@polymorphism-tech/morph-spec 8.34.2 → 8.35.0

package/framework/hooks/git/commit-msg/conventional-commits.sh

@@ -1,33 +1,33 @@
-#!/usr/bin/env bash
-# Scope: universal | Validates commit message format (Conventional Commits)
-# MORPH-SPEC Commit Message Hook
-# Enforces Conventional Commits specification
-
-COMMIT_MSG_FILE="$1"
-COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
-
-# Conventional Commits pattern: type(scope): description
-# Types: feat, fix, docs, style, refactor, perf, test, chore, build, ci, revert
-PATTERN="^(feat|fix|docs|style|refactor|perf|test|chore|build|ci|revert)(\(.+\))?: .{1,100}"
-
-if ! echo "$COMMIT_MSG" | grep -qE "$PATTERN"; then
-  echo "❌ Invalid commit message format!"
-  echo ""
-  echo "Required format: <type>(<scope>): <description>"
-  echo ""
-  echo "Types: feat, fix, docs, style, refactor, perf, test, chore, build, ci, revert"
-  echo ""
-  echo "Examples:"
-  echo "  feat(auth): add JWT refresh token rotation"
-  echo "  fix(api): resolve null reference in UserService"
-  echo "  docs(readme): update installation instructions"
-  echo ""
-  echo "Your message:"
-  echo "  $COMMIT_MSG"
-  echo ""
-  echo "Override with: git commit --no-verify"
-  exit 1
-fi
-
-echo "✅ Commit message format valid"
-exit 0
+#!/usr/bin/env bash
+# Scope: universal | Validates commit message format (Conventional Commits)
+# MORPH-SPEC Commit Message Hook
+# Enforces Conventional Commits specification
+
+COMMIT_MSG_FILE="$1"
+COMMIT_MSG=$(cat "$COMMIT_MSG_FILE")
+
+# Conventional Commits pattern: type(scope): description
+# Types: feat, fix, docs, style, refactor, perf, test, chore, build, ci, revert
+PATTERN="^(feat|fix|docs|style|refactor|perf|test|chore|build|ci|revert)(\(.+\))?: .{1,100}"
+
+if ! echo "$COMMIT_MSG" | grep -qE "$PATTERN"; then
+  echo "❌ Invalid commit message format!"
+  echo ""
+  echo "Required format: <type>(<scope>): <description>"
+  echo ""
+  echo "Types: feat, fix, docs, style, refactor, perf, test, chore, build, ci, revert"
+  echo ""
+  echo "Examples:"
+  echo "  feat(auth): add JWT refresh token rotation"
+  echo "  fix(api): resolve null reference in UserService"
+  echo "  docs(readme): update installation instructions"
+  echo ""
+  echo "Your message:"
+  echo "  $COMMIT_MSG"
+  echo ""
+  echo "Override with: git commit --no-verify"
+  exit 1
+fi
+
+echo "✅ Commit message format valid"
+exit 0

package/framework/hooks/git/pre-commit/agents.sh

@@ -1,25 +1,25 @@
-#!/bin/bash
-# Scope: universal | Validates agents.json Schema
-# MORPH-SPEC Pre-Commit Hook: Agent Configuration Validation
-# Uses validate-agents.js to check agents.json
-
-echo "🤖 Validating agent configuration..."
-
-# Check if agents.json is being modified
-if git diff --cached --name-only | grep -q 'agents\.json$'; then
-  echo "Detected changes to agents.json"
-
-  # Run validator
-  if ! morph-spec validate-agents-skills; then
-    echo ""
-    echo "❌ COMMIT BLOCKED: agents.json validation failed"
-    echo "   Fix errors above before committing"
-    exit 1
-  fi
-
-  echo "✓ agents.json is valid"
-else
-  echo "✓ No changes to agents.json"
-fi
-
-exit 0
+#!/bin/bash
+# Scope: universal | Validates agents.json Schema
+# MORPH-SPEC Pre-Commit Hook: Agent Configuration Validation
+# Uses validate-agents.js to check agents.json
+
+echo "🤖 Validating agent configuration..."
+
+# Check if agents.json is being modified
+if git diff --cached --name-only | grep -q 'agents\.json$'; then
+  echo "Detected changes to agents.json"
+
+  # Run validator
+  if ! morph-spec validate-agents-skills; then
+    echo ""
+    echo "❌ COMMIT BLOCKED: agents.json validation failed"
+    echo "   Fix errors above before committing"
+    exit 1
+  fi
+
+  echo "✓ agents.json is valid"
+else
+  echo "✓ No changes to agents.json"
+fi
+
+exit 0

