@onlineapps/conn-orch-validator 6.0.1 → 8.0.0

package/src/manifest/checks/docsLintBridge.js

@@ -0,0 +1,553 @@
+'use strict';
+
+/**
+ * The bridge from a manifest row to the documentation lint that ALREADY owns
+ * the rules of a documentation tree.
+ *
+ * Confirmation `biz-service-manifest` 004 point 4: a rule that exists is cited,
+ * never restated. The rules of `<service>/docs/**` exist and have an owner —
+ * `api/scripts/ci/lint-biz-docs.mjs`, held by BIZ-DOCS — so nothing here decides
+ * whether a document is wrong. The row names the lint rule it stands for, this
+ * module runs the lint ONCE per service and hands each row the findings of the
+ * rules it cites, with the lint's own `file:line` and message.
+ *
+ * The same shape `contractBridge.js` keeps for `deployContract.js` and friends,
+ * with one difference that is forced by where the checker lives: those are
+ * modules of this package, and this one is a script of the `api` checkout. So:
+ *
+ *   - the rows are `bearer`-scoped. They speak about ONE service and need the
+ *     workspace only to reach the script, which is exactly what that scope is
+ *     for (`manifestShape.js` § CHECK_SCOPES). Inside a service image, and in a
+ *     service's own CI, there is no api checkout, so `requiresSiblings` makes
+ *     the runner report them NOT RUN — never a silent pass
+ *     (`.claude/rules/automation-gates.md` §5);
+ *   - the citation is a rule id of the lint, in the lint's OWN `--rules`
+ *     syntax: `S001,S002` names two rules, `F002` names every banned token and
+ *     `F002:http-ports` names one of them (the lint reads both forms, its
+ *     `severityOf`: `options.rules.has(ruleId) || options.rules.has(ruleId.split(':')[0])`).
+ *     Writing the citation in the linter's vocabulary is what keeps the row and
+ *     the tool from growing a private dialect between them.
+ *
+ * **One finding lands on exactly one row.** `D-PORT` cites `F002:http-ports`
+ * and `D-RETIRED` cites `F002`, which the ban on localhost ports is one of — so
+ * without a rule the port finding would appear twice, under two ids with two
+ * different `fix` sentences. The most SPECIFIC citation wins, and two rows
+ * citing the same id are a fail-fast, because then nobody can say which fix a
+ * reader should follow.
+ *
+ * **A rule no row cites lands on the catch-all row, `D-LINT`.** Until d.303 it
+ * landed nowhere: the lint raises far more than the citing rows claim (measured
+ * 2026-09-09 over the eight repositories: 80 findings, of which 16 fell to a row
+ * here), so a tree the documentation gate called broken came back DEPLOYABLE
+ * from this uniform — coverage implied and not held (`automation-gates.md` §5).
+ * `docsLintClean` below closes that, and what the citing rows still buy is their
+ * own `fix` sentence, not coverage. The documentation gate itself is unchanged
+ * and still lands in each repository's CI at zero findings, repo by repo
+ * (`biz-docs-foreign-tree-gate` 001).
+ *
+ * @see api/docs/governance/confirmations/biz-service-manifest.md §2
+ * @see api/docs/governance/confirmations/biz-docs-foreign-tree-gate.md
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const { whereOf } = require('./libraryContext');
+const { resolveWorkspacePath } = require('../workspaceRoot');
+
+/** The documentation lint, by the path the manifest writes every api path in. */
+const LINT_SCRIPT = 'api/scripts/ci/lint-biz-docs.mjs';
+
+/**
+ * The directory holding it. The runner verifies THIS before running the check
+ * and reports NOT RUN when it is absent, which is the whole of "no api checkout
+ * here" — a container, or a service's own CI.
+ */
+const LINT_DIR = 'api/scripts/ci';
+
+/** Where a service's own documentation tree lives, by DOC-STANDARD § Scope. */
+const DOCS_DIR = 'docs';
+
+/**
+ * The invocation, and why each option is on it.
+ *
+ *   `--root` / `--tree-config`  the foreign tree and the budget it declares of
+ *                               its own; the lint refuses the tree without them
+ *                               (`biz-docs-foreign-tree-gate` 001).
