@onlineapps/conn-orch-validator 6.0.1 → 8.0.0

package/src/manifest/checks/gitTracked.js

@@ -0,0 +1,204 @@
+'use strict';
+
+/**
+ * `git-tracked` — a file this uniform REQUIRES must reach a clean clone.
+ *
+ * Finding 19 of the controller (`api/shared/TODO.md`), on the owner's words about
+ * `.gitignore`: "biz služba by neměla mít právo ignorovat nic závažného, co
+ * uniforma vyžaduje". It is not a theory. Measured 2026-09-10 on a copy of
+ * converter outside the repository: with `init.sh` and `jest.config.js` added to
+ * `.gitignore` and still on disk, `F-INIT` and `F-JEST` reported NOTHING —
+ * because every file row reads the WORKING TREE. Delete the same two files, the
+ * state a clean clone and the production image are actually in, and both rows
+ * fire and the service is NOT DEPLOYABLE.
+ *
+ * Developer green, CI and image red. It is the same class as the pathspec-commit
+ * trap the workspace has already paid for once
+ * (`.claude/rules/shared-working-tree.md` § Past untracked souborů), one layer
+ * down: what git will hand to the next reader is not what the checker looked at.
+ *
+ * WHICH PATHS. The ones the manifest already names — `files.identical`,
+ * `files.contains` and `files.generated` — read from the block this row sits in,
+ * so there is NO second list here and adding a file row extends this one too
+ * (confirmation `biz-service-manifest` 004 point 2). `files.forbidden` is
+ * deliberately excluded: demanding that a banned file be tracked would be a
+ * contradiction. So is `files.own`, whose whole meaning is that the service
+ * decides.
+ *
+ * A named path that is a DIRECTORY covers every file under it. `scripts/` is the
+ * case that makes the difference: `S-SCRIPTS` lints the headers of the scripts
+ * it finds on disk, and a script the clone never receives is linted here and
+ * missing there.
+ *
+ * TRACKED is the question, not IGNORED. A tracked file matching a `.gitignore`
+ * line is harmless — git ignores the rule for it — while an untracked file is
+ * gone from the clone whether a rule covers it or not. `git check-ignore` is
+ * asked only about the files that already failed, because that is where it turns
+ * "this is missing" into "delete this line".
+ *
+ * OUTSIDE A GIT CHECKOUT the row is NOT RUN with that reason — never a pass. A
+ * service container and an exported tarball carry no `.git`, and answering "all
+ * tracked" there would be the false guarantee `automation-gates.md` §5 names.
+ *
+ * @see api/docs/governance/confirmations/biz-service-manifest.md §2
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+/** Never walked: neither is part of a repository's declared shape. */
+const NEVER_WALKED = Object.freeze(['node_modules', '.git']);
+
+/** The file classes whose rows REQUIRE a path to be there. */
+const REQUIRING_CLASSES = Object.freeze(['identical', 'contains', 'generated']);
+
+/**
+ * Run one git command in the repository, or return null when git itself could
+ * not answer. Nothing here guesses: the caller turns a null into NOT RUN.
+ *
+ * @param {string} serviceRoot
+ * @param {string[]} args
+ * @param {string} [input]
+ * @returns {string|null}
+ */
+function git(serviceRoot, args, input = undefined) {
+  try {
+    return execFileSync('git', ['-C', serviceRoot, ...args], {
+      encoding: 'utf8',
+      input,
+      stdio: ['pipe', 'pipe', 'pipe']
+    });
+  } catch (error) {
+    // check-ignore exits 1 when nothing matched, which is an ANSWER.
+    if (error.status === 1 && typeof error.stdout === 'string') return error.stdout;
+    return null;
+  }
+}
+
+/**
+ * Does the path exist under EXACTLY this spelling?
+ *
+ * `fs.existsSync` is the wrong question on macOS and on Windows: the filesystem
+ * is case-insensitive, git's index is not. Measured 2026-09-11 against property,
+ * whose setup documents are committed as `docs/80-setup/install.md` while the row
+ * `G-SETUP-INSTALL` names `docs/80-setup/INSTALL.md` — `existsSync` said yes,
+ * `git ls-files` said no, and this row reported two untracked files that are
+ * tracked. A finding nobody can act on is the defect `automation-gates.md` §5
+ * names, and here it would also hide the real one: a name a row does not match
+ * is ABSENT, which is the file row's own finding and not this one's.
