@formigio/fazemos-cli 0.10.67 → 0.10.75

package/dist/preflight/row1_member.js

@@ -0,0 +1,64 @@
+/**
+ * F53 Row 1 — Agent member exists in org with the target role_slug.
+ *
+ * Data source: GET /api/organizations/:orgId/members?type=agent
+ * Checks: (a) an agent member named agentName exists, (b) role_slug ∈ agent_config.roles.
+ */
+import { api } from '../api.js';
+/**
+ * Normalize a display name for fuzzy matching (case-insensitive, collapse separators).
+ */
+function normName(s) {
+    return s.toLowerCase().replace(/[-_\s]+/g, ' ').trim();
+}
+export async function checkRow1Member(orgId, agentName, roleSlug) {
+    const base = { id: '1', name: 'agent member + credential' };
+    try {
+        const data = (await api('GET', `/api/organizations/${orgId}/members?type=agent`, undefined, { noProjectHeader: true }));
+        const members = data.members ?? [];
+        const agent = members.find((m) => m.member_type === 'agent' && normName(m.display_name) === normName(agentName));
+        if (!agent) {
+            return {
+                ...base,
+                status: 'fail',
+                detail: `No agent member named '${agentName}' found in org (${members.filter((m) => m.member_type === 'agent').length} total agents).`,
+                fix_command: `fazemos agents register --name "${agentName}" --model sonnet`,
+            };
+        }
+        const roles = agent.agent_config?.roles ?? [];
+        if (!roles.includes(roleSlug)) {
+            return {
+                ...base,
+                status: 'fail',
+                detail: `Agent '${agentName}' (id=${agent.id}) found but role '${roleSlug}' not in agent_config.roles: [${roles.join(', ') || 'empty'}].`,
+                fix_command: null,
+                fix_instruction: `Update agent '${agentName}' config to include role '${roleSlug}' in its roles array. Re-run: fazemos agents register --name "${agentName}" --roles ${roleSlug}`,
+            };
+        }
+        return {
+            ...base,
+            status: 'pass',
+            detail: `${agentName} (id=${agent.id}), roles=[${roles.join(', ')}]`,
+            fix_command: null,
+        };
+    }
+    catch (err) {
+        if (err?.status === 403 || err?.status === 401) {
+            return {
+                ...base,
+                status: 'tooling_error',
+                detail: 'Access denied — owner/admin role required to list agent members.',
+                fix_command: null,
+                fix_instruction: 'Contact your org admin to grant owner or admin role, then retry.',
+            };
+        }
+        return {
+            ...base,
+            status: 'tooling_error',
+            detail: `API call failed: ${err?.message ?? String(err)}`,
+            fix_command: null,
+            fix_instruction: 'Check your Fazemos API credentials and active org, then retry.',
+        };
+    }
+}
+//# sourceMappingURL=row1_member.js.map

package/dist/preflight/row1_member.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row1_member.js","sourceRoot":"","sources":["../../src/preflight/row1_member.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAchC;;GAEG;AACH,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,SAAiB,EACjB,QAAgB;IAEhB,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,sBAAsB,KAAK,qBAAqB,EAChD,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CAA8B,CAAC;QAEhC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CACrF,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,0BAA0B,SAAS,mBAAmB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,MAAM,iBAAiB;gBACtI,WAAW,EAAE,mCAAmC,SAAS,kBAAkB;aAC5E,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,UAAU,SAAS,SAAS,KAAK,CAAC,EAAE,qBAAqB,QAAQ,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI;gBACzI,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,iBAAiB,SAAS,6BAA6B,QAAQ,iEAAiE,SAAS,aAAa,QAAQ,EAAE;aAClL,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,SAAS,QAAQ,KAAK,CAAC,EAAE,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACpE,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/C,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,kEAAkE;gBAC1E,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,kEAAkE;aACpF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,oBAAoB,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE;YACzD,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,gEAAgE;SAClF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/preflight/row2_roleRegistration.d.ts

@@ -0,0 +1,18 @@
+/**
+ * F53 Row 2 — role_registrations row exists, active, and bound to the correct
+ * (org_id, project_id). Also verifies resolver-key parity (r3 D8).
+ *
+ * Data source: GET /api/role-registrations/lookup?workspace=&role_slug=&org_id=<uuid>
+ * Outcome: PASS | FAIL(no_registration) | FAIL(bound_elsewhere) |
+ *           FAIL(resolver_ambiguous) | FAIL(resolver_mismatch)
+ */
+import type { PreflightRow } from './schema.js';
+export declare function checkRow2RoleRegistration(opts: {
+    workspace: string;
+    roleSlug: string;
+    orgId: string;
+    projectId: string | null;
+    orgSlug: string;
+    projectSlug: string;
+    env: string;
+}): Promise<PreflightRow>;