+ *   `--skip-code-rules`         L008 and L009 scan code and rules of the api
+ *                               checkout, which are not this service's tree and
+ *                               not this uniform's subject. It is the
+ *                               invocation the packaged tree config's own note
+ *                               writes.
+ *   `--allow-missing-siblings`  a probe into a checkout this run does not have
+ *                               is reported as NOT RUN rather than answered.
+ *                               Without it the same absence reads as "the
+ *                               concept is gone" and the ban silently switches
+ *                               off — the failure `automation-gates.md` §5 is
+ *                               about, and the reason the skipped list below is
+ *                               turned into a finding rather than dropped.
+ *   `--format json`             the machine-readable half; the human half goes
+ *                               to stderr and is never parsed.
+ *
+ * @param {{ docsDir: string, treeConfig: string }} params
+ * @returns {string[]}
+ */
+const lintArgumentsFor = ({ docsDir, treeConfig }) => [
+  '--root', docsDir,
+  '--tree-config', treeConfig,
+  '--skip-code-rules',
+  '--allow-missing-siblings',
+  '--format', 'json'
+];
+
+/** How long one tree may take before the run is called undecided, in ms. */
+const LINT_TIMEOUT_MS = 120000;
+
+/** Room for the JSON of a large tree; the biggest measured today is 54 findings. */
+const LINT_MAX_BUFFER = 32 * 1024 * 1024;
+
+/**
+ * The lint's answers, keyed by what the run was about. One service is linted
+ * ONCE however many rows cite it: five rows spawning five processes over the
+ * same tree would be the same answer bought five times.
+ *
+ * The lifetime is the process, which is the lifetime of a run — `oa-validate`
+ * is one process, and so is a jest worker over static fixtures. Nothing here
+ * watches the disk, so a tree edited mid-process keeps the answer it gave.
+ */
+const answers = new Map();
+
+/**
+ * One violation as one table cell, without the `Fix:` sentence the row carries
+ * in its own column. The same summarising `contractBridge.js` does, for the same
+ * reason.
+ *
+ * @param {string} message the lint's message, as it writes it
+ * @returns {string}
+ */
+function summarise(message) {
+  return String(message).split('\n')[0].split(' Fix:')[0].trim();
+}
+
+/**
+ * The rule ids a row cites, in the lint's `--rules` syntax.
+ *
+ * @param {object} row the manifest row
+ * @returns {string[]}
+ */
+function citationsOf(row) {
+  const cited = String(row.rule).split(',').map((one) => one.trim()).filter((one) => one.length > 0);
+  if (cited.length === 0) {
+    throw new Error(`[DocsLintBridge] Row ${row.id} cites no lint rule - "rule" is ${JSON.stringify(row.rule)}. `
+      + 'Fix: name the rule ids of api/scripts/ci/lint-biz-docs.mjs this row stands for, comma-separated '
+      + '(the --rules syntax); a row citing nothing reports nothing and reads as a pass.');
+  }
+  return cited;
+}
+
+/**
+ * Does this citation cover this rule id? The lint's own answer: a citation is
+ * either the whole id or the part before the colon, so `F002` covers every
+ * banned token and `F002:http-ports` covers one.
+ *
+ * @param {string} citation
+ * @param {string} ruleId
+ * @returns {boolean}
+ */
+const covers = (citation, ruleId) => ruleId === citation || String(ruleId).split(':')[0] === citation;
+
+/** The check of a row that CITES rules; the catch-all below cites none. */
+const CITING_CHECK = 'docs-lint';
+
+/**
+ * The rows of the block competing for a finding: the ones that cite rules.
+ *
+ * The catch-all row (`docs-lint-clean`) is deliberately not among them. It
+ * claims what nobody else claims, so letting it compete would make every
+ * finding ambiguous at specificity 0 — and `citationsOf` would read its absent
+ * `rule` as a citation.
