@onlineapps/conn-orch-validator 9.0.0 → 11.0.0

package/src/utils/dbAccountGrants.js

@@ -0,0 +1,126 @@
+'use strict';
+
+/**
+ * The one definition of a biz service's database account.
+ *
+ * Owner decision `db-accounts-per-service` 001: every service reaches its schema
+ * as ITSELF, with grants on its own schemas, and root stops being an operational
+ * identity. `db-migrations-first-deploy` 001 says what that is worth — "migrace
+ * nikdy pod rootem" (:32) — and, in the same breath, "žádný nový generátor SQL …
+ * žádná druhá kolej" (:33). So these statements exist ONCE: the production
+ * runbook (`api/docs/setup/INSTALL.md` § the account and its grants) and
+ * `biz-ci-gate setup-db-account` are two CALLERS of this function, not two
+ * copies of the same SQL.
+ *
+ * `createDatabaseSql` in `setupDatabase.js` stays where it is and is not
+ * re-exported here: creating the SCHEMA and creating the ACCOUNT are two
+ * concerns with two moments (the account exists before the schema in CI, and is
+ * created by the operator before the installer runs in production).
+ *
+ * ## The one difference between CI and production
+ *
+ * An integration suite builds THROWAWAY schemas beside the declared one —
+ * `src/utils/throwawaySchema.js`, used today as `oagen_emailer_fixture_<ms>_<pid>`
+ * (`api_biz/emailer/tests/integration/fixtureSchema.js`) and
+ * `oagen_meta_platformseedtest` (`api_biz/meta`). A grant on `oagen_emailer`
+ * alone refuses every one of them, which is why `ciThrowaway: true` adds a
+ * second grant over the service's own namespace.
+ *
+ * It does NOT widen the account's reach to another service: the pattern is
+ * anchored on this schema's name, and the `_` is ESCAPED. Unescaped, `_` is a
+ * single-character LIKE wildcard, so `oagen_meta_%` would also match
+ * `oagen_metadata` — a neighbouring service handed over whole. The backslash is
+ * what keeps the grant inside one service, and it is the difference
+ * `tests/unit/dbAccountGrants.test.js` measures.
+ *
+ * Production never gets that grant: it installs one schema, and a wildcard there
+ * would be a standing privilege nobody asked for.
+ *
+ * ## What is deliberately NOT here
+ *
+ * `GRANT SELECT ON information_schema.*` — the privilege
+ * `setupDatabase.assertTargetIsEmpty` names in its own error message. The server
+ * refuses to grant it at all (measured 2026-09-16, dev `gen_mariadb10.5`,
+ * MariaDB 10.5.17: `ERROR 1044 (42000): Access denied for user 'root'@'localhost'
+ * to database 'information_schema'`). Every account reads that catalogue
+ * already, filtered to the schemas it is granted — which is precisely the answer
+ * the emptiness probe needs.
+ *
+ * @see api/docs/governance/confirmations/db-accounts-per-service.md
+ * @see api/docs/governance/confirmations/db-migrations-first-deploy.md
+ * @see src/utils/setupDatabase.js
+ */
+
+/**
+ * The host part of every account. One value, because a second spelling is a
+ * second account: `'x'@'%'` and `'x'@'localhost'` are different rows in
+ * `mysql.user`, with different grants, and an installer that picked one while
+ * the gate created the other would report an account the service cannot use.
+ */
+const ACCOUNT_HOST = '%';
+
+/**
+ * Identifiers and passwords reach the server as TEXT, so they are checked rather
+ * than escaped: an identifier in this platform is `oagen_<shortname>`, and
+ * anything carrying a quote, a backslash or a backtick is not one.
+ *
+ * Refusing is the whole of the answer (`architecture-principles.md` §3): a value
+ * that needs escaping here came from somewhere it should not have.
+ */
+const FORBIDDEN_IN_VALUE = /['"`\\;\n\r]/;
+
+function requireValue(value, name, fix) {
+  if (typeof value !== 'string' || value === '') {
+    throw new Error(`[DbAccountGrants] Missing ${name} - Expected a non-empty value.\n`
+      + `       Fix: ${fix}`);
+  }
+  if (FORBIDDEN_IN_VALUE.test(value)) {
+    throw new Error(`[DbAccountGrants] ${name} carries a character these statements cannot contain: `
+      + `${JSON.stringify(value)}.\n`
+      + '       The statements are text handed to the SQL client, so a quote, backslash, backtick, '
+      + 'semicolon or newline would end one statement and start another.\n'
+      + `       Fix: ${fix}`);
+  }
+  return value;
+}
+
+/**
+ * Every statement that creates this service's account and grants it what it
+ * needs, in the order they must run.
+ *
+ * @param {object} options
+ * @param {string} options.schema the schema the service declares
+ *   (`database.schema` of `config/service/integration-contract.json`)
+ * @param {string} options.account the account the service declares
+ *   (`DB_USER` of `config/env-templates/<service>.env`)
+ * @param {string} options.password the password the account is created with
+ * @param {boolean} [options.ciThrowaway] also grant the throwaway namespace
+ *   `<schema>\_%`, which only an integration tier builds into
+ * @returns {string[]} the statements, in order
+ */
+function databaseAccountSql({ schema, account, password, ciThrowaway = false } = {}) {
+  requireValue(schema, 'schema', 'pass database.schema from config/service/integration-contract.json.');
+  requireValue(account, 'account', 'pass DB_USER from this service\'s config/env-templates/<service>.env.');
+  requireValue(password, 'password', 'pass the password the account is created with; an account created '
+    + 'with an empty password is one anybody on the network can use.');
+
+  const identity = `'${account}'@'${ACCOUNT_HOST}'`;
+
+  const statements = [
+    `CREATE USER IF NOT EXISTS ${identity} IDENTIFIED BY '${password}';`,
+    `GRANT ALL PRIVILEGES ON \`${schema}\`.* TO ${identity};`
+  ];
+
+  if (ciThrowaway === true) {
+    // The backslash escapes `_` so the pattern stays inside this service; see
+    // the head of this file for the neighbour it would otherwise reach.
+    statements.push(`GRANT ALL PRIVILEGES ON \`${schema}\\_%\`.* TO ${identity};`);
+  }
+
+  // Last, always: a grant is not live for a connection opened before it.
+  statements.push('FLUSH PRIVILEGES;');
+
+  return statements;
+}
+
+module.exports = { databaseAccountSql, ACCOUNT_HOST };

