@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/commands/validate/service/specs.js

@@ -0,0 +1,279 @@
+/**
+ * This service's requirement documents: spec.md, arch.spec.md, and the
+ * obligations the second of them carries that the first never does.
+ *
+ * Two entry points because the two happen at different moments in a service's
+ * grading and the order of findings is part of the report. `readServiceSpecs`
+ * runs first — everything downstream joins through the requirements it parses —
+ * while `archAxisFindings` runs last, after both spines, because `covers.unknown`
+ * resolves against the C4 model and the landscape and cannot be answered until
+ * those are in hand.
+ *
+ * The arch axis is advisory in what it ASKS for (covers.unknown,
+ * health.uncovered are warnings; arch.spec.md's absence is not a finding at all,
+ * because partial adoption is supported) but not in whether the file is
+ * readable: a conflict marker or a stepless scenario is graded exactly as it is
+ * on the business axis. One file, one rule.
+ */
+import { existsSync } from "node:fs";
+import {} from "../../../core/c4/likec4.js";
+import {} from "../../../core/kernel/ids/service.js";
+import {} from "../../../core/repo/paths.js";
+import {} from "../../../core/vocabulary/report.js";
+import {} from "../../../core/document/spec.js";
+import {} from "../../../core/c4/arch.js";
+import { hasDeployment } from "../../../core/c4/parsed/deployment.js";
+import {} from "../../../core/kernel/ids/dirs.js";
+import { repoPath } from "../../../core/envelope/json.js";
+import { readHealth } from "../../../core/vocabulary/health.js";
+import { documentConflictFinding } from "../../../core/conflict-markers.js";
+import { FleetContext } from "../../../core/fleet-context.js";
+import { healthDependencyFindings } from "../checks/health-deps.js";
+import { coverageFinding, coversEntries, coversUnknownFindings, duplicateRequirementFindings, repeatedListLineFindings, requirementIdFindings, scenarioShapeFindings, } from "../checks/requirements.js";
+export async function readServiceSpecs(input) {
+    const { docsDir, service, paths, fleet } = input;
+    const findings = [];
+    // Requirement coverage.
+    let reqs = [];
+    if (existsSync(paths.spec)) {
+        const specText = await fleet.readText(paths.spec);
+        reqs = await fleet.readRequirements(paths.spec);
+        // Conflict markers first, because they say that nothing below this line is
+        // anyone's text. An error, gating by the default rule and deliberately
+        // without `gates`: that field is coherence's (issue.ts) and archive does
+        // not read validate's findings, so claiming it here would be a promise
+        // about a gate that is not wired. What makes it an error rather than a
+        // warning is what the next merge does — `loam archive` rewrites the
+        // requirements section of this very file and takes whichever marker lines
+        // fall inside it, turning a conflict anyone can see into a document nobody
+        // can tell is wrong.
+        const conflict = documentConflictFinding(`${service}: spec.md`, service, specText);
+        if (conflict !== null)
+            findings.push(conflict);
+        // A living spec with no `### Requirement:` block at all is the baseline
+        // `loam adopt` scaffolds and nobody ever filled in. "requirements covered
+        // (0 requirements, all with scenarios)" is true of it and says the opposite
+        // of what a reader needs: every cross-axis check downstream — API
+        // governance, the Operations: spine, gherkin generation — is vacuous here,
+        // and the green tick is what let a whole fleet score `sourced` over empty
+        // files.
+        if (reqs.length === 0) {
+            findings.push({
+                severity: "warn",
+                code: "spec.no-requirements",
+                subject: service,
+                message: `${service}: spec.md holds no '### Requirement:' blocks — every requirement-driven check below is vacuous, and nothing here can go out of date because nothing is written down`,
+            });
+        }
+        else {
+            findings.push(coverageFinding(`${service}: requirements`, reqs));
+        }
+        // The other half of the coverage question, and an error for the same
+        // reason the first half is: the whole claim of coverage is that a
+        // requirement has a scenario something can RUN. A heading with no steps
+        // satisfies the count and tests nothing — cucumber runs it vacuously green
+        // and `loam verify --results` can never confirm it — so a fleet gate that
+        // called it covered was certifying the absence of a test.
+        findings.push(...scenarioShapeFindings(`${service}: requirements`, service, reqs));
+        findings.push(...duplicateRequirementFindings(reqs, `${service}: spec.md`, service));
+        findings.push(...requirementIdFindings(reqs, `${service}: spec.md`, service));
+        findings.push(...repeatedListLineFindings(reqs, `${service}: spec.md`, service));
+    }
+    else {
+        findings.push({
+            severity: "warn",
+            code: "service.no-spec",
+            message: `No living spec at ${repoPath(docsDir, paths.spec)} — requirement coverage and API governance are unchecked`,
+        });
+    }
+    // The requirements that still govern anything. A REMOVED requirement is on
+    // its way out together with the operations it names: it makes no claim on the
+    // contract and governs nothing once the retiring feature archives — the same
+    // position coherence/coherence.ts takes on the delta side.
+    //
+    // Spelled once because it was spelled three times and dropped on the fourth:
+    // `governedOps` filtered, `spec-api.op-undefined` filtered, and the
+    // `api.covered` join did not — so an operation whose only requirement was
+    // REMOVED counted as governed, and the one operation about to be left without
+    // a requirement was the one the report called covered.