+ *
+ * @param {string} serviceRoot
+ * @param {string[]} segments the path, split
+ * @returns {boolean}
+ */
+function existsExactly(serviceRoot, segments) {
+  let dir = serviceRoot;
+  for (const [index, segment] of segments.entries()) {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return false;
+    }
+    const entry = entries.find((candidate) => candidate.name === segment);
+    if (entry === undefined) return false;
+    if (index < segments.length - 1 && !entry.isDirectory()) return false;
+    dir = path.join(dir, segment);
+  }
+  return true;
+}
+
+/**
+ * Every file under `relative`, repository-relative, `/`-separated. A path naming
+ * one file answers with itself; one naming a directory answers with its tree.
+ *
+ * @param {string} serviceRoot
+ * @param {string} relative as the row writes it, with or without a trailing slash
+ * @returns {string[]}
+ */
+function filesUnder(serviceRoot, relative) {
+  const trimmed = relative.replace(/\/+$/, '');
+  const absolute = path.join(serviceRoot, ...trimmed.split('/'));
+  if (!existsExactly(serviceRoot, trimmed.split('/'))) return [];
+  if (fs.statSync(absolute).isFile()) return [trimmed];
+
+  const found = [];
+  const descend = (dir, prefix) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (NEVER_WALKED.includes(entry.name)) continue;
+      const next = `${prefix}/${entry.name}`;
+      if (entry.isDirectory()) descend(path.join(dir, entry.name), next);
+      else if (entry.isFile()) found.push(next);
+    }
+  };
+  descend(absolute, trimmed);
+  return found;
+}
+
+/**
+ * The paths the manifest requires, from the block this row belongs to.
+ *
+ * @param {object} block the `files` object
+ * @returns {string[]}
+ */
+function requiredPaths(block) {
+  const paths = new Set();
+  for (const name of REQUIRING_CLASSES) {
+    for (const row of Array.isArray(block[name]) ? block[name] : []) {
+      if (typeof row.path === 'string' && row.path.length > 0) paths.add(row.path);
+    }
+  }
+  return [...paths].sort();
+}
+
+const check = Object.freeze({
+  scope: 'service',
+  requires: Object.freeze([]),
+
+  /**
+   * @param {{ block: object, serviceRoot: string }} params
+   * @returns {{findings: Array<{where: string, what: string}>, notRun: string|null}}
+   */
+  run({ block, serviceRoot }) {
+    const listed = git(serviceRoot, ['ls-files', '-z']);
+    if (listed === null) {
+      return {
+        findings: [],
+        notRun: 'this tree is not a git checkout (git ls-files could not answer), so what a clone '
+          + 'would receive cannot be read — a container and an exported tarball are in exactly this state'
+      };
+    }
+
+    const tracked = new Set(listed.split('\0').filter((entry) => entry.length > 0));
+
+    const candidates = requiredPaths(block).flatMap((relative) => filesUnder(serviceRoot, relative)
+      .map((file) => ({ file, declared: relative })));
+
+    const missing = candidates.filter(({ file }) => !tracked.has(file));
+    if (missing.length === 0) return { findings: [], notRun: null };
+
+    // Only now, and only for those: which of them a .gitignore rule covers is
+    // what turns the finding into an edit the reader can make.
+    const answered = git(serviceRoot, ['check-ignore', '--stdin', '-z'], missing.map(({ file }) => file).join('\0'));
+    const ignored = new Set((answered === null ? '' : answered).split('\0').filter((entry) => entry.length > 0));
+
+    return {
+      findings: missing.map(({ file, declared }) => ({
+        where: file,
+        what: ignored.has(file)
+          ? `git does not track it and .gitignore covers it — the uniform requires ${declared}, so a clone, `
+            + 'a CI checkout and the production image get a repository without this file while this working '
+            + 'tree reports it present'
+          : `git does not track it — the uniform requires ${declared}, so a clone, a CI checkout and the `
+            + 'production image get a repository without this file while this working tree reports it present'
+      })),
+      notRun: null
+    };
+  }
+});
+
+// `existsExactly` is exported for the one other place that asks whether a file
+// exists under the name the contract spells (installContract.js) — one rail for
+// the case-insensitive-filesystem trap, not a second copy of it.