package/dist/preflight/row2_roleRegistration.js

@@ -0,0 +1,156 @@
+/**
+ * F53 Row 2 — role_registrations row exists, active, and bound to the correct
+ * (org_id, project_id). Also verifies resolver-key parity (r3 D8).
+ *
+ * Data source: GET /api/role-registrations/lookup?workspace=&role_slug=&org_id=<uuid>
+ * Outcome: PASS | FAIL(no_registration) | FAIL(bound_elsewhere) |
+ *           FAIL(resolver_ambiguous) | FAIL(resolver_mismatch)
+ */
+import { api } from '../api.js';
+export async function checkRow2RoleRegistration(opts) {
+    const { workspace, roleSlug, orgId, projectId, orgSlug, projectSlug, env } = opts;
+    const base = { id: '2', name: 'role_registrations row' };
+    try {
+        const params = new URLSearchParams({ workspace, role_slug: roleSlug, org_id: orgId });
+        const data = (await api('GET', `/api/role-registrations/lookup?${params.toString()}`, undefined, { noProjectHeader: true }));
+        const reg = data.registration;
+        const candidates = data.resolver_candidates ?? null;
+        const resolverDeterministic = data.resolver_deterministic ?? false;
+        // ── No row or soft-deleted ──────────────────────────────────────────────
+        if (!data.found || !reg || !reg.active) {
+            const projFlag = projectId ? ` --project-id ${projectSlug}` : '';
+            return {
+                ...base,
+                status: 'fail',
+                variant: 'no_registration',
+                detail: `No active role_registrations row for workspace='${workspace}', role_slug='${roleSlug}'.${!data.found ? '' : ' Row exists but active=false.'}`,
+                fix_command: `cd <workspace-repo> && fazemos --env ${env} roles sync --org-id ${orgSlug}${projFlag}`,
+            };
+        }
+        // ── Bound to different (org, project) ───────────────────────────────────
+        const sameOrg = reg.org_id === orgId;
+        const sameProject = projectId ? reg.project_id === projectId : true;
+        if (!sameOrg || !sameProject) {
+            return {
+                ...base,
+                status: 'fail',
+                variant: 'bound_elsewhere',
+                detail: `Row exists but bound to org=${reg.org_slug}, project=${reg.project_slug ?? 'null'} (caller wants org=${orgSlug}, project=${projectSlug}).`,
+                bound_to: {
+                    org_slug: reg.org_slug,
+                    org_id: reg.org_id,
+                    project_slug: reg.project_slug,
+                    project_id: reg.project_id,
+                },
+                fix_command: null,
+                fix_instruction: `role_registrations row for (workspace='${workspace}', role_slug='${roleSlug}') is already bound ` +
+                    `to org=${reg.org_slug}, project=${reg.project_slug ?? 'null'}. ` +
+                    `UNIQUE (workspace, role_slug) prevents holding both bindings — a sync attempt from ` +
+                    `a different project would clobber the current binding, not add a second one. ` +
+                    `See ROLE-REGISTRY-PROJECT-ADDRESSABILITY. ` +
+                    `If you meant to migrate the binding, deactivate the old row first ` +
+                    `(fazemos roles set-inactive --workspace ${workspace} --role-slug ${roleSlug}) ` +
+                    `then re-run from the target project.`,
+            };
+        }
+        // ── Resolver-parity checks (r3) ─────────────────────────────────────────
+        if (candidates === null) {
+            // API is pre-r3 — degrade gracefully to r2 tri-state PASS
+            return {
+                ...base,
+                status: 'pass',
+                detail: `${reg.filler_identity}, active=true, bound=(org=${orgSlug}, project=${projectSlug}). Resolver parity check unavailable (API may be pre-r3).`,
+                fix_command: null,
+                resolver_parity_unavailable: true,
+            };
+        }
+        // FAIL: ambiguous — N > 1 candidates for (role_slug, org_id) with no ORDER BY
+        if (candidates.length > 1) {
+            const candidateList = candidates
+                .map((c) => `${c.workspace} → ${c.project_slug ?? 'null'}`)
+                .join(', ');
+            return {
+                ...base,
+                status: 'fail',
+                variant: 'resolver_ambiguous',
+                detail: `${candidates.length} active role_registrations rows for (role_slug='${roleSlug}', org_id=${orgSlug}); resolver picks nondeterministically.`,
+                resolver_candidates: candidates,
+                resolver_deterministic: resolverDeterministic,
+                fix_command: null,
+                fix_instruction: `${candidates.length} active role_registrations rows exist for ` +
+                    `(role_slug='${roleSlug}', org_id=${orgSlug}), with candidates [${candidateList}]. ` +
+                    `Dispatch resolution (dispatchesService.ts:345, :356, :1003, :1050) has no ORDER BY ` +
+                    `and picks nondeterministically. ` +
+                    `See ROLE-REGISTRY-PROJECT-ADDRESSABILITY (Stage 1 = resolver determinism, ` +
+                    `Stage 0 = data repair for existing duplicates). F53 detects only.`,
+            };
+        }
+        // FAIL: mismatch — the schema-key row is not the one dispatch would pick
+        if (candidates.length === 1 && candidates[0].id !== reg.id) {
+            return {
+                ...base,
+                status: 'fail',
+                variant: 'resolver_mismatch',
+                detail: `Schema-key row (id=${reg.id}) ≠ resolver-candidate row (id=${candidates[0].id}).`,
+                resolver_candidates: candidates,
+                resolver_deterministic: resolverDeterministic,
+                fix_command: null,
+                fix_instruction: `role_registrations row (workspace='${workspace}', role_slug='${roleSlug}') hit by the schema key ` +
+                    `does not match the row dispatch would resolve for (role_slug='${roleSlug}', org_id=${orgSlug}). ` +
+                    `Schema row: id=${reg.id}, workspace=${reg.workspace}, project=${reg.project_slug ?? 'null'}. ` +
+                    `Resolver row: id=${candidates[0].id}, workspace=${candidates[0].workspace}, ` +
+                    `project=${candidates[0].project_slug ?? 'null'}. ` +
+                    `See ROLE-REGISTRY-PROJECT-ADDRESSABILITY. F53 detects only.`,
+            };
+        }
+        // ── PASS ────────────────────────────────────────────────────────────────
+        const resolverNote = candidates.length === 0
+            ? ' (no resolver candidates — resolver would not resolve this role)'
+            : ` resolver deterministic: ${resolverDeterministic}`;
+        return {
+            ...base,
+            status: 'pass',
+            detail: `${reg.filler_identity}, active=true, bound=(org=${orgSlug}, project=${projectSlug}).${resolverNote}`,
+            fix_command: null,
+            resolver_candidates: candidates.length > 0 ? candidates : undefined,
+            resolver_deterministic: resolverDeterministic,
+        };
+    }
+    catch (err) {
+        if (err?.status === 403 || err?.status === 401) {
+            return {
+                ...base,
+                status: 'tooling_error',
+                detail: 'Access denied — owner/admin role required for role_registrations lookup.',
+                fix_command: null,
+                fix_instruction: 'Contact your org admin to grant owner or admin role, then retry.',
+            };
+        }
+        // 404 on this specific endpoint means it is not deployed on this env yet.
+        // Rule rul_f53_row2_404_is_tooling_error (AC13): a 404 from the lookup endpoint is
+        // TOOLING-ERROR (exit 2), NOT FAIL(no_registration). An unverifiable row must never
+        // carry an executable fix — roles sync upserts on (workspace, role_slug) and can
+        // silently clobber a working binding whose status cannot be confirmed (rul_f53_row2_clobber_guard).
+        if (err?.status === 404) {
+            return {
+                ...base,
+                status: 'tooling_error',
+                detail: `GET /api/role-registrations/lookup returned HTTP 404 — ` +
+                    `the endpoint is not yet deployed on env '${env}'. ` +
+                    `The row_registrations row may already exist; it cannot be verified until the endpoint is deployed. ` +
+                    `Running roles sync against an unverified binding risks clobber (rul_f53_row2_clobber_guard).`,
+                fix_command: null,
+                fix_instruction: `Deploy the updated fazemos-api to env '${env}' (the /api/role-registrations/lookup endpoint ` +
+                    `must be present), then re-run: fazemos --env ${env} agents preflight ${orgSlug}/${projectSlug}/${roleSlug}`,
+            };
+        }
+        return {
+            ...base,
+            status: 'tooling_error',
+            detail: `API call failed: ${err?.message ?? String(err)}`,
+            fix_command: null,
+            fix_instruction: 'Check your Fazemos API credentials and active org, then retry.',
+        };
+    }
+}
+//# sourceMappingURL=row2_roleRegistration.js.map

