@ogygie/cli 0.1.0

package/templates/project/scripts/ogygie-impact.ts

@@ -0,0 +1,301 @@
+/**
+ * @intent Session tool `pnpm ogygie:impact <feature>` (specs/ogygie-impact.spec.md,
+ * DECISIONS.md D21): prints the blast radius of a change to a delivered
+ * feature — who depends on it (declared AND actually imported symbols), its
+ * routes, its owned tables and any outside reader of them, plus the exact
+ * test command to keep every dependent green. Same family as verify-*:
+ * fs + textual import analysis, no new dependency, findings as OgygieError.
+ *
+ * Output contract (spec §États UI reconciled with §Comportements): default
+ * prints the JSON report THEN the human summary; `--json` prints the JSON
+ * report only. Exit 0 when findings are empty, 1 otherwise.
+ *
+ * Deliberate scope choices:
+ * - Depth 1 only (direct dependents) — spec §Non-objectifs.
+ * - The owned-tables scan ignores *.test.ts files: seeding ANOTHER feature's
+ *   table as a fixture is the canonical bench pattern ("the socle feature owns
+ *   that model" — see any service.test.ts); flagging it would make every run
+ *   red and the tool useless. Production code referencing a foreign table
+ *   remains a potential violation and IS flagged.
+ */
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { OgygieManifestSchema } from "@ogygie/core/manifest";
+import { dbTableNamesOf } from "@ogygie/core/shared-tables";
+import { OgygieErrorSchema, ogygieError, type OgygieError } from "@ogygie/core/errors";
+
+const ROOT = new URL("..", import.meta.url).pathname;
+const MANIFEST_PATH = "ogygie.manifest.json";
+
+// ---------------------------------------------------------------- contract
+/** In @ogygie/core once the pattern proves generic (spec §Contrats, D10 rule 3). */
+export const ImpactReportSchema = z.object({
+  feature: z.string(),
+  dependents: z.array(
+    z.object({
+      name: z.string(),
+      importedSymbols: z.array(z.string()),
+      viaIndexOnly: z.boolean(),
+    }),
+  ),
+  routes: z.array(
+    z.object({ method: z.string(), path: z.string(), description: z.string() }),
+  ),
+  ownedTables: z.array(z.string()),
+  tableReadersOutsideOwner: z.array(
+    z.object({ table: z.string(), feature: z.string(), file: z.string() }),
+  ),
+  findings: z.array(OgygieErrorSchema),
+  testCommand: z.string(),
+});
+export type ImpactReport = z.infer<typeof ImpactReportSchema>;
+
+// ---------------------------------------------------------------- helpers
+function walkTsFiles(dir: string): string[] {
+  const files: string[] = [];
+  for (const entry of readdirSync(dir)) {
+    const fullPath = join(dir, entry);
+    if (statSync(fullPath).isDirectory()) files.push(...walkTsFiles(fullPath));
+    else if (entry.endsWith(".ts") || entry.endsWith(".tsx")) files.push(fullPath);
+  }
+  return files;
+}
+
+/** Named/default/namespace symbols of one import clause ("type" stripped). */
+function symbolsOfImportClause(clause: string): string[] {
+  const symbols: string[] = [];
+  const braces = /\{([^}]*)\}/.exec(clause);
+  if (braces?.[1] !== undefined) {
+    for (const rawEntry of braces[1].split(",")) {
+      const name = rawEntry.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0]?.trim();
+      if (name !== undefined && name !== "") symbols.push(name);
+    }
+  }
+  const outsideBraces = clause.replace(/\{[^}]*\}/, "").replace(/^type\s+/, "").trim();
+  if (/\*\s*as\s+/.test(outsideBraces)) symbols.push("*");
+  else if (outsideBraces.replace(/,/g, "").trim() !== "") symbols.push("default");
+  return symbols;
+}
+
+// ---------------------------------------------------------------- report
+export function buildImpactReport(featureName: string): ImpactReport {
+  const manifest = OgygieManifestSchema.parse(
+    JSON.parse(readFileSync(join(ROOT, MANIFEST_PATH), "utf8")),
+  );
+  const apiApp = manifest.apps.find((app) => app.type === "api");
+  if (apiApp === undefined) {
+    throw new Error("no app of type api in the manifest");
+  }
+  const target = manifest.features.find((feature) => feature.name === featureName);
+  if (target === undefined) {
+    const failure = ogygieError({
+      code: "IMPACT_UNKNOWN_FEATURE",
+      message: `Feature "${featureName}" is unknown to the manifest. Valid features: ${manifest.features.map((feature) => feature.name).join(", ")}.`,