+module.exports = { name: 'git-tracked', check, existsExactly };

package/src/manifest/checks/index.js

@@ -0,0 +1,111 @@
+'use strict';
+
+/**
+ * The registry of checks a manifest row may name.
+ *
+ * A row is a DECLARATION (`id`, `severity`, `owner`, `fix`, `doc`) plus the name
+ * of the check that decides it. The check is the code. Keeping the two apart is
+ * what makes the manifest extensible by one row and keeps the rules of service
+ * and library shape in one place instead of two.
+ *
+ * Every entry states:
+ *   - `scope`   — one of the three words `manifestShape.js` § CHECK_SCOPES
+ *                 defines: `service` (the bearer's root is enough), `workspace`
+ *                 (the check reports about the workspace itself) or `bearer`
+ *                 (the check reports about one bearer and needs the workspace
+ *                 only to read its `from:` reference — so it runs once per
+ *                 discovered bearer in a workspace run). The last two are NOT
+ *                 RUN where the workspace is unreachable;
+ *   - `requires` — the row fields the check reads, verified by the shape check
+ *                 before anything runs, so a check never sees a missing param;
+ *   - `requiresSiblings({ row, block })` — OPTIONAL; the workspace-relative
+ *                 directories this check will walk. The runner verifies they
+ *                 exist BEFORE running it and reports NOT RUN otherwise, so a
+ *                 check that walks an absent directory never reports the empty
+ *                 set as an answer. Derive them from the row or the block
+ *                 (`rootOfPattern`), never restate a name the row already
+ *                 carries;
+ *   - `run({ row, block, serviceRoot, workspaceRoot })` — returns
+ *                 `[{ where, what }]`, one per finding; the runner adds the
+ *                 row's own id, severity, fix, owner and doc.
+ *
+ * This is the bridge to the checkers this package already has, and the reason
+ * they are not rewritten: a row such as
+ *   `{ "id": "R-PORTS", "check": "deploy-contract", "requirement": "R4", … }`
+ * needs one registry entry that calls `verifyDeployContract(serviceRoot)` and
+ * keeps the violations of that requirement — no rule moves into the manifest,
+ * the manifest only names it (confirmation biz-service-manifest 004 point 4).
+ * The rows citing the existing contracts land with d.210.
+ *
+ * A module registers either one check (`{ name, check }`) or several
+ * (`{ checks: [{ name, check }, …] }`); grouping the rows of one concern in one
+ * file is what keeps the library family readable.
+ */
+
+const fileAbsent = require('./fileAbsent');
+const gitTracked = require('./gitTracked');
+const discoveryOrphan = require('./discoveryOrphan');
+const contractBridge = require('./contractBridge');
+const docsLintBridge = require('./docsLintBridge');
+const serviceFiles = require('./serviceFiles');
+const serviceScripts = require('./serviceScripts');
+const scriptHeaders = require('./scriptHeaders');
+const serviceConfig = require('./serviceConfig');
+const serviceConnectors = require('./serviceConnectors');
+const serviceIdentityRows = require('./serviceIdentityRows');
+const serviceRuntime = require('./serviceRuntime');
+const serviceDb = require('./serviceDb');
+const libraryPackage = require('./libraryPackage');
+const libraryTests = require('./libraryTests');
+const libraryDocs = require('./libraryDocs');
+const librarySource = require('./librarySource');
+const libraryWorkspace = require('./libraryWorkspace');
+const readmeRegion = require('./readmeRegion');
+const { CHECK_SCOPES } = require('../manifestShape');
+
+const MODULES = Object.freeze([
+  fileAbsent,
+  gitTracked,
+  discoveryOrphan,
+  contractBridge,
+  docsLintBridge,
+  serviceFiles,
+  serviceScripts,
+  scriptHeaders,
+  serviceConfig,
+  serviceConnectors,
+  serviceIdentityRows,
+  serviceRuntime,
+  serviceDb,
+  libraryPackage,
+  libraryTests,
+  libraryDocs,
+  librarySource,
+  libraryWorkspace,
+  readmeRegion
+]);
+
+const registry = {};
+for (const module of MODULES) {
+  const entries = Array.isArray(module.checks) ? module.checks : [{ name: module.name, check: module.check }];
+  for (const { name, check } of entries) {
+    // Fail-fast at registration, not at the first run that needs it: a check
+    // whose scope the runner does not know would be placed nowhere, and the
+    // report of a run that placed it nowhere is indistinguishable from the
+    // report of a run in which it found nothing (`automation-gates.md` §5).