+    const livingReqs = reqs.filter((r) => r.kind !== "REMOVED");
+    // The architecture spec, read HERE with spec.md rather than with the rest of
+    // its own axis below, because the event links are a requirement-level join and
+    // BOTH requirement files carry them. Events are architecture as often as they
+    // are business — the outbox requirement in a service's arch.spec.md is the
+    // canonical place a `Publishes:` line belongs — so handing the event axis only
+    // spec.md would silently ignore the lines most authors write.
+    const archText = existsSync(paths.archSpec) ? await fleet.readText(paths.archSpec) : null;
+    const archReqs = archText === null ? [] : await fleet.readRequirements(paths.archSpec);
+    return { findings, reqs, livingReqs, archText, archReqs };
+}
+/**
+ * The topology a `node:` Covers entry resolves against, loaded at most once and
+ * only when something asks for it.
+ *
+ * Under `--all` the caller hands in the doc it already loaded — the whole
+ * `architecture/` project — so the deployment model is already here and this
+ * returns it. A SINGLE-service run loads only `landscape.likec4`, and a fleet
+ * that keeps its `deployment { }` block in a file beside it, which is the
+ * ordinary layout once one landscape file is the fleet's convention, would then
+ * resolve one `Covers:` line two different ways depending on which command
+ * asked. `loam status`'s two forms had exactly that disagreement and it was a
+ * defect both times; this is the same class, prevented rather than found.
+ *
+ * The cost is paid only by a service whose `arch.spec.md` actually writes a
+ * `node:` entry. A fleet with no topology at all pays one project load per such
+ * service — a state in which the entry is a typo anyway, and one load is what
+ * buys it a message that names the real ids.
+ */
+async function topology(land, archReqs, docsDir, fleet) {
+    if (land?.deployment !== undefined && hasDeployment(land.deployment))
+        return land.deployment;
+    const wanted = coversEntries(archReqs).some((e) => e.form === "node" || e.form === "node-edge");
+    if (!wanted)
+        return undefined;
+    // Through the index, always: `land` above is now that same project in every
+    // mode, so this fallback fires only for the caller that handed in nothing,
+    // and it must not be a second parse of documents already in the memo.
+    const project = await fleet.architecture(docsDir);
+    return project.errors.length === 0 ? project.deployment : undefined;
+}
+export async function archAxisFindings(axis) {
+    const { service, paths, archText, archReqs, elements, relationships, land, known, docsDir } = axis;
+    const { fleet } = axis;
+    const findings = [];
+    // The architecture spec axis — the obligations a business spec never carries
+    // (the transactional outbox, retries, metrics, alerts). arch.spec.md is
+    // optional and its ABSENCE is not a finding (partial adoption is supported);
+    // what exists must hold together: every requirement needs a scenario, every
+    // `Covers:` entry must resolve (covers.unknown), and every alert/SLI that
+    // health.yaml declares wants a covering requirement (health.uncovered) — the
+    // moment health.yaml stops being inert. Warnings, never gates: `--strict` is
+    // the CI escalation.
+    const health = await readHealth(paths.health);
+    // A model that reaches nothing is almost never true — but only when
+    // something else attests it should reach. A deliberately shallow synthetic
+    // fixture can hold elements without relationships beside sources that name
+    // dependencies, yet `0 errors, 0 warnings` would still read as done.
+    // Evidence-gated on purpose: a bare root-plus-one-container baseline stays
+    // silent (nothing PROVES it thin — the standard mid-adoption shape), the
+    // warn needs either a second nested element with no edge joining anything,
+    // or dependencies declared in this service's own health.yaml. The health
+    // half goes quiet when the file is unreadable — no claims on bad data.
+    // "Nested" is a PARENT in this slice, not a dot in the id, and the two stopped
+    // meaning the same thing when a model could extend the map: an extending
+    // placeholder `extend marketplace.orderService { }` contributes one element
+    // whose id is dotted and whose parent belongs to the map, so a dot count read
+    // it as nested architecture that reaches nothing — the standalone placeholder
+    // `orderService = softwareSystem` was silent for the same shape. One rule for
+    // both: `a`/`a.x`/`kafka`/`kafka.t` still counts two.
+    const sliceIds = new Set(elements.map((e) => e.id));
+    const nested = elements.filter((e) => {
+        const dot = e.id.lastIndexOf(".");
+        return dot !== -1 && sliceIds.has(e.id.slice(0, dot));
+    }).length;
+    const deps = health.unreadable ? [] : health.dependencies;
+    if (elements.length > 0 && relationships.length === 0 && (nested > 1 || deps.length > 0)) {
+        const evidence = [
+            ...(nested > 1 ? [`${nested} nested elements with no edge joining them`] : []),
+            ...(deps.length > 0
+                ? [`health.yaml declares ${deps.length} dependenc${deps.length === 1 ? "y" : "ies"} (${deps.join(", ")})`]
+                : []),
+        ].join(", and ");
+        findings.push({
+            severity: "warn",
+            code: "c4.no-relationships",
+            subject: service,
+            message: `${service}: model.likec4 declares ${elements.length} element(s) and 0 relationships, yet ${evidence} — ` +
+                `a model that reaches nothing is almost never true; draw the edges the service actually has ` +
+                `(what its containers call, what reads and writes its stores, what it depends on at runtime)`,
+        });
+    }
+    if (archText !== null) {
+        // The arch axis is advisory in what it ASKS for (covers.unknown,
+        // health.uncovered are warnings) but not in whether the file is readable:
+        // both breaches below are about the document itself, and they are graded
+        // exactly as they are on the business axis — one file, one rule.