+      file: MANIFEST_PATH,
+      cause: `no features[] entry has name="${featureName}"`,
+      suggestedFix: "Pick one of the valid feature names listed in the message.",
+    });
+    console.error(JSON.stringify(failure, null, 2));
+    console.error("\nogygie:impact — feature inconnue.");
+    process.exit(1);
+  }
+
+  const findings: OgygieError[] = [];
+  const targetDirName = target.folder.split("/").pop() ?? target.folder;
+
+  // (a)+(b) dependents: declared in the manifest AND/OR actually importing.
+  const importersByFeature = new Map<
+    string,
+    { importedSymbols: Set<string>; viaIndexOnly: boolean }
+  >();
+  for (const feature of manifest.features) {
+    if (feature.name === target.name) continue;
+    const featureDir = join(ROOT, apiApp.path, feature.folder);
+    if (!existsSync(featureDir)) continue;
+    for (const filePath of walkTsFiles(featureDir)) {
+      const content = readFileSync(filePath, "utf8");
+      const relativeFile = filePath.slice(ROOT.length);
+      for (const match of content.matchAll(
+        /import\s+([^'"]+?)\s+from\s+"([^"]+)"/g,
+      )) {
+        const clause = match[1];
+        const source = match[2];
+        if (clause === undefined || source === undefined) continue;
+        const sibling = new RegExp(`^\\.\\./${targetDirName}/(.+)$`).exec(source);
+        if (sibling === null || sibling[1] === undefined) continue;
+        const entry = importersByFeature.get(feature.name) ?? {
+          importedSymbols: new Set<string>(),
+          viaIndexOnly: true,
+        };
+        for (const symbol of symbolsOfImportClause(clause)) {
+          entry.importedSymbols.add(symbol);
+        }
+        if (sibling[1] !== "index.js") {
+          entry.viaIndexOnly = false;
+          findings.push(
+            ogygieError({
+              code: "FEATURE_BOUNDARY_VIOLATION",
+              message: `Feature "${feature.name}" imports an internal file of "${target.name}" instead of its index.ts.`,
+              file: relativeFile,
+              cause: `import from "${source}" bypasses ${targetDirName}/index.ts`,
+              suggestedFix: `Export the needed symbols from ${targetDirName}/index.ts and import them from "../${targetDirName}/index.js".`,
+            }),
+          );
+        }
+        importersByFeature.set(feature.name, entry);
+      }
+    }
+  }
+
+  const declaredDependents = manifest.features.filter((feature) =>
+    feature.dependsOn.includes(target.name),
+  );
+  for (const declared of declaredDependents) {
+    if (!importersByFeature.has(declared.name)) {
+      findings.push(
+        ogygieError({
+          code: "MANIFEST_DEPENDENCY_STALE",
+          message: `Feature "${declared.name}" declares dependsOn "${target.name}" but never imports it.`,
+          file: `${MANIFEST_PATH}#features.${declared.name}`,
+          cause: `dependsOn contains "${target.name}", no import of ../${targetDirName}/ found in its code`,
+          suggestedFix:
+            "Remove the stale dependsOn entry, or make the dependency real through the feature's index.ts.",
+        }),
+      );
+    }
+  }
+  for (const importerName of importersByFeature.keys()) {
+    if (!declaredDependents.some((declared) => declared.name === importerName)) {
+      findings.push(
+        ogygieError({
+          code: "MANIFEST_DEPENDENCY_UNDECLARED",
+          message: `Feature "${importerName}" imports "${target.name}" but does not declare it in dependsOn.`,
+          file: `${MANIFEST_PATH}#features.${importerName}`,
+          cause: `imports of ../${targetDirName}/ found in its code, "${target.name}" absent from its dependsOn`,
+          suggestedFix: `Add "${target.name}" to the dependsOn of "${importerName}" — the manifest must never lie by omission.`,
+        }),
+      );
+    }
+  }
+
+  const dependentNames = [
+    ...new Set([
+      ...declaredDependents.map((feature) => feature.name),
+      ...importersByFeature.keys(),
+    ]),
+  ].sort();
+  const dependents = dependentNames.map((name) => {
+    const imports = importersByFeature.get(name);
+    return {
+      name,
+      importedSymbols: [...(imports?.importedSymbols ?? [])].sort(),
+      viaIndexOnly: imports?.viaIndexOnly ?? true,
+    };
+  });
+
+  // (d) owned tables referenced by another feature's PRODUCTION code.