package/src/utils/envContract.js

@@ -378,17 +378,26 @@ function assertScannableServiceRoot(serviceRoot) {
 }
 
 /**
- * COMPLETENESS: every environment name the repository visibly reads is either
- * declared in the env block or covered by M1/M2.
+ * The names this service's environment is ALLOWED to be judged by: everything
+ * the declaration names, plus everything M1/M2 already cover.
+ *
+ * It is the set `verifyEnvCompleteness` measures the repository against, lifted
+ * out of it so a second caller cannot grow a second definition of it (d.533c;
+ * `change-discipline.md` § One rail per concern). The completeness check below
+ * asks the same question from the other side — which read is NOT in this set —
+ * and `oa-validate --env-reads` prints the set itself, for the deploy gate that
+ * must not demand a value for a name this service never reads.
+ *
+ * Sorted with the default comparator rather than `localeCompare`: the order is
+ * read by a machine, and a collation that depends on the host's locale data is
+ * the ambient state `automation-gates.md` §1.1 forbids.
  *
  * @param {object} args
  * @param {string} args.serviceRoot
  * @param {object} args.contract normalized integration contract
- * @returns {{ok: boolean, violations: Array<{name: string, sources: string[]}>, declaredCount: number,
- *            coveredCount: number, readCount: number, filesScanned: number,
- *            dynamicSites: Array<{file: string, line: number}>}}
+ * @returns {{names: string[], coverage: Map<string,string>, declared: Set<string>}}
  */
-function verifyEnvCompleteness({ serviceRoot, contract }) {
+function collectDeclaredEnvNames({ serviceRoot, contract }) {
   assertScannableServiceRoot(serviceRoot);
   assertNormalizedContract(contract);
 