+        const conflict = documentConflictFinding(`${service}: arch.spec.md`, service, archText);
+        if (conflict !== null)
+            findings.push(conflict);
+        findings.push(coverageFinding(`${service}: arch requirements`, archReqs));
+        findings.push(...scenarioShapeFindings(`${service}: arch requirements`, service, archReqs));
+        findings.push(...duplicateRequirementFindings(archReqs, `${service}: arch.spec.md`, service));
+        findings.push(...requirementIdFindings(archReqs, `${service}: arch.spec.md`, service));
+        findings.push(...repeatedListLineFindings(archReqs, `${service}: arch.spec.md`, service));
+    }
+    // A health.yaml that exists but does not read is reported once, and the
+    // checks that read it go quiet BOTH ways: its ids are unknown, so no
+    // health.uncovered obligation exists (the empty id set below is already
+    // silent), and no `Covers: alert:/sli:` entry may be graded a typo against
+    // ids nobody could read (coversUnknownFindings mutes on the flag). A warn,
+    // not an error: the axis it feeds is advisory end to end.
+    if (health.unreadable) {
+        findings.push({
+            severity: "warn",
+            code: "health.invalid",
+            subject: service,
+            message: `${service}: health.yaml does not parse — alert/SLI ids are unreadable, so Covers: alert:/sli: entries and health coverage are unchecked`,
+            ...(health.error === undefined ? {} : { details: [health.error] }),
+        });
+    }
+    const landParses = land !== null && land.errors.length === 0 ? land : null;
+    const deployment = await topology(landParses, archReqs, docsDir, fleet);
+    const scope = {
+        elements: [...elements, ...(landParses?.elements ?? [])],
+        relationships: [...relationships, ...(landParses?.relationships ?? [])],
+        ...(deployment === undefined ? {} : { deployment }),
+        health: health.ids,
+        known,
+    };
+    // `covers.unknown` is suspended entirely when the model could not be read —
+    // it EXTENDS a map that does not parse, or it does not parse itself — and
+    // this is the standing rule of the whole axis rather than a special case:
+    // nothing may be graded out of a document nobody could read
+    // (`core/c4/service-model/load.ts` states it; `model/grade.ts`, `model/diverged.ts`
+    // and the flow skip in `./service.ts` all honour it). Such a model comes back
+    // with no elements and no edges, so every `Covers:` line naming one of its
+    // containers would resolve to nothing. For an unreadable map the landscape
+    // half of the scope is empty too — one unparseable
+    // `architecture/usecases/x.likec4` convicting every Covers: line of every
+    // migrated service in the fleet as a typo, under a code whose whole job is to
+    // catch typos. For the model's own parse error it was one dropped quote in
+    // the example fleet's order-service: `c4.invalid` and six `covers.unknown`
+    // warnings, each sending the reader to arch.spec.md to fix an id that was
+    // spelled right. `c4.invalid` is the one finding; the grade comes back with
+    // the next run that parses.
+    //
+    // The alert:/sli: forms could still be answered out of health.yaml, which IS
+    // readable, and they are suspended with the rest on purpose: a verdict that
+    // grades two of the Covers: forms and drops the others is a report whose
+    // completeness depends on which form the author happened to write, and the one
+    // repair — fix the map, or the model — brings all of them back on the next
+    // run. The same holds for a STANDALONE model that does not parse, whose
+    // landscape half is still readable: grading only the entries that name the
+    // map would be that partial report again. The health axis keeps its own grade
+    // either way (`health.uncovered`, below).
+    if (axis.modelUnreadable !== true) {
+        findings.push(...coversUnknownFindings(archReqs, { where: `${service}: arch.spec.md`, subject: service }, scope, health.unreadable));
+    }
+    const activeCovers = coversEntries(archReqs);
+    for (const { form, ids } of [
+        { form: "alert", ids: health.ids.alerts },
+        { form: "sli", ids: health.ids.slis },
+    ]) {
+        for (const id of ids) {
+            if (activeCovers.some((e) => e.form === form && e.id === id))
+                continue;
+            findings.push({
+                severity: "warn",
+                code: "health.uncovered",
+                subject: service,
+                message: `${service}: health.yaml declares ${form === "alert" ? "alert" : "SLI"} '${id}' but no arch.spec.md requirement covers it — write one with 'Covers: ${form}:${id}', or the signal ships with nothing testing it`,
+            });
+        }
+    }
+    // The other direction health.yaml is read in: its dependencies must be the
+    // model's dependencies. `deps` is already muted on an unreadable file above.