package/dist/preflight/row2_roleRegistration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row2_roleRegistration.js","sourceRoot":"","sources":["../../src/preflight/row2_roleRegistration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AA2BhC,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAQ/C;IACC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAClF,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IAEzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,kCAAkC,MAAM,CAAC,QAAQ,EAAE,EAAE,EACrD,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CAAmB,CAAC;QAErB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;QAC9B,MAAM,UAAU,GAA+B,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;QAChF,MAAM,qBAAqB,GAAG,IAAI,CAAC,sBAAsB,IAAI,KAAK,CAAC;QAEnE,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,iBAAiB;gBAC1B,MAAM,EAAE,mDAAmD,SAAS,iBAAiB,QAAQ,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,+BAA+B,EAAE;gBACtJ,WAAW,EAAE,wCAAwC,GAAG,wBAAwB,OAAO,GAAG,QAAQ,EAAE;aACrG,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC;QACrC,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,iBAAiB;gBAC1B,MAAM,EAAE,+BAA+B,GAAG,CAAC,QAAQ,aAAa,GAAG,CAAC,YAAY,IAAI,MAAM,sBAAsB,OAAO,aAAa,WAAW,IAAI;gBACnJ,QAAQ,EAAE;oBACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;iBAC3B;gBACD,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,0CAA0C,SAAS,iBAAiB,QAAQ,sBAAsB;oBAClG,UAAU,GAAG,CAAC,QAAQ,aAAa,GAAG,CAAC,YAAY,IAAI,MAAM,IAAI;oBACjE,qFAAqF;oBACrF,+EAA+E;oBAC/E,4CAA4C;oBAC5C,oEAAoE;oBACpE,2CAA2C,SAAS,gBAAgB,QAAQ,IAAI;oBAChF,sCAAsC;aACzC,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,0DAA0D;YAC1D,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,GAAG,GAAG,CAAC,eAAe,6BAA6B,OAAO,aAAa,WAAW,2DAA2D;gBACrJ,WAAW,EAAE,IAAI;gBACjB,2BAA2B,EAAE,IAAI;aAClC,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,aAAa,GAAG,UAAU;iBAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;iBAC1D,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,mDAAmD,QAAQ,aAAa,OAAO,yCAAyC;gBACpJ,mBAAmB,EAAE,UAAU;gBAC/B,sBAAsB,EAAE,qBAAqB;gBAC7C,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,GAAG,UAAU,CAAC,MAAM,4CAA4C;oBAChE,eAAe,QAAQ,aAAa,OAAO,uBAAuB,aAAa,KAAK;oBACpF,qFAAqF;oBACrF,kCAAkC;oBAClC,4EAA4E;oBAC5E,mEAAmE;aACtE,CAAC;QACJ,CAAC;QAED,yEAAyE;QACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;YAC3D,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE,sBAAsB,GAAG,CAAC,EAAE,kCAAkC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI;gBAC1F,mBAAmB,EAAE,UAAU;gBAC/B,sBAAsB,EAAE,qBAAqB;gBAC7C,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,sCAAsC,SAAS,iBAAiB,QAAQ,2BAA2B;oBACnG,iEAAiE,QAAQ,aAAa,OAAO,KAAK;oBAClG,kBAAkB,GAAG,CAAC,EAAE,eAAe,GAAG,CAAC,SAAS,aAAa,GAAG,CAAC,YAAY,IAAI,MAAM,IAAI;oBAC/F,oBAAoB,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI;oBAC9E,WAAW,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,IAAI;oBACnD,6DAA6D;aAChE,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC;YAC1C,CAAC,CAAC,kEAAkE;YACpE,CAAC,CAAC,4BAA4B,qBAAqB,EAAE,CAAC;QACxD,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,GAAG,GAAG,CAAC,eAAe,6BAA6B,OAAO,aAAa,WAAW,KAAK,YAAY,EAAE;YAC7G,WAAW,EAAE,IAAI;YACjB,mBAAmB,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACnE,sBAAsB,EAAE,qBAAqB;SAC9C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;YAC/C,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,0EAA0E;gBAClF,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,kEAAkE;aACpF,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,mFAAmF;QACnF,oFAAoF;QACpF,iFAAiF;QACjF,oGAAoG;QACpG,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,eAAe;gBACvB,MAAM,EACJ,yDAAyD;oBACzD,4CAA4C,GAAG,KAAK;oBACpD,qGAAqG;oBACrG,8FAA8F;gBAChG,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,0CAA0C,GAAG,iDAAiD;oBAC9F,gDAAgD,GAAG,qBAAqB,OAAO,IAAI,WAAW,IAAI,QAAQ,EAAE;aAC/G,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,oBAAoB,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE;YACzD,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,gEAAgE;SAClF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/preflight/row3_persona.d.ts