@@ -409,6 +418,26 @@ function verifyEnvCompleteness({ serviceRoot, contract }) {
     for (const item of declaration?.[listKey] ?? []) declared.add(item.name);
   }
 
+  const names = new Set(coverage.keys());
+  for (const name of declared) names.add(name);
+
+  return { names: [...names].sort(), coverage, declared };
+}
+
+/**
+ * COMPLETENESS: every environment name the repository visibly reads is either
+ * declared in the env block or covered by M1/M2.
+ *
+ * @param {object} args
+ * @param {string} args.serviceRoot
+ * @param {object} args.contract normalized integration contract
+ * @returns {{ok: boolean, violations: Array<{name: string, sources: string[]}>, declaredCount: number,
+ *            coveredCount: number, readCount: number, filesScanned: number,
+ *            dynamicSites: Array<{file: string, line: number}>}}
+ */
+function verifyEnvCompleteness({ serviceRoot, contract }) {
+  const { coverage, declared } = collectDeclaredEnvNames({ serviceRoot, contract });
+
   const { reads, dynamicSites, filesScanned } = collectEnvReads({ serviceRoot });
 
   const violations = [];
@@ -467,6 +496,7 @@ module.exports = {
   ENV_SCAN_BLIND_SPOTS,
   normalizeEnvDeclaration,
   collectEnvCoverage,
+  collectDeclaredEnvNames,
   collectEnvReads,
   verifyEnvCompleteness,
   verifyEnvPresence