+    findings.push(...healthDependencyFindings({ service, dependencies: deps, elements, modelPath: repoPath(docsDir, paths.model) }));
+    return findings;
+}
+//# sourceMappingURL=specs.js.map

package/dist/commands/validate/service/specs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"specs.js","sourceRoot":"","sources":["../../../../src/commands/validate/service/specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAuC,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAqB,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAoB,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAsB,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAwB,MAAM,uCAAuC,CAAC;AAC5F,OAAO,EAAgB,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACL,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAenC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAKtC;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACjD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,wBAAwB;IACxB,IAAI,IAAI,GAAkB,EAAE,CAAC;IAC7B,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,0EAA0E;QAC1E,2EAA2E;QAC3E,qBAAqB;QACrB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,OAAO,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,QAAQ,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,wEAAwE;QACxE,0EAA0E;QAC1E,4EAA4E;QAC5E,kEAAkE;QAClE,2EAA2E;QAC3E,0EAA0E;QAC1E,SAAS;QACT,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,qKAAqK;aACzL,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,OAAO,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,0DAA0D;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,OAAO,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QACnF,QAAQ,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,IAAI,EAAE,GAAG,OAAO,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACrF,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,GAAG,OAAO,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9E,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,IAAI,EAAE,GAAG,OAAO,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,qBAAqB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,0DAA0D;SACtH,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,2DAA2D;IAC3D,EAAE;IACF,6EAA6E;IAC7E,oEAAoE;IACpE,0EAA0E;IAC1E,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAE5D,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEvF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAqCD;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,QAAQ,CACrB,IAAsB,EACtB,QAAuB,EACvB,OAAgB,EAChB,KAAmB;IAEnB,IAAI,IAAI,EAAE,UAAU,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC,UAAU,CAAC;IAC7F,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAChG,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc;IACnD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACnG,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,qBAAqB;IACrB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE9C,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,+EAA+E;IAC/E,yEAAyE;IACzE,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,sDAAsD;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC,MAAM,CAAC;IACV,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;IAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,QAAQ,GAAG;YACf,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,4CAA4C,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBACjB,CAAC,CAAC,CAAC,wBAAwB,IAAI,CAAC,MAAM,aAAa,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC1G,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,OAAO;YAChB,OAAO,EACL,GAAG,OAAO,2BAA2B,QAAQ,CAAC,MAAM,wCAAwC,QAAQ,KAAK;gBACzG,6FAA6F;gBAC7F,6FAA6F;SAChG,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,iEAAiE;QACjE,0EAA0E;QAC1E,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,OAAO,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxF,IAAI,QAAQ,KAAK,IAAI;YAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,OAAO,qBAAqB,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,OAAO,qBAAqB,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5F,QAAQ,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,QAAQ,EAAE,GAAG,OAAO,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9F,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,EAAE,GAAG,OAAO,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;QACvF,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,QAAQ,EAAE,GAAG,OAAO,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,wEAAwE;IACxE,qEAAqE;IACrE,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,0DAA0D;IAC1D,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,OAAO,+HAA+H;YAClJ,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,KAAK,GAAkB;QAC3B,QAAQ,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QACxD,aAAa,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACvE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QACnD,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,KAAK;KACN,CAAC;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,4DAA4D;IAC5D,oFAAoF;IACpF,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,mDAAmD;IACnD,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,4BAA4B;IAC5B,EAAE;IACF,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,+EAA+E;IAC/E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,8EAA8E;IAC9E,0CAA0C;IAC1C,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CACX,GAAG,qBAAqB,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CACtH,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI;QAC1B,EAAE,IAAI,EAAE,OAAgB,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE;QAClD,EAAE,IAAI,EAAE,KAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE;KAC/C,EAAE,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;gBAAE,SAAS;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,0BAA0B,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,yEAAyE,IAAI,IAAI,EAAE,gDAAgD;aAC1N,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAEjI,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * This service's requirement documents: spec.md, arch.spec.md, and the\n * obligations the second of them carries that the first never does.