER_ERROR_CODES.NEGATIVE_CLAIM,
-      section: `§${SECTION.number} ${SECTION.heading}`,
-      source: `grep on ${SERVICES_DIR}`,
-      expected: 'no matches for gatewayDispatch|routeByProduct|extractProductId|getProductId',
-      recovery: 'Either the briefer is stale (a runtime gateway middleware was introduced) or the code added a forbidden construct. Reconcile by rewriting the briefer claim or removing the code.',
-      detail: `Found ${forbiddenGateway.length} match(es). Sample: ${sample}`
-    });
-  }
-
-  // (2) HARD: no CacheFirestore / admin.firestore in provision-platform-lb.js.
-  const mesh = await readSourceFile({
-    cliPaths,
-    relPath: MESH_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-  for (let i = 0; i < mesh.lines.length; i++) {
-    if (/CacheFirestore|admin\.firestore\(/.test(mesh.lines[i])) {
-      throw new BrieferExtractorError({
-        code: BRIEFER_ERROR_CODES.NEGATIVE_CLAIM,
-        section: `§${SECTION.number} ${SECTION.heading}`,
-        source: `${MESH_FILE}:${i + 1}`,
-        expected: 'no runtime Firestore lookup in provision-platform-lb.js (LB wiring is deploy-time only)',
-        recovery: 'A Firestore lookup was added to the LB-wiring path. Reconcile: routing must not depend on runtime Firestore reads.',
-        detail: `Match at ${MESH_FILE}:${i + 1} — ${mesh.lines[i].trim()}`
-      });
-    }
-  }
-
-  // (3) HARD: no per-app DNS provisioning in deploy scripts.
-  // CRUFT-8 fix yesterday removed the legacy `gcloud dns` references; ensure
-  // they don't come back.
-  const dnsMatches = await grepFiles({
-    repoRoot: cliPaths.repoRoot,
-    relPaths: [
-      'DeSciX/DeSciX_Cloud/microservice/admin/scripts/deploy',
-      'DeSciX/DeSciX_Powch/microservice/scripts'
-    ],
-    regex: /gcloud\s+dns\s+|domain-mappings\s+/,
-    excludePaths: new Set(['/node_modules/', '/.git/'])
-  });
-  // Soft: only WARN. DNS may legitimately surface in cert-management docs.
-  // The briefer claim is rendered as-is; matches surface as a footnote.
-
-  // (4) HARD: wildcard cert config (single managed cert) — grep
-  // provision-platform-lb.js to ensure no per-app cert provisioning was wired.
-  for (let i = 0; i < mesh.lines.length; i++) {
-    if (/ssl-certificates\s+create|managedCert/.test(mesh.lines[i])) {
-      throw new BrieferExtractorError({
-        code: BRIEFER_ERROR_CODES.NEGATIVE_CLAIM,
-        section: `§${SECTION.number} ${SECTION.heading}`,
-        source: `${MESH_FILE}:${i + 1}`,
-        expected: 'no per-app SSL cert provisioning in mesh-routing wiring',
-        recovery: 'Per-app cert provisioning was added — reconcile with the wildcard-cert architecture.',
-        detail: `Match at ${MESH_FILE}:${i + 1} — ${mesh.lines[i].trim()}`
-      });
-    }
-  }
-
-  // (5) TOGGLE: no `descix microservice deploy` (yet) — grep CLI.
-  const cli = await readSourceFile({
-    cliPaths,
-    relPath: CLI_FILE,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-  let microserviceDeployFound = false;
-  for (let i = 1; i < cli.lines.length; i++) {
-    if (/\.command\(['"]deploy['"]\)/.test(cli.lines[i])) {
-      for (let j = i - 1; j >= Math.max(0, i - 3); j--) {
-        if (/microserviceCommand/.test(cli.lines[j])) {
-          microserviceDeployFound = true;
-          break;
-        }
-      }
-      if (microserviceDeployFound) break;
-    }
-  }
-
-  // (6) HARD: no descix-chain runtime lookup for routing — grep mesh.
