@pareto4/pp-core 1.19.0 → 1.21.0

package/pp-core/bin/lib/check-command-router.cjs

@@ -23,6 +23,8 @@ const phaseScopeMod = require("./phase-scope.cjs");
 const { resolvePhaseForRead } = phaseScopeMod;
 const decisions_cjs_1 = require("./decisions.cjs");
 const ui_safety_gate_cjs_1 = require("./ui-safety-gate.cjs");
+const plan_sizing_cjs_1 = require("./plan-sizing.cjs");
+const test_substance_cjs_1 = require("./test-substance.cjs");
 const semver_compare_cjs_1 = require("./semver-compare.cjs");
 // Quick 261003-lqi (FIX-C): the ship-time drift check resolves the platform tag
 // through the init-time owner, so it and init cannot disagree about the tag.
@@ -663,6 +665,57 @@ function cmdUiPlanGate(projectDir, args, raw) {
     }
     output(computeUiPlanGate(projectDir, phase), raw, undefined);
 }
+// ─── plan-sizing ──────────────────────────────────────────────────────────────
+/**
+ * plan-sizing: reads a phase's PLAN.md files and `context_window` and reports plans
+ * over the 6-task ceiling, plans over the per-plan budget, and serial splits that
+ * have neither a parallelism nor a budget reason (Phase 36, D-14).
+ *
+ * Invocable as: pp_run check plan-sizing <phase>
+ * Exits 0 on every analysed phase; `block` carries the verdict in the payload.
+ */
+function cmdPlanSizing(projectDir, args, raw) {
+    // args[0] = 'check', args[1] = 'plan-sizing', args[2] = phase
+    const phase = args[2] || '';
+    if (!phase) {
+        error('plan-sizing requires a phase argument: check plan-sizing <phase>', ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    output((0, plan_sizing_cjs_1.computePlanSizing)(projectDir, phase), raw, undefined);
+}
+// ─── test-substance ───────────────────────────────────────────────────────────
+/**
+ * test-substance: reads a phase's PLAN.md files and reports, per task, a missing or
+ * generic <behavior>, a verify command that can pass without asserting, a MISSING
+ * test file no task creates and a scaffold that describes a vacuous test
+ * (Phase 38, D-06).
+ *
+ * Invocable as: pp_run check test-substance <phase>
+ * Exits 0 on every analysed phase; `block` carries the verdict in the payload.
+ *
+ * The scan mode, `check test-substance --scan <file...>`, counts assertions per test
+ * case in the given test files (Phase 38, D-14): the validation-time half, read by
+ * validate-phase. It exits 0 on every scanned list; a file the scanner cannot read
+ * reports `unknown` with a reason.
+ */
+function cmdTestSubstance(projectDir, args, raw) {
+    // args[0] = 'check', args[1] = 'test-substance', args[2..] = phase (flags skipped) or --scan <file...>
+    if (args[2] === '--scan') {
+        const files = args.slice(3).filter((a) => !a.startsWith('--'));
+        if (files.length === 0) {
+            error('test-substance --scan requires at least one test file: check test-substance --scan <file...>', ERROR_REASON.SDK_MISSING_ARG);
+            return;
+        }
+        output((0, test_substance_cjs_1.scanTestFiles)(projectDir, files), raw, undefined);
+        return;
+    }
+    const phase = args.slice(2).find((a) => !a.startsWith('--')) || '';
+    if (!phase) {
+        error('test-substance requires a phase argument or test files: check test-substance <phase> | check test-substance --scan <file...>', ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    output((0, test_substance_cjs_1.computeTestSubstance)(projectDir, phase), raw, undefined);
+}
 // ─── ui-safety-gate ───────────────────────────────────────────────────────────
 /**
  * ui-safety-gate: post-wave check that verifies UI-changed files conform to
@@ -3105,6 +3158,14 @@ function routeCheckCommand({ args, cwd, raw }) {
         cmdUiPlanGate(cwd, args, raw);
         return;
     }
+    if (subcommand === 'plan-sizing') {
+        cmdPlanSizing(cwd, args, raw);
+        return;