\n *\n * Two entry points because the two happen at different moments in a service's\n * grading and the order of findings is part of the report. `readServiceSpecs`\n * runs first — everything downstream joins through the requirements it parses —\n * while `archAxisFindings` runs last, after both spines, because `covers.unknown`\n * resolves against the C4 model and the landscape and cannot be answered until\n * those are in hand.\n *\n * The arch axis is advisory in what it ASKS for (covers.unknown,\n * health.uncovered are warnings; arch.spec.md's absence is not a finding at all,\n * because partial adoption is supported) but not in whether the file is\n * readable: a conflict marker or a stepless scenario is graded exactly as it is\n * on the business axis. One file, one rule.\n */\nimport { existsSync } from \"node:fs\";\nimport { type Elem, type LoadedDoc, type Rel } from \"../../../core/c4/likec4.js\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { type ServicePaths } from \"../../../core/repo/paths.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../../core/document/spec.js\";\nimport { type CoverageScope } from \"../../../core/c4/arch.js\";\nimport { hasDeployment, type DeploymentModel } from \"../../../core/c4/parsed/deployment.js\";\nimport { type DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport { repoPath } from \"../../../core/envelope/json.js\";\nimport { readHealth } from \"../../../core/vocabulary/health.js\";\nimport { documentConflictFinding } from \"../../../core/conflict-markers.js\";\nimport { FleetContext } from \"../../../core/fleet-context.js\";\nimport { healthDependencyFindings } from \"../checks/health-deps.js\";\nimport {\n  coverageFinding,\n  coversEntries,\n  coversUnknownFindings,\n  duplicateRequirementFindings,\n  repeatedListLineFindings,\n  requirementIdFindings,\n  scenarioShapeFindings,\n} from \"../checks/requirements.js\";\n\n/** Both requirement documents, parsed once for every axis that joins through them. */\nexport interface ServiceSpecs {\n  /** spec.md's findings, emitted before any cross-axis check runs. */\n  findings: Finding[];\n  /** Every requirement spec.md declares, REMOVED ones included. */\n  reqs: Requirement[];\n  /** The ones that still govern something. */\n  livingReqs: Requirement[];\n  /** arch.spec.md's text, or null when the service has none. */\n  archText: string | null;\n  archReqs: Requirement[];\n}\n\nexport async function readServiceSpecs(input: {\n  docsDir: DocsDir;\n  service: PathableService;\n  paths: ServicePaths;\n  fleet: FleetContext;\n}): Promise<ServiceSpecs> {\n  const { docsDir, service, paths, fleet } = input;\n  const findings: Finding[] = [];\n\n  // Requirement coverage.\n  let reqs: Requirement[] = [];\n  if (existsSync(paths.spec)) {\n    const specText = await fleet.readText(paths.spec);\n    reqs = await fleet.readRequirements(paths.spec);\n    // Conflict markers first, because they say that nothing below this line is\n    // anyone's text. An error, gating by the default rule and deliberately\n    // without `gates`: that field is coherence's (issue.ts) and archive does\n    // not read validate's findings, so claiming it here would be a promise\n    // about a gate that is not wired. What makes it an error rather than a\n    // warning is what the next merge does — `loam archive` rewrites the\n    // requirements section of this very file and takes whichever marker lines\n    // fall inside it, turning a conflict anyone can see into a document nobody\n    // can tell is wrong.\n    const conflict = documentConflictFinding(`${service}: spec.md`, service, specText);\n    if (conflict !== null) findings.push(conflict);\n    // A living spec with no `### Requirement:` block at all is the baseline\n    // `loam adopt` scaffolds and nobody ever filled in. \"requirements covered\n    // (0 requirements, all with scenarios)\" is true of it and says the opposite\n    // of what a reader needs: every cross-axis check downstream — API\n    // governance, the Operations: spine, gherkin generation — is vacuous here,\n    // and the green tick is what let a whole fleet score `sourced` over empty\n    // files.\n    if (reqs.length === 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"spec.no-requirements\",\n        subject: service,\n        message: `${service}: spec.md holds no '### Requirement:' blocks — every requirement-driven check below is vacuous, and nothing here can go out of date because nothing is written down`,\n      });\n    } else {\n      findings.push(coverageFinding(`${service}: requirements`, reqs));\n    }\n    // The other half of the coverage question, and an error for the same\n    // reason the first half is: the whole claim of coverage is that a\n    // requirement has a scenario something can RUN. A heading with no steps\n    // satisfies the count and tests nothing — cucumber runs it vacuously green\n    // and `loam verify --results` can never confirm it — so a fleet gate that\n    // called it covered was certifying the absence of a test.\n    findings.push(...scenarioShapeFindings(`${service}: requirements`, service, reqs));\n    findings.push(...duplicateRequirementFindings(reqs, `${service}: spec.md`, service));\n    findings.push(...requirementIdFindings(reqs, `${service}: spec.md`, service));\n    findings.push(...repeatedListLineFindings(reqs, `${service}: spec.md`, service));\n  } else {\n    findings.push({\n      severity: \"warn\",\n      code: \"service.no-spec\",\n      message: `No living spec at ${repoPath(docsDir, paths.spec)} — requirement coverage and API governance are unchecked`,\n    });\n  }\n\n  // The requirements that still govern anything. A REMOVED requirement is on\n  // its way out together with the operations it names: it makes no claim on the\n  // contract and governs nothing once the retiring feature archives — the same\n  // position coherence/coherence.ts takes on the delta side.\n  //\n  // Spelled once because it was spelled three times and dropped on the fourth:\n  // `governedOps` filtered, `spec-api.op-undefined` filtered, and the\n  // `api.covered` join did not — so an operation whose only requirement was\n  // REMOVED counted as governed, and the one operation about to be left without\n  // a requirement was the one the report called covered.\n  const livingReqs = reqs.filter((r) => r.kind !