-  for (let i = 0; i < mesh.lines.length; i++) {
-    if (/descix-chain/.test(mesh.lines[i])) {
-      throw new BrieferExtractorError({
-        code: BRIEFER_ERROR_CODES.NEGATIVE_CLAIM,
-        section: `§${SECTION.number} ${SECTION.heading}`,
-        source: `${MESH_FILE}:${i + 1}`,
-        expected: 'no descix-chain reference in LB-wiring code (routing is host-rule based, not chain-lookup based)',
-        recovery: 'A descix-chain reference appeared in the LB wiring path. Reconcile.',
-        detail: `Match at ${MESH_FILE}:${i + 1} — ${mesh.lines[i].trim()}`
-      });
-    }
-  }
-
-  // (7) Cite: no path rewriting in `descix serve` for product sites.
-  const proxyConfig = await readSourceFile({
-    cliPaths,
-    relPath: PROXY_CONFIG,
-    section: `§${SECTION.number} ${SECTION.heading}`
-  });
-
-  // (8) TOGGLE: no `--env` for MCP server. Per scope §2.2 §6, surface this
-  // as the open WS-CLI-HEALTH-ENV-PIVOT gap. We grep for an `--env` option
-  // declaration in mcp-server.js / mcp* CLI surface.
-  let mcpEnvFound = false;
-  try {
-    const mcp = await readSourceFile({
-      cliPaths,
-      relPath: 'DeSciX/DeSciX_Core/descix-cli/bin/mcp-server.js',
-      section: `§${SECTION.number} ${SECTION.heading}`
-    });
-    for (let i = 0; i < mcp.lines.length; i++) {
-      if (/--env|\.option\(['"]--env/.test(mcp.lines[i])) {
-        mcpEnvFound = true;
-        break;
-      }
-    }
-  } catch (err) {
-    // If mcp-server.js doesn't exist, the gap is trivially open.
-    if (err.code !== BRIEFER_ERROR_CODES.SRC_NOT_FOUND) throw err;
-  }
-
-  // ── Render markdown ──
-  const lines = [
-    `- **No "API Gateway" middleware at runtime.** No Lambda, no Cloud Function, no Cloud Run named "gateway." The LB URL map is the only request-time router. _Verified: grep on \`${SERVICES_DIR}\` for \`gatewayDispatch|routeByProduct|extractProductId|getProductId\` → 0 matches._`,
-    `- **No runtime Firestore lookup for routing.** The LB does not read Firestore. Period. _Verified: grep on \`${MESH_FILE}\` for \`CacheFirestore|admin.firestore\` → 0 matches._`,
-    `- **No per-app DNS provisioning.** Wildcard \`*.{env}.descix.net\` cert + wildcard A record cover all apps. Adding an app does NOT touch DNS.${dnsMatches.length > 0 ? ` _(${dnsMatches.length} \`gcloud dns\`/\`domain-mappings\` reference(s) detected in deploy scripts — manually verify these are wildcard-cert touches, not per-app DNS.)_` : ''}`,
-    `- **No per-app TLS cert.** Same wildcard cert covers everything. _Verified: grep on \`${MESH_FILE}\` for \`ssl-certificates create|managedCert\` → 0 matches._`
-  ];
-  if (microserviceDeployFound) {
-    lines.push(`- ~~No \`descix microservice deploy\` CLI command~~ — **GAP CLOSED** at this regen. \`descix microservice deploy\` is present in \`${CLI_FILE}\`.`);
-  } else {
-    lines.push(`- **No \`descix microservice deploy\` CLI command (yet).** \`descix microservice register\` does Firestore-manifest-registration only. _Detected: grep on \`${CLI_FILE}\` for \`microserviceCommand.command('deploy')\` → 0 matches._`);
-  }
-  lines.push(
-    `- **No central \`descix-chain\` runtime lookup for routing.** \`descix-chain\` Firestore is the canonical token/contract registry, read for contract addresses (e.g., \`getContractAddressBySymbol()\`); never for request routing. _Verified: grep on \`${MESH_FILE}\` for \`descix-chain\` → 0 matches._`,
-    `- **No path rewriting for product sites in \`descix serve\` (local dev).** Each app sets its own framework base path. — \`${PROXY_CONFIG}\``