+    }
+    if (subcommand === 'test-substance') {
+        cmdTestSubstance(cwd, args, raw);
+        return;
+    }
     if (subcommand === 'gap-analysis-plan-post') {
         cmdGapAnalysisPlanPost(cwd, args, raw);
         return;
@@ -3175,7 +3236,7 @@ function routeCheckCommand({ args, cwd, raw }) {
         (0, prohibition_enforcement_cjs_1.routeProhibitionEnforcement)(args, raw);
         return;
     }
-    error('Unknown check subcommand. Available: auto-mode, decision-coverage-plan, decision-coverage-verify, gap-analysis-plan-post, prohibition-enforcement, ship-platform-drift, tdd-review-checkpoint, ui-plan-gate, ui-safety-gate, vault-review, vault-status, vault-trace, verify-schema-drift, verify-codebase-drift', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    error('Unknown check subcommand. Available: auto-mode, decision-coverage-plan, decision-coverage-verify, gap-analysis-plan-post, plan-sizing, prohibition-enforcement, ship-platform-drift, tdd-review-checkpoint, test-substance, ui-plan-gate, ui-safety-gate, vault-review, vault-status, vault-trace, verify-schema-drift, verify-codebase-drift', ERROR_REASON.SDK_UNKNOWN_COMMAND);
 }
 module.exports = {
     routeCheckCommand,

package/pp-core/bin/lib/commands.cjs

@@ -51,6 +51,10 @@ const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
 // Node built-ins and it never requires this module, so the edge adds no cycle.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const vaultSeal = require("./vault-seal.cjs");
+// 35-02: per-phase TIMELINE.jsonl fold for cmdStats (timeline key + wall_clock column).
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const timelineMod = require("./timeline.cjs");
+const { foldRecords, buildPhaseTimeline } = timelineMod;
 // ─── Phase Status ─────────────────────────────────────────────────────────────
 /**
  * Determine phase status by checking plan/summary counts AND verification state.
@@ -1141,6 +1145,7 @@ function cmdStats(cwd, format, raw) {
     const isDirInMilestone = getMilestonePhaseFilter(cwd);
     // Phase & plan stats (reuse progress pattern)
     const phasesByNumber = new Map();
+    const timeline = {};
     let totalPlans = 0;
     let totalSummaries = 0;
     try {
@@ -1160,6 +1165,7 @@ function cmdStats(cwd, format, raw) {
                 plans: 0,
                 summaries: 0,
                 status: 'Not Started',
+                wall_clock: null,
             });
         }
     }
@@ -1186,12 +1192,31 @@ function cmdStats(cwd, format, raw) {
             const status = determinePhaseStatus(plans, summaries, node_path_1.default.join(phasesDir, dir), 'Not Started');
             const normalizedNum = normalizePhaseName(phaseNum);
             const existing = phasesByNumber.get(normalizedNum);
+            // D-12/D-15: fold this phase's TIMELINE file(s). Its own try/catch keeps one
+            // unreadable file from escaping into the outer catch and dropping later phases.
+            let wallClock = existing?.wall_clock ?? null;
+            try {
+                const timelineFiles = phaseFiles.filter(f => f.endsWith('-TIMELINE.jsonl'));
+                if (timelineFiles.length > 0) {
+                    const text = timelineFiles
+                        .map(f => node_fs_1.default.readFileSync(node_path_1.default.join(phasesDir, dir, f), 'utf-8'))
+                        .join('\n');
+                    const runs = foldRecords(text);
+                    if (runs.length > 0) {
+                        const built = buildPhaseTimeline(runs);
+                        timeline[normalizedNum] = built;
+                        wallClock = built.wall_clock;
+                    }
+                }
+            }
+            catch { /* a bad timeline file never drops phases */ }
             phasesByNumber.set(normalizedNum, {
