@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.1

package/dist/commands/validate/service/events/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAIN,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAqB,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAoB,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAyB1D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAe;IACrD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAC9F,IAAI,CAAC;IACP,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9C,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,UAAU,GACd,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/B,MAAM,KAAK,GAA8E,EAAE,CAAC;YAC5F,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACT,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjG,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,WAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,sEAAsE;QACtE,4DAA4D;QAC5D,EAAE;QACF,gEAAgE;QAChE,MAAM,QAAQ,GAAG;YACf,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACvF,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,wBAAwB,KAAK,CAAC,QAAQ,SAAS,QAAQ,CAAC,MAAM,2CAA2C;oBACzG,oGAAoG;gBACtG,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,2EAA2E;QAC3E,8EAA8E;QAC9E,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,OAAO,gFAAgF;YACnG,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,yDAAyD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8GAA8G;aACpN,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,qCAAqC,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oIAAoI;aAC5O,CAAC,CAAC;QACL,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAC9F,4EAA4E;oBAC5E,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,4BAA4B,MAAM,CAAC,YAAY,CAAC,MAAM,iCAAiC;oBACjG,6FAA6F;oBAC7F,+BAA+B;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,6EAA6E;QAC7E,yEAAyE;QACzE,yDAAyD;QACzD,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,CAAC,SAAmC,EAAE,OAAe,EAAW,EAAE,CACjF,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,SAAmC,EAAU,EAAE,CAC7D,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,oBAAoB,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,OAAO,EAAE,GAAG;oBACpH,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACnI,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACrL,CAAC,CAAC;QACL,CAAC;QACD,qEAAqE;QACrE,2EAA2E;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/F,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,yFAAyF;aAC/J,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACxI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7E,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SAC9E,CAAC;KACH,CAAC,IAAI,EAAE,CAAC;IACT,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAElH,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,6CAA6C;IAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC1D,IAAI,WAAW,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,OAAO,kBAAkB,WAAW,4CAA4C;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The async contract axis — AsyncAPI messages on the landscape spine.\n *\n * The HTTP spine (`./spine.js`) and this one are mirror images, and the mirror\n * is the whole reason this is a second axis rather than a second `metadata`\n * key. On the HTTP axis the PROVIDER owns the contract: an edge names an\n * operation and the target's openapi.yaml settles it, locally, in one file.\n * Here the PRODUCER owns the message and the consumer joins to it from another\n * repository — so \"is this message declared\" is local, while \"does anybody\n * publish it\" is a fleet question with no local answer at all. That second\n * question is the only check on either spine that reads other services'\n * contracts; it lives in `./message-producers.js`, and this axis only decides\n * when it is worth paying for — exactly when something actually consumes.\n */\nimport { existsSync } from \"node:fs\";\nimport {\n  type DeclaredService,\n  type PathableService,\n  type RawServiceId,\n} from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { type ServicePaths } from \"../../../../core/repo/paths.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../../../core/document/spec.js\";\nimport { readAsyncapi, slotsOf } from \"../../../../core/asyncapi/read.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { producerFindings } from \"./message-producers.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/** What the service target hands the event axis. */\nexport interface EventAxis {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** `service` widened for `===` against the resolver's DOCUMENT text — see service.ts. */\n  me: string;\n  paths: ServicePaths;\n  /** Every requirement the living spec declares; `event.messages-unlinked` counts what is written. */\n  reqs: Requirement[];\n  /** The ones that still govern something — a REMOVED requirement links nothing. */\n  livingReqs: Requirement[];\n  /** arch.spec.md's requirements, which carry as many event links as spec.md's do. */\n  archReqs: Requirement[];\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  fleet?: FleetContext;\n}\n\nexport async function eventAxisFindings(axis: EventAxis): Promise<Finding[]> {\n  const { docsDir, service, me, paths, reqs, livingReqs, archReqs, land, landSvcOf, known, fleet } =\n    axis;\n  const findings: Finding[] = [];\n\n  // Where this axis started, so the closing ok-finding can be \"nothing here\n  // broke\" rather than a second, independently-computed claim about the same\n  // facts. A positive finding derived from the same walk cannot disagree with it.\n  const eventFindingsAt = findings.length;\n  const events = await readAsyncapi(paths.asyncapi, fleet);\n  const sentHere = new Set(events.sent);\n  const receivedHere = new Set(events.received);\n\n  // Every edge that binds THIS service to a message: `publishes` binds the\n  // edge's source (a service produces what it declares an `action: send` for),\n  // `consumes` binds its target. One edge may legitimately carry both — a relay\n  // that reads one topic and writes another is a single arrow in most fleet maps.\n  const eventEdges =\n    land === null || land.errors.length > 0\n      ? []\n      : land.relationships.flatMap((r) => {\n          const bound: { direction: \"publishes\" | \"consumes\"; message: string; other: string }[] = [];\n          if (r.publishes !== undefined && landSvcOf!(r.source) === me) {\n            bound.push({ direction: \"publishes\", message: r.publishes, other: landSvcOf!(r.target) });\n          }\n          if (r.consumes !== undefined && landSvcOf!(r.target) === me) {\n            bound.push({ direction: \"consumes\", message: r.consumes, other: landSvcOf!(r.source) });\n          }\n          return bound;\n        });\n  // Both requirement namespaces, and a REMOVED requirement links nothing —\n  // the `livingReqs` rule the API axis already follows, applied to the pair.\n  const eventLinks = [...livingReqs, ...archReqs.filter((r) => r.kind !== \"REMOVED\")].flatMap((r) => [\n    ...r.publishes.map((m) => ({ direction: \"publishes\" as const, message: m, requirement: r.name })),\n    ...r.consumes.map((m) => ({ direction: \"consumes\" as const, message: m, requirement: r.name })),\n  ]);\n\n  if (!existsSync(paths.asyncapi)) {\n    // Deliberately TWO grades, not the three `service.no-openapi` uses. Its\n    // middle grade — warn when the landscape cannot prove nobody calls this\n    // service — rests on HTTP being the default: most services expose one, so\n    // \"I could not look\" is worth saying. An event contract is genuinely\n    // optional; most services in a legacy fleet touch no topic at all. Warning\n    // every one of them the moment a landscape fails to parse would put a\n    // finding on the whole fleet that names a file nobody owes.\n    //\n    // So: something already joins into the absent file, or silence.\n    const dangling = [\n      ...new Set([...eventEdges.map((e) => e.message), ...eventLinks.map((e) => e.message)]),\n    ].sort();\n    if (dangling.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"service.no-asyncapi\",\n        subject: service,\n        message:\n          `No async contract at ${paths.asyncapi}, and ${dangling.length} message link(s) already point into it — ` +\n          `every landscape edge and requirement naming one of them resolves to nothing until the file is back`,\n        details: dangling,\n      });\n    }\n  } else if (events.unreadable) {\n    // The openapi.invalid discipline: a contract that EXISTS but does not read\n    // is a broken source of truth, not an empty one. Grading the links against\n    // an empty message set would turn one file into one `spine.message-undefined`\n    // per edge, every one of them pointing at the landscape.\n    findings.push({\n      severity: \"error\",\n      code: \"asyncapi.invalid\",\n      subject: service,\n      message: `${service}: asyncapi.yaml does not parse — the event spine is unchecked for this service`,\n      ...(events.error === undefined ? {} : { details: [events.error] }),\n    });\n  } else {\n    // Feature-only bookkeeping published to the fleet — the openapi axis's\n    // `openapi.remove-marker-living` discipline, one code for every depth the\n    // reader collects markers at (slots and inline channel messages alike).\n    if (events.markers.