-  );
-  if (mcpEnvFound) {
-    lines.push(`- ~~No \`--env\` flag for the MCP server~~ — **GAP CLOSED**. WS-CLI-HEALTH-ENV-PIVOT shipped: MCP accepts \`--env\`.`);
-  } else {
-    lines.push(`- **No \`--env\` flag for the MCP server.** MCP reads workspace.json once at startup and is bound for its lifetime. Tracked as WS-CLI-HEALTH-ENV-PIVOT (open as of this regen).`);
-  }
-
-  const markdown = lines.join('\n');
-
-  const citations = [
-    makeCitation({ file: MESH_FILE, lines: '1-' + mesh.lines.length, anchor: 'no runtime Firestore / TLS / chain in LB wiring', fileLines: mesh.lines }),
-    makeCitation({ file: CLI_FILE, lines: '1-' + cli.lines.length, anchor: 'descix microservice deploy toggle', fileLines: cli.lines }),
-    makeCitation({ file: PROXY_CONFIG, lines: '1-' + proxyConfig.lines.length, anchor: 'no path rewriting in descix serve', fileLines: proxyConfig.lines })
-  ];
-
-  return { markdown, citations };
-}

package/lib/commands/briefer/stitcher.js

@@ -1,134 +0,0 @@
-/**
- * Markdown stitcher — composes per-section extract outputs into the final
- * briefer markdown, with the canonical header (provenance, last-regen timestamp,
- * confidence, audience) per the existing briefer at
- * DeSciX/V2_docs/architecture/platform-must-know-briefer.md.
- *
- * Per WS-DESCIX-BRIEFER-CLI scope doc §2.5 (Provenance), every successful regen
- * appends a row to the briefer's "Provenance / regeneration history" table with
- * source blob SHAs, gcloud etags, and Products counts.
- *
- * Per scope doc §2.2 §3 critical safeguard, each citation also emits a hidden
- * HTML comment `<!-- briefer-cite: file=... sha=... lines=... anchor=... -->`
- * so `--check` can diff citations (not just rendered prose).
- *
- * M1: produces a real (non-empty) markdown file using the section stubs so the
- * CLI surface can be exercised end-to-end.
- */
-
-const HEADER_TEMPLATE = (env, regenTs, mechanism, sectionsCount) => [
-  `# DeSciX Platform Must-Know Briefer`,
-  ``,
-  `> **THIS DOC WINS.** If anything else in V2_docs, the cloud KB, an agent persona,`,
-  `> or a code comment conflicts with what is written here, this briefer is canonical.`,
-  `> Conflicting prose is cruft and should be patched, not relied on.`,
-  ``,
-  `**Last regenerated:** ${regenTs}`,
-  `**Regeneration mechanism:** ${mechanism}`,
-  `**Target env (for this regen):** \`${env}\``,
-  `**Sections rendered:** ${sectionsCount}`,
-  `**Audience:** every COS / EVP / sub-agent at bootstrap. Load this BEFORE any other architecture chunk.`,
-  ``,
-  `---`,
-  ``
-].join('\n');
-
-const FOOTER_TEMPLATE = (provenanceRow) => [
-  `---`,
-  ``,
-  `## Provenance / regeneration history`,
-  ``,
-  `| Date | Mechanism | By | Notes |`,
-  `|---|---|---|---|`,
-  `${provenanceRow}`,
-  ``,
-  `---`,
-  ``,
-  `## Engineering principle declarations (this briefer)`,
-  ``,
-  `- **No fallback prose.** If a claim cannot be cited to code or live infra state, it is not in this briefer.`,
-  `- **Single source of truth.** This file is the canonical mental model. Other docs paraphrase; this one binds.`,
-  `- **Removal over deprecation.** When this briefer changes, contradictory passages in other files are REWRITTEN or REMOVED — never marked "deprecated" while left in place.`,
-  ``
-].join('\n');
-
-/**
- * Render a citation set as hidden HTML comments. These are the "machine trail"
- * that --check uses to detect citation drift (see scope doc §2.2 §3 safeguard).