                 number: normalizedNum,
                 name: existing?.name || phaseName,
                 plans: (existing?.plans || 0) + plans,
                 summaries: (existing?.summaries || 0) + summaries,
                 status,
+                wall_clock: wallClock,
             });
         }
     }
@@ -1240,6 +1265,7 @@ function cmdStats(cwd, format, raw) {
         milestone_version: milestone.version,
         milestone_name: milestone.name,
         phases,
+        timeline,
         phases_completed: completedPhases,
         phases_total: phases.length,
         total_plans: totalPlans,
@@ -1266,10 +1292,10 @@ function cmdStats(cwd, format, raw) {
             out += `**Requirements:** ${requirementsComplete}/${requirementsTotal} complete\n`;
         }
         out += '\n';
-        out += `| Phase | Name | Plans | Completed | Status |\n`;
-        out += `|-------|------|-------|-----------|--------|\n`;
+        out += `| Phase | Name | Plans | Completed | Status | Wall-clock |\n`;
+        out += `|-------|------|-------|-----------|--------|------------|\n`;
         for (const p of phases) {
-            out += `| ${p.number} | ${p.name} | ${p.plans} | ${p.summaries} | ${p.status} |\n`;
+            out += `| ${p.number} | ${p.name} | ${p.plans} | ${p.summaries} | ${p.status} | ${p.wall_clock ?? '—'} |\n`;
         }
         if (gitCommits > 0) {
             out += `\n**Git:** ${gitCommits} commits`;

package/pp-core/bin/lib/config.cjs

@@ -589,6 +589,11 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     if (kp === 'workflow.drift_action' && !isStringMember(VALID_DRIFT_ACTIONS, parsedValue)) {
         error(`Invalid workflow.drift_action '${val}'. Valid values: ${VALID_DRIFT_ACTIONS.join(', ')}`);
     }
+    // Phase classification (D-09, CLAS-03): `full` reproduces the pre-1.21 gate stack.
+    const VALID_CEREMONY_MODES = ['proportional', 'full'];
+    if (kp === 'workflow.ceremony' && !isStringMember(VALID_CEREMONY_MODES, parsedValue)) {
+        error(`Invalid workflow.ceremony '${val}'. Valid values: ${VALID_CEREMONY_MODES.join(', ')}`);
+    }
     if (kp === 'workflow.drift_threshold') {
         if (typeof parsedValue !== 'number' || !Number.isInteger(parsedValue) || parsedValue < 1) {
             error(`Invalid workflow.drift_threshold '${val}'. Must be a positive integer.`);

package/pp-core/bin/lib/discovery-access.cjs

@@ -0,0 +1,276 @@
+"use strict";
+/**
+ * Discovery access-model check (Discovery Sprint improvement plan, Batch 3).
+ *
+ * `.planning/discovery/_roles.md` is the register of roles and what each may
+ * do — Session 7 writes it in place of the old preset RBAC matrix. Three
+ * tables: `## Roles` (the role, what it is, its data scope, how it is
+ * recovered when its last holder leaves — the vault's role-recovery rule —
+ * and its source), `## Permissions` (role × operation × entity, with the
+ * condition that narrows it and the requirements it realises; one row per
+ * role-and-entity, operations as a list — never CRUD columns) and
+ * `## Screens` (which role may open which `SCR-` screen, the join the
+ * forbidden-path tests are written from). The build's planner reads the
+ * permissions by requirement ID. This module checks the structure:
+ *
+ *   - the three sections exist with the template's columns;
+ *   - every role is a Session 2 persona, an actor a step matrix names, or
+ *     `System`, when those sources are on file (a role nobody plays is a
+ *     role the build cannot test), and is listed once;
+ *   - every permission and screen row names a role of `## Roles`;
+ *   - every entity resolves against `_entities.md`, every screen against
+ *     `_screens.md`, every requirement against `_requirements.md`, when
+ *     those artifacts are on file and parseable;
+ *   - operations are a comma list of lowercase verbs.