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"asyncapi.remove-marker-living\",\n        subject: service,\n        message: `${service}: living asyncapi.yaml carries x-loam-remove: true at ${events.markers.join(\", \")} — removal markers are valid only in feature deltas; retire a slot through a feature's asyncapi.yaml instead`,\n      });\n    }\n    for (const name of events.duplicateNames) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.duplicate-message\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares message '${name}' in ${slotsOf(events, name).join(\" and \")} — every join on the name (an edge's metadata { publishes }, a requirement's Publishes: line) picks one of those slots arbitrarily`,\n      });\n    }\n    // The contract-depth probes. Form validated and depth did not: a payload\n    // of bare `type: object` and a `$ref` to nothing both read as cleanly as\n    // a full schema, while a reader still cannot rebuild the payload from the\n    // green contract. Presence probes only — a non-JSON schemaFormat\n    // is skipped, so Avro stays a document change.\n    const empties = events.messages.filter((m) => m.payloadEmpty === true).map((m) => m.name);\n    if (empties.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.payload-undescribed\",\n        subject: service,\n        message:\n          `${service}: ${empties.length} message(s) declare no payload shape (${empties.join(\", \")}) — ` +\n          `the name joins the spine, but nothing defines what a consumer would read; ` +\n          `declare properties, or a schemaFormat for a non-JSON schema`,\n      });\n    }\n    if (events.danglingRefs.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.ref-unresolved\",\n        subject: service,\n        message:\n          `${service}: asyncapi.yaml contains ${events.danglingRefs.length} internal $ref(s) that resolve ` +\n          `to nothing in the document — whatever they were meant to carry is silently absent from the ` +\n          `spine's view of this contract`,\n        details: events.danglingRefs,\n      });\n    }\n    // Local resolution, both directions and both sources of a claim. An edge and\n    // a requirement making the same broken claim get the same sentence under\n    // different codes, matching how `spine.op-undefined` and\n    // `spec-api.op-undefined` split the HTTP axis: one is the fleet map's\n    // mistake, the other is this document's, and the fix is in a different file.\n    const declares = (direction: \"publishes\" | \"consumes\", message: string): boolean =>\n      direction === \"publishes\" ? sentHere.has(message) : receivedHere.has(message);\n    const action = (direction: \"publishes\" | \"consumes\"): string =>\n      direction === \"publishes\" ? \"send\" : \"receive\";\n    for (const e of eventEdges) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spine.message-undefined\",\n        subject: service,\n        message:\n          `${service}: landscape edge ${e.direction === \"publishes\" ? `${service} → ${e.other}` : `${e.other} → ${service}`} ` +\n          `${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    for (const e of eventLinks) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spec-event.message-undefined\",\n        subject: service,\n        message: `${service}: requirement '${e.requirement}' ${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    // The migration-debt case, `api.ops-unlinked`'s twin: a contract and\n    // requirements that never name each other leave this axis vacuously green.\n    if (events.messages.length > 0 && reqs.length + archReqs.length > 0 && eventLinks.length === 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.messages-unlinked\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares ${events.messages.length} message(s) but no requirement links any — the event axis is unchecked for this service`,\n      });\n    }\n    // `api.ungoverned`'s event twin, and the per-message half the check above\n    // cannot see: `event.messages-unlinked` fires only when ZERO links exist,\n    // so a contract with five declared messages and three governed ones\n    // reported nothing about the other two. The join is against requirement\n    // lines ONLY, deliberately ignoring landscape edges — an edge is a claim\n    // about traffic, a requirement is governance — exactly as the API axis\n    // ignores inbound edges when grading coverage.\n    const governed = new Set(eventLinks.map((e) => e.message));\n    const orphans = [...new Set(events.messages.map((m) => m.name))].filter((name) => !governed.has(name));\n    if (orphans.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.ungoverned\",\n        subject: service,\n        message: `${service}: ${orphans.length} message(s) not governed by any requirement's Publishes:/Consumes: line — ${orphans.join(\", \")}`,\n      });\n    }\n  }\n\n  // The consumed-message list is the handover to the fleet question in\n  // ./message-producers.js — a fleet where nothing consumes walks nothing.\n  const consumed = [\n    ...new Set([\n      ...eventEdges.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n      ...eventLinks.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n    ]),\n  ].sort();\n  findings.push(...(await producerFindings({ docsDir, service, land, landSvcOf, known, events, consumed, fleet })));\n\n  // Positive confirmation, on the same rule `spine.resolved` follows: claimed\n  // only where the axis actually checked something. A service that touches no\n  // topic says nothing here — an \"event axis clean\" on every worker in the fleet\n  // would be a green tick for work nobody did.\n  const eventChecks = eventEdges.length + eventLinks.length;\n  if (eventChecks > 0 && findings.length === eventFindingsAt) {\n    findings.push({\n      severity: \"ok\",\n      code: \"event.covered\",\n      message: `${service}: event spine (${eventChecks} message link(s) resolve to asyncapi.yaml)`,\n    });\n  }\n\n  return findings;\n}\n"]}

package/dist/commands/validate/service/events/message-producers.js

@@ -0,0 +1,77 @@
+/**
+ * The fleet question the event axis asks: who produces what this service
+ * consumes. Split out of `./events.js` along the seam its own header always
+ * named — the local axis grades one service's files, while this is the only
+ * check on either spine that reads OTHER services' contracts, and the two
+ * subjects share nothing but the consumed-message list the axis hands over.
+ */
+import {} from "../../../../core/kernel/ids/service.js";
+import {} from "../../../../core/c4/likec4.js";
+import {} from "../../../../core/vocabulary/report.js";
+import { producersByMessage } from "../../../../core/asyncapi/producers.js";
+import {} from "../../../../core/asyncapi/model.js";
+import { FleetContext } from "../../../../core/fleet-context.js";
+import { externalProducerOf } from "../../checks/fleet-shape.js";
+// The fleet question, and the one check on either spine that a single
+// repository cannot answer: a consumer joins to a message whose schema lives
+// in the producer's contract, in the producer's repo. Paid only when something
+// actually consumes — a fleet where nobody has adopted the axis walks nothing.
+export async function producerFindings(input) {
+    const { docsDir, service, land, landSvcOf, known, events, consumed, fleet } = input;
+    const findings = [];
+    if (consumed.length === 0)
+        return findings;
+    const producers = await producersByMessage(docsDir, [...known], fleet);
+    for (const message of consumed) {
+        const who = producers.byMessage.get(message) ?? [];
+        // "Nobody produces this" is an argument from absence, and it is only
+        // sound over a fleet loam could actually read. One unreadable contract
+        // anywhere suspends it — that service may be the producer, and the
+        // alternative is blaming every consumer for somebody else's broken YAML.
+        // The external answer and the contested answer below rest on positive
+        // evidence and need no such guard.
+        if (who.length === 0) {
+            // A message produced OUTSIDE the fleet used to be inexpressible: the
+            // landscape said the producer was #external, and this error fired
+            // anyway — so honesty cost a red build, and the exit ramp people took
+            // was deleting the link. The landscape already carries the answer; an
+            // external producer shifts the contract question to the one file that
+            // can settle it, this service's own asyncapi.yaml.
+            const ext = externalProducerOf(message, land, landSvcOf, known);
+            if (ext !== null) {
+                const local = events.messages.find((m) => m.name === message);
+                if (local === undefined || local.payloadEmpty === true) {
+                    findings.push({
+                        severity: "warn",
+                        code: "spine.message-external",
+                        subject: service,
+                        message: `${service}: consumes '${message}' from '${ext}', a system outside the fleet — the ` +
+                            `producer declares no contract here, so the only payload definition is this service's ` +
+                            `own asyncapi.yaml, and it currently defines no shape for it; declare the message with ` +
+                            `its payload`,
+                    });
+                }
+                // A carried contract closes the question: the landscape states the
+                // external dependency, the consumer owns the schema — nothing to say.