+  const tableReadersOutsideOwner: ImpactReport["tableReadersOutsideOwner"] = [];
+  for (const feature of manifest.features) {
+    if (feature.name === target.name) continue;
+    const featureDir = join(ROOT, apiApp.path, feature.folder);
+    if (!existsSync(featureDir)) continue;
+    for (const filePath of walkTsFiles(featureDir)) {
+      if (filePath.endsWith(".test.ts") || filePath.endsWith(".test.tsx")) continue;
+      const content = readFileSync(filePath, "utf8");
+      const relativeFile = filePath.slice(ROOT.length);
+      for (const table of dbTableNamesOf(target)) {
+        if (!content.includes(`"${table}"`)) continue;
+        tableReadersOutsideOwner.push({
+          table,
+          feature: feature.name,
+          file: relativeFile,
+        });
+        findings.push(
+          ogygieError({
+            code: "TABLE_REFERENCED_OUTSIDE_OWNER",
+            message: `Table "${table}" is owned by "${target.name}" but referenced by production code of "${feature.name}".`,
+            file: relativeFile,
+            cause: `"${table}" found in a non-test file outside its owner feature`,
+            suggestedFix: `Go through the public contracts of ${targetDirName}/index.ts instead of touching the table — one table = one owner.`,
+          }),
+        );
+      }
+    }
+  }
+
+  const dependentDirNames = dependentNames.map((name) => {
+    const feature = manifest.features.find((candidate) => candidate.name === name);
+    return feature?.folder.split("/").pop() ?? name;
+  });
+  const testCommand = ["pnpm test --", `features/${targetDirName}`, ...dependentDirNames.map((dirName) => `features/${dirName}`)].join(" ");
+
+  return ImpactReportSchema.parse({
+    feature: target.name,
+    dependents,
+    routes: target.routes.map((route) => ({
+      method: route.method,
+      path: route.path,
+      description: route.description,
+    })),
+    ownedTables: dbTableNamesOf(target),
+    tableReadersOutsideOwner,
+    findings,
+    testCommand,
+  });
+}
+
+// ---------------------------------------------------------------- CLI
+function printSummary(report: ImpactReport): void {
+  console.log(`\n── ogygie:impact ${report.feature} ──`);
+  if (report.dependents.length === 0) {
+    console.log("Dépendants : aucun.");
+  } else {
+    console.log(`Dépendants (${report.dependents.length}) :`);
+    for (const dependent of report.dependents) {
+      const symbols =
+        dependent.importedSymbols.length > 0
+          ? `importe { ${dependent.importedSymbols.join(", ")} }`
+          : "n'importe aucun symbole";
+      const boundary = dependent.viaIndexOnly ? "via index.ts uniquement" : "⚠ contourne index.ts";
+      console.log(`  • ${dependent.name} — ${symbols} — ${boundary}`);
+    }
+  }
+  const routes = report.routes.map((route) => `${route.method} ${route.path}`).join(" · ");
+  console.log(`Routes exposées (${report.routes.length}) : ${routes === "" ? "aucune" : routes}`);
+  console.log(
+    `Tables possédées : ${report.ownedTables.length === 0 ? "aucune" : report.ownedTables.join(", ")}`,
+  );
+  if (report.tableReadersOutsideOwner.length > 0) {
+    for (const reader of report.tableReadersOutsideOwner) {
+      console.log(`  ⚠ "${reader.table}" référencée par ${reader.feature} (${reader.file})`);
+    }
+  }
+  console.log(
+    report.findings.length === 0
+      ? "Findings : aucun."