+ *
+ * @param {object} block the manifest block holding the rows
+ * @returns {object[]}
+ */
+function rowsOf(block) {
+  const rows = block && block.rules;
+  if (!Array.isArray(rows) || rows.length === 0) {
+    throw new Error('[DocsLintBridge] The documentation block declares no "rules" array - a finding is '
+      + 'placed on the row with the most specific citation, so the check has to see every row of the '
+      + 'block. Fix: repair manifests/biz-service.manifest.json.');
+  }
+
+  const citing = rows.filter((row) => row.check === CITING_CHECK);
+  if (citing.length === 0) {
+    throw new Error(`[DocsLintBridge] The documentation block declares no row of check "${CITING_CHECK}" - `
+      + 'a finding is placed on the row with the most specific citation, and with no citing row every '
+      + 'finding would fall to the catch-all with no fix sentence of its own. '
+      + 'Fix: repair manifests/biz-service.manifest.json.');
+  }
+  return citing;
+}
+
+/** The grade that makes a documentation finding block a deploy (`--severity error`). */
+const ERROR_SEVERITY = 'error';
+
+/**
+ * The findings the LINT graded `error` — the set its own `--severity error`
+ * prints, read from the one run the block already made rather than bought with
+ * a second process.
+ *
+ * This is the whole of the safeguard that lets `D-LINT` exist before every tree
+ * is clean: grading belongs to BIZ-DOCS and to nobody else
+ * (`api/config/biz-docs-lint.json` § severities), so a rule they add at `warn`
+ * is visible in their run and blocks no deploy until they raise it on their own
+ * dated transition (`automation-gates.md` §3 — a gate lands with compliance,
+ * never ahead of it). Nothing here decides a grade; it reads the one the lint
+ * stamped.
+ *
+ * @param {Array<object>} findings the lint's findings, as it wrote them
+ * @returns {Array<object>} the error-graded ones
+ */
+const errorGraded = (findings) => findings.filter((finding) => finding.severity === ERROR_SEVERITY);
+
+/**
+ * Which row owns a lint finding: the one whose citation is the most specific.
+ *
+ * @param {string} ruleId the lint's rule id
+ * @param {object[]} rows every row of the block
+ * @returns {string|null} the row id, or null when no row cites this rule
+ */
+function claimantOf(ruleId, rows) {
+  let claimant = null;
+  let specificity = -1;
+  let ambiguous = null;
+
+  for (const row of rows) {
+    for (const citation of citationsOf(row)) {
+      if (!covers(citation, ruleId)) continue;
+      if (citation.length > specificity) {
+        claimant = row.id;
+        specificity = citation.length;
+        ambiguous = null;
+      } else if (citation.length === specificity && row.id !== claimant) {
+        ambiguous = row.id;
+      }
+    }
+  }
+
+  if (ambiguous !== null) {
+    throw new Error(`[DocsLintBridge] Two rows claim lint rule ${ruleId} equally - ${claimant} and `
+      + `${ambiguous}. Fix: a finding is named by one row with one fix; make one citation more specific, `
+      + 'or delete the second row.');
+  }
+  return claimant;
+}
+
+/**
+ * Run the lint over one tree, once.
+ *
+ * @param {{ lintScript: string, docsDir: string, treeConfig: string }} params absolute paths
+ * @returns {{findings: Array<object>, skipped: Array<object>}|{problem: string}}
+ */
+function lintOnce({ lintScript, docsDir, treeConfig }) {
+  const key = [lintScript, docsDir, treeConfig].join('');
+  if (answers.has(key)) return answers.get(key);
+
+  const answer = runLint({ lintScript, docsDir, treeConfig });
+  answers.set(key, answer);
+  return answer;
+}
+
+/**
+ * @param {{ lintScript: string, docsDir: string, treeConfig: string }} params
+ * @returns {{findings: Array<object>, skipped: Array<object>}|{problem: string}}
+ */
+function runLint({ lintScript, docsDir, treeConfig }) {
+  const run = spawnSync(process.execPath, [lintScript, ...lintArgumentsFor({ docsDir, treeConfig })], {
+    // The lint derives its own roots from its location, never from the caller's
+    // directory; the checkout root is passed anyway so two runs from two shells
+    // are the same run (`automation-gates.md` §1.1).
+    cwd: path.resolve(path.dirname(lintScript), '..', '..'),
+    encoding: 'utf8',
+    timeout: LINT_TIMEOUT_MS,
+    maxBuffer: LINT_MAX_BUFFER
+  });
+
+  if (run.error) return { problem: `${run.error.message} (${lintScript})` };
+
+  // 0 = clean, 1 = findings; anything else is the lint refusing to run, and its
+  // reason is on stderr. A run that ended there is NOT an empty finding list.