@@ -0,0 +1,24 @@
+/**
+ * F53 Row 3a (r3.2) — Effective persona non-empty assertion.
+ *
+ * r3.2 SUPERSEDES r3.1's file-presence check.
+ * Calls GET /api/organizations/:orgId/projects/:projectId/agents/:name
+ * (the existing project-scoped agent detail endpoint, which already applies
+ * the F18 file-layer over the F17 DB systemPrompt per AII Fix 3).
+ * Asserts response.agent.effective_config.systemPrompt.trim().length > 0.
+ *
+ * Three fixture classes (per rul_f53_row3a_verifies_effective_persona):
+ *   (a) DB-only agent (ollie/cass/tessa) — no docs/agents/<name>.md file,
+ *       non-empty DB systemPrompt → PASS. The missing file is HEALTHY
+ *       fall-through; r3.1 false-FAILed here 3× on prod 2026-08-19.
+ *   (b) BUG160 class — docs/agents/<name>.md exists but is empty/whitespace;
+ *       F18 file clobbers DB with "". Effective persona empty → FAIL.
+ *   (c) BUG161 class — no file AND DB empty → FAIL.
+ *   (d) 404 from endpoint → INDETERMINATE (Row 1 catches the member miss).
+ */
+import type { PreflightRow } from './schema.js';
+export declare function checkRow3aPersona(opts: {
+    agentName: string;
+    orgId: string;
+    projectId: string;
+}): Promise<PreflightRow>;