+      : `Findings : ${report.findings.length} (détail dans le JSON ci-dessus).`,
+  );
+  console.log(`Tests à relancer : ${report.testCommand}\n`);
+}
+
+const cliArguments = process.argv.slice(2);
+const jsonOnly = cliArguments.includes("--json");
+const featureArgument = cliArguments.find((argument) => !argument.startsWith("--"));
+
+if (featureArgument === undefined) {
+  const failure = ogygieError({
+    code: "IMPACT_UNKNOWN_FEATURE",
+    message: "No feature name given. Usage: pnpm ogygie:impact <feature> [--json].",
+    file: null,
+    cause: "process.argv carries no non-flag argument",
+    suggestedFix: "Pass a feature name from ogygie.manifest.json, e.g. `pnpm ogygie:impact cultures`.",
+  });
+  console.error(JSON.stringify(failure, null, 2));
+  process.exit(1);
+}
+
+const report = buildImpactReport(featureArgument);
+console.log(JSON.stringify(report, null, 2));
+if (!jsonOnly) printSummary(report);
+process.exit(report.findings.length === 0 ? 0 : 1);

package/templates/project/scripts/verify-contracts.ts

@@ -0,0 +1,86 @@
+/**
+ * @intent CI gate `pnpm ogygie:verify-contracts` (DECISIONS.md D29): from every
+ * feature's `schemas.ts`, walk the WHOLE import graph and prove that nothing
+ * with a runtime effect is reachable — the transitivity is the point, since
+ * that is how the server came back into the browser bundle
+ * (`cultures/schemas.ts` → `especes-eppo/index.ts` → `seed.ts` → `node:fs`,
+ * FAILURES.md).
+ *
+ * The decision logic lives in @ogygie/core/contract-purity, born with its
+ * mutation tests (D22) — this script only reads the manifest, the disk, and
+ * reports as OgygieError so an agent can fix without guessing.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { OgygieManifestSchema } from "@ogygie/core/manifest";
+import {
+  auditContractPurity,
+  type ContractImpurity,
+  type ContractImpurityKind,
+} from "@ogygie/core/contract-purity";
+import { ogygieError } from "@ogygie/core/errors";
+
+const ROOT = fileURLToPath(new URL("..", import.meta.url));
+const MANIFEST_PATH = "ogygie.manifest.json";
+
+/** One stable error code per rule broken (D11 — machine-readable = English). */
+const ERROR_CODES: Record<ContractImpurityKind, string> = {
+  RUNTIME_PACKAGE: "CONTRACT_IMPURE_PACKAGE",
+  SERVER_SURFACE: "CONTRACT_REACHES_SERVER_SURFACE",
+  MODULE_NOT_FOUND: "CONTRACT_MODULE_NOT_FOUND",
+};
+
+const SUGGESTED_FIXES: Record<ContractImpurityKind, string> = {
+  RUNTIME_PACKAGE:
+    "Move what needs this package to service.ts/repository.ts, or make the import type-only — a contract is imported by apps/web.",
+  SERVER_SURFACE:
+    "Import the other feature's schemas.ts, never its index.ts (AGENTS.md §Structure, bounded exception).",
+  MODULE_NOT_FOUND:
+    "Fix the import path or create the missing module: the graph of a contract is audited whole, never partially.",
+};
+
+const manifest = OgygieManifestSchema.parse(
+  JSON.parse(readFileSync(join(ROOT, MANIFEST_PATH), "utf8")),