== \"REMOVED\");\n\n  // The architecture spec, read HERE with spec.md rather than with the rest of\n  // its own axis below, because the event links are a requirement-level join and\n  // BOTH requirement files carry them. Events are architecture as often as they\n  // are business — the outbox requirement in a service's arch.spec.md is the\n  // canonical place a `Publishes:` line belongs — so handing the event axis only\n  // spec.md would silently ignore the lines most authors write.\n  const archText = existsSync(paths.archSpec) ? await fleet.readText(paths.archSpec) : null;\n  const archReqs = archText === null ? [] : await fleet.readRequirements(paths.archSpec);\n\n  return { findings, reqs, livingReqs, archText, archReqs };\n}\n\n/** What the arch axis needs once the model and the landscape have been read. */\nexport interface ArchAxis {\n  service: PathableService;\n  paths: ServicePaths;\n  /** arch.spec.md's text, or null — its absence is not a finding. */\n  archText: string | null;\n  archReqs: Requirement[];\n  /** The service's own C4 model, empty when it has none. */\n  elements: Elem[];\n  relationships: Rel[];\n  /**\n   * True when this service's model could not be read — it does not parse\n   * (`c4.invalid`), or it EXTENDS a fleet map that does not — so `elements` and\n   * `relationships` above are empty for that reason and no other. See\n   * `covers.unknown` below, which is suspended on it.\n   */\n  modelUnreadable?: boolean;\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** The docs root, for the one lazy load below — see `deployment` in the scope. */\n  docsDir: DocsDir;\n  /**\n   * The enumerated fleet, for the Covers matcher's endpoint resolution — the\n   * same set the caller's own spine resolution uses, so a `Covers:` line\n   * naming a service matches an edge drawn into that service's container.\n   */\n  known?: ReadonlySet<string>;\n  /**\n   * The run's read index, so the one lazy project load below is the same\n   * memoised parse the rest of the target already made rather than a second\n   * workspace spun for one `node:` entry.\n   */\n  fleet: FleetContext;\n}\n\n/**\n * The topology a `node:` Covers entry resolves against, loaded at most once and\n * only when something asks for it.\n *\n * Under `--all` the caller hands in the doc it already loaded — the whole\n * `architecture/` project — so the deployment model is already here and this\n * returns it. A SINGLE-service run loads only `landscape.likec4`, and a fleet\n * that keeps its `deployment { }` block in a file beside it, which is the\n * ordinary layout once one landscape file is the fleet's convention, would then\n * resolve one `Covers:` line two different ways depending on which command\n * asked. `loam status`'s two forms had exactly that disagreement and it was a\n * defect both times; this is the same class, prevented rather than found.\n *\n * The cost is paid only by a service whose `arch.spec.md` actually writes a\n * `node:` entry. A fleet with no topology at all pays one project load per such\n * service — a state in which the entry is a typo anyway, and one load is what\n * buys it a message that names the real ids.\n */\nasync function topology(\n  land: LoadedDoc | null,\n  archReqs: Requirement[],\n  docsDir: DocsDir,\n  fleet: FleetContext,\n): Promise<DeploymentModel | undefined> {\n  if (land?.deployment !== undefined && hasDeployment(land.deployment)) return land.deployment;\n  const wanted = coversEntries(archReqs).some((e) => e.form === \"node\" || e.form === \"node-edge\");\n  if (!wanted) return undefined;\n  // Through the index, always: `land` above is now that same project in every\n  // mode, so this fallback fires only for the caller that handed in nothing,\n  // and it must not be a second parse of documents already in the memo.\n  const project = await fleet.architecture(docsDir);\n  return project.errors.length === 0 ? project.deployment : undefined;\n}\n\nexport async function archAxisFindings(axis: ArchAxis): Promise<Finding[]> {\n  const { service, paths, archText, archReqs, elements, relationships, land, known, docsDir } = axis;\n  const { fleet } = axis;\n  const findings: Finding[] = [];\n\n  // The architecture spec axis — the obligations a business spec never carries\n  // (the transactional outbox, retries, metrics, alerts). arch.spec.md is\n  // optional and its ABSENCE is not a finding (partial adoption is supported);\n  // what exists must hold together: every requirement needs a scenario, every\n  // `Covers:` entry must resolve (covers.unknown), and every alert/SLI that\n  // health.yaml declares wants a covering requirement (health.uncovered) — the\n  // moment health.yaml stops being inert. Warnings, never gates: `--strict` is\n  // the CI escalation.\n  const health = await readHealth(paths.health);\n\n  // A model that reaches nothing is almost never true — but only when\n  // something else attests it should reach. A deliberately shallow synthetic\n  // fixture can hold elements without relationships beside sources that name\n  // dependencies, yet `0 errors, 0 warnings` would still read as done.\n  // Evidence-gated on purpose: a bare root-plus-one-container baseline stays\n  // silent (nothing PROVES it thin — the standard mid-adoption shape), the\n  // warn needs either a second nested element with no edge joining anything,\n  // or dependencies declared in this service's own health.yaml. The health\n  // half goes quiet when the file is unreadable — no claims on bad data.\n  // \"Nested\" is a PARENT in this slice, not a dot in the id, and the two stopped\n  // meaning the same thing when a model could extend the map: an extending\n  // placeholder `extend marketplace.orderService { }` contributes one element\n  // whose id is dotted and whose parent belongs to the map, so a dot count read\n  // it as nested architecture that reaches nothing — the standalone placeholder\n  // `orderService = softwareSystem` was silent for the same shape. One rule for\n  // both: `a`/`a.x`/`kafka`/`kafka.t` still counts two.\n  const sliceIds = new Set(elements.map((e) => e.id));\n  const nested = elements.filter((e) => {\n    const dot = e.id.lastIndexOf(\".\");\n    return dot !== -1 && sliceIds.has(e.id.slice(0, dot));\n  }).length;\n  const deps = health.unreadable ? [] : health.dependencies;\n  if (elements.length > 0 && relationships.length === 0 && (nested > 1 || deps.length > 0)) {\n    const evidence = [\n      ...