+    if (!CHECK_SCOPES.includes(check.scope)) {
+      throw new Error(`[CheckRegistry] Check declares an unknown scope - "${name}" states `
+        + `${JSON.stringify(check.scope)}. `
+        + `Fix: declare one of ${CHECK_SCOPES.join(', ')} (see manifestShape.js § CHECK_SCOPES).`);
+    }
+    if (registry[name] !== undefined) {
+      throw new Error(`[CheckRegistry] Check name registered twice - "${name}". `
+        + 'Fix: a finding is named by its row and decided by exactly one check; rename one of them.');
+    }
+    registry[name] = check;
+  }
+}
+
+const CHECK_REGISTRY = Object.freeze(registry);
+
+module.exports = { CHECK_REGISTRY };

package/src/manifest/checks/libraryContext.js

@@ -0,0 +1,226 @@
+'use strict';
+
+/**
+ * What every library row needs before it can decide anything: the package's own
+ * `package.json`, the category it declares, and a `where` a human can act on.
+ *
+ * This module holds no rule. Each rule is one check module plus the manifest row
+ * that declares it; keeping the reading here is what stops five checks from
+ * parsing the same file five different ways.
+ *
+ * @see api/docs/governance/confirmations/biz-service-manifest.md §11
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { CHECK_SCOPES } = require('../manifestShape');
+
+/** The scopes whose `where` is read from the workspace root — every one but `service`. */
+const WORKSPACE_RELATIVE_SCOPES = Object.freeze(CHECK_SCOPES.filter((scope) => scope !== 'service'));
+
+/** The scope that answers about ONE bearer, and can do so without a workspace (d.229). */
+const BEARER_SCOPE = 'bearer';
+
+/** The scope prefix of every package this platform owns. */
+const SCOPE = '@onlineapps/';
+
+/** Where a category-scoped duty section says which category it belongs to. */
+const ALL_CATEGORIES = '*';
+
+/**
+ * Read a JSON file, or `null` when it is absent. A file that IS there but is not
+ * JSON stops the run: that is damage, and hiding it behind a `null` would make a
+ * broken package look conformant.
+ *
+ * @param {string} file absolute path
+ * @returns {object|null}
+ */
+function readJson(file) {
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (cause) {
+    throw new Error(`[LibraryManifest] File is not valid JSON - ${file}. `
+      + 'Fix: repair the file; every library row reads it as the package declaration.', { cause });
+  }
+}
+
+/**
+ * Read a text file, or `null` when it is absent.
+ *
+ * @param {string} file absolute path
+ * @returns {string|null}
+ */
+function readText(file) {
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The package declaration of the library being checked.
+ *
+ * A workspace-mode run has no package root at all (`runManifest.js` § The two
+ * modes): the whole-set rows still run, and the per-package ones find nothing to
+ * read and raise nothing. That is not a pass being hidden — in that mode those
+ * rows have no bearer to judge, and every bearer gets its own run.
+ *
+ * @param {string|null} serviceRoot the package directory, or null in workspace mode
+ * @returns {{ json: object|null, file: string|null }}
+ */
+function readPackage(serviceRoot) {
+  if (typeof serviceRoot !== 'string' || serviceRoot.length === 0) return { json: null, file: null };
+  const file = path.join(serviceRoot, 'package.json');
+  return { json: readJson(file), file };
+}
+
+/**
+ * Where a finding points, as a path a human can paste into an editor.
+ *
+ * The reference point is the check's own scope, and `runManifest` depends on it:
+ * a `scope: service` check reports relative to the package root, a
+ * `scope: workspace` check relative to the workspace root, because that is what
+ * lets a service-mode run keep the workspace findings that are about THIS
+ * package and drop its neighbours' (`runManifest.js` § The two modes).
+ *
+ * A `scope: bearer` check places its finding the same way a workspace one does,
+ * and for a reason of its own: the SAME row answers for several bearers in a
+ * workspace run, so a path relative to "the package" would name four files
+ * `package.json` and tell nobody which package is drifting.