+);
+
+const report = auditContractPurity({
+  manifest,
+  readModule: (path) => {
+    const absolutePath = join(ROOT, path);
+    if (!existsSync(absolutePath) || !statSync(absolutePath).isFile()) return null;
+    return readFileSync(absolutePath, "utf8");
+  },
+});
+
+function describe(impurity: ContractImpurity): string {
+  const chain = impurity.chain.join("\n     → ");
+  return `${impurity.rule}\n  imported as: ${impurity.statement}\n  chain: ${chain}`;
+}
+
+for (const impurity of report.impurities) {
+  console.error(
+    JSON.stringify(
+      ogygieError({
+        code: ERROR_CODES[impurity.kind],
+        message: `Contract ${impurity.entryPath} reaches a module it must not: ${impurity.specifier}.`,
+        file: impurity.chain.at(-1) ?? impurity.entryPath,
+        cause: describe(impurity),
+        suggestedFix: SUGGESTED_FIXES[impurity.kind],
+      }),
+      null,
+      2,
+    ),
+  );
+}
+
+if (report.impurities.length > 0) {
+  console.error(
+    `\nogygie:verify-contracts — ${report.impurities.length} impureté(s) sur ${report.entryPaths.length} contrat(s).`,
+  );
+  process.exit(1);
+}
+
+console.log(
+  `ogygie:verify-contracts — OK, ${report.entryPaths.length} contrats purs (${report.reachedPaths.length} modules atteints).`,
+);

package/templates/project/scripts/verify-manifest.ts

@@ -0,0 +1,306 @@
+/**
+ * @intent CI gate `pnpm ogygie:verify-manifest`: proves that ogygie.manifest.json
+ * tells the truth about the actual code. A lying manifest must break the build
+ * faster than a red test. Every finding is printed as an OgygieError (JSON) so
+ * an agent can fix it without guessing.
+ *
+ * Checks, per feature:
+ * - the manifest parses against OgygieManifestSchema;
+ * - the spec file exists (when declared);
+ * - `dependsOn` only references features that exist in the manifest;
+ * - for non-"skeleton" features: the folder exists with the canonical files,
+ *   every route's input/output schema is exported from schemas.ts, every route
+ *   path appears in routes.ts, every owned table appears in db.schema.ts.
+ *
+ * And in the REVERSE direction (the most likely lie is the omission): every
+ * `url: "/api/..."` found in a feature's routes.ts and every `pgTable("...")`
+ * found in a feature's db.schema.ts must be declared in the manifest
+ * (MANIFEST_ROUTE_UNDECLARED / MANIFEST_TABLE_UNDECLARED).
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { OgygieManifestSchema } from "@ogygie/core/manifest";
+import {
+  dbTableNamesOf,
+  findTenantColumnsInSharedTables,
+  sharedTableNamesOf,
+} from "@ogygie/core/shared-tables";
+import { ogygieError, type OgygieError } from "@ogygie/core/errors";
+
+/**
+ * Tenant column names of the PRODUCT (the core stays generic). A table
+ * declared `shared: true` must carry none of them.
+ * TODO(product): declare your tenant column here (the SQL name announced in
+ * AGENTS.product.md, e.g. "workspace_id") — empty, this check guards nothing.