package/framework/hooks/git/pre-commit/orchestrator.sh

@@ -1,64 +1,64 @@
-#!/usr/bin/env bash
-# Scope: universal | Orchestrates framework + stack-specific pre-commit hooks
-# MORPH-SPEC Master Pre-Commit Hook
-# Runs universal framework hooks + stack-specific hooks in sequence
-
-echo "╔════════════════════════════════════════════════╗"
-echo "║     MORPH-SPEC PRE-COMMIT VALIDATION           ║"
-echo "╚════════════════════════════════════════════════╝"
-echo ""
-
-FRAMEWORK_HOOKS_DIR="$(dirname "$0")"
-STACK_HOOKS_DIR=".morph/hooks/pre-commit"
-
-HAS_FAILURES=false
-
-# Run framework hooks (universal - all stacks)
-echo "📦 Running framework hooks (universal)..."
-for hook in "$FRAMEWORK_HOOKS_DIR"/*.sh; do
-  # Skip orchestrator itself
-  if [[ "$hook" == */orchestrator.sh ]]; then
-    continue
-  fi
-
-  if [[ -f "$hook" ]]; then
-    hook_name=$(basename "$hook")
-    echo "─────────────────────────────────────────────────"
-    if ! bash "$hook"; then
-      HAS_FAILURES=true
-      echo "❌ Framework hook failed: $hook_name"
-    fi
-    echo ""
-  fi
-done
-
-# Run stack-specific hooks (if exist)
-if [[ -d "$STACK_HOOKS_DIR" ]]; then
-  echo "🎯 Running stack-specific hooks..."
-  for hook in "$STACK_HOOKS_DIR"/*.sh; do
-    if [[ -f "$hook" ]]; then
-      hook_name=$(basename "$hook")
-      echo "─────────────────────────────────────────────────"
-      if ! bash "$hook"; then
-        HAS_FAILURES=true
-        echo "❌ Stack hook failed: $hook_name"
-      fi
-      echo ""
-    fi
-  done
-else
-  echo "ℹ️  No stack-specific hooks found (optional)"
-  echo ""
-fi
-
-echo "═════════════════════════════════════════════════"
-
-if [[ "$HAS_FAILURES" == "true" ]]; then
-  echo "❌ PRE-COMMIT VALIDATION FAILED"
-  echo "   Fix errors above before committing"
-  echo "   Or use: git commit --no-verify to skip"
-  exit 1
-fi
-
-echo "✅ ALL PRE-COMMIT VALIDATIONS PASSED"
-exit 0
+#!/usr/bin/env bash
+# Scope: universal | Orchestrates framework + stack-specific pre-commit hooks
+# MORPH-SPEC Master Pre-Commit Hook
+# Runs universal framework hooks + stack-specific hooks in sequence
+
+echo "╔════════════════════════════════════════════════╗"
+echo "║     MORPH-SPEC PRE-COMMIT VALIDATION           ║"
+echo "╚════════════════════════════════════════════════╝"
+echo ""
+
+FRAMEWORK_HOOKS_DIR="$(dirname "$0")"
+STACK_HOOKS_DIR=".morph/hooks/pre-commit"
+
+HAS_FAILURES=false
+
+# Run framework hooks (universal - all stacks)
+echo "📦 Running framework hooks (universal)..."
+for hook in "$FRAMEWORK_HOOKS_DIR"/*.sh; do
+  # Skip orchestrator itself
+  if [[ "$hook" == */orchestrator.sh ]]; then
+    continue
+  fi
+
+  if [[ -f "$hook" ]]; then
+    hook_name=$(basename "$hook")
+    echo "─────────────────────────────────────────────────"
+    if ! bash "$hook"; then
+      HAS_FAILURES=true
+      echo "❌ Framework hook failed: $hook_name"
+    fi
+    echo ""
+  fi
+done
+
+# Run stack-specific hooks (if exist)
+if [[ -d "$STACK_HOOKS_DIR" ]]; then
+  echo "🎯 Running stack-specific hooks..."
+  for hook in "$STACK_HOOKS_DIR"/*.sh; do
+    if [[ -f "$hook" ]]; then
+      hook_name=$(basename "$hook")
+      echo "─────────────────────────────────────────────────"
+      if ! bash "$hook"; then
+        HAS_FAILURES=true
+        echo "❌ Stack hook failed: $hook_name"
+      fi
+      echo ""
+    fi
+  done
+else
+  echo "ℹ️  No stack-specific hooks found (optional)"
+  echo ""
+fi
+
+echo "═════════════════════════════════════════════════"
+
+if [[ "$HAS_FAILURES" == "true" ]]; then
+  echo "❌ PRE-COMMIT VALIDATION FAILED"
+  echo "   Fix errors above before committing"
+  echo "   Or use: git commit --no-verify to skip"
+  exit 1
+fi
+
+echo "✅ ALL PRE-COMMIT VALIDATIONS PASSED"
+exit 0