+ *
+ * That reason has a limit, and since d.229 a run reaches it: a bearer row whose
+ * reference is a file this package carries runs with NO workspace at all — in a
+ * service container there is none. There is then exactly one bearer, nothing to
+ * tell apart, and no root to be relative TO, so the finding names the file the
+ * way the repository does. The same holds for a bearer root that lies outside
+ * the workspace given: `../../elsewhere/init.sh` names the file no better than
+ * `init.sh` and reads as a defect of the run.
+ *
+ * A `scope: workspace` check keeps the strict rule — it reports ABOUT the
+ * workspace, so without one it must not report at all.
+ *
+ * @param {{ scope: string, serviceRoot: string, workspaceRoot: string|null, relative?: string }} params
+ * @returns {string}
+ */
+function whereOf({ scope, serviceRoot, workspaceRoot, relative = '' }) {
+  if (scope === 'service') return relative;
+  if (!WORKSPACE_RELATIVE_SCOPES.includes(scope)) {
+    throw new Error(`[LibraryManifest] Unknown check scope - whereOf({ scope }) got ${JSON.stringify(scope)}. `
+      + `Fix: pass one of ${CHECK_SCOPES.join(', ')}, the scopes the check registry knows.`);
+  }
+  const placeable = workspaceRoot !== null && workspaceRoot !== undefined;
+  if (!placeable && scope !== BEARER_SCOPE) {
+    throw new Error(`[LibraryManifest] ${scope}-scoped finding without a workspace root - whereOf() cannot `
+      + 'place it. Fix: such a check runs only when the workspace root resolved.');
+  }
+
+  const dir = placeable
+    ? path.relative(workspaceRoot, path.resolve(serviceRoot)).split(path.sep).join('/')
+    : '';
+  if (dir === '' || dir.startsWith('..')) return relative;
+  return relative ? `${dir}/${relative}` : dir;
+}
+
+/**
+ * The category the package DECLARES. It is the one fact about a library that
+ * cannot be derived — the intent — so its absence is a finding of `U-MISMATCH`
+ * and never a default (confirmation `biz-service-manifest` 005 point 3).
+ *
+ * @param {object|null} pkg parsed package.json
+ * @returns {string|null}
+ */
+function declaredCategory(pkg) {
+  const declared = pkg && pkg.oa ? pkg.oa.category : undefined;
+  return typeof declared === 'string' && declared.length > 0 ? declared : null;
+}
+
+/**
+ * Does this duty section apply to this package? `applies_to: "*"` is every
+ * library; a category name applies to the package that declares that category.
+ *
+ * A package with NO declaration matches no category section. It is not silently
+ * excused: `U-MISMATCH` fires on the same run with severity `publish`, so the
+ * package is blocked before any category duty could have mattered.
+ *
+ * @param {object} block the duty section the row lives in
+ * @param {object|null} pkg parsed package.json
+ * @returns {boolean}
+ */
+function appliesTo(block, pkg) {
+  const target = block && block.applies_to;
+  if (target === ALL_CATEGORIES) return true;
+  return declaredCategory(pkg) === target;
+}
+
+/**
+ * Every entry of the sections asked for, whoever owns the package.
+ *
+ * @param {object|null} pkg parsed package.json
+ * @param {string[]} sections which dependency sections to read
+ * @returns {Array<{name: string, spec: string, section: string}>}
+ */
+function allDeps(pkg, sections) {
+  const found = [];
+  for (const section of sections) {
+    const block = pkg && pkg[section];
+    if (!block || typeof block !== 'object') continue;
+    for (const [name, spec] of Object.entries(block)) found.push({ name, spec: String(spec), section });
+  }
+  return found;
+}
+
+/**
+ * The `@onlineapps/*` entries of the sections asked for.
+ *
+ * `dependencies` alone answers "what does this package pull into a runtime" —
+ * the layer question. `dependencies` + `devDependencies` answers "which versions
+ * does this package pin", which is the question `scripts/ci/verify-manifest-pins.mjs`
+ * asks over the same files, and the two rows agree on the sections deliberately.