+            }
+            else if (producers.unreadable.length === 0) {
+                findings.push({
+                    severity: "error",
+                    code: "spine.message-unproduced",
+                    subject: service,
+                    message: `${service}: consumes '${message}', but no service in the fleet and no #external element declares it is sent — the message has no producer anywhere, so nothing defines its payload`,
+                });
+            }
+        }
+        else if (who.length > 1) {
+            findings.push({
+                severity: "warn",
+                code: "asyncapi.message-contested",
+                subject: service,
+                message: `${service}: consumes '${message}', which ${who.length} services declare they send (${who.join(", ")}) — every consumer's join picks one of them arbitrarily, so the payload this service reads is whichever one happens to win`,
+            });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=message-producers.js.map

package/dist/commands/validate/service/events/message-producers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-producers.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/message-producers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAiE,MAAM,wCAAwC,CAAC;AACvH,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAoB,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAwBjE,sEAAsE;AACtE,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAuB;IAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACnD,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,mCAAmC;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,qEAAqE;YACrE,kEAAkE;YAClE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAChE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;gBAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,OAAO;wBAChB,OAAO,EACL,GAAG,OAAO,eAAe,OAAO,WAAW,GAAG,sCAAsC;4BACpF,uFAAuF;4BACvF,wFAAwF;4BACxF,aAAa;qBAChB,CAAC,CAAC;gBACL,CAAC;gBACD,mEAAmE;gBACnE,sEAAsE;YACxE,CAAC;iBAAM,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,oJAAoJ;iBAC9L,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,YAAY,GAAG,CAAC,MAAM,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,4HAA4H;aAC1O,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The fleet question the event axis asks: who produces what this service\n * consumes. Split out of `./events.js` along the seam its own header always\n * named — the local axis grades one service's files, while this is the only\n * check on either spine that reads OTHER services' contracts, and the two\n * subjects share nothing but the consumed-message list the axis hands over.\n */\nimport { type DeclaredService, type PathableService, type RawServiceId } from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { producersByMessage } from \"../../../../core/asyncapi/producers.js\";\nimport { type AsyncapiDoc } from \"../../../../core/asyncapi/model.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { externalProducerOf } from \"../../checks/fleet-shape.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/**\n * What the producer question is asked over. One record rather than a parameter\n * list: everything here is already bound together as one service's view of the\n * fleet, and the 4-parameter limit says so too.\n */\nexport interface ProducerQuestion {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  /** This service's own parsed contract — the local-shape half of the external answer. */\n  events: AsyncapiDoc;\n  /** The deduped message names this service consumes, from edges and requirement lines alike. */\n  consumed: readonly string[];\n  fleet?: FleetContext;\n}\n\n// The fleet question, and the one check on either spine that a single\n// repository cannot answer: a consumer joins to a message whose schema lives\n// in the producer's contract, in the producer's repo. Paid only when something\n// actually consumes — a fleet where nobody has adopted the axis walks nothing.\nexport async function producerFindings(input: ProducerQuestion): Promise<Finding[]> {\n  const { docsDir, service, land, landSvcOf, known, events, consumed, fleet } = input;\n  const findings: Finding[] = [];\n  if (consumed.length === 0) return findings;\n  const producers = await producersByMessage(docsDir, [...known], fleet);\n  for (const message of consumed) {\n    const who = producers.byMessage.get(message) ?? [];\n    // \"Nobody produces this\" is an argument from absence, and it is only\n    // sound over a fleet loam could actually read. One unreadable contract\n    // anywhere suspends it — that service may be the producer, and the\n    // alternative is blaming every consumer for somebody else's broken YAML.\n    // The external answer and the contested answer below rest on positive\n    // evidence and need no such guard.\n    if (who.length === 0) {\n      // A message produced OUTSIDE the fleet used to be inexpressible: the\n      // landscape said the producer was #external, and this error fired\n      // anyway — so honesty cost a red build, and the exit ramp people took\n      // was deleting the link. The landscape already carries the answer; an\n      // external producer shifts the contract question to the one file that\n      // can settle it, this service's own asyncapi.yaml.\n      const ext = externalProducerOf(message, land, landSvcOf, known);\n      if (ext !== null) {\n        const local = events.messages.find((m) => m.name === message);\n        if (local === undefined || local.payloadEmpty === true) {\n          findings.push({\n            severity: \"warn\",\n            code: \"spine.message-external\",\n            subject: service,\n            message:\n              `${service}: consumes '${message}' from '${ext}', a system outside the fleet — the ` +\n              `producer declares no contract here, so the only payload definition is this service's ` +\n              `own asyncapi.yaml, and it currently defines no shape for it; declare the message with ` +\n              `its payload`,\n          });\n        }\n        // A carried contract closes the question: the landscape states the\n        // external dependency, the consumer owns the schema — nothing to say.\n      } else if (producers.unreadable.length === 0) {\n        findings.push({\n          severity: \"error\",\n          code: \"spine.message-unproduced\",\n          subject: service,\n          message: `${service}: consumes '${message}', but no service in the fleet and no #external element declares it is sent — the message has no producer anywhere, so nothing defines its payload`,\n        });\n      }\n    } else if (who.length > 1) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.message-contested\",\n        subject: service,\n        message: `${service}: consumes '${message}', which ${who.length} services declare they send (${who.join(\", \")}) — every consumer's join picks one of them arbitrarily, so the payload this service reads is whichever one happens to win`,\n      });\n    }\n  }\n  return findings;\n}\n"]}

package/dist/commands/validate/service/evidence-pins.js

@@ -0,0 +1,131 @@
+/**
+ * The evidence-pin re-check as validate findings: every ACTIVE feature record
+ * this service has attested, its pins graded against THIS working tree.
+ *
+ * Service-repo-scoped like `sources.*` and the gherkin chain — the citations
+ * resolve only inside the service's own repository. From the docs repo the
+ * whole family is silent by design: every pin would grade `unresolved` there,
+ * which would be a lie about the code rather than about the record, and
+ * `sources.unverifiable-from-here` already names the blind spot once per
+ * service.
+ *
+ * ARCHIVED records are deliberately not linted (a v1 non-goal, recorded here):
+ * a frozen record is history, post-ship code drift is normal evolution, and
+ * grading it would turn every service's CI permanently yellow the week after
+ * every ship. If audit-time re-checks of shipped records are ever wanted, the
+ * same `lintEvidencePins` call over `listFeatures` include-archived is the
+ * whole change — behind an explicit flag, so the default stays quiet.
+ *
+ * Everything here demotes reviewer confidence only: warns never flip `valid`,
+ * `--strict` may gate on them as it gates on any warning, and no grade ever
+ * moves a verdict — `attested` never silently becomes `verified` and a drifted
+ * pin never un-confirms a claim.
+ */
+import { repoPath } from "../../../core/envelope/json.js";
+import { inOrder } from "../../../core/kernel/concurrency.js";
+import {} from "../../../core/kernel/ids/service.js";
+import { listFeatures } from "../../../core/repo/repo.js";
+import { readVerificationState } from "../../../core/verify/file.js";
+import { verificationPath } from "../../../core/verify/record.js";
+import { lintEvidencePins } from "../../../core/verify/pins/lint.js";
+import {} from "../../../core/vocabulary/report.js";
+export async function evidencePinFindings(docsDir, service, repoDir, fleet) {
+    if (repoDir === undefined)
+        return [];
+    // Membership questions cross the provenance line through plain strings by
+    // design (kernel/ids/service.ts) — record subjects are document text.
+    const me = service;
+    // ACTIVE features only — see the header for why archived records stay frozen.
+    const features = await listFeatures(docsDir, {}, fleet);
+    const lints = await inOrder(features, async (feature) => {
+        // Three states, graded apart on purpose. ABSENT is a feature nobody has
+        // verified — legitimate silence. UNREADABLE is somebody's record this run
+        // could not use, and it must be a finding here rather than a skip: the
+        // damage that most plausibly breaks a record in a service repo's CI is a
+        // hand edit to the very pins this family grades, and a lint that went
+        // silent over it would turn "someone broke the record" into a green run —
+        // `verify` names the same file `record-unreadable`, but this CI job never
+        // runs verify. An unreadable record also cannot say whether it attests
+        // this service, so the finding fires regardless of attestation.
+        const read = await readVerificationState(feature.dir);
+        if (read.state === "unreadable") {
+            return { feature: feature.id, path: repoPath(docsDir, verificationPath(feature.dir)), unreadable: read.reason };
+        }
+        if (read.state === "absent" || read.verification.schema !== 2)
+            return null;
+        if (!(read.verification.attestations ?? []).some((a) => a.service === me))
+            return null;
+        return { feature: feature.id, lint: await lintEvidencePins(read.verification.claims, me, repoDir) };
+    });
+    const findings = [];
+    let checked = 0;
+    let pinnedRecords = 0;
+    let drifted = false;
+    for (const entry of lints) {
+        if (entry === null)
+            continue;
+        if ("unreadable" in entry) {
+            findings.push({
+                severity: "warn",
+                code: "evidence.record-unreadable",
+                subject: service,
+                message: `${me}: ${entry.feature}: ${entry.path} exists but cannot be read as a verification record (${entry.unreadable}) — ` +
+                    "none of its evidence was checked. It is plain YAML: repair it by hand, or re-record " +
+                    `(\`loam verify ${entry.feature} --service ${me} --record answers.json\`); loam never overwrites a record it could not read`,
+            });
+            continue;
+        }
+        const { feature, lint } = entry;
+        if (lint.checked > 0 || lint.drifts.length > 0)
+            pinnedRecords += 1;
+        checked += lint.checked;
+        // The code is spelled as a literal at each call below, and the grade rides
+        // beside it rather than being sliced back out of the code string — the
+        // codes-drift collector resolves the `code` slot, and a derivation would
+        // be a second definition of the pairing free to drift from the first.