+ */
+const TENANT_COLUMN_NAMES: readonly string[] = [];
+
+const ROOT = new URL("..", import.meta.url).pathname;
+const MANIFEST_PATH = "ogygie.manifest.json";
+const problems: OgygieError[] = [];
+
+function report(input: Parameters<typeof ogygieError>[0]): void {
+  problems.push(ogygieError(input));
+}
+
+function conclude(): never {
+  if (problems.length > 0) {
+    for (const problem of problems) {
+      console.error(JSON.stringify(problem, null, 2));
+    }
+    console.error(`\nogygie:verify-manifest — ${problems.length} problème(s).`);
+    process.exit(1);
+  }
+  console.log("ogygie:verify-manifest — OK, le manifeste dit la vérité.");
+  process.exit(0);
+}
+
+const rawManifest: unknown = JSON.parse(readFileSync(join(ROOT, MANIFEST_PATH), "utf8"));
+const parsed = OgygieManifestSchema.safeParse(rawManifest);
+if (!parsed.success) {
+  report({
+    code: "MANIFEST_INVALID",
+    message: "ogygie.manifest.json does not satisfy OgygieManifestSchema.",
+    file: MANIFEST_PATH,
+    cause: parsed.error.issues
+      .map((issue) => `${issue.path.join(".")}: ${issue.message}`)
+      .join(" ; "),
+    suggestedFix:
+      "Fix the listed fields to match packages/ogygie-core/src/manifest.schema.ts.",
+  });
+  conclude();
+}
+const manifest = parsed.data;
+
+for (const app of manifest.apps) {
+  if (!existsSync(join(ROOT, app.path))) {
+    report({
+      code: "MANIFEST_APP_NOT_FOUND",
+      message: `App "${app.name}" declares folder ${app.path} which does not exist.`,
+      file: MANIFEST_PATH,
+      cause: `apps[].path=${app.path} absent from disk`,
+      suggestedFix: "Create the folder or fix the manifest entry.",
+    });
+  }
+}
+
+const apiApp = manifest.apps.find((app) => app.type === "api");
+const featureNames = new Set(manifest.features.map((feature) => feature.name));
+
+for (const feature of manifest.features) {
+  const manifestRef = `${MANIFEST_PATH}#features.${feature.name}`;
+
+  if (feature.spec !== null && !existsSync(join(ROOT, feature.spec))) {
+    report({
+      code: "MANIFEST_SPEC_NOT_FOUND",
+      message: `Feature "${feature.name}" declares spec ${feature.spec} which does not exist.`,
+      file: manifestRef,
+      cause: `spec=${feature.spec} absent from disk`,
+      suggestedFix: "Create the spec file or fix the manifest entry.",
+    });
+  }
+
+  for (const dependency of feature.dependsOn) {
+    if (!featureNames.has(dependency)) {
+      report({
+        code: "MANIFEST_UNKNOWN_DEPENDENCY",
+        message: `Feature "${feature.name}" depends on "${dependency}" which is not in the manifest.`,
+        file: manifestRef,
+        cause: `dependsOn contains "${dependency}"`,
+        suggestedFix: "Declare the missing feature in the manifest or remove the dependency.",
+      });
+    }
+  }
+
+  // A "skeleton" feature has no code yet — nothing more to check.
+  if (feature.status === "skeleton") continue;
+
+  // Non-api feature (front or gateway — manifest schema guarantees
+  // routes/dbTables are empty): its truth check is the folder's existence
+  // under ITS app — the canonical api files (routes.ts, repository.ts…) do
+  // not apply to a front or gateway folder.