package/src/utils/envReads.js

@@ -0,0 +1,102 @@
+'use strict';
+
+/**
+ * Which environment names a service's image reads — asked by a deploy gate,
+ * answered by the contract (d.533c).
+ *
+ * ## The defect this ends
+ *
+ * `api/scripts/validate-env.sh` refuses a deploy when a key in the target's
+ * `.env` still says `CHANGE_ME`. Pointed at a biz service it refused on
+ * `JWT_SECRET`, a key the gateway reads and no biz image ever opens: the gate
+ * was judging the platform's whole key set against one service. The fix is not
+ * a list of exceptions in bash — it is the service saying what it reads.
+ *
+ * ## Why not a grep for `process.env`
+ *
+ * Because most of the platform's environment is read inside installed
+ * libraries: `@onlineapps/service-wrapper` reads `SECRETS_MASTER_KEYS`,
+ * `@onlineapps/conn-base-cache` reads `REDIS_URL`. A grep over `src/` sees none
+ * of them and would answer a set too small — which in a gate means a key
+ * silently unchecked. That blind spot is stated, not discovered:
+ * `utils/envContract.js` § Measurability boundary.
+ *
+ * ## The set is the uniform's, not a second definition
+ *
+ * The answer is `collectDeclaredEnvNames` — the contract's `env` block, the
+ * `${VAR}` placeholders of `config/service/*.json`, and the endpoint variables
+ * of the connectors the contract declares required. That is exactly the set row
+ * `C-ENV-READS` of the biz-service uniform measures the repository against, so
+ * the two can never disagree about what a service reads
+ * (`change-discipline.md` § One rail per concern).
+ *
+ * The consequence is deliberate: a name the SOURCE reads and the contract does
+ * not declare is absent from this answer. It is a blocking finding of
+ * `C-ENV-READS`, with its own fix, and a gate must not demand a value for a key
+ * nobody owns.
+ *
+ * The messages carry the context `[oa-validate]` because the subcommand is this
+ * module's only caller and the message goes to a bash gate reading stderr; there
+ * is no wrapper re-wording them, which is how they stay the exact sentence the
+ * test asserts (`automation-gates.md` §2).
+ *
+ * @see api/docs/biz/70-contracts/env-contract.md
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const { loadAndValidateIntegrationContract } = require('./bizCiGateContract');
+const { collectDeclaredEnvNames } = require('./envContract');
+
+/** Where every biz service declares what it integrates with. */
+const CONTRACT_RELATIVE_PATH = path.join('config', 'service', 'integration-contract.json');
+
+/**
+ * Every environment name the service at `serviceRoot` reads, as the uniform
+ * measures it.
+ *
+ * @param {string} serviceRoot repository root of the service; the caller
+ *   resolves its own default, so an empty value is refused rather than silently
+ *   answered about `process.cwd()`
+ * @returns {string[]} the names, sorted, without duplicates
+ * @throws {Error} when the root or the contract cannot be read — a gate that
+ *   cannot get the set must stop, never continue with an empty one
+ */
+function listEnvReads(serviceRoot) {
+  if (typeof serviceRoot !== 'string' || serviceRoot.trim() === '') {
+    throw new Error('[oa-validate] No service root to answer about - --env-reads was given '
+      + `${typeof serviceRoot === 'string' ? 'an empty path' : typeof serviceRoot}. `
+      + 'Fix: oa-validate --env-reads <serviceRoot>, or run it inside the service repository.');
+  }
+
+  const root = path.resolve(serviceRoot);
+  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {
+    throw new Error(`[oa-validate] Service root not found - ${root}. `
+      + 'Fix: pass an existing repository directory, or run the command inside the service repository.');
+  }
+
+  const contractPath = path.join(root, CONTRACT_RELATIVE_PATH);
+  if (!fs.existsSync(contractPath)) {
+    throw new Error(`[oa-validate] No environment contract - ${contractPath} does not exist, so nothing `
+      + 'declares which environment names this service reads and the answer would be an empty set. '
+      + 'Fix: add config/service/integration-contract.json with requiredConnectors and, where the '
+      + 'service reads a name no placeholder and no connector covers, an "env" block.');
+  }
+
+  let contract;
+  try {
+    contract = loadAndValidateIntegrationContract(root).contract;
+  } catch (error) {
+    throw new Error(`[oa-validate] Unusable environment contract - ${contractPath}: `
+      + `${String(error.message).split('\n')[0].trim()} `
+      + 'Fix: correct the contract, then run npx oa-validate to see the row that judges it.');
+  }
+
+  return collectDeclaredEnvNames({ serviceRoot: root, contract }).names;
+}
+
+module.exports = {
+  CONTRACT_RELATIVE_PATH,
+  listEnvReads
+};

package/src/utils/installContract.js

@@ -20,7 +20,10 @@
  *                applies — in both directions (§7)
  *   SQL_HEADERS  every live SQL file declares its dataset class and safety, with
  *                VALUES from the contract's closed vocabularies and not merely the
- *                four keys (§4)
+ *                four keys (§4). "Live" is what the installer applies: the
+ *                migrations tree outside history, AND the seeds the integration
+ *                contract declares, wherever they sit
+ *                (`installation-sql-contract-scope` 003)
  *
  * Rules: api/docs/standards/repository-installation-sql-contract.md §2-§5, §7
  * @see api/docs/governance/confirmations/installation-sql-contract-scope.md
@@ -127,8 +130,22 @@ function listSqlFiles(absoluteDir) {
  * package directories alone: the root `migrations/*.sql` set IS the live
  * migration set of four services, and until this loop reached it those files
  * carried no header requirement at all while the gate reported PASS.
+ *
+ * `migrations/**` is not the whole scope either. What the contract covers is
+ * what the INSTALLER APPLIES, whatever directory it sits in
+ * (`installation-sql-contract-scope` 003: "Ano, vše co instalátor aplikuje"),
+ * and what the installer applies beyond the migration set is exactly the
+ * `database.seeds` list of the integration contract — read here from that one
+ * declaration rather than from a second list of directories, which would rot
+ * the moment a service put a seed somewhere new (`doc-code-binding.md` §1).
+ * Measured 2026-09-16: converter declares two seeds under `scripts/seed/` and
+ * ingest one, and the header gate had never looked at any of them.
+ *
+ * @param {string} serviceRoot repository root to walk
+ * @param {string[]} seeds repo-relative seed paths the contract declares, which
+ *   exist; one already inside `migrations/**` is not listed twice
  */
-function listLiveSqlFiles(serviceRoot) {
+function listLiveSqlFiles(serviceRoot, seeds = []) {
   const found = [];
 