package/framework/hooks/git/pre-commit/specs.sh

@@ -1,50 +1,50 @@
-#!/bin/bash
-# Scope: universal | Validates spec.md required sections
-# MORPH-SPEC Pre-Commit Hook: Spec Validation
-# Validates that spec.md files have required sections
-
-echo "🔍 Validating spec files..."
-
-# Find modified spec.md files
-SPEC_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep 'spec\.md$')
-
-if [ -z "$SPEC_FILES" ]; then
-  echo "✓ No spec files modified"
-  exit 0
-fi
-
-HAS_ERRORS=false
-
-for spec_file in $SPEC_FILES; do
-  echo "Checking: $spec_file"
-
-  # Required sections
-  REQUIRED_SECTIONS=(
-    "## 📋 Metadata"
-    "## 🎯 Overview"
-    "## 🏗️ Technical Design"
-    "## ✅ Acceptance Criteria"
-  )
-
-  for section in "${REQUIRED_SECTIONS[@]}"; do
-    if ! grep -q "$section" "$spec_file"; then
-      echo "  ❌ Missing section: $section"
-      HAS_ERRORS=true
-    fi
-  done
-
-  # Check if has at least one user story or requirement
-  if ! grep -qi "user story\|requirement\|acceptance criteria" "$spec_file"; then
-    echo "  ⚠️  Warning: No user stories or requirements found"
-  fi
-done
-
-if [ "$HAS_ERRORS" = true ]; then
-  echo ""
-  echo "❌ COMMIT BLOCKED: spec.md files are incomplete"
-  echo "   Add missing sections before committing"
-  exit 1
-fi
-
-echo "✓ All spec files are valid"
-exit 0
+#!/bin/bash
+# Scope: universal | Validates spec.md required sections
+# MORPH-SPEC Pre-Commit Hook: Spec Validation
+# Validates that spec.md files have required sections
+
+echo "🔍 Validating spec files..."
+
+# Find modified spec.md files
+SPEC_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep 'spec\.md$')
+
+if [ -z "$SPEC_FILES" ]; then
+  echo "✓ No spec files modified"
+  exit 0
+fi
+
+HAS_ERRORS=false
+
+for spec_file in $SPEC_FILES; do
+  echo "Checking: $spec_file"
+
+  # Required sections
+  REQUIRED_SECTIONS=(
+    "## 📋 Metadata"
+    "## 🎯 Overview"
+    "## 🏗️ Technical Design"
+    "## ✅ Acceptance Criteria"
+  )
+
+  for section in "${REQUIRED_SECTIONS[@]}"; do
+    if ! grep -q "$section" "$spec_file"; then
+      echo "  ❌ Missing section: $section"
+      HAS_ERRORS=true
+    fi
+  done
+
+  # Check if has at least one user story or requirement
+  if ! grep -qi "user story\|requirement\|acceptance criteria" "$spec_file"; then
+    echo "  ⚠️  Warning: No user stories or requirements found"
+  fi
+done
+
+if [ "$HAS_ERRORS" = true ]; then
+  echo ""
+  echo "❌ COMMIT BLOCKED: spec.md files are incomplete"
+  echo "   Add missing sections before committing"
+  exit 1
+fi
+
+echo "✓ All spec files are valid"
+exit 0