+  if (run.status !== 0 && run.status !== 1) {
+    const said = String(run.stderr || run.stdout || '').trim().split('\n').filter(Boolean).pop();
+    return { problem: `the lint exited ${run.status === null ? 'on a signal' : run.status}: ${said || 'no output'}` };
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(run.stdout);
+  } catch (error) {
+    return { problem: `its JSON output could not be read: ${error.message}` };
+  }
+  if (!Array.isArray(parsed.findings) || !Array.isArray(parsed.skipped)) {
+    return { problem: 'its JSON output carries no "findings"/"skipped" arrays' };
+  }
+  return { findings: parsed.findings, skipped: parsed.skipped };
+}
+
+/**
+ * Is there a tree to lint at all?
+ *
+ * A service with no `docs/` is already a finding — `G-SETUP` demands the three
+ * installation documents — so a second row saying the same thing would be a
+ * duplicate with a different fix. Over a tree that exists and holds no document
+ * the lint has nothing to say, and neither has this row: PASS, not NOT RUN,
+ * because the question WAS asked and answered.
+ *
+ * @param {string} docsDir absolute
+ * @returns {boolean}
+ */
+function carriesDocuments(docsDir) {
+  if (!fs.existsSync(docsDir) || !fs.statSync(docsDir).isDirectory()) return false;
+
+  const pending = [docsDir];
+  while (pending.length > 0) {
+    const current = pending.pop();
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      if (entry.isDirectory()) pending.push(path.join(current, entry.name));
+      else if (entry.name.endsWith('.md')) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * The tree-bound configuration path this uniform's documentation block is
+ * invoked with — read from the ROW that owns the file, never written a second
+ * time beside it.
+ *
+ * The block names the row (`tree_config_row`) and the row names the path
+ * (`C-LINT.path`). Until d.215d the literal `config/biz-docs-lint.tree.json`
+ * stood in both places, and a rename would have had to find both
+ * (`api/.claude/rules/single-source-of-truth.md`).
+ *
+ * @param {object} block the documentation block
+ * @returns {string} repository-relative path
+ */
+function treeConfigOf(block) {
+  const declared = block && block.tree_config_row;
+  if (typeof declared !== 'string' || declared.length === 0) {
+    throw new Error('[DocsLintBridge] The documentation block names no "tree_config_row" - the lint refuses '
+      + 'a foreign tree that declares no budget of its own, so the check cannot be invoked without one. '
+      + 'Fix: declare tree_config_row in manifests/biz-service.manifest.json, naming the row whose path '
+      + 'is that budget.');
+  }
+
+  const owner = (Array.isArray(block.required) ? block.required : []).find((row) => row.id === declared);
+  if (owner === undefined || typeof owner.path !== 'string' || owner.path.length === 0) {
+    throw new Error(`[DocsLintBridge] The documentation block names row "${declared}" as the owner of the `
+      + 'tree budget, and no row of its "required" list carries that id with a "path". '
+      + 'Fix: name a row that declares the tree config file, or correct tree_config_row in '
+      + 'manifests/biz-service.manifest.json.');
+  }
+  return owner.path;
+}
+
+/**
+ * Ask the lint about one service tree, once, for whichever row is asking.
+ *
+ * Three answers, and every caller words them in its own sentence: the tree has
+ * nothing to lint, the question could not be decided (with the reason), or the
+ * lint's own payload.
+ *
+ * @param {{ block: object, serviceRoot: string, workspaceRoot: string }} params
+ * @returns {{nothingToLint: true}
+ *           |{undecidable: {relative: string, reason: string}}
+ *           |{answer: {findings: Array<object>, skipped: Array<object>}}}
+ */
+function askLint({ block, serviceRoot, workspaceRoot }) {
+  const docsDir = path.join(serviceRoot, DOCS_DIR);
+  if (!carriesDocuments(docsDir)) return { nothingToLint: true };
+
+  // The absent tree config is `C-LINT`'s finding, with its own fix; the
+  // sentence a caller builds from this is about the question that could not be
+  // decided because of it. The shape `contractBridge.js` uses for the
+  // unreadable contract.