+        const drift = (grade, code, sentence) => {
+            const drifts = lint.drifts.filter((d) => d.grade === grade);
+            if (drifts.length === 0)
+                return;
+            drifted = true;
+            findings.push({
+                severity: "warn",
+                code,
+                subject: service,
+                message: `${me}: ${feature}: ${drifts.length} recorded evidence pin(s) ${sentence} — ` +
+                    "a reading priority for the reviewer, never a verdict change; re-answer and re-record " +
+                    `(\`loam verify ${feature} --service ${me} --record answers.json\`) once the evidence is re-read`,
+                details: drifts.map(detailLine),
+            });
+        };
+        drift("unresolved", "evidence.unresolved", "cannot be re-checked in this working tree: the cited file is gone, unreadable, not a regular file, or the cited line is past its end");
+        drift("moved", "evidence.moved", "cite a file that changed since the record, though each cited line survives");
+        drift("line-changed", "evidence.line-changed", "cite line(s) that no longer say what was recorded");
+        drift("token-missing", "evidence.token-missing", "cite file(s) that no longer contain the literal string the claim asserts");
+        if (lint.unpinned > 0) {
+            findings.push({
+                severity: "ok",
+                // The pre-content_digest-vouch precedent: a record from before the
+                // capability existed is not wrong, it is unfindable-by-this-check.
+                code: "evidence.unpinned",
+                subject: service,
+                message: `${me}: ${feature}: ${lint.unpinned} agent-confirmed citation(s) carry no evidence pin — ` +
+                    `recorded before pins existed; the next \`loam verify ${feature} --service ${me} --record\` makes them drift-checkable`,
+            });
+        }
+    }
+    if (checked > 0 && !drifted) {
+        findings.push({
+            severity: "ok",
+            code: "evidence.checked",
+            subject: service,
+            message: `${me}: ${checked} evidence pin(s) across ${pinnedRecords} feature record(s) re-checked against this working tree`,
+        });
+    }
+    return findings;
+}
+/** One drift as a detail line: which claim, which citation, what changed. */
+function detailLine(d) {
+    return `${d.claim} ${d.evidence} — ${d.what}`;
+}
+//# sourceMappingURL=evidence-pins.js.map

package/dist/commands/validate/service/evidence-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-pins.js","sourceRoot":"","sources":["../../../../src/commands/validate/service/evidence-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAA+B,MAAM,mCAAmC,CAAC;AAClG,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAIlE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAwB,EACxB,OAA2B,EAC3B,KAAoB;IAEpB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,EAAE,GAAW,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAKxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAmB,EAAE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAClH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,wDAAwD,KAAK,CAAC,UAAU,MAAM;oBACpH,sFAAsF;oBACtF,kBAAkB,KAAK,CAAC,OAAO,cAAc,EAAE,6EAA6E;aAC/H,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAChC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QACnE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACxB,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAE,QAAgB,EAAQ,EAAE;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI;gBACJ,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,MAAM,CAAC,MAAM,6BAA6B,QAAQ,KAAK;oBAC7E,uFAAuF;oBACvF,kBAAkB,OAAO,cAAc,EAAE,wDAAwD;gBACnG,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;aAChC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,KAAK,CACH,YAAY,EACZ,qBAAqB,EACrB,sIAAsI,CACvI,CAAC;QACF,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,4EAA4E,CAAC,CAAC;QAC/G,KAAK,CAAC,cAAc,EAAE,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;QACpG,KAAK,CACH,eAAe,EACf,wBAAwB,EACxB,0EAA0E,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,mEAAmE;gBACnE,mEAAmE;gBACnE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,IAAI,CAAC,QAAQ,uDAAuD;oBAC1F,wDAAwD,OAAO,cAAc,EAAE,wCAAwC;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,EAAE,KAAK,OAAO,2BAA2B,aAAa,yDAAyD;SAC5H,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,CAAW;IAC7B,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC","sourcesContent":["/**\n * The evidence-pin re-check as validate findings: every ACTIVE feature record\n * this service has attested, its pins graded against THIS working tree.\n *\n * Service-repo-scoped like `sources.*` and the gherkin chain — the citations\n * resolve only inside the service's own repository. From the docs repo the\n * whole family is silent by design: every pin would grade `unresolved` there,\n * which would be a lie about the code rather than about the record, and\n * `sources.unverifiable-from-here` already names the blind spot once per\n * service.\n *\n * ARCHIVED records are deliberately not linted (a v1 non-goal, recorded here):\n * a frozen record is history, post-ship code drift is normal evolution, and\n * grading it would turn every service's CI permanently yellow the week after\n * every ship. If audit-time re-checks of shipped records are ever wanted, the\n * same `lintEvidencePins` call over `listFeatures` include-archived is the\n * whole change — behind an explicit flag, so the default stays quiet.\n *\n * Everything here demotes reviewer confidence only: warns never flip `valid`,\n * `--strict` may gate on them as it gates on any warning, and no grade ever\n * moves a verdict — `attested` never silently becomes `verified` and a drifted\n * pin never un-confirms a claim.\n */\nimport { repoPath } from \"../../../core/envelope/json.js\";\nimport { inOrder } from \"../../../core/kernel/concurrency.js\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { listFeatures } from \"../../../core/repo/repo.js\";\nimport { readVerificationState } from \"../../../core/verify/file.js\";\nimport { verificationPath } from \"../../../core/verify/record.js\";\nimport { lintEvidencePins, type PinDrift, type PinLint } from \"../../../core/verify/pins/lint.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport type { FleetContext } from \"../../../core/fleet-context.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\n\nexport async function evidencePinFindings(\n  docsDir: DocsDir,\n  service: PathableService,\n  repoDir: string | undefined,\n  fleet?: FleetContext,\n): Promise<Finding[]> {\n  if (repoDir === undefined) return [];\n  // Membership questions cross the provenance line through plain strings by\n  // design (kernel/ids/service.ts) — record subjects are document text.\n  const me: string = service;\n  // ACTIVE features only — see the header for why archived records stay frozen.\n  const features = await listFeatures(docsDir, {}, fleet);\n  type Linted =\n    | null\n    | { feature: string; path: string; unreadable: string }\n    | { feature: string; lint: PinLint };\n  const lints = await inOrder(features, async (feature): Promise<Linted> => {\n    // Three states, graded apart on purpose. ABSENT is a feature nobody has\n    // verified — legitimate silence. UNREADABLE is somebody's record this run\n    // could not use, and it must be a finding here rather than a skip: the\n    // damage that most plausibly breaks a record in a service repo's CI is a\n    // hand edit to the very pins this family grades, and a lint that went\n    // silent over it would turn \"someone broke the record\" into a green run —\n    // `verify` names the same file `record-unreadable`, but this CI job never\n    // runs verify. An unreadable record also cannot say whether it attests\n    // this service, so the finding fires regardless of attestation.\n    const read = await readVerificationState(feature.dir);\n    if (read.state === \"unreadable\") {\n      return { feature: feature.id, path: repoPath(docsDir, verificationPath(feature.dir)), unreadable: read.reason };\n    }\n    if (read.state === \"absent\" || read.verification.schema !== 2) return null;\n    if (!