   const walk = (relativeDir) => {
@@ -149,6 +166,11 @@ function listLiveSqlFiles(serviceRoot) {
   };
 
   walk(MIGRATIONS_ROOT);
+
+  for (const seed of seeds) {
+    if (!found.includes(seed)) found.push(seed);
+  }
+
   return found;
 }
 
@@ -285,7 +307,26 @@ function checkManifestCompleteness(serviceRoot, manifestFile, add) {
   }
 }
 
-function checkSqlPackage(serviceRoot, add) {
+/**
+ * The seeds the contract declares AND the repository carries. A declared file
+ * that is not there is reported rather than read: the installer would stop on
+ * it, so the gate says so with the same words instead of throwing ENOENT out of
+ * a header check (`automation-gates.md` §1 requirement 4).
+ */
+function existingSeeds(serviceRoot, database, add) {
+  const declared = Array.isArray(database?.seeds) ? database.seeds : [];
+
+  return declared.filter((relativeFile) => {
+    if (existsExactly(serviceRoot, relativeFile.split('/'))) return true;
+
+    add('SQL_PACKAGE', 'Declared seed does not exist - config/service/integration-contract.json '
+      + `declares "${relativeFile}" in database.seeds and the repository does not carry it. `
+      + 'Fix: add the file, or remove the declaration — the installer applies exactly what is declared.');
+    return false;
+  });
+}
+
+function checkSqlPackage(serviceRoot, database, add) {
   for (const relativeDir of SQL_DIRECTORIES) {
     const absoluteDir = path.join(serviceRoot, relativeDir);
 
@@ -303,7 +344,7 @@ function checkSqlPackage(serviceRoot, add) {
     }
   }
 
-  const liveFiles = listLiveSqlFiles(serviceRoot);
+  const liveFiles = listLiveSqlFiles(serviceRoot, existingSeeds(serviceRoot, database, add));
 
   for (const relativeFile of liveFiles) {
     checkSqlHeaders(serviceRoot, relativeFile, add);
@@ -374,7 +415,7 @@ function verifyInstallContract(serviceRoot, database) {
 
   const databaseChecked = database !== null && database !== undefined;
   if (databaseChecked) {
-    checkSqlPackage(serviceRoot, add);
+    checkSqlPackage(serviceRoot, database, add);
   }
 
   return {

package/src/utils/libCompat.js

@@ -23,6 +23,15 @@
  * to "not gated" (principle 3), and it would let a typo or a retired package
  * name travel into an image with the gate reporting OK (measured 2026-09-14).
  *
+ * The narrowing decides one thing only: which packages are COMPARED against an
+ * infra version. It never relaxes the exact-pin rule, which `^`, `~` and
+ * `latest` break in EVERY `@onlineapps/*` dependency, gated or not
+ * (`.claude/rules/architecture-principles.md` § Version pinning) — a floating
+ * range makes the same commit install different code on different days whether
+ * or not infra happens to ship that package too. Until 2026-09-15 (W413) the
+ * exactness test sat inside the gated branch, so a biz-only pin could float
+ * past a green gate.
+ *
  * Pure module: the rules and the fetch live here, presentation and exit codes
  * live in the CLI.
  *
@@ -85,40 +94,51 @@ function checkLibCompat(pkg, librarySet) {
   const violations = [];
 