package/framework/hooks/git/pre-push/run-tests.sh

@@ -1,44 +1,44 @@
-#!/usr/bin/env bash
-# Scope: universal | Runs test suite before push
-# MORPH-SPEC Pre-Push Hook
-# Ensures all tests pass before pushing to remote
-
-echo "🧪 Running test suite before push..."
-echo ""
-
-# Detect project type and run appropriate tests
-if [[ -f *.csproj ]] || find . -maxdepth 2 -name "*.csproj" 2>/dev/null | grep -q .; then
-  # .NET project detected
-  echo "📦 Detected .NET project"
-
-  if ! dotnet test --verbosity minimal --no-build --no-restore 2>/dev/null; then
-    echo ""
-    echo "❌ .NET tests failed!"
-    echo ""
-    echo "Fix failing tests before pushing."
-    echo "Override with: git push --no-verify"
-    exit 1
-  fi
-
-elif [[ -f package.json ]]; then
-  # Node.js project detected
-  echo "📦 Detected Node.js project"
-
-  if ! npm test 2>/dev/null; then
-    echo ""
-    echo "❌ Node.js tests failed!"
-    echo ""
-    echo "Fix failing tests before pushing."
-    echo "Override with: git push --no-verify"
-    exit 1
-  fi
-
-else
-  echo "⚠️  No recognized test framework found"
-  echo "   Skipping test execution"
-  exit 0
-fi
-
-echo ""
-echo "✅ All tests passed - safe to push"
-exit 0
+#!/usr/bin/env bash
+# Scope: universal | Runs test suite before push
+# MORPH-SPEC Pre-Push Hook
+# Ensures all tests pass before pushing to remote
+
+echo "🧪 Running test suite before push..."
+echo ""
+
+# Detect project type and run appropriate tests
+if [[ -f *.csproj ]] || find . -maxdepth 2 -name "*.csproj" 2>/dev/null | grep -q .; then
+  # .NET project detected
+  echo "📦 Detected .NET project"
+
+  if ! dotnet test --verbosity minimal --no-build --no-restore 2>/dev/null; then
+    echo ""
+    echo "❌ .NET tests failed!"
+    echo ""
+    echo "Fix failing tests before pushing."
+    echo "Override with: git push --no-verify"
+    exit 1
+  fi
+
+elif [[ -f package.json ]]; then
+  # Node.js project detected
+  echo "📦 Detected Node.js project"
+
+  if ! npm test 2>/dev/null; then
+    echo ""
+    echo "❌ Node.js tests failed!"
+    echo ""
+    echo "Fix failing tests before pushing."
+    echo "Override with: git push --no-verify"
+    exit 1
+  fi
+
+else
+  echo "⚠️  No recognized test framework found"
+  echo "   Skipping test execution"
+  exit 0
+fi
+
+echo ""
+echo "✅ All tests passed - safe to push"
+exit 0

package/framework/hooks/shared/e2e-check.js

@@ -322,10 +322,29 @@ export function deleteStamp(gitCommonDir, projectName) {
 /**
  * Does this stack serve the working tree directly?
  *
- * A service that bind-mounts the project into the container reads source from
- * disk on every request, so a rebuild can never make it fresher — it is
- * already serving whatever is on disk. This is the ONE case where reuse is
- * unconditionally safe.
+ * The question is right; the answer used to be wrong. The predicate used to be
+ * "does ANY service mount ANYTHING under cwd" — which a Playwright sidecar
+ * mounting `./e2e` answers yes to. `decideReuse()` then short-circuited BEFORE
+ * the stamp comparison and printed "source is bind-mounted" about a stack whose
+ * application is a compiled image: a true statement about the sidecar, used as
+ * a false statement about the code under test, and the stamp — the only real
+ * proof of freshness — never got a say.
+ *
+ * The honest predicate looks only at services that are BUILT here, because only
+ * those carry code a rebuild could refresh:
+ *
+ *   - no service declares `build:`  → false. Nothing is compiled from this
+ *     tree, so "a rebuild cannot make it fresher" says nothing about it, and
+ *     the stamp decides.
+ *   - EVERY built service mounts the project ROOT → true. Each reads source
+ *     from disk on every request, so a running stack is current by
+ *     construction — the ONE case where reuse is unconditionally safe.
+ *   - anything else → false. One built service serving an image is one service
+ *     that can be stale.
+ *
+ * A subdirectory mount is deliberately not enough: a service that mounts only
+ * `./e2e` still runs whatever was baked into its image. Uncertainty answers
+ * false, which costs one cheap layer-cached rebuild — see bringUpStack().
  *
  * @param {object} composeConfig - parsed `docker compose config --format json`
  * @param {string} cwd
@@ -335,18 +354,46 @@ export function usesBindMount(composeConfig, cwd) {
   const services = composeConfig?.services;
   if (!services || typeof services !== 'object') return false;
 