(read.verification.attestations ?? []).some((a) => a.service === me)) return null;\n    return { feature: feature.id, lint: await lintEvidencePins(read.verification.claims, me, repoDir) };\n  });\n\n  const findings: Finding[] = [];\n  let checked = 0;\n  let pinnedRecords = 0;\n  let drifted = false;\n  for (const entry of lints) {\n    if (entry === null) continue;\n    if (\"unreadable\" in entry) {\n      findings.push({\n        severity: \"warn\",\n        code: \"evidence.record-unreadable\",\n        subject: service,\n        message:\n          `${me}: ${entry.feature}: ${entry.path} exists but cannot be read as a verification record (${entry.unreadable}) — ` +\n          \"none of its evidence was checked. It is plain YAML: repair it by hand, or re-record \" +\n          `(\\`loam verify ${entry.feature} --service ${me} --record answers.json\\`); loam never overwrites a record it could not read`,\n      });\n      continue;\n    }\n    const { feature, lint } = entry;\n    if (lint.checked > 0 || lint.drifts.length > 0) pinnedRecords += 1;\n    checked += lint.checked;\n    // The code is spelled as a literal at each call below, and the grade rides\n    // beside it rather than being sliced back out of the code string — the\n    // codes-drift collector resolves the `code` slot, and a derivation would\n    // be a second definition of the pairing free to drift from the first.\n    const drift = (grade: PinDrift[\"grade\"], code: string, sentence: string): void => {\n      const drifts = lint.drifts.filter((d) => d.grade === grade);\n      if (drifts.length === 0) return;\n      drifted = true;\n      findings.push({\n        severity: \"warn\",\n        code,\n        subject: service,\n        message:\n          `${me}: ${feature}: ${drifts.length} recorded evidence pin(s) ${sentence} — ` +\n          \"a reading priority for the reviewer, never a verdict change; re-answer and re-record \" +\n          `(\\`loam verify ${feature} --service ${me} --record answers.json\\`) once the evidence is re-read`,\n        details: drifts.map(detailLine),\n      });\n    };\n    drift(\n      \"unresolved\",\n      \"evidence.unresolved\",\n      \"cannot be re-checked in this working tree: the cited file is gone, unreadable, not a regular file, or the cited line is past its end\",\n    );\n    drift(\"moved\", \"evidence.moved\", \"cite a file that changed since the record, though each cited line survives\");\n    drift(\"line-changed\", \"evidence.line-changed\", \"cite line(s) that no longer say what was recorded\");\n    drift(\n      \"token-missing\",\n      \"evidence.token-missing\",\n      \"cite file(s) that no longer contain the literal string the claim asserts\",\n    );\n    if (lint.unpinned > 0) {\n      findings.push({\n        severity: \"ok\",\n        // The pre-content_digest-vouch precedent: a record from before the\n        // capability existed is not wrong, it is unfindable-by-this-check.\n        code: \"evidence.unpinned\",\n        subject: service,\n        message:\n          `${me}: ${feature}: ${lint.unpinned} agent-confirmed citation(s) carry no evidence pin — ` +\n          `recorded before pins existed; the next \\`loam verify ${feature} --service ${me} --record\\` makes them drift-checkable`,\n      });\n    }\n  }\n  if (checked > 0 && !drifted) {\n    findings.push({\n      severity: \"ok\",\n      code: \"evidence.checked\",\n      subject: service,\n      message: `${me}: ${checked} evidence pin(s) across ${pinnedRecords} feature record(s) re-checked against this working tree`,\n    });\n  }\n  return findings;\n}\n\n/** One drift as a detail line: which claim, which citation, what changed. */\nfunction detailLine(d: PinDrift): string {\n  return `${d.claim} ${d.evidence} — ${d.what}`;\n}\n"]}

package/dist/commands/validate/service/service.js

@@ -0,0 +1,250 @@
+/**
+ * The service target: one adopted service graded across every axis it owns.
+ *
+ * This module is the ORDER, not the checks. It reads what more than one axis
+ * joins through — the C4 model, the living landscape and its resolver, the two
+ * requirement documents — hands each of those to the axis that grades it, and
+ * pushes the findings in the sequence the report is read in. The axes
+ * themselves cannot see each other, which is the point: `./api.js` decides once
+ * whether there is a contract to read, and `./spine.js` is handed the answer
+ * instead of re-deriving it against a file it would open a second time.
+ */
+import { existsSync } from "node:fs";
+import { relative } from "node:path";
+import { loadFile } from "../../../core/c4/likec4.js";
+import { serviceResolver } from "../../../core/c4/resolve/service.js";
+import {} from "../../../core/kernel/ids/service.js";
+import { landscapePath as landscapeFile, permissionsPath } from "../../../core/repo/paths.js";
+import { locateServicePaths } from "../../../core/repo/service-target.js";
+import { readVocabulary } from "../../../core/permissions/permissions.js";
+import { readCapabilityVocabulary } from "../../../core/capabilities/capabilities.js";
+import { capabilityRequirementIndex, capabilityUnknownFindings } from "../../../core/capabilities/findings.js";
+import { realizesStaleFindings, realizesUnknownFindings } from "../../../core/capabilities/realizes/findings.js";
+import { parseRequirements, readRequirementsDocument } from "../../../core/document/parse.js";
+import { requiresUnknownFindings } from "../checks/requirements.js";
+import { listServices } from "../../../core/repo/repo.js";
+import {} from "../../../core/c4/likec4.js";
+import {} from "../../../core/vocabulary/report.js";
+import { closeIds } from "../../../core/c4/arch.js";
+import { serviceProvenance } from "../../../core/provenance/findings.js";
+import { gherkinFindings } from "../../../core/gherkin/stale.js";
+import { gherkinRoot } from "../../../core/gherkin/stamp.js";
+import { UnsafePathError } from "../../../core/kernel/path-safety.js";
+import { interruptedCommitFinding } from "../../../core/staging/recovery/finding.js";
+import { FleetContext } from "../../../core/fleet-context.js";
+import { errorText } from "../checks/vocabulary.js";
+import { serviceLinkFindings } from "../links/corpus.js";
+import { sourceScopeFindings } from "../checks/sources.js";
+import { apiAxisFindings, generatedContractFindings } from "./api.js";
+import { evidencePinFindings } from "./evidence-pins.js";
+import { spineFindings } from "./spine.js";
+import { eventAxisFindings } from "./events/events.js";
+import { archAxisFindings, readServiceSpecs } from "./specs.js";
+import { unknownDirectiveFindings } from "../../../core/document/grammar/directives.js";
+export async function validateService(check) {
+    const { docsDir, service, repoDir, preloaded, gherkinDir, contracts, fleet } = check;
+    // The spine and event joins below all ask the landscape's resolver one
+    // question: does this edge's endpoint resolve into the directory being
+    // validated? The resolver answers with DOCUMENT text and `service` is the
+    // repository's own name — disjoint brands, so `===` between them is TS2367.
+    // Widening to `string` is not a cast: membership questions cross the
+    // provenance line through plain-string containers by design (kernel/ids/service.ts),
+    // and nothing pathable ever comes back out of a comparison.
+    const me = service;
+    const findings = [];
+    const paths = await locateServicePaths(docsDir, service, fleet);
+    const report = {
+        kind: "service",
+        id: service,
+        path: relative(docsDir, paths.dir).replaceAll("\\", "/"),
+        findings,
+    };
+    // A directory that does not exist is a different fact from a directory with
+    // everything missing: validating a typo must say "typo", not "unadopted".
+    if (!existsSync(paths.dir)) {
+        const close = closeIds(service, (await listServices(docsDir, fleet)).map((s) => s.id));
+        findings.push({
+            severity: "error",
+            code: "service.unknown",
+            message: `No service directory at ${paths.dir}.` +
+                (close.length > 0
+                    ? ` Did you mean: ${close.join(", ")}?`
+                    : " `loam list services` shows what exists."),
+            text: { marker: false },
+        });
+        return report;
+    }
+    // C4 model. Its absence is an error — this is where `adopt` comes in — but it
+    // must NOT silence the rest of the gate stack: `loam archive` of a feature
+    // introducing a new service creates exactly this state (spec.md, arch.spec.md,
+    // openapi.yaml, no model.likec4), and an early return here suspended arch
+    // coverage, health.uncovered, provenance (content_digest included) and the
+    // gherkin staleness chain for the very services vouch had just promised them
+    // to. So the finding is emitted and the walk CONTINUES; only the checks that
+    // read the model itself are guarded.