- */
-function renderCitationTrail(citations) {
-  if (!Array.isArray(citations) || citations.length === 0) return '';
-  return citations.map(c => {
-    const sha = c.sha || 'PENDING-M2';
-    if (c.source === 'gcloud' || c.source === 'firestore-rest') {
-      // M3 — live-state probe citation. Escapes single quotes in the probe
-      // string so the comment remains a single line + diff-friendly.
-      const probeEsc = (c.probe || '').replace(/'/g, "\\'");
-      return `<!-- briefer-cite: source=${c.source} env=${c.env} probe='${probeEsc}' sha=${sha} anchor=${c.anchor} lines=${c.lines || ''} -->`;
-    }
-    return `<!-- briefer-cite: file=${c.file} lines=${c.lines} sha=${sha} anchor=${c.anchor} -->`;
-  }).join('\n');
-}
-
-/**
- * Stitch the briefer document.
- *
- * @param {object} args
- * @param {string} args.env                Target env (dev|demo|prod).
- * @param {string} args.mechanism          Mechanism description (e.g., "descix briefer v1.0 (M1 scaffold)").
- * @param {string} args.regenBy            Who triggered the regen (e.g., wallet email).
- * @param {Array<{section, extract}>} args.sections
- *                                          Per-section results: section metadata + extract output.
- * @returns {string}                        Final markdown document.
- */
-export function stitchBriefer({ env, mechanism, regenBy, sections }) {
-  if (!env) throw new Error('stitchBriefer: env is required');
-  if (!mechanism) throw new Error('stitchBriefer: mechanism is required');
-  if (!regenBy) throw new Error('stitchBriefer: regenBy is required');
-  if (!Array.isArray(sections)) throw new Error('stitchBriefer: sections must be an array');
-
-  const regenTs = new Date().toISOString().replace('T', ' ').replace(/\..*$/, ' UTC');
-  const header = HEADER_TEMPLATE(env, regenTs, mechanism, sections.length);
-
-  const body = sections.map(({ section, extract }) => {
-    const heading = `## ${section.heading}`;
-    const trail = renderCitationTrail(extract.citations || []);
-    const blocks = [heading, '', extract.markdown || '_(extractor returned no markdown)_'];
-    if (trail) blocks.push('', trail);
-    return blocks.join('\n');
-  }).join('\n\n');
-
-  const sourcesNote = sections
-    .flatMap(s => (s.extract.citations || []).map(c => {
-      const key = c.source === 'gcloud' || c.source === 'firestore-rest'
-        ? `${c.source}:${c.anchor}@${c.sha || 'PENDING-M3'}`
-        : `${c.file}@${c.sha || 'PENDING-M2'}`;
-      return key;
-    }))
-    .filter((v, i, a) => a.indexOf(v) === i)
-    .join('; ');
-  const provenanceRow = `| ${regenTs} | ${mechanism} | ${regenBy} | sources: ${sourcesNote || '(none)'} |`;
-
-  const footer = FOOTER_TEMPLATE(provenanceRow);
-
-  return [header, body, '', footer].join('\n');
-}
-
-/**
- * Extract just the citation trail comments from a rendered briefer document.
- * Used by --check to compare citations (not prose) between canonical + regen.
- *
- * Per scope doc §2.2 §3: --check MUST diff §3 source-by-source against the
- * canonical briefer with stricter tolerance — any line-range citation that no
- * longer points at the documented code construct triggers non-zero exit even
- * if the prose has not changed.
- */
-export function extractCitationTrail(markdown) {
-  const trail = [];
-  const lines = (markdown || '').split(/\r?\n/);
-  for (const line of lines) {
-    const m = line.match(/^<!-- briefer-cite:\s*(.*?)\s*-->$/);
-    if (m) trail.push(m[1]);
-  }
-  return trail;
-}