   for (const [name, version] of ours) {
-    if (infraConsumed && !infraConsumed.has(name)) {
-      if (!(name in versions)) {
-        violations.push({
-          package: name,
-          message: `${name}: unknown to the platform library SSOT `
-            + "- declared in neither 'libraries' nor 'infraConsumed', so no platform version exists to pin against. "
-            + `Fix: publish ${name} and add it to config/libraries.json, or remove the pin.`
-        });
-        continue;
-      }
-      notGated.push(name);
+    const bizOnly = Boolean(infraConsumed) && !infraConsumed.has(name);
+    const declared = versions[name];
+
+    if (bizOnly && declared === undefined) {
+      violations.push({
+        package: name,
+        message: `${name}: unknown to the platform library SSOT `
+          + "- declared in neither 'libraries' nor 'infraConsumed', so no platform version exists to pin against. "
+          + `Fix: publish ${name} and add it to config/libraries.json, or remove the pin.`
+      });
       continue;
     }
 
-    gated.push(name);
-    if (!EXACT_VERSION.test(version)) {
+    if (bizOnly) notGated.push(name);
+    else gated.push(name);
+
+    if (declared === undefined) {
       violations.push({
         package: name,
-        message: `${name}: version '${version}' is not exact x.y.z — caret/tilde/range pins are banned, `
-          + 'because what resolves today is not what resolved when the image was built.'
+        message: `${name}: not present in the infra library set — the platform does not ship this package version contract.`
       });
       continue;
     }
-    if (!(name in versions)) {
+
+    // The exact-pin rule is unconditional: `.claude/rules/architecture-principles.md`
+    // § Version pinning bans `^`, `~` and `latest` in EVERY `@onlineapps/*`
+    // dependency, so it is checked before the narrowing has any say. Being "not
+    // gated" answers one question only — is there an infra version to diverge
+    // from — and it never answers whether the pin may float.
+    if (!EXACT_VERSION.test(version)) {
       violations.push({
         package: name,
-        message: `${name}: not present in the infra library set — the platform does not ship this package version contract.`
+        message: `${name}: version '${version}' is not exact x.y.z — caret/tilde/range pins are banned, `
+          + 'because what resolves today is not what resolved when the image was built. '
+          + `Fix: npm install ${name}@${declared} --save-exact.`
       });
       continue;
     }
-    if (versions[name] !== version) {
+
+    if (bizOnly) continue;
+
+    if (declared !== version) {
       violations.push({
         package: name,
-        message: `${name}: biz pins ${version}, infra ships ${versions[name]} — `
+        message: `${name}: biz pins ${version}, infra ships ${declared} — `
           + 'rebuild the service against the current platform, or deploy the matching infra release first.'
       });
     }

package/src/utils/preValidation.js

@@ -25,6 +25,8 @@
 const fs = require('fs');
 const path = require('path');
 
+const { KIND_STEP, KIND_COOKBOOK_LOAD_FAILURE } = require('./stepFailure');
+
 /**
  * A step error is whatever the handler threw or the transport returned — often
  * an object, not a string. The scripts this replaces interpolated it straight
@@ -42,10 +44,56 @@ function describeStepError(error) {
   }
 }
 