+ *
+ * The scope is what the SSOT owns: `api/config/libraries.json` decides the
+ * version of an `@onlineapps` package and of no other, so a range on a
+ * third-party dependency is a judgement no row here can make. `file:` is the
+ * exception, and it is not scoped at all — see `libraryPackage.js`
+ * § `libraryDepRange`.
+ *
+ * @param {object|null} pkg parsed package.json
+ * @param {string[]} sections which dependency sections to read
+ * @returns {Array<{name: string, spec: string, section: string}>}
+ */
+function scopedDeps(pkg, sections) {
+  return allDeps(pkg, sections).filter(({ name }) => name.startsWith(SCOPE));
+}
+
+/**
+ * The major of a Node version range, whatever shape it is written in
+ * (`24`, `^24`, `>=24.0.0 <25`, `24.x`).
+ *
+ * @param {string} range
+ * @returns {number|null}
+ */
+function nodeMajorOf(range) {
+  const match = /(\d+)/.exec(String(range));
+  return match === null ? null : Number(match[1]);
+}
+
+module.exports = {
+  SCOPE,
+  ALL_CATEGORIES,
+  readJson,
+  readText,
+  readPackage,
+  whereOf,
+  declaredCategory,
+  appliesTo,
+  allDeps,
+  scopedDeps,
+  nodeMajorOf
+};

package/src/manifest/checks/libraryDocs.js

@@ -0,0 +1,75 @@
+'use strict';
+
+/**
+ * The two documentation rows: a file the uniform requires must be there, and the
+ * README must carry the node header that makes its ownership a machine answer.
+ *
+ * `file-present` is the mirror of `file-absent` and takes the same one parameter,
+ * so a future "this uniform requires X" needs a row and no code.
+ *
+ * @see api/docs/standards/INFRA-DOC-STANDARD.md
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { readPackage, readText, whereOf, appliesTo } = require('./libraryContext');
+
+/**
+ * The node header, in the blockquote shape the infra standard fixes. `Owns:` must
+ * carry a value - an empty label names no fact class and answers nothing. `Parent:`
+ * is neither required nor forbidden: a library's parent is the rendered category
+ * line, and a hand-written copy of it would be a second owner of one fact.
+ */
+const OWNS = /^>[ \t]*Owns:[ \t]*\S/m;
+const STATUS = /^>[ \t]*Status:[ \t]*(\S+)/m;
+const STATUS_VALUES = Object.freeze(['current', 'draft', 'archived']);
+
+const filePresent = Object.freeze({
+  scope: 'service',
+  requires: Object.freeze(['path']),
+
+  run({ row, block, serviceRoot, workspaceRoot }) {
+    const { json } = readPackage(serviceRoot);
+    if (json !== null && !appliesTo(block, json)) return [];
+
+    const where = whereOf({ scope: 'service', serviceRoot, workspaceRoot, relative: row.path });
+    if (fs.existsSync(path.join(serviceRoot, ...row.path.split('/')))) return [];
+
+    const because = row.why ? `: ${row.why}` : '';
+    return [{ where, what: `file absent — this uniform requires it${because}` }];
+  }
+});
+
+const libraryReadme = Object.freeze({
+  scope: 'service',
+  requires: Object.freeze([]),
+
+  run({ block, serviceRoot, workspaceRoot }) {
+    const { json } = readPackage(serviceRoot);
+    if (json === null || !appliesTo(block, json)) return [];
+
+    const where = whereOf({ scope: 'service', serviceRoot, workspaceRoot, relative: 'README.md' });
+    const body = readText(path.join(serviceRoot, 'README.md'));
+    if (body === null) return [{ where, what: 'README.md is absent — the package documents nothing' }];
+
+    const problems = [];
+    if (!OWNS.test(body)) problems.push('no "> Owns:" line');
+
+    const status = STATUS.exec(body);
+    if (status === null) problems.push('no "> Status:" line');
+    else if (!STATUS_VALUES.includes(status[1])) {
+      problems.push(`Status "${status[1]}" is not one of ${STATUS_VALUES.join(', ')}`);
+    }
+
+    if (problems.length === 0) return [];
+    return [{ where, what: `the node header does not hold: ${problems.join('; ')}` }];
+  }
+});
+
+module.exports = {
+  checks: [
+    { name: 'file-present', check: filePresent },
+    { name: 'library-readme', check: libraryReadme }
+  ]
+};