-  const normalizedCwd = cwd.replace(/\\/g, '/').replace(/\/+$/, '');
-
-  return Object.values(services).some((service) => {
-    const volumes = Array.isArray(service?.volumes) ? service.volumes : [];
-    return volumes.some((vol) => {
-      // Long syntax: { type: 'bind', source: '...' }. Short syntax is a string
-      // "src:dst" that compose has already expanded to an absolute path.
-      const source = typeof vol === 'string' ? vol.split(':')[0] : vol?.source;
-      if (!source) return false;
-      const normalized = String(source).replace(/\\/g, '/').replace(/\/+$/, '');
-      return normalized === normalizedCwd || normalized.startsWith(`${normalizedCwd}/`);
-    });
+  const normalizedCwd = normalizeMountPath(cwd);
+  const built = Object.values(services).filter(
+    (service) => service && service.build !== undefined && service.build !== null,
+  );
+  if (built.length === 0) return false;
+
+  return built.every((service) => mountsProjectRoot(service, normalizedCwd));
+}
+
+/** One spelling per path, so two spellings of the same directory compare equal. */
+function normalizeMountPath(path) {
+  return String(path ?? '')
+    .replace(/\\/g, '/')
+    .replace(/\/+$/, '');
+}
+
+/**
+ * Source half of a short-syntax volume ("src:dst[:mode]").
+ *
+ * Splitting on the FIRST ':' loses on Windows, where compose expands the source
+ * to `C:\path`. The target is always an absolute container path, so anchoring on
+ * the ':' that precedes it is the split that survives both platforms.
+ */
+function shortVolumeSource(spec) {
+  const match = /^(.+):(\/[^:]*)(:[A-Za-z,]+)?$/.exec(spec);
+  return match ? match[1] : null;
+}
+
+/**
+ * Does this service bind-mount the project ROOT? A subdirectory does not count:
+ * only the root makes the whole service read its code from disk.
+ */
+function mountsProjectRoot(service, normalizedCwd) {
+  const volumes = Array.isArray(service?.volumes) ? service.volumes : [];
+  return volumes.some((vol) => {
+    // Long syntax: { type: 'bind', source: '...' }; short syntax is a string.
+    if (typeof vol !== 'string' && vol?.type && vol.type !== 'bind') return false;
+    const source = typeof vol === 'string' ? shortVolumeSource(vol) : vol?.source;
+    if (!source) return false;
+    return normalizeMountPath(source) === normalizedCwd;
   });
 }
 
@@ -513,6 +560,19 @@ export function bringUpStack(
     return { status: 'pass', reused: true, output: '', reason: decision.reason };
   }
 
+  // "Fresh" is a promise about the DATA, not only about the image. Adding
+  // `--build` alone rebuilds the container and leaves the postgres volume
+  // standing, so the next suite talks to the previous run's database — the
+  // stale rows survive the very flag asked to get rid of them. The named
+  // volumes go first, and the stamp goes with them: a stamp that outlives the
+  // stack it described would let the next `up` reuse something that no longer
+  // exists. Teardown is best-effort by construction (tearDownStack never
+  // throws), so a stack that was not up costs nothing here.
+  if (forceFresh) {
+    tearDownStack(cwd, { composeFile, projectName, env, volumes: true }, exec);
+    deleteStamp(gitCommonDir, projectName);
+  }
+
   const upArgs = [...base, 'up', '-d', '--wait'];
   if (decision.rebuild) upArgs.push('--build');
 
@@ -555,7 +615,11 @@ function decideReuse({ cwd, base, env, stamp, status, gitCommonDir, projectName,
   if (!status.up || !status.healthy) return { reuse: false, rebuild: true };
 