package/dist/preflight/row3_persona.js

@@ -0,0 +1,92 @@
+/**
+ * F53 Row 3a (r3.2) — Effective persona non-empty assertion.
+ *
+ * r3.2 SUPERSEDES r3.1's file-presence check.
+ * Calls GET /api/organizations/:orgId/projects/:projectId/agents/:name
+ * (the existing project-scoped agent detail endpoint, which already applies
+ * the F18 file-layer over the F17 DB systemPrompt per AII Fix 3).
+ * Asserts response.agent.effective_config.systemPrompt.trim().length > 0.
+ *
+ * Three fixture classes (per rul_f53_row3a_verifies_effective_persona):
+ *   (a) DB-only agent (ollie/cass/tessa) — no docs/agents/<name>.md file,
+ *       non-empty DB systemPrompt → PASS. The missing file is HEALTHY
+ *       fall-through; r3.1 false-FAILed here 3× on prod 2026-08-19.
+ *   (b) BUG160 class — docs/agents/<name>.md exists but is empty/whitespace;
+ *       F18 file clobbers DB with "". Effective persona empty → FAIL.
+ *   (c) BUG161 class — no file AND DB empty → FAIL.
+ *   (d) 404 from endpoint → INDETERMINATE (Row 1 catches the member miss).
+ */
+import { api } from '../api.js';
+export async function checkRow3aPersona(opts) {
+    const { agentName, orgId, projectId } = opts;
+    const base = { id: '3a', name: 'persona (effective)' };
+    try {
+        const data = (await api('GET', `/api/organizations/${orgId}/projects/${projectId}/agents/${encodeURIComponent(agentName)}`, undefined, { noProjectHeader: true }));
+        const systemPrompt = data.agent?.effective_config?.systemPrompt ?? '';
+        const trimmed = systemPrompt.trim();
+        if (trimmed.length === 0) {
+            // Distinguish BUG160 class (file exists but empty, clobbers DB) from
+            // BUG161 class (no file and DB empty) when role_doc_path is available.
+            const hasRoleDoc = data.agent?.role_doc_path != null;
+            const roleDocPath = data.agent?.role_doc_path;
+            const fixInstruction = hasRoleDoc
+                ? `The F18 file layer at ${roleDocPath} is empty or whitespace-only and is ` +
+                    `overriding the DB systemPrompt with an empty string. ` +
+                    `Either delete the file to fall through to the DB systemPrompt, ` +
+                    `or author non-empty persona content into it. (BUG160 class)`
+                : `Both the DB systemPrompt and any F18 file-layer override are empty — the agent ` +
+                    `would wake promptless. Set the DB systemPrompt via \`fazemos agents update-config\` ` +
+                    `or author docs/agents/${agentName}.md in the workspace repo with persona content. (BUG161 class)`;
+            return {
+                ...base,
+                status: 'fail',
+                detail: `Effective persona for agent '${agentName}' is empty (trim length 0). ` +
+                    `Agent would wake with no persona.`,
+                fix_command: null,
+                fix_instruction: fixInstruction,
+            };
+        }
+        return {
+            ...base,
+            status: 'pass',
+            detail: `Effective persona for agent '${agentName}' is non-empty ` +
+                `(${trimmed.length} chars after trim). Agent runtime has an operative persona.`,
+            fix_command: null,
+        };
+    }
+    catch (err) {
+        const status = err?.status ?? 0;
+        if (status === 404) {
+            // Agent not registered (or not visible) at this org/project level.
+            // INDETERMINATE: cannot classify the row — Row 1 will separately
+            // report the member miss. Exit contribution: 3 (INCOMPLETE).
+            // Per rul_f53_row_level_indeterminate_state + rul_f53_row3a_verifies_effective_persona.
+            return {
+                ...base,
+                status: 'indeterminate',
+                detail: `Agent '${agentName}' not found (HTTP 404) — effective persona cannot be resolved ` +
+                    `until the agent is registered at this org/project level.`,
+                fix_command: null,
+                fix_instruction: `Ensure the agent member exists first (Row 1 check). Register with: ` +
+                    `\`fazemos agents register\` — then re-run preflight.`,
+            };
+        }
+        if (status === 401 || status === 403) {
+            return {
+                ...base,
+                status: 'tooling_error',
+                detail: `Access denied (HTTP ${status}) when fetching agent '${agentName}'.`,
+                fix_command: null,
+                fix_instruction: 'Check your Fazemos API credentials and org membership, then retry.',
+            };
+        }
+        return {
+            ...base,
+            status: 'tooling_error',
+            detail: `API call failed (HTTP ${status}): ${err?.message ?? String(err)}`,
+            fix_command: null,
+            fix_instruction: 'Check your Fazemos API credentials and active org, then retry.',
+        };
+    }
+}
+//# sourceMappingURL=row3_persona.js.map

package/dist/preflight/row3_persona.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row3_persona.js","sourceRoot":"","sources":["../../src/preflight/row3_persona.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAgBhC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAIvC;IACC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAC7C,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAW,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CACrB,KAAK,EACL,sBAAsB,KAAK,aAAa,SAAS,WAAW,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAC3F,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CAAwB,CAAC;QAE1B,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,YAAY,IAAI,EAAE,CAAC;QACtE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;QAEpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,IAAI,CAAC;YACrD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC;YAC9C,MAAM,cAAc,GAAG,UAAU;gBAC/B,CAAC,CAAC,yBAAyB,WAAW,sCAAsC;oBAC1E,uDAAuD;oBACvD,iEAAiE;oBACjE,6DAA6D;gBAC/D,CAAC,CAAC,iFAAiF;oBACjF,sFAAsF;oBACtF,yBAAyB,SAAS,gEAAgE,CAAC;YAEvG,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,MAAM;gBACd,MAAM,EACJ,gCAAgC,SAAS,8BAA8B;oBACvE,mCAAmC;gBACrC,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,cAAc;aAChC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,gCAAgC,SAAS,iBAAiB;gBAC1D,IAAI,OAAO,CAAC,MAAM,6DAA6D;YACjF,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC;QAEhC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,mEAAmE;YACnE,iEAAiE;YACjE,6DAA6D;YAC7D,wFAAwF;YACxF,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,eAAe;gBACvB,MAAM,EACJ,UAAU,SAAS,gEAAgE;oBACnF,0DAA0D;gBAC5D,WAAW,EAAE,IAAI;gBACjB,eAAe,EACb,qEAAqE;oBACrE,sDAAsD;aACzD,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,uBAAuB,MAAM,0BAA0B,SAAS,IAAI;gBAC5E,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,oEAAoE;aACtF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,yBAAyB,MAAM,MAAM,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE;YAC1E,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,gEAAgE;SAClF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/preflight/row3_playbook.d.ts