+  const owningApp =
+    feature.app === undefined
+      ? apiApp
+      : manifest.apps.find((app) => app.name === feature.app);
+  if (owningApp !== undefined && owningApp.type !== "api") {
+    if (!existsSync(join(ROOT, owningApp.path, feature.folder))) {
+      report({
+        code: "MANIFEST_FOLDER_NOT_FOUND",
+        message: `Feature "${feature.name}" declares folder ${feature.folder} which does not exist under ${owningApp.path}.`,
+        file: manifestRef,
+        cause: `${join(owningApp.path, feature.folder)} absent from disk`,
+        suggestedFix: "Create the feature folder or fix `folder` in the manifest.",
+      });
+    }
+    continue;
+  }
+
+  if (apiApp === undefined) {
+    report({
+      code: "MANIFEST_API_APP_MISSING",
+      message: 'No app of type "api" in the manifest, cannot locate feature folders.',
+      file: MANIFEST_PATH,
+      cause: "apps[] has no entry with type=api",
+      suggestedFix: "Declare the api app in the manifest.",
+    });
+    break;
+  }
+
+  const featureDir = join(ROOT, apiApp.path, feature.folder);
+  if (!existsSync(featureDir)) {
+    report({
+      code: "MANIFEST_FOLDER_NOT_FOUND",
+      message: `Feature "${feature.name}" declares folder ${feature.folder} which does not exist under ${apiApp.path}.`,
+      file: manifestRef,
+      cause: `${join(apiApp.path, feature.folder)} absent from disk`,
+      suggestedFix: "Create the feature folder or fix `folder` in the manifest.",
+    });
+    continue;
+  }
+
+  const canonicalFiles = ["index.ts", "routes.ts", "schemas.ts", "service.ts", "repository.ts"];
+  for (const fileName of canonicalFiles) {
+    if (!existsSync(join(featureDir, fileName))) {
+      report({
+        code: "FEATURE_CANONICAL_FILE_MISSING",
+        message: `Feature "${feature.name}" is missing canonical file ${fileName}.`,
+        file: join(apiApp.path, feature.folder, fileName),
+        cause: `${fileName} absent (AGENTS.md §Structure d'une feature)`,
+        suggestedFix: "Create the file following the canonical template in AGENTS.md.",
+      });
+    }
+  }
+
+  const schemasPath = join(featureDir, "schemas.ts");
+  const routesPath = join(featureDir, "routes.ts");
+  const schemasContent = existsSync(schemasPath) ? readFileSync(schemasPath, "utf8") : "";
+  const routesContent = existsSync(routesPath) ? readFileSync(routesPath, "utf8") : "";
+
+  for (const route of feature.routes) {
+    for (const schemaName of [route.schemaInput, route.schemaOutput]) {
+      if (!schemasContent.includes(`export const ${schemaName}`)) {
+        report({
+          code: "MANIFEST_SCHEMA_NOT_EXPORTED",
+          message: `Route ${route.method} ${route.path} declares schema ${schemaName}, not exported by schemas.ts.`,
+          file: join(apiApp.path, feature.folder, "schemas.ts"),
+          cause: `\`export const ${schemaName}\` not found`,
+          suggestedFix:
+            "Export the schema from schemas.ts or fix schemaInput/schemaOutput in the manifest.",
+        });
+      }
+    }
+    if (!routesContent.includes(`"${route.path}"`)) {
+      report({
+        code: "MANIFEST_ROUTE_NOT_FOUND",
+        message: `Route ${route.method} ${route.path} is declared in the manifest but absent from routes.ts.`,
+        file: join(apiApp.path, feature.folder, "routes.ts"),
+        cause: `"${route.path}" not found in routes.ts`,
+        suggestedFix: "Register the route in routes.ts or remove it from the manifest.",
+      });
+    }
+  }
+
+  if (feature.dbTables.length > 0) {
+    const dbSchemaPath = join(featureDir, "db.schema.ts");
+    const dbSchemaContent = existsSync(dbSchemaPath) ? readFileSync(dbSchemaPath, "utf8") : "";
+    for (const table of dbTableNamesOf(feature)) {
+      const tableDefinition = new RegExp(`pgTable\\(\\s*"${table}"`);
+      if (!tableDefinition.test(dbSchemaContent)) {
+        report({
+          code: "MANIFEST_TABLE_NOT_FOUND",
+          message: `Feature "${feature.name}" declares table "${table}" but db.schema.ts does not define it.`,
+          file: join(apiApp.path, feature.folder, "db.schema.ts"),
+          cause: `pgTable("${table}") not found`,
+          suggestedFix: "Define the table in db.schema.ts or remove it from dbTables.",
+        });
+      }
+    }
+
+    // A table declared `shared: true` escapes tenantDb AND the tenant RLS
+    // policy (AGENTS.md §Multi-tenant rule 4). If it still carries a tenant
+    // column, the declaration and the shape contradict each other — and an
+    // audited exception silently becomes an unguarded table.