+  const treeConfigRelative = treeConfigOf(block);
+  const treeConfig = path.join(serviceRoot, ...treeConfigRelative.split('/'));
+  if (!fs.existsSync(treeConfig)) {
+    return {
+      undecidable: {
+        relative: treeConfigRelative,
+        reason: 'the documentation lint refuses a tree that declares no budget of its own, '
+          + 'and this file is not there'
+      }
+    };
+  }
+
+  const answer = lintOnce({
+    lintScript: resolveWorkspacePath(workspaceRoot, LINT_SCRIPT),
+    docsDir,
+    treeConfig
+  });
+  if (answer.problem !== undefined) return { undecidable: { relative: DOCS_DIR, reason: answer.problem } };
+
+  return { answer };
+}
+
+const docsLint = Object.freeze({
+  scope: 'bearer',
+  requires: Object.freeze(['rule']),
+
+  requiresSiblings: () => [LINT_DIR],
+
+  describeNotRun() {
+    return `the workspace root is not reachable, so ${LINT_SCRIPT} cannot be run`;
+  },
+
+  /**
+   * @param {{ row: object, block: object, serviceRoot: string, workspaceRoot: string }} params
+   * @returns {Array<{where: string, what: string}>}
+   */
+  run({ row, block, serviceRoot, workspaceRoot }) {
+    const rows = rowsOf(block);
+    const citations = citationsOf(row);
+    const place = (relative) => whereOf({ scope: 'bearer', serviceRoot, workspaceRoot, relative });
+
+    const asked = askLint({ block, serviceRoot, workspaceRoot });
+    if (asked.nothingToLint === true) return [];
+    if (asked.undecidable !== undefined) {
+      return [{
+        where: place(asked.undecidable.relative),
+        what: `${row.rule} could not be decided — ${asked.undecidable.reason}`
+      }];
+    }
+    const answer = asked.answer;
+
+    const found = answer.findings
+      .filter((finding) => claimantOf(finding.rule, rows) === row.id)
+      .map((finding) => ({
+        where: `${place(`${DOCS_DIR}/${finding.file}`)}:${finding.line}`,
+        what: `${finding.rule}: ${summarise(finding.message)}`
+      }));
+
+    // A rule the lint could not evaluate is not a rule that passed — and it is
+    // not a FINDING either, which is what it used to be reported as. Measured
+    // 2026-09-10 over `git archive HEAD` into a checkout with no `api_biz`
+    // beside it (the shape of the CI job): the template mirror came back NOT
+    // DEPLOYABLE on two rows whose bans nobody had violated, because the
+    // evidence probe of `F002:http-ports` reads `api_biz/*/docker-compose.yml`
+    // and there was none to read. `U-ORPHAN` in the same run said the honest
+    // thing — NOT RUN, sibling root absent — and so does this now.
+    //
+    // The mapping is the linter's own two channels onto this uniform's two: its
+    // `findings` are findings, its `skipped` list is the NOT RUN one (that is
+    // what `--allow-missing-siblings` fills, and what its own text output prints
+    // as NOT RUN lines). A tree the linter REFUSES outright is neither — that
+    // is `answer.problem` above, and the absent tree config before it, both of
+    // which stay findings with a fix somebody can carry out.
+    //
+    // Collapsed into one reason per row: a checkout without siblings makes a
+    // dozen bans undecidable at once, and twelve identical sentences say nothing
+    // the first one does not.
+    const undecided = answer.skipped
+      .filter((entry) => citations.some((citation) => covers(citation, entry.rule)))
+      .filter((entry) => claimantOf(entry.rule, rows) === row.id);
+
+    if (undecided.length === 0) return found;
+
+    return {
+      findings: found,
+      notRun: `${undecided.map((entry) => entry.rule).join(', ')} could not be decided — `
+        + `${undecided[0].reason}`
+    };
+  }
+});
+
+/**
+ * `D-LINT` — the row that says the tree is clean, rather than clean of the five
+ * classes the rows above name.
+ *
+ * The rows above exist for their `fix` sentences: a localhost port, a dead
+ * script citation and a missing header are three different repairs, and a
+ * reader told only "the lint objects" would have to go and ask which. What they
+ * do NOT buy is coverage. Measured 2026-09-09 over the eight repositories: 80
+ * lint findings, of which 16 fell to a row — the other 64 were raised by rules
+ * this uniform stayed silent about, so a tree the documentation gate called
+ * broken came back DEPLOYABLE here. That silence is the defect
+ * `automation-gates.md` §5 names, and this row closes it: every error-graded
+ * finding the rows above do not already claim lands here, with the lint's own
+ * file, line and message.