@@ -0,0 +1,30 @@
+/**
+ * F53 Row 3b (r3.2) — Cadence-aware playbook classifier.
+ *
+ * r3.2 SUPERSEDES r3.1's unconditional FAIL on missing playbook.
+ * Classifies each role as cadence-bearing vs. dispatch-driven via the
+ * SSM triggers allowlist (/fazemos/<env>/triggers/allowlist — same
+ * parameter Row 4c reads; Row 3b reuses Row 4c's read output to avoid
+ * a second SSM call via the `ssmContext` parameter).
+ *
+ * State machine (rul_f53_row3b_classifies_by_cadence_signal):
+ *   playbook present → PASS (regardless of cadence classification)
+ *   cadence-bearing + no playbook → FAIL (real miss)
+ *   dispatch-driven + no playbook → SKIP "role is dispatch-driven; playbook not required by design"
+ *   SSM unavailable + no playbook → INDETERMINATE (cannot classify)
+ *   SSM unavailable + playbook present → PASS (classification not needed)
+ *
+ * This closes 7 of the 10 false FAILs from the 2026-08-19 prod run.
+ */
+import type { RoleEntry } from '../dispatch.js';
+import type { PreflightRow } from './schema.js';
+export interface SsmTriggersContext {
+    /** The role slugs in the SSM triggers allowlist, or 'unavailable' if Row 4c TOOLING-ERRORed. */
+    triggers_allowlist: string[] | 'unavailable';
+}
+export declare function checkRow3bPlaybook(opts: {
+    workspaceRoot: string;
+    roleSlug: string;
+    roleEntry: RoleEntry | undefined;
+    ssmContext: SsmTriggersContext;
+}): Promise<PreflightRow>;

package/dist/preflight/row3_playbook.js

@@ -0,0 +1,142 @@
+/**
+ * F53 Row 3b (r3.2) — Cadence-aware playbook classifier.
+ *
+ * r3.2 SUPERSEDES r3.1's unconditional FAIL on missing playbook.
+ * Classifies each role as cadence-bearing vs. dispatch-driven via the
+ * SSM triggers allowlist (/fazemos/<env>/triggers/allowlist — same
+ * parameter Row 4c reads; Row 3b reuses Row 4c's read output to avoid
+ * a second SSM call via the `ssmContext` parameter).
+ *
+ * State machine (rul_f53_row3b_classifies_by_cadence_signal):
+ *   playbook present → PASS (regardless of cadence classification)
+ *   cadence-bearing + no playbook → FAIL (real miss)
+ *   dispatch-driven + no playbook → SKIP "role is dispatch-driven; playbook not required by design"
+ *   SSM unavailable + no playbook → INDETERMINATE (cannot classify)
+ *   SSM unavailable + playbook present → PASS (classification not needed)
+ *
+ * This closes 7 of the 10 false FAILs from the 2026-08-19 prod run.
+ */
+import { checkGhAvailable, getWorkspaceGitHubRepo, listDirectoryFilenamesOnGitHub, ToolingError, } from './repoRead.js';
+/**
+ * Derive the role's directory path from its inbox path.
+ * e.g. "projects/fazemos/roles/project-manager/inbox/" → "projects/fazemos/roles/project-manager"
+ * Falls back to "roles/<role_slug>" if inbox is not set.
+ */
+function deriveRoleDir(roleEntry, roleSlug) {
+    if (roleEntry?.inbox) {
+        const trimmed = roleEntry.inbox.replace(/\/+$/, '');
+        const parts = trimmed.split('/');
+        if (parts[parts.length - 1] === 'inbox') {
+            return parts.slice(0, -1).join('/');
+        }
+        return trimmed;
+    }
+    return `roles/${roleSlug}`;
+}
+export async function checkRow3bPlaybook(opts) {
+    const { workspaceRoot, roleSlug, roleEntry, ssmContext } = opts;
+    const base = { id: '3b', name: 'playbook file' };
+    const ssmAvailable = ssmContext.triggers_allowlist !== 'unavailable';
+    const triggersAllowlist = ssmAvailable ? ssmContext.triggers_allowlist : [];
+    const isCadenceBearing = ssmAvailable && triggersAllowlist.includes(roleSlug);
+    // ── Check gh CLI + resolve GitHub repo ──────────────────────────────────
+    let ghAvailable = true;
+    let ghError = '';
+    try {
+        checkGhAvailable();
+    }
+    catch (err) {
+        ghAvailable = false;
+        ghError = err instanceof ToolingError ? err.message : String(err);
+    }
+    const repoRef = ghAvailable ? getWorkspaceGitHubRepo(workspaceRoot) : null;
+    if (!ghAvailable || !repoRef) {
+        const detail = !ghAvailable
+            ? ghError
+            : 'Cannot determine GitHub repo from workspace git remote.origin.url.';
+        // If we cannot read the repo, we cannot check for playbook files.
+        // Without playbook files, we also cannot classify the role if SSM is unavailable.
+        // Either way, this is a tooling error for the gh CLI dependency.
+        return {
+            ...base,
+            status: 'tooling_error',
+            detail,
+            fix_command: null,
+            fix_instruction: 'Install and authenticate gh CLI: brew install gh && gh auth login',
+        };
+    }
+    const roleDir = deriveRoleDir(roleEntry, roleSlug);
+    // ── Enumerate playbook files in the role dir ────────────────────────────
+    let playbookFiles = [];
+    let dirMissing = false;
+    let ghReadError = null;
+    try {
+        const dirFiles = listDirectoryFilenamesOnGitHub(repoRef, roleDir);
+        if (dirFiles === null) {
+            dirMissing = true;
+        }
+        else {
+            playbookFiles = dirFiles.filter((f) => /^playbook-.+\.md$/.test(f));
+        }
+    }
+    catch (err) {
+        ghReadError = err instanceof ToolingError ? err.message : String(err);
+    }
+    if (ghReadError) {
+        return {
+            ...base,
+            status: 'tooling_error',
+            detail: ghReadError,
+            fix_command: null,
+            fix_instruction: 'gh CLI authentication or network issue. Run: gh auth login',
+        };
+    }
+    // ── Playbook present → PASS (regardless of cadence classification) ──────
+    if (playbookFiles.length > 0) {
+        return {
+            ...base,
+            status: 'pass',
+            detail: `Found ${playbookFiles.length} playbook file(s) in ${roleDir}/: ${playbookFiles.join(', ')}`,
+            fix_command: null,
+        };
+    }
+    // ── No playbook found — apply cadence classifier ───────────────────────
+    // Dir missing: treat as no playbook files found (PASS/FAIL/SKIP/INDETERMINATE
+    // follow the same classifier — a missing dir means no playbook exists there).
+    const noPlaybookDetail = dirMissing
+        ? `Role directory '${roleDir}/' not found on GitHub origin/main — no playbook files can exist there.`
+        : `No playbook-*.md files found in ${roleDir}/ on GitHub origin/main.`;
+    // SSM unavailable + no playbook → INDETERMINATE
+    // Cannot determine if role is cadence-bearing — can't FAIL or SKIP honestly.
+    if (!ssmAvailable) {
+        return {
+            ...base,
+            status: 'indeterminate',
+            detail: noPlaybookDetail + ' SSM triggers allowlist unreadable (Row 4c TOOLING-ERROR) — cannot classify role as cadence-bearing vs. dispatch-driven.',
+            fix_command: null,
+            fix_instruction: `Fix the Row 4c SSM read error first (AWS credentials/SSO), then re-run preflight. ` +
+                `Once SSM is readable, Row 3b can determine whether a playbook is required for role '${roleSlug}'.`,
+        };
+    }
+    // Cadence-bearing + no playbook → FAIL (real miss)
+    if (isCadenceBearing) {
+        return {
+            ...base,
+            status: 'fail',
+            detail: noPlaybookDetail + ` Role '${roleSlug}' IS in the SSM triggers allowlist (/fazemos/.../triggers/allowlist) and will fire on cadence with no playbook to read.`,
+            fix_command: null,
+            fix_instruction: `Author at least one playbook file in ${roleDir}/ ` +
+                `(e.g. ${roleDir}/playbook-daily.md or ${roleDir}/playbook-task.md) in the workspace repo. ` +
+                `Role '${roleSlug}' is in the SSM triggers allowlist and will be invoked on cadence — ` +
+                `it needs a playbook to follow. See docs/guides/agent-provisioning-runbook.md §3.`,
+        };
+    }
+    // Dispatch-driven + no playbook → SKIP (by design, not a defect)
+    return {
+        ...base,
+        status: 'skip',
+        detail: `No playbook-*.md files found — role '${roleSlug}' is NOT in the SSM triggers allowlist; playbook not required by design.`,
+        fix_command: null,
+    };
+}
+//# sourceMappingURL=row3_playbook.js.map