(nested > 1 ? [`${nested} nested elements with no edge joining them`] : []),\n      ...(deps.length > 0\n        ? [`health.yaml declares ${deps.length} dependenc${deps.length === 1 ? \"y\" : \"ies\"} (${deps.join(\", \")})`]\n        : []),\n    ].join(\", and \");\n    findings.push({\n      severity: \"warn\",\n      code: \"c4.no-relationships\",\n      subject: service,\n      message:\n        `${service}: model.likec4 declares ${elements.length} element(s) and 0 relationships, yet ${evidence} — ` +\n        `a model that reaches nothing is almost never true; draw the edges the service actually has ` +\n        `(what its containers call, what reads and writes its stores, what it depends on at runtime)`,\n    });\n  }\n\n  if (archText !== null) {\n    // The arch axis is advisory in what it ASKS for (covers.unknown,\n    // health.uncovered are warnings) but not in whether the file is readable:\n    // both breaches below are about the document itself, and they are graded\n    // exactly as they are on the business axis — one file, one rule.\n    const conflict = documentConflictFinding(`${service}: arch.spec.md`, service, archText);\n    if (conflict !== null) findings.push(conflict);\n    findings.push(coverageFinding(`${service}: arch requirements`, archReqs));\n    findings.push(...scenarioShapeFindings(`${service}: arch requirements`, service, archReqs));\n    findings.push(...duplicateRequirementFindings(archReqs, `${service}: arch.spec.md`, service));\n    findings.push(...requirementIdFindings(archReqs, `${service}: arch.spec.md`, service));\n    findings.push(...repeatedListLineFindings(archReqs, `${service}: arch.spec.md`, service));\n  }\n  // A health.yaml that exists but does not read is reported once, and the\n  // checks that read it go quiet BOTH ways: its ids are unknown, so no\n  // health.uncovered obligation exists (the empty id set below is already\n  // silent), and no `Covers: alert:/sli:` entry may be graded a typo against\n  // ids nobody could read (coversUnknownFindings mutes on the flag). A warn,\n  // not an error: the axis it feeds is advisory end to end.\n  if (health.unreadable) {\n    findings.push({\n      severity: \"warn\",\n      code: \"health.invalid\",\n      subject: service,\n      message: `${service}: health.yaml does not parse — alert/SLI ids are unreadable, so Covers: alert:/sli: entries and health coverage are unchecked`,\n      ...(health.error === undefined ? {} : { details: [health.error] }),\n    });\n  }\n  const landParses = land !== null && land.errors.length === 0 ? land : null;\n  const deployment = await topology(landParses, archReqs, docsDir, fleet);\n  const scope: CoverageScope = {\n    elements: [...elements, ...(landParses?.elements ?? [])],\n    relationships: [...relationships, ...(landParses?.relationships ?? [])],\n    ...(deployment === undefined ? {} : { deployment }),\n    health: health.ids,\n    known,\n  };\n  // `covers.unknown` is suspended entirely when the model could not be read —\n  // it EXTENDS a map that does not parse, or it does not parse itself — and\n  // this is the standing rule of the whole axis rather than a special case:\n  // nothing may be graded out of a document nobody could read\n  // (`core/c4/service-model/load.ts` states it; `model/grade.ts`, `model/diverged.ts`\n  // and the flow skip in `./service.ts` all honour it). Such a model comes back\n  // with no elements and no edges, so every `Covers:` line naming one of its\n  // containers would resolve to nothing. For an unreadable map the landscape\n  // half of the scope is empty too — one unparseable\n  // `architecture/usecases/x.likec4` convicting every Covers: line of every\n  // migrated service in the fleet as a typo, under a code whose whole job is to\n  // catch typos. For the model's own parse error it was one dropped quote in\n  // the example fleet's order-service: `c4.invalid` and six `covers.unknown`\n  // warnings, each sending the reader to arch.spec.md to fix an id that was\n  // spelled right. `c4.invalid` is the one finding; the grade comes back with\n  // the next run that parses.\n  //\n  // The alert:/sli: forms could still be answered out of health.yaml, which IS\n  // readable, and they are suspended with the rest on purpose: a verdict that\n  // grades two of the Covers: forms and drops the others is a report whose\n  // completeness depends on which form the author happened to write, and the one\n  // repair — fix the map, or the model — brings all of them back on the next\n  // run. The same holds for a STANDALONE model that does not parse, whose\n  // landscape half is still readable: grading only the entries that name the\n  // map would be that partial report again. The health axis keeps its own grade\n  // either way (`health.uncovered`, below).\n  if (axis.modelUnreadable !== true) {\n    findings.push(\n      ...coversUnknownFindings(archReqs, { where: `${service}: arch.spec.md`, subject: service }, scope, health.unreadable),\n    );\n  }\n  const activeCovers = coversEntries(archReqs);\n  for (const { form, ids } of [\n    { form: \"alert\" as const, ids: health.ids.alerts },\n    { form: \"sli\" as const, ids: health.ids.slis },\n  ]) {\n    for (const id of ids) {\n      if (activeCovers.some((e) => e.form === form && e.id === id)) continue;\n      findings.push({\n        severity: \"warn\",\n        code: \"health.uncovered\",\n        subject: service,\n        message: `${service}: health.yaml declares ${form === \"alert\" ? \"alert\" : \"SLI\"} '${id}' but no arch.spec.md requirement covers it — write one with 'Covers: ${form}:${id}', or the signal ships with nothing testing it`,\n      });\n    }\n  }\n  // The other direction health.yaml is read in: its dependencies must be the\n  // model's dependencies. `deps` is already muted on an unreadable file above.\n  findings.push(...healthDependencyFindings({ service, dependencies: deps, elements, modelPath: repoPath(docsDir, paths.model) }));\n\n  return findings;\n}\n"]}

package/dist/commands/validate/service/spine.js

@@ -0,0 +1,148 @@
+/**
+ * The inbound half of the C4↔API spine: every cross-system edge the living
+ * landscape draws INTO this service must resolve to a real operation in its
+ * OpenAPI.