+    const hasModel = existsSync(paths.model);
+    let elements = [];
+    let relationships = [];
+    if (!hasModel) {
+        findings.push({
+            severity: "error",
+            code: "service.no-model",
+            message: `No C4 model at ${paths.model}. Run \`loam adopt\` for '${service}' first.`,
+            text: { marker: false },
+        });
+    }
+    else {
+        const model = fleet === undefined ? await loadFile(paths.model) : await fleet.loadLikeC4(paths.model);
+        elements = model.elements;
+        relationships = model.relationships;
+        if (model.errors.length > 0) {
+            findings.push({
+                severity: "error",
+                code: "c4.invalid",
+                message: `${service}: C4 model has ${model.errors.length} error(s)`,
+                details: model.errors.map(errorText),
+            });
+        }
+        else {
+            findings.push({
+                severity: "ok",
+                code: "c4.valid",
+                message: `${service}: C4 model valid (${elements.length} elements · ${relationships.length} relationships)`,
+            });
+        }
+    }
+    // The living landscape, parsed at most once per run: under --all the caller
+    // hands in the doc it already loaded, single-service runs load on demand. It
+    // serves two checks below — the no-openapi grace and the spine.
+    const land = preloaded ??
+        (existsSync(landscapeFile(docsDir))
+            ? fleet === undefined
+                ? await loadFile(landscapeFile(docsDir))
+                : await fleet.loadLikeC4(landscapeFile(docsDir))
+            : null);
+    // Which service directories actually exist — the positive evidence
+    // `serviceOf` needs to resolve an edge drawn into a modelled CONTAINER
+    // (`paymentService.api`) back to the service that owns it. Without it every
+    // such edge resolves to the container's own title, i.e. to a service nobody
+    // has ever adopted, and drops out of the spine unnoticed.
+    const known = new Set((await listServices(docsDir, fleet)).map((s) => s.id));
+    // The living landscape's element→service resolver, container-aware and
+    // memoized. Every question below that asks "does this edge point at me?"
+    // asks it through this one function, so the no-openapi grace, the HTTP spine
+    // and the event spine can never disagree about which edges are inbound.
+    const landSvcOf = land === null ? null : serviceResolver(land.elements, known);
+    const specs = await readServiceSpecs({ service, paths, fleet });
+    findings.push(...specs.findings);
+    const { reqs, livingReqs, archText, archReqs } = specs;
+    const api = await apiAxisFindings({
+        service,
+        me,
+        paths,
+        reqs,
+        livingReqs,
+        land,
+        landSvcOf,
+        fleet,
+    });
+    findings.push(...api.findings);
+    findings.push(...spineFindings({
+        service,
+        me,
+        land,
+        landSvcOf,
+        contract: api.contract,
+        landscapeReported: check.landscapeReported,
+    }));
+    findings.push(...(await eventAxisFindings({
+        docsDir,
+        service,
+        me,
+        paths,
+        reqs,
+        livingReqs,
+        archReqs,
+        land,
+        landSvcOf,
+        known,
+        fleet,
+    })));
+    findings.push(...(await archAxisFindings({
+        service,
+        paths,
+        archText,
+        archReqs,
+        elements,
+        relationships,
+        land,
+        known,
+    })));
+    // The authorization axis. Both requirement documents are graded against one
+    // fleet vocabulary — a permission is a fleet fact, and an arch requirement
+    // gates on one exactly as a business requirement does. The capability axis
+    // rides the same loop against ITS fleet vocabulary; under --all the fleet
+    // memo makes that one parse for the whole run.
+    const vocabulary = await readVocabulary(permissionsPath(docsDir));
+    const capabilities = fleet === undefined ? await readCapabilityVocabulary(docsDir) : await fleet.capabilities(docsDir);
+    // The requirement-level index behind `Realizes:`. Built once for both axes,
+    // and behind the same ladder `capabilityUnknownFindings` applies — an absent
+    // or unreadable vocabulary means no reads and no grades at all, so a fleet
+    // that has not adopted the axis pays nothing for a line it never wrote.
+    const capabilityReqs = await capabilityRequirementIndex(capabilities, fleet === undefined ? async (p) => parseRequirements(await readRequirementsDocument(p)) : (p) => fleet.readRequirements(p));
+    for (const [label, docReqs] of [
+        ["spec.md", reqs],
+        ["arch.spec.md", archReqs],
+    ]) {
+        const target = { where: `${service}: ${label}`, subject: service };
+        findings.push(...requiresUnknownFindings(docReqs, target, vocabulary));
+        findings.push(...capabilityUnknownFindings(docReqs, target, capabilities));
+        findings.push(...realizesUnknownFindings(docReqs, target, capabilityReqs));
+        findings.push(...realizesStaleFindings(docReqs, target, capabilityReqs));
+        // The grammar guard, last in the loop: it grades the KEYS the three checks
+        // above resolve values from, so a line none of them saw is reported here
+        // rather than staying invisible for having produced nothing to check.
+        findings.push(...unknownDirectiveFindings(docReqs, target));
+    }
+    // The links this service's own documents write. Its place in the order is
+    // deliberate: every axis above joins through a LINE loam defined, and this one
+    // grades the join an author writes in prose — so it reads last among the
+    // document checks and adds no input any of them depend on.
+    findings.push(...(await serviceLinkFindings({ docsDir, subject: service, fleet }, paths)));
+    // Provenance last: who vouched for this, and what code it was written from.
+    findings.push(...(await serviceProvenance(docsDir, service, { repoDir, fleet })));
+    findings.push(...(await sourceScopeFindings(docsDir, service, repoDir, fleet)));
+    // The build's own contract against the committed copy. Service-repo only:
+    // from the docs repo there is no build output to read, and the family stays
+    // silent rather than guessing — the same rule `sources` provenance follows.
+    if (repoDir !== undefined) {
+        findings.push(...(await generatedContractFindings(service, repoDir, contracts?.openapi, paths.openapi)));
+    }
+    // The generated-gherkin freshness chain, service-repo-scoped like sources.*:
+    // it needs the repo (the suite lives there), and it stays quiet until
+    // <gherkinDir>/loam/ exists — a service that never generated has not opted in.
+    findings.push(...(await gherkinFindings({ docsDir, service, repoDir, gherkinDir, fleet })));
+    // The evidence-pin re-check, the same service-repo-scoped family: recorded
+    // verification citations graded against THIS working tree, quiet from the
+    // docs repo — sources.unverifiable-from-here already names that blind spot.
+    findings.push(...(await evidencePinFindings(docsDir, service, repoDir, fleet)));
+    // The one journal that does NOT live in the docs repo: gherkin commits into
+    // the service repo's emission root. A half-committed suite graded by the
+    // freshness chain above reads as merely stale — warn-severity, which never
+    // gates — while doctor calls the same state a blocker. Same finding, same
+    // code, led rather than appended, exactly as validate leads with the docs
+    // repo's own journal.
+    if (repoDir !== undefined) {
+        try {
+            const interrupted = await interruptedCommitFinding(gherkinRoot(repoDir, gherkinDir));
+            if (interrupted !== null)
+                findings.unshift(interrupted);
+        }
+        catch (err) {
+            // An unsafe gherkinDir is `loam gherkin`'s refusal to make, with its
+            // own sentence; grading declines to scan what it cannot trust.