package/dist/preflight/row3_playbook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row3_playbook.js","sourceRoot":"","sources":["../../src/preflight/row3_playbook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,8BAA8B,EAC9B,YAAY,GACb,MAAM,eAAe,CAAC;AAOvB;;;;GAIG;AACH,SAAS,aAAa,CAAC,SAAgC,EAAE,QAAgB;IACvE,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,SAAS,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAKxC;IACC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAW,CAAC;IAE1D,MAAM,YAAY,GAAG,UAAU,CAAC,kBAAkB,KAAK,aAAa,CAAC;IACrE,MAAM,iBAAiB,GAAG,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,gBAAgB,GAAG,YAAY,IAAI,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE9E,2EAA2E;IAC3E,IAAI,WAAW,GAAG,IAAI,CAAC;IACvB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,gBAAgB,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,GAAG,KAAK,CAAC;QACpB,OAAO,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3E,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,WAAW;YACzB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,oEAAoE,CAAC;QAEzE,kEAAkE;QAClE,kFAAkF;QAClF,iEAAiE;QACjE,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,eAAe;YACvB,MAAM;YACN,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,mEAAmE;SACrF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAEnD,2EAA2E;IAC3E,IAAI,aAAa,GAAa,EAAE,CAAC;IACjC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,GAAG,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,IAAI;YACjB,eAAe,EAAE,4DAA4D;SAC9E,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,SAAS,aAAa,CAAC,MAAM,wBAAwB,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACpG,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAE1E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,gBAAgB,GAAG,UAAU;QACjC,CAAC,CAAC,mBAAmB,OAAO,yEAAyE;QACrG,CAAC,CAAC,mCAAmC,OAAO,0BAA0B,CAAC;IAEzE,gDAAgD;IAChD,6EAA6E;IAC7E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,gBAAgB,GAAG,0HAA0H;YACrJ,WAAW,EAAE,IAAI;YACjB,eAAe,EACb,oFAAoF;gBACpF,uFAAuF,QAAQ,IAAI;SACtG,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,gBAAgB,GAAG,UAAU,QAAQ,yHAAyH;YACtK,WAAW,EAAE,IAAI;YACjB,eAAe,EACb,wCAAwC,OAAO,IAAI;gBACnD,SAAS,OAAO,yBAAyB,OAAO,4CAA4C;gBAC5F,SAAS,QAAQ,sEAAsE;gBACvF,kFAAkF;SACrF,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,wCAAwC,QAAQ,0EAA0E;QAClI,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC"}