+    for (const finding of findTenantColumnsInSharedTables(
+      dbSchemaContent,
+      sharedTableNamesOf(feature),
+      TENANT_COLUMN_NAMES,
+    )) {
+      report({
+        code: "SHARED_TABLE_WITH_TENANT_COLUMN",
+        message: `Table "${finding.table}" is declared shared in the manifest but its Drizzle definition still carries "${finding.tenantColumn}".`,
+        file: join(apiApp.path, feature.folder, "db.schema.ts"),
+        cause: `pgTable("${finding.table}") declares column "${finding.tenantColumn}" while the manifest says shared: true`,
+        suggestedFix:
+          "Either drop the tenant column (the table is a shared referential: no tenant owns it, no RLS tenant policy), or remove `shared: true` and go back through tenantDb.",
+      });
+    }
+  }
+}
+
+// Reverse direction: everything the code exposes must be declared in the
+// manifest. Scans every folder under src/features/, including folders that
+// have no manifest entry at all.
+if (apiApp !== undefined) {
+  const featuresRoot = join(ROOT, apiApp.path, "src", "features");
+  const featureDirNames = existsSync(featuresRoot)
+    ? readdirSync(featuresRoot).filter((entry) =>
+        statSync(join(featuresRoot, entry)).isDirectory(),
+      )
+    : [];
+
+  for (const dirName of featureDirNames) {
+    const relativeFolder = `src/features/${dirName}`;
+    const manifestFeature = manifest.features.find(
+      (feature) => feature.folder === relativeFolder,
+    );
+    const declaredPaths = new Set(
+      manifestFeature?.routes.map((route) => route.path) ?? [],
+    );
+    const declaredTables = new Set(
+      manifestFeature === undefined ? [] : dbTableNamesOf(manifestFeature),
+    );
+    const missingEntryCause =
+      manifestFeature === undefined
+        ? ` (no manifest entry has folder=${relativeFolder})`
+        : "";
+
+    const routesPath = join(featuresRoot, dirName, "routes.ts");
+    if (existsSync(routesPath)) {
+      const routesContent = readFileSync(routesPath, "utf8");
+      for (const match of routesContent.matchAll(/url:\s*"(\/api\/[^"]*)"/g)) {
+        const routePath = match[1];
+        if (routePath !== undefined && !declaredPaths.has(routePath)) {
+          report({
+            code: "MANIFEST_ROUTE_UNDECLARED",
+            message: `Route ${routePath} is registered in ${relativeFolder}/routes.ts but not declared in the manifest.`,
+            file: join(apiApp.path, relativeFolder, "routes.ts"),
+            cause: `url: "${routePath}" found in code, absent from the manifest${missingEntryCause}`,
+            suggestedFix:
+              "Declare the route (method, path, schemas) in ogygie.manifest.json — the manifest must never lie by omission.",
+          });
+        }
+      }
+    }
+
+    const dbSchemaPath = join(featuresRoot, dirName, "db.schema.ts");
+    if (existsSync(dbSchemaPath)) {
+      const dbSchemaContent = readFileSync(dbSchemaPath, "utf8");
+      for (const match of dbSchemaContent.matchAll(/pgTable\(\s*"([^"]+)"/g)) {
+        const tableName = match[1];
+        if (tableName !== undefined && !declaredTables.has(tableName)) {
+          report({
+            code: "MANIFEST_TABLE_UNDECLARED",
+            message: `Table "${tableName}" is defined in ${relativeFolder}/db.schema.ts but not declared in the manifest.`,
+            file: join(apiApp.path, relativeFolder, "db.schema.ts"),
+            cause: `pgTable("${tableName}") found in code, absent from dbTables${missingEntryCause}`,
+            suggestedFix:
+              "Add the table to the feature's dbTables in ogygie.manifest.json (one table = one owner).",
+          });
+        }
+      }
+    }
+  }
+}
+
+conclude();