   // Bind-mounted source is served from disk, so a running stack is current by
-  // construction — the only unconditionally safe reuse.
+  // construction — the only unconditionally safe reuse. usesBindMount() answers
+  // this for the services that are BUILT here; when it says no, control falls
+  // through to the stamp, which is the real proof. The two reasons below stay
+  // distinct on purpose: whoever reads "reused warm stack" has to be able to
+  // tell which fact bought the reuse.
   const configJson = exec('docker', [...base, 'config', '--format', 'json'], { cwd, env });
   if (configJson.code === 0) {
     try {
@@ -666,13 +730,37 @@ export function loadEnvFile(path) {
  * screen would quietly end up with no e2e at all. Missing auth CONFIG is a
  * planning gap (Gate 2); broken auth at runtime is a real failure.
  *
- * @returns {{ status: 'pass'|'fail'|'skip', reason: string|null }}
+ * The same rule applied one level up is why `warning` exists: a config that
+ * declares `seedCommand` but leaves `mode` absent (or "none") used to return
+ * `skip` on the first line and run nothing at all. The seed was configured, the
+ * code knew how to execute it, and `mode` switched it off without a word — the
+ * silence is what made a working seedCommand look like dead configuration.
+ *
+ * @param {object} [options]
+ * @param {boolean} [options.forceSeed] - `--fresh-e2e`: the database was just
+ *   dropped, so a storageState captured against it is a session for rows that
+ *   no longer exist. Refuses the "file exists → reuse" shortcut.
+ * @returns {{ status: 'pass'|'fail'|'skip', reason: string|null, warning?: string }}
  */
-export function prepareAuth(cwd, { config, env, timeout = 60_000 } = {}, exec = defaultExec) {
+export function prepareAuth(
+  cwd,
+  { config, env, timeout = 60_000, forceSeed = false } = {},
+  exec = defaultExec,
+) {
   const auth = config?.e2e?.auth;
   const mode = auth?.mode ?? 'none';
 
   if (mode === 'none') {
+    if (auth?.seedCommand) {
+      const declared = auth.mode == null ? 'absent' : `"${auth.mode}"`;
+      return {
+        status: 'skip',
+        reason: null,
+        warning:
+          `e2e.auth.seedCommand is configured but e2e.auth.mode is ${declared} — ` +
+          'the seed never runs (set e2e.auth.mode to "seed" or "storageState")',
+      };
+    }
     return { status: 'skip', reason: null };
   }
 
@@ -685,10 +773,25 @@ export function prepareAuth(cwd, { config, env, timeout = 60_000 } = {}, exec =
     const statePath = auth.storageStatePath
       ? join(cwd, auth.storageStatePath)
       : null;
-    if (statePath && existsSync(statePath)) {
+    const stateExists = Boolean(statePath && existsSync(statePath));
+
+    // The file's existence is not its freshness. After `--fresh-e2e` dropped
+    // the volumes, a storageState captured against the old database
+    // authenticates a user that is no longer there: every request comes back
+    // 403 and the failure looks like a broken app. forceSeed refuses the
+    // shortcut and re-establishes the session against the new database.
+    if (stateExists && !forceSeed) {
       return { status: 'pass', reason: 'reused stored auth session' };
     }
     if (!auth.seedCommand) {
+      if (stateExists) {
+        // Nothing to refresh it with — reusing is the only option left, and
+        // saying so is the difference between a reuse and a silent one.
+        return {
+          status: 'pass',
+          reason: 'reused stored auth session (no e2e.auth.seedCommand to refresh it)',
+        };
+      }
       return {
         status: 'fail',
         reason:
@@ -715,7 +818,12 @@ export function prepareAuth(cwd, { config, env, timeout = 60_000 } = {}, exec =
       reason: `e2e auth setup failed (${auth.seedCommand}): ${firstLine(result.output)}`,
     };
   }
-  return { status: 'pass', reason: 'auth seeded for the e2e environment' };
+  return {
+    status: 'pass',
+    reason: forceSeed
+      ? 'auth re-seeded against the fresh stack'
+      : 'auth seeded for the e2e environment',
+  };
 }
 
 // ============================================================================
@@ -818,7 +926,12 @@ export function runE2eCheck(cwd, options = {}) {
   }
 
   try {
-    const auth = prepareAuth(cwd, { config, env: composeEnv }, exec);
+    // forceSeed rides on forceFresh: the same flag that dropped the database is
+    // the one that invalidates any session captured against it.
+    const auth = prepareAuth(cwd, { config, env: composeEnv, forceSeed: forceFresh }, exec);
+    // A configured seed that never runs is a finding, not a detail — it travels
+    // to warnings[] so verify turns it into a "[e2e] warning: …" feedback line.
+    if (auth.warning) warnings.push(auth.warning);
     if (auth.status === 'fail') {
       return { status: 'fail', command: null, output: '', reason: auth.reason, warnings };
     }