package/dist/preflight/row3_rolesJson.d.ts

@@ -0,0 +1,12 @@
+/**
+ * F53 Row 3c — .fazemos/roles.json entry presence.
+ *
+ * Local check: does the workspace registry declare a filler for the role?
+ * A missing entry means `fazemos roles sync` will have nothing to sync.
+ */
+import type { RolesRegistry } from '../dispatch.js';
+import type { PreflightRow } from './schema.js';
+export declare function checkRow3cRolesJson(opts: {
+    roleSlug: string;
+    registry: RolesRegistry | null;
+}): PreflightRow;

package/dist/preflight/row3_rolesJson.js

@@ -0,0 +1,38 @@
+/**
+ * F53 Row 3c — .fazemos/roles.json entry presence.
+ *
+ * Local check: does the workspace registry declare a filler for the role?
+ * A missing entry means `fazemos roles sync` will have nothing to sync.
+ */
+export function checkRow3cRolesJson(opts) {
+    const { roleSlug, registry } = opts;
+    const base = { id: '3c', name: 'roles.json entry' };
+    if (!registry || !registry.roles[roleSlug]) {
+        return {
+            ...base,
+            status: 'fail',
+            detail: `Role '${roleSlug}' not found in .fazemos/roles.json (or no registry found).`,
+            fix_command: null,
+            fix_instruction: `Add a filler entry for '${roleSlug}' in the workspace .fazemos/roles.json, ` +
+                `then run: fazemos roles sync`,
+        };
+    }
+    if (!registry.roles[roleSlug].filler?.identity) {
+        return {
+            ...base,
+            status: 'fail',
+            detail: `Role '${roleSlug}' in .fazemos/roles.json has no filler.identity.`,
+            fix_command: null,
+            fix_instruction: `Set filler.identity for '${roleSlug}' in .fazemos/roles.json (the agent's display name), ` +
+                `then run: fazemos roles sync`,
+        };
+    }
+    const entry = registry.roles[roleSlug];
+    return {
+        ...base,
+        status: 'pass',
+        detail: `${roleSlug}: filler.type=${entry.filler.type}, filler.identity=${entry.filler.identity}, scope=${entry.scope}`,
+        fix_command: null,
+    };
+}
+//# sourceMappingURL=row3_rolesJson.js.map

package/dist/preflight/row3_rolesJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row3_rolesJson.js","sourceRoot":"","sources":["../../src/preflight/row3_rolesJson.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,UAAU,mBAAmB,CAAC,IAGnC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAW,CAAC;IAE7D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,SAAS,QAAQ,4DAA4D;YACrF,WAAW,EAAE,IAAI;YACjB,eAAe,EACb,2BAA2B,QAAQ,0CAA0C;gBAC7E,8BAA8B;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC/C,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,SAAS,QAAQ,kDAAkD;YAC3E,WAAW,EAAE,IAAI;YACjB,eAAe,EACb,4BAA4B,QAAQ,uDAAuD;gBAC3F,8BAA8B;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO;QACL,GAAG,IAAI;QACP,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,GAAG,QAAQ,iBAAiB,KAAK,CAAC,MAAM,CAAC,IAAI,qBAAqB,KAAK,CAAC,MAAM,CAAC,QAAQ,WAAW,KAAK,CAAC,KAAK,EAAE;QACvH,WAAW,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC"}

package/dist/preflight/row3_workspace.d.ts

@@ -0,0 +1,24 @@
+/**
+ * F53 Rows 3a/3b/3c — Workspace repo file checks.
+ *
+ * Checks performed via `gh api` against origin/main (D3: remote, not local copy).
+ *   3a — persona file exists (path from role.persona in roles.json)
+ *   3b — playbook file exists (derived from role.inbox path convention)
+ *   3c — .fazemos/roles.json has the role entry with a filler (local check)
+ *
+ * Row 3 rows do NOT run if `gh` is unavailable (whole group becomes tooling_error).
+ */
+import type { RoleEntry, RolesRegistry } from '../dispatch.js';
+import type { PreflightRow } from './schema.js';
+/**
+ * Run rows 3a, 3b, 3c for a given workspace/role.
+ */
+export declare function checkRow3Workspace(opts: {
+    workspaceRoot: string;
+    roleSlug: string;
+    /** Agent name (filler.identity), used to resolve the runtime persona path docs/agents/<name>.md */
+    agentName: string;
+    /** Role entry from the local registry (may be undefined if roles.json doesn't have it). */
+    roleEntry: RoleEntry | undefined;
+    registry: RolesRegistry | null;
+}): Promise<PreflightRow[]>;