+/**
+ * One failed record of `results.steps`, in the shape the caller reports.
+ *
+ * `results.steps` holds TWO kinds of record and they are not both steps: a step
+ * result, and the entry `CookbookTestRunner.runCookbooks` pushes for a file the
+ * format check rejected — a whole cookbook that produced no step at all. Each
+ * DECLARES which it is in `kind`, written where the record is made (d.516b), so
+ * nothing here infers it from a missing field
+ * (`.claude/rules/architecture-principles.md` §8).
+ *
+ * This is the switchboard `utils/stepFailure.js` § describeStepFailureWithContext
+ * already keeps, for the structured half of the same answer: a cookbook that
+ * never ran is named by its FILE, because there is no step in it to name. Until
+ * d.518 both kinds were read as steps, so a rejected file reached the reader as
+ * `step_id: undefined` — a field naming nothing, about a step that does not
+ * exist, which `src/cli/biz-ci-gate.js` prints verbatim.
+ *
+ * The step's own `step_id` and nothing standing in for it: until d.516 this read
+ * `step.step_id || step.operation`, so a step that named no step_id was reported
+ * under its OPERATION — a field called `step_id` carrying something that is not
+ * one, which the reader has no way to see (§3, No Fallbacks). Since
+ * `@onlineapps/cookbook-core` 5.0.0 the schema requires `step_id` on every task
+ * step (`schemas/cookbook.v2.schema.json` definitions.TaskStep.required), and
+ * since d.460 the orchestrator refuses a task step that names no operation
+ * either (`@onlineapps/conn-orch-orchestrator` § _requireStepOperation), so a
+ * step arriving here without one is a broken cookbook — and a broken cookbook is
+ * what the outcome must show, not a plausible name.
+ *
+ * @param {object} record a failed entry of `results.steps`
+ * @returns {{kind: string, error: string, validationErrors: string[]}} plus
+ *   `cookbook` for a load failure, `step_id` for a step; WHICH of the two it is
+ *   stays in `kind`, so a reader names it with `stepFailure.js`
+ *   § describeRecordIdentity instead of picking a field
+ */
+function describeFailedRecord(record) {
+  const reason = {
+    error: describeStepError(record.error),
+    validationErrors: record.validationErrors || []
+  };
+
+  if (record.kind === KIND_COOKBOOK_LOAD_FAILURE) {
+    return { kind: KIND_COOKBOOK_LOAD_FAILURE, cookbook: record.cookbook, ...reason };
+  }
+
+  return { kind: KIND_STEP, step_id: record.step_id, ...reason };
+}
+
 const COOKBOOKS_RELATIVE_DIR = path.join('tests', 'cookbooks');
 const PROOF_RELATIVE_PATH = path.join('conn-runtime', 'validation-proof.json');
 const OPERATIONS_RELATIVE_PATH = path.join('config', 'service', 'operations.json');
-const VALIDATOR_NAME = '@onlineapps/conn-orch-validator';
 const COOKBOOK_TIMEOUT_MS = 30000;
 
 /**
@@ -104,7 +152,6 @@ async function runPreValidation({ serviceRoot, RunnerClass, ProofGeneratorClass,
   const runner = new RunnerClass({
     serviceName: packageJson.name,
     servicePath: serviceRoot,
-    mockInfrastructure: true,
     timeout: COOKBOOK_TIMEOUT_MS,
     logger
   });
@@ -117,12 +164,8 @@ async function runPreValidation({ serviceRoot, RunnerClass, ProofGeneratorClass,
     // No proof on a failed run. A proof is a claim that the cookbooks passed,
     // so writing one here would make the Registry trust a run that did not.
     const failedSteps = results.steps
-      .filter((step) => !step.passed)
-      .map((step) => ({
-        step_id: step.step_id || step.operation,
-        error: describeStepError(step.error),
-        validationErrors: step.validationErrors || []
-      }));
+      .filter((record) => !record.passed)
+      .map(describeFailedRecord);
 
     return { ok: false, results, failedSteps, proof: null, proofPath: null, filteredBy };
   }
@@ -131,11 +174,13 @@ async function runPreValidation({ serviceRoot, RunnerClass, ProofGeneratorClass,
     return { ok: true, results, failedSteps: [], proof: null, proofPath: null, filteredBy };
   }
 
+  // The validator's own name and version are NOT passed in: they are this
+  // package's identity and the generator reads them from its own package.json
+  // (`src/validatorIdentity.js`, d.524). Passing them made this module carry a
+  // second copy of the package name.
   const proofGenerator = new ProofGeneratorClass({
     serviceName: packageJson.name,
-    serviceVersion: packageJson.version,
-    validatorName: VALIDATOR_NAME,
-    validatorVersion: require('../../package.json').version
+    serviceVersion: packageJson.version
   });
 
   const proof = proofGenerator.generateProof(results, packageJson.dependencies || {});