+ *
+ * Separate from `./api.js` because the two grade different documents and the
+ * fix lives in different files — a broken edge is the fleet map's mistake, a
+ * missing operation is the contract's — but it may conclude nothing without
+ * `api.js`'s answer, which is why `ServiceContract` is a parameter rather than
+ * a second read of openapi.yaml.
+ *
+ * The event-side mirror of this check is inside `./events.js`: there the
+ * PRODUCER owns the contract and it lives in another repository, so the two
+ * could not share a walk even though they share the shape.
+ */
+import {} from "../../../core/kernel/ids/service.js";
+import {} from "../../../core/c4/likec4.js";
+import {} from "../../../core/kernel/ids/dirs.js";
+import {} from "../../../core/kernel/ids/service.js";
+import {} from "../../../core/vocabulary/report.js";
+import { brokenDocumentPaths, errorText } from "../../../core/c4/likec4.js";
+import {} from "./api.js";
+export function spineFindings(spine) {
+    const { service, me, land, landSvcOf, contract } = spine;
+    const findings = [];
+    // Landscape spine: cross-system edges calling THIS service must resolve to a real
+    // operation in its OpenAPI — the C4↔API contract, checked in the living landscape,
+    // not only in feature mode. Catches dangling / de-linked op edges.
+    if (land !== null) {
+        if (land.errors.length > 0) {
+            // A living landscape that does not parse disables the C4↔API spine check —
+            // that is a broken source of truth, not a skippable detail.
+            //
+            // The parser's own output is attached ONCE per run, and not here when the
+            // run has a landscape target to carry it. One syntax error in one file
+            // becomes N copies of a dozen cascading diagnostics on a fleet of N
+            // services — the report stops being readable at exactly the moment
+            // somebody needs to read it, and the fix is one file either way.
+            // Which DOCUMENT broke, spelled exactly as the fleet arm spells it
+            // (`fleet/landscape.ts`): `land` is the whole `architecture/` project, so
+            // the broken file is as often a `usecases/*.likec4` as the map itself,
+            // and the filename used to be hardcoded here — an agent told to "fix the
+            // file the message names" opened a document that parses (verification
+            // 2026-09-04, W2).
+            const broken = brokenDocumentPaths(spine.docsDir, land.errors);
+            const named = broken.length === 0 ? "architecture/landscape.likec4" : broken.join(", ");
+            // The verb agrees with the LIST, not with the count after it: `named` is a
+            // comma-joined series once two documents broke, and "a, b, c has 6
+            // error(s)" is a sentence a reader trips over — the same care `remedy()`
+            // in model/diverged.ts takes over "the kind differ".
+            const verb = broken.length > 1 ? "have" : "has";
+            findings.push({
+                severity: "error",
+                code: "spine.landscape-invalid",
+                subject: service,
+                message: `${service}: ${named} ${verb} ${land.errors.length} error(s) — spine check impossible` +
+                    (spine.modelExtends === true
+                        ? " — and model.likec4 extends it, so the model cannot be read either"
+                        : "") +
+                    (spine.landscapeReported === true
+                        ? "; the parser output is reported once, on the landscape target"
+                        : ""),
+                ...(spine.landscapeReported === true
+                    ? {}
+                    : {
+                        // Every line carries its own file once more than one document is
+                        // broken, the fleet arm's rule verbatim: a bare `L8:` across two
+                        // documents is unactionable. The prefix is `brokenDocumentPaths`'s
+                        // spelling of that one error's document, as the message's list is.
+                        details: land.errors.map((e) => {
+                            const [file] = broken.length < 2 ? [] : brokenDocumentPaths(spine.docsDir, [e]);
+                            return file === undefined ? errorText(e) : `${file} ${errorText(e)}`;
+                        }),
+                    }),
+                // The broken document first, the service second: the finding is about a
+                // file under `architecture/` and is FILED on this service, and without
+                // the pair the payload carried only the service directory.
+                locations: [
+                    ...(broken.length === 0 ? [] : [{ path: broken[0], role: "primary" }]),
+                    { path: spine.treePath, role: "scope" },
+                ],
+            });
+        }
+        else {
+            // Which element IS this service is the binding's call, then a title that
+            // names a real services/<id>/, and an edge into a modelled container
+            // counts as an edge into its service — matching the exact id alone meant a
+            // container edge left the spine without a word.
+            const svcOf = landSvcOf;
+            const opset = new Set(contract.ops);
+            let checked = 0;
+