+            if (!(err instanceof UnsafePathError))
+                throw err;
+        }
+    }
+    return report;
+}
+//# sourceMappingURL=service.js.map

package/dist/commands/validate/service/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../../src/commands/validate/service/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAuB,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,aAAa,IAAI,aAAa,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAC/G,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AACjH,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC9F,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAkB,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAmC,MAAM,oCAAoC,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AA4CxF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAmB;IACvD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACrF,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,qEAAqE;IACrE,qFAAqF;IACrF,4DAA4D;IAC5D,MAAM,EAAE,GAAW,OAAO,CAAC;IAC3B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;QACxD,QAAQ;KACT,CAAC;IAEF,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EACL,2BAA2B,KAAK,CAAC,GAAG,GAAG;gBACvC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;oBACf,CAAC,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACvC,CAAC,CAAC,0CAA0C,CAAC;YACjD,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,0EAA0E;IAC1E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,qCAAqC;IACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAW,EAAE,CAAC;IAC1B,IAAI,aAAa,GAAU,EAAE,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,kBAAkB,KAAK,CAAC,KAAK,6BAA6B,OAAO,UAAU;YACpF,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtG,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC1B,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,GAAG,OAAO,kBAAkB,KAAK,CAAC,MAAM,CAAC,MAAM,WAAW;gBACnE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,GAAG,OAAO,qBAAqB,QAAQ,CAAC,MAAM,eAAe,aAAa,CAAC,MAAM,iBAAiB;aAC5G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,IAAI,GACR,SAAS;QACT,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC,CAAC,KAAK,KAAK,SAAS;gBACnB,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;gBACxC,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,CAAC;IAEZ,mEAAmE;IACnE,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAG7E,uEAAuE;IACvE,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,SAAS,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE/E,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAEvD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC;QAChC,OAAO;QACP,EAAE;QACF,KAAK;QACL,IAAI;QACJ,UAAU;QACV,IAAI;QACJ,SAAS;QACT,KAAK;KACN,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,aAAa,CAAC;QACf,OAAO;QACP,EAAE;QACF,IAAI;QACJ,SAAS;QACT,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CACH,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,iBAAiB,CAAC;QAC1B,OAAO;QACP,OAAO;QACP,EAAE;QACF,KAAK;QACL,IAAI;QACJ,UAAU;QACV,QAAQ;QACR,IAAI;QACJ,SAAS;QACT,KAAK;QACL,KAAK;KACN,CAAC,CAAC,CACJ,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,MAAM,gBAAgB,CAAC;QACzB,OAAO;QACP,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,aAAa;QACb,IAAI;QACJ,KAAK;KACN,CAAC,CAAC,CACJ,CAAC;IAEF,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,YAAY,GAChB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACpG,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,cAAc,GAAG,MAAM,0BAA0B,CACrD,YAAY,EACZ,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAC3H,CAAC;IACF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI;QAC7B,CAAC,SAAS,EAAE,IAAI,CAAC;QACjB,CAAC,cAAc,EAAE,QAAQ,CAAC;KAClB,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,KAAK,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACvE,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,yEAAyE;IACzE,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,mBAAmB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3F,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAChF,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5F,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAEhF,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,sBAAsB;IACtB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,wBAAwB,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;YACrF,IAAI,WAAW,KAAK,IAAI;gBAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,+DAA+D;YAC/D,IAAI,CAAC,CAAC,GAAG,YAAY,eAAe,CAAC;gBAAE,MAAM,GAAG,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * The service target: one adopted service graded across every axis it owns.\n *\n * This module is the ORDER, not the checks. It reads what more than one axis\n * joins through — the C4 model, the living landscape and its resolver, the two\n * requirement documents — hands each of those to the axis that grades it, and\n * pushes the findings in the sequence the report is read in. The axes\n * themselves cannot see each other, which is the point: `./api.js` decides once\n * whether there is a contract to read, and `./spine.js` is handed the answer\n * instead of re-deriving it against a file it would open a second time.\n */\nimport { existsSync } from \"node:fs\";\nimport { relative } from \"node:path\";\nimport { loadFile, type Elem, type Rel } from \"../../../core/c4/likec4.js\";\nimport { serviceResolver } from \"../../../core/c4/resolve/service.js\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { landscapePath as landscapeFile, permissionsPath } from \"../../../core/repo/paths.js\";\nimport { locateServicePaths } from \"../../../core/repo/service-target.js\";\nimport { readVocabulary } from \"../../../core/permissions/permissions.js\";\nimport { readCapabilityVocabulary } from \"../../../core/capabilities/capabilities.js\";\nimport { capabilityRequirementIndex, capabilityUnknownFindings } from \"../../../core/capabilities/findings.js\";\nimport { realizesStaleFindings, realizesUnknownFindings } from \"../../../core/capabilities/realizes/findings.js\";\nimport { parseRequirements, readRequirementsDocument } from \"../../../core/document/parse.js\";\nimport { requiresUnknownFindings } from \"../checks/requirements.js\";\nimport { listServices } from \"../../../core/repo/repo.js\";\nimport { type LoadedDoc } from \"../../../core/c4/likec4.js\";\nimport { type Finding, type TargetReport } from \"../../../core/vocabulary/report.js\";\nimport { closeIds } from \"../../../core/c4/arch.js\";\nimport { serviceProvenance } from \"../../../core/provenance/findings.js\";\nimport { gherkinFindings } from \"../../../core/gherkin/stale.js\";\nimport { gherkinRoot } from \"../../../core/gherkin/stamp.js\";\nimport { UnsafePathError } from \"../../../core/kernel/path-safety.js\";\nimport { interruptedCommitFinding } from \"../../../core/staging/recovery/finding.js\";\nimport { FleetContext } from \"../../../core/fleet-context.js\";\nimport { errorText } from \"../checks/vocabulary.js\";\nimport { serviceLinkFindings } from \"../links/corpus.js\";\nimport { sourceScopeFindings } from \"../checks/sources.js\";\nimport { apiAxisFindings, generatedContractFindings } from \"./api.js\";\nimport { evidencePinFindings } from \"./evidence-pins.js\";\nimport { spineFindings } from \"./spine.js\";\nimport { eventAxisFindings } from \"./events/events.js\";\nimport { archAxisFindings, readServiceSpecs } from \"./specs.js\";\nimport { unknownDirectiveFindings } from \"../../../core/document/grammar/directives.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\n\n/**\n * A service's absences are graded by what each one proves.\n *\n * `service.unknown` (error): the directory itself does not exist — the id is a\n * typo until proven otherwise, so the hint names ids that DO exist and never\n * `loam adopt`, which would faithfully document the misspelling.\n * `service.no-model` (error): the directory is real but the C4 center is not —\n * adopt is the right hint. Every check that does not read the model still runs\n * (spec coverage, the arch axis, provenance, gherkin staleness): archive\n * creates exactly this state for a new service, and those signals must not go\n * quiet there.\n * `service.no-spec` / `service.no-openapi` (warn): the adopt brief marks both\n * required, but a fleet mid-rollout legitimately has part-adopted services —\n * the absence must stay visible without gating CI for months. The openapi warn\n * keeps quiet when the landscape proves nobody calls an operation on this\n * service: a worker with no API is not missing one.\n * `api.ops-unlinked` (warn): an OpenAPI and requirements that never name each\n * other pass every cross-axis check vacuously — a repo migrated from OpenSpec\n * does exactly that by default, and vacuous is not the same as checked.\n */\ninterface ServiceCheck {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** The service's own repo, when loam is standing in it. Undefined from the docs repo. */\n  repoDir?: string;\n  /** The build outputs `loam.json` names, when this repo declares any. */\n  contracts?: { openapi?: string };\n  /** The living landscape under --all; undefined means \"load it if you need it\", null means \"there is none\". */\n  preloaded?: LoadedDoc | null;\n  gherkinDir?: string;\n  fleet?: FleetContext;\n  /**\n   * True when this run ALSO emits a `landscape` target. It decides one thing:\n   * whether a landscape parse error's details are repeated here. Under --all\n   * they are not — the landscape target already carries them once, and N copies\n   * of one parser's cascade is the whole report.\n   */\n  landscapeReported?: boolean;\n}\n\n\nexport async function validateService(check: ServiceCheck): Promise<TargetReport> {\n  const { docsDir, service, repoDir, preloaded, gherkinDir, contracts, fleet } = check;\n  // The spine and event joins below all ask the landscape's resolver one\n  // question: does this edge's endpoint resolve into the directory being\n  // validated? The resolver answers with DOCUMENT text and `service` is the\n  // repository's own name — disjoint brands, so `===` between them is TS2367.