+ *
+ * Two properties keep it honest and keep it from becoming a second rail:
+ *
+ *   - **it decides nothing.** The rules are BIZ-DOCS's, the grading is
+ *     BIZ-DOCS's, and this row cites `DOC-STANDARD.md` rather than restating a
+ *     single rule (confirmation `biz-service-manifest` 004 point 2). It cites no
+ *     rule id at all, which is why it is a check of its own: a citation list
+ *     here would have to be kept equal to the linter's, and would fall behind it
+ *     the first time BIZ-DOCS wrote a rule;
+ *   - **one finding still lands on exactly one row.** A finding a citing row
+ *     claims is that row's, with that row's fix; this one takes what is left.
+ *
+ * @see api/docs/biz/DOC-STANDARD.md
+ */
+const docsLintClean = Object.freeze({
+  scope: 'bearer',
+  requires: Object.freeze([]),
+
+  requiresSiblings: () => [LINT_DIR],
+
+  describeNotRun() {
+    return `the workspace root is not reachable, so ${LINT_SCRIPT} cannot be run`;
+  },
+
+  /**
+   * @param {{ block: object, serviceRoot: string, workspaceRoot: string }} params
+   * @returns {Array<{where: string, what: string}>|{findings: Array<object>, notRun: string}}
+   */
+  run({ block, serviceRoot, workspaceRoot }) {
+    const rows = rowsOf(block);
+    const place = (relative) => whereOf({ scope: 'bearer', serviceRoot, workspaceRoot, relative });
+
+    const asked = askLint({ block, serviceRoot, workspaceRoot });
+    if (asked.nothingToLint === true) return [];
+    if (asked.undecidable !== undefined) {
+      return [{
+        where: place(asked.undecidable.relative),
+        what: `no finding could be decided — ${asked.undecidable.reason}`
+      }];
+    }
+    const answer = asked.answer;
+
+    const found = errorGraded(answer.findings)
+      .filter((finding) => claimantOf(finding.rule, rows) === null)
+      .map((finding) => ({
+        where: `${place(`${DOCS_DIR}/${finding.file}`)}:${finding.line}`,
+        what: `${finding.rule}: ${summarise(finding.message)}`
+      }));
+
+    // Same two channels as the citing rows: a rule the lint could not evaluate
+    // is NOT RUN, never a silent pass and never a finding nobody can fix.
+    const undecided = answer.skipped.filter((entry) => claimantOf(entry.rule, rows) === null);
+    if (undecided.length === 0) return found;
+
+    return {
+      findings: found,
+      notRun: `${undecided.map((entry) => entry.rule).join(', ')} could not be decided — `
+        + `${undecided[0].reason}`
+    };
+  }
+});
+
+module.exports = {
+  checks: [
+    { name: 'docs-lint', check: docsLint },
+    { name: 'docs-lint-clean', check: docsLintClean }
+  ],
+  claimantOf,
+  citationsOf,
+  covers,
+  errorGraded,
+  LINT_SCRIPT,
+  LINT_DIR
+};

package/src/manifest/checks/fileAbsent.js

@@ -0,0 +1,35 @@
+'use strict';
+
+/**
+ * `file-absent` — the file the uniform forbids must not be in the repository.
+ *
+ * The whole rule is the row: which path, why it is forbidden, and the command
+ * that removes it. This module only looks.
+ *
+ * @see api/docs/governance/confirmations/biz-service-manifest.md §5
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const check = Object.freeze({
+  scope: 'service',
+  requires: Object.freeze(['path']),
+
+  /**
+   * @param {{ row: object, serviceRoot: string }} params
+   * @returns {Array<{where: string, what: string}>}
+   */
+  run({ row, serviceRoot }) {
+    const target = path.join(serviceRoot, ...row.path.split('/'));
+    if (!fs.existsSync(target)) return [];
+
+    const because = row.why ? `: ${row.why}` : '';
+    return [{
+      where: row.path,
+      what: `file present — this uniform forbids it${because}`
+    }];
+  }
+});
+
+module.exports = { name: 'file-absent', check };