+ *
+ * Posture (D-43/D-53): reports at Sessions 8 and 13; hard-blocks at
+ * `/pp-discovery-to-build`. Absent artifact → exit 0.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const io = require("./io.cjs");
+const { output, error, ERROR_REASON } = io;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const table = require("./discovery-table.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const rollup = require("./discovery-rollup.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const processes = require("./discovery-processes.cjs");
+// ─── Constants ────────────────────────────────────────────────────────────────
+const DISCOVERY_DIR = '.planning/discovery';
+const ROLES_FILE = `${DISCOVERY_DIR}/_roles.md`;
+const REQUIREMENTS_FILE = `${DISCOVERY_DIR}/_requirements.md`;
+const ENTITIES_FILE = `${DISCOVERY_DIR}/_entities.md`;
+const PROCESSES_FILE = `${DISCOVERY_DIR}/_processes.md`;
+const SCREENS_FILE = `${DISCOVERY_DIR}/_screens.md`;
+const SESSION_02_FILE = `${DISCOVERY_DIR}/session-02.md`;
+const ROLES_SECTION = 'Roles';
+const PERMISSIONS_SECTION = 'Permissions';
+const SCREENS_SECTION = 'Screens';
+const ROLES_HEADER = Object.freeze(['Role', 'Description', 'Scope', 'Recovery path', 'Source']);
+const PERMISSIONS_HEADER = Object.freeze(['Role', 'Entity', 'Operation', 'Condition', 'Requirements']);
+const SCREENS_HEADER = Object.freeze(['Role', 'Screen']);
+const SYSTEM_ACTOR = 'System';
+const ENTITY_NAME_RE = /^[A-Z][A-Za-z0-9]*$/;
+const OPERATION_RE = /^[a-z][a-z-]*$/;
+const SCREEN_ID_RE = /^SCR-\d{2}$/;
+const REQUIREMENT_ID_RE = /^[A-Z][A-Z0-9]*-\d+$/;
+const STEPS_ACTOR_COLUMN = 'Actor';
+const USAGE = 'Usage: pp-tools discovery roles-check';
+function readIfPresent(abs) {
+    if (!node_fs_1.default.existsSync(abs))
+        return { kind: 'absent' };
+    try {
+        return { kind: 'ok', content: node_fs_1.default.readFileSync(abs, 'utf-8') };
+    }
+    catch {
+        return { kind: 'unreadable' };
+    }
+}
+function sameHeader(actual, expected) {
+    return actual.length === expected.length && actual.every((c, i) => c.trim().toLowerCase() === expected[i].toLowerCase());
+}
+function splitList(cell) {
+    return cell.split(',').map((t) => t.trim()).filter(Boolean);
+}
+/** First-column values of the first table under a `## <heading>` of another artifact. */
+function firstColumnOf(content, heading) {
+    const section = table.splitSections(content.split(/\r?\n/), 2).find((s) => s.heading === heading);
+    if (!section)
+        return new Set();
+    const tables = table.parseTables(section.body);
+    if (tables.length === 0)
+        return new Set();
+    return new Set(tables[0].rows.map((r) => (r.cells[0] ?? '').trim()).filter(Boolean));
+}
+/** Every actor a step matrix of `_processes.md` § Steps names, by the `Actor` column. */
+function stepActors(content) {
+    const out = new Set();
+    const steps = table.splitSections(content.split(/\r?\n/), 2).find((s) => s.heading === 'Steps');
+    if (!steps)
+        return out;
+    for (const t of table.parseTables(steps.body)) {
+        const col = t.header.findIndex((h) => h.trim().toLowerCase() === STEPS_ACTOR_COLUMN.toLowerCase());
+        if (col === -1)
+            continue;
+        for (const r of t.rows)
+            for (const a of splitList(r.cells[col] ?? ''))
+                out.add(a);
+    }
+    return out;
+}
+/** The first table under `## <heading>`, header-checked; faults are pushed and null returned. */
+function sectionTable(content, heading, expected, violations) {
+    const section = table.splitSections(content.split(/\r?\n/), 2).find((s) => s.heading === heading);
+    if (!section) {
+        violations.push({ artifact: ROLES_FILE, reason: 'missing_section', id: heading });
+        return null;
+    }
+    const tables = table.parseTables(section.body);
+    if (tables.length === 0) {
+        violations.push({ artifact: ROLES_FILE, reason: 'missing_section', line: section.line, id: heading });
+        return null;
+    }
+    if (!sameHeader(tables[0].header, expected)) {
+        violations.push({ artifact: ROLES_FILE, reason: 'bad_table_shape', line: tables[0].line, id: heading });
+        return null;
+    }
+    return tables[0];
+}
+// ─── Check ────────────────────────────────────────────────────────────────────
+function checkRoles(content, sources) {
+    const violations = [];
+    const roles = sectionTable(content, ROLES_SECTION, ROLES_HEADER, violations);
+    const permissions = sectionTable(content, PERMISSIONS_SECTION, PERMISSIONS_HEADER, violations);
+    const screens = sectionTable(content, SCREENS_SECTION, SCREENS_HEADER, violations);
+    const known = new Set();
+    if (roles) {
+        for (const row of roles.rows) {
+            const [role, description, scope, recovery] = row.cells.map((c) => c.trim());
+            if ((role ?? '') === '') {
+                violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line: row.line, id: 'Role' });
+            }
+            else if (known.has(role)) {
+                violations.push({ artifact: ROLES_FILE, reason: 'duplicate_role', line: row.line, id: role.slice(0, 40) });
+            }
+            else {
+                known.add(role);
+                if (sources.actors !== null && role !== SYSTEM_ACTOR && !sources.actors.has(role))
+                    violations.push({ artifact: ROLES_FILE, reason: 'unknown_role', line: row.line, id: role.slice(0, 40) });
+            }
+            if ((description ?? '') === '')
+                violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line: row.line, id: 'Description' });
+            if ((scope ?? '') === '')
+                violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line: row.line, id: 'Scope' });
+            if ((recovery ?? '') === '')
+                violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line: row.line, id: 'Recovery path' });
+        }
+    }
+    const roleRef = (role, line) => {
+        if (role === '')
+            violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line, id: 'Role' });
+        else if (roles && !known.has(role))
+            violations.push({ artifact: ROLES_FILE, reason: 'unknown_role', line, id: role.slice(0, 40) });
+    };
+    if (permissions) {
+        for (const row of permissions.rows) {
+            const [role, entity, operation, , requirements] = row.cells.map((c) => c.trim());
+            roleRef(role ?? '', row.line);
+            if (!ENTITY_NAME_RE.test(entity ?? ''))
+                violations.push({ artifact: ROLES_FILE, reason: 'bad_entity', line: row.line });
+            else if (sources.entities !== null && !sources.entities.has(entity))
+                violations.push({ artifact: ROLES_FILE, reason: 'unknown_entity', line: row.line, id: entity });
+            const ops = splitList(operation ?? '');
+            if (ops.length === 0 || ops.some((o) => !OPERATION_RE.test(o)))
+                violations.push({ artifact: ROLES_FILE, reason: 'bad_operation', line: row.line });
+            const reqs = splitList(requirements ?? '');
+            if (reqs.length === 0)
+                violations.push({ artifact: ROLES_FILE, reason: 'no_requirement', line: row.line });
+            for (const r of reqs) {
+                if (!REQUIREMENT_ID_RE.test(r))
+                    violations.push({ artifact: ROLES_FILE, reason: 'unknown_requirement_id', line: row.line, id: r.slice(0, 40) });
+                else if (sources.requirementIds instanceof Set && !sources.requirementIds.has(r))
+                    violations.push({ artifact: ROLES_FILE, reason: 'unknown_requirement_id', line: row.line, id: r });
+            }
+        }
+    }
+    if (screens) {
+        for (const row of screens.rows) {
+            const [role, screen] = row.cells.map((c) => c.trim());
+            roleRef(role ?? '', row.line);
+            if (!SCREEN_ID_RE.test(screen ?? ''))
+                violations.push({ artifact: ROLES_FILE, reason: 'bad_screen', line: row.line });
+            else if (sources.screens !== null && !sources.screens.has(screen))
+                violations.push({ artifact: ROLES_FILE, reason: 'unknown_screen', line: row.line, id: screen });
+        }
+    }
+    if (sources.requirementIds === 'unparseable')
+        violations.push({ artifact: REQUIREMENTS_FILE, reason: 'requirements_unparseable' });
+    return {
+        ok: violations.length === 0,
+        roles: known.size,
+        permissions: permissions ? permissions.rows.length : 0,
+        screens: screens ? screens.rows.length : 0,
+        violations,
+    };
+}
+function checkProjectRoles(cwd) {
+    const read = readIfPresent(node_path_1.default.join(cwd, ROLES_FILE));
+    if (read.kind === 'absent')
+        return null;
+    if (read.kind === 'unreadable')
+        return { ok: false, file: ROLES_FILE, roles: 0, permissions: 0, screens: 0, violations: [{ artifact: ROLES_FILE, reason: 'artifact_unreadable' }] };
+    const extra = [];
+    const sources = { actors: null, entities: null, screens: null, requirementIds: null };
+    const s2 = readIfPresent(node_path_1.default.join(cwd, SESSION_02_FILE));
+    if (s2.kind === 'unreadable')
+        extra.push({ artifact: SESSION_02_FILE, reason: 'artifact_unreadable' });
+    const personas = s2.kind === 'ok' ? processes.personasFrom(s2.content) : null;
+    const proc = readIfPresent(node_path_1.default.join(cwd, PROCESSES_FILE));
+    if (proc.kind === 'unreadable')
+        extra.push({ artifact: PROCESSES_FILE, reason: 'artifact_unreadable' });
+    const actors = proc.kind === 'ok' ? stepActors(proc.content) : null;
+    if (personas !== null || actors !== null)
+        sources.actors = new Set([...(personas ?? []), ...(actors ?? [])]);
+    const ent = readIfPresent(node_path_1.default.join(cwd, ENTITIES_FILE));
+    if (ent.kind === 'unreadable')
+        extra.push({ artifact: ENTITIES_FILE, reason: 'artifact_unreadable' });
+    if (ent.kind === 'ok')
+        sources.entities = firstColumnOf(ent.content, 'Entities');
+    const scr = readIfPresent(node_path_1.default.join(cwd, SCREENS_FILE));
+    if (scr.kind === 'unreadable')
+        extra.push({ artifact: SCREENS_FILE, reason: 'artifact_unreadable' });
+    if (scr.kind === 'ok')
+        sources.screens = firstColumnOf(scr.content, 'Screens');
+    const req = readIfPresent(node_path_1.default.join(cwd, REQUIREMENTS_FILE));
+    if (req.kind === 'unreadable')
+        extra.push({ artifact: REQUIREMENTS_FILE, reason: 'artifact_unreadable' });
+    if (req.kind === 'ok') {
+        const parsed = rollup.parseRequirementsArtifact(req.content);
+        sources.requirementIds = parsed.ok ? new Set(parsed.rows.map((r) => r.id)) : 'unparseable';
+    }
+    const result = checkRoles(read.content, sources);
+    result.violations.push(...extra);
+    result.ok = result.violations.length === 0;
+    return { file: ROLES_FILE, ...result };
+}
+function formatViolation(v) {
+    const where = v.line !== undefined ? `:${v.line}` : '';
+    const what = v.id !== undefined ? ` (${v.id})` : '';
+    return `  - ${v.artifact}${where}: ${v.reason}${what}`;
+}
+// ─── CLI adapter ──────────────────────────────────────────────────────────────
+/** `pp-tools discovery roles-check` (dotted `query discovery.roles-check`). Absent artifact → exit 0, `present: false`. */
+function cmdDiscoveryRolesCheck(cwd, args, raw) {
+    if (args.length > 2) {
+        error(USAGE, ERROR_REASON.USAGE);
+        return; // unreachable
+    }
+    const result = checkProjectRoles(cwd);
+    if (result === null) {
+        output({ ok: true, present: false, file: ROLES_FILE }, raw);
+        return;
+    }
+    const payload = { ok: result.ok, present: true, file: result.file, roles: result.roles, permissions: result.permissions, screens: result.screens };
+    if (!result.ok) {
+        output({ ...payload, violations: result.violations.length }, raw);
+        error(`discovery roles-check: ${result.violations.length} violation(s):\n` + result.violations.map(formatViolation).join('\n'), ERROR_REASON.DISCOVERY_ROLES_CHECK_FAILED);
+        return; // unreachable
+    }
+    output(payload, raw);
+}
+module.exports = {
+    ROLES_FILE,
+    ROLES_HEADER,
+    PERMISSIONS_HEADER,
+    SCREENS_HEADER,
+    ROLES_CHECK_FAILED: ERROR_REASON.DISCOVERY_ROLES_CHECK_FAILED,
+    stepActors,
+    checkRoles,
+    checkProjectRoles,
+    cmdDiscoveryRolesCheck,
+};