\n  // Widening to `string` is not a cast: membership questions cross the\n  // provenance line through plain-string containers by design (kernel/ids/service.ts),\n  // and nothing pathable ever comes back out of a comparison.\n  const me: string = service;\n  const findings: Finding[] = [];\n  const paths = await locateServicePaths(docsDir, service, fleet);\n  const report: TargetReport = {\n    kind: \"service\",\n    id: service,\n    path: relative(docsDir, paths.dir).replaceAll(\"\\\\\", \"/\"),\n    findings,\n  };\n\n  // A directory that does not exist is a different fact from a directory with\n  // everything missing: validating a typo must say \"typo\", not \"unadopted\".\n  if (!existsSync(paths.dir)) {\n    const close = closeIds(service, (await listServices(docsDir, fleet)).map((s) => s.id));\n    findings.push({\n      severity: \"error\",\n      code: \"service.unknown\",\n      message:\n        `No service directory at ${paths.dir}.` +\n        (close.length > 0\n          ? ` Did you mean: ${close.join(\", \")}?`\n          : \" `loam list services` shows what exists.\"),\n      text: { marker: false },\n    });\n    return report;\n  }\n\n  // C4 model. Its absence is an error — this is where `adopt` comes in — but it\n  // must NOT silence the rest of the gate stack: `loam archive` of a feature\n  // introducing a new service creates exactly this state (spec.md, arch.spec.md,\n  // openapi.yaml, no model.likec4), and an early return here suspended arch\n  // coverage, health.uncovered, provenance (content_digest included) and the\n  // gherkin staleness chain for the very services vouch had just promised them\n  // to. So the finding is emitted and the walk CONTINUES; only the checks that\n  // read the model itself are guarded.\n  const hasModel = existsSync(paths.model);\n  let elements: Elem[] = [];\n  let relationships: Rel[] = [];\n  if (!hasModel) {\n    findings.push({\n      severity: \"error\",\n      code: \"service.no-model\",\n      message: `No C4 model at ${paths.model}. Run \\`loam adopt\\` for '${service}' first.`,\n      text: { marker: false },\n    });\n  } else {\n    const model = fleet === undefined ? await loadFile(paths.model) : await fleet.loadLikeC4(paths.model);\n    elements = model.elements;\n    relationships = model.relationships;\n    if (model.errors.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"c4.invalid\",\n        message: `${service}: C4 model has ${model.errors.length} error(s)`,\n        details: model.errors.map(errorText),\n      });\n    } else {\n      findings.push({\n        severity: \"ok\",\n        code: \"c4.valid\",\n        message: `${service}: C4 model valid (${elements.length} elements · ${relationships.length} relationships)`,\n      });\n    }\n  }\n\n  // The living landscape, parsed at most once per run: under --all the caller\n  // hands in the doc it already loaded, single-service runs load on demand. It\n  // serves two checks below — the no-openapi grace and the spine.\n  const land =\n    preloaded ??\n    (existsSync(landscapeFile(docsDir))\n      ? fleet === undefined\n        ? await loadFile(landscapeFile(docsDir))\n        : await fleet.loadLikeC4(landscapeFile(docsDir))\n      : null);\n\n  // Which service directories actually exist — the positive evidence\n  // `serviceOf` needs to resolve an edge drawn into a modelled CONTAINER\n  // (`paymentService.api`) back to the service that owns it. Without it every\n  // such edge resolves to the container's own title, i.e. to a service nobody\n  // has ever adopted, and drops out of the spine unnoticed.\n  const known = new Set((await listServices(docsDir, fleet)).map((s) => s.id));\n\n\n  // The living landscape's element→service resolver, container-aware and\n  // memoized. Every question below that asks \"does this edge point at me?\"\n  // asks it through this one function, so the no-openapi grace, the HTTP spine\n  // and the event spine can never disagree about which edges are inbound.\n  const landSvcOf = land === null ? null : serviceResolver(land.elements, known);\n\n  const specs = await readServiceSpecs({ service, paths, fleet });\n  findings.push(...specs.findings);\n  const { reqs, livingReqs, archText, archReqs } = specs;\n\n  const api = await apiAxisFindings({\n    service,\n    me,\n    paths,\n    reqs,\n    livingReqs,\n    land,\n    landSvcOf,\n    fleet,\n  });\n  findings.push(...api.findings);\n  findings.push(\n    ...spineFindings({\n      service,\n      me,\n      land,\n      landSvcOf,\n      contract: api.contract,\n      landscapeReported: check.landscapeReported,\n    }),\n  );\n  findings.push(\n    ...(await eventAxisFindings({\n      docsDir,\n      service,\n      me,\n      paths,\n      reqs,\n      livingReqs,\n      archReqs,\n      land,\n      landSvcOf,\n      known,\n      fleet,\n    })),\n  );\n  findings.push(\n    ...(await archAxisFindings({\n      service,\n      paths,\n      archText,\n      archReqs,\n      elements,\n      relationships,\n      land,\n      known,\n    })),\n  );\n\n  // The authorization axis. Both requirement documents are graded against one\n  // fleet vocabulary — a permission is a fleet fact, and an arch requirement\n  // gates on one exactly as a business requirement does. The capability axis\n  // rides the same loop against ITS fleet vocabulary; under --all the fleet\n  // memo makes that one parse for the whole run.\n  const vocabulary = await readVocabulary(permissionsPath(docsDir));\n  const capabilities =\n    fleet === undefined ? await readCapabilityVocabulary(docsDir) : await fleet.capabilities(docsDir);\n  // The requirement-level index behind `Realizes:`. Built once for both axes,\n  // and behind the same ladder `capabilityUnknownFindings` applies — an absent\n  // or unreadable vocabulary means no reads and no grades at all, so a fleet\n  // that has not adopted the axis pays nothing for a line it never wrote.\n  const capabilityReqs = await capabilityRequirementIndex(\n    capabilities,\n    fleet === undefined ? async (p) => parseRequirements(await readRequirementsDocument(p)) : (p) => fleet.readRequirements(p),\n  );\n  for (const [label, docReqs] of [\n    [\"spec.md\", reqs],\n    [\"arch.spec.md\", archReqs],\n  ] as const) {\n    const target = { where: `${service}: ${label}`, subject: service };\n    findings.push(...requiresUnknownFindings(docReqs, target, vocabulary));\n    findings.push(...capabilityUnknownFindings(docReqs, target, capabilities));\n    findings.push(...realizesUnknownFindings(docReqs, target, capabilityReqs));\n    findings.push(...realizesStaleFindings(docReqs, target, capabilityReqs));\n    // The grammar guard, last in the loop: it grades the KEYS the three checks\n    // above resolve values from, so a line none of them saw is reported here\n    // rather than staying invisible for having produced nothing to check.\n    findings.push(...unknownDirectiveFindings(docReqs, target));\n  }\n\n  // The links this service's own documents write. Its place in the order is\n  // deliberate: every axis above joins through a LINE loam defined, and this one\n  // grades the join an author writes in prose — so it reads last among the\n  // document checks and adds no input any of them depend on.\n  findings.push(...(await serviceLinkFindings({ docsDir, subject: service, fleet }, paths)));\n\n  // Provenance last: who vouched for this, and what code it was written from.\n  findings.push(...(await serviceProvenance(docsDir, service, { repoDir, fleet })));\n  findings.push(...(await sourceScopeFindings(docsDir, service, repoDir, fleet)));\n  // The build's own contract against the committed copy. Service-repo only:\n  // from the docs repo there is no build output to read, and the family stays\n  // silent rather than guessing — the same rule `sources` provenance follows.\n  if (repoDir !== undefined) {\n    findings.push(...(await generatedContractFindings(service, repoDir, contracts?.openapi, paths.openapi)));\n  }\n\n  // The generated-gherkin freshness chain, service-repo-scoped like sources.*:\n  // it needs the repo (the suite lives there), and it stays quiet until\n  // <gherkinDir>/loam/ exists — a service that never generated has not opted in.\n  findings.push(...(await gherkinFindings({ docsDir, service, repoDir, gherkinDir, fleet })));\n\n  // The evidence-pin re-check, the same service-repo-scoped family: recorded\n  // verification citations graded against THIS working tree, quiet from the\n  // docs repo — sources.unverifiable-from-here already names that blind spot.\n  findings.push(...(await evidencePinFindings(docsDir, service, repoDir, fleet)));\n\n  // The one journal that does NOT live in the docs repo: gherkin commits into\n  // the service repo's emission root. A half-committed suite graded by the\n  // freshness chain above reads as merely stale — warn-severity, which never\n  // gates — while doctor calls the same state a blocker. Same finding, same\n  // code, led rather than appended, exactly as validate leads with the docs\n  // repo's own journal.\n  if (repoDir !== undefined) {\n    try {\n      const interrupted = await interruptedCommitFinding(gherkinRoot(repoDir, gherkinDir));\n      if (interrupted !== null) findings.unshift(interrupted);\n    } catch (err) {\n      // An unsafe gherkinDir is `loam gherkin`'s refusal to make, with its\n      // own sentence; grading declines to scan what it cannot trust.\n      if (!(err instanceof UnsafePathError)) throw err;\n    }\n  }\n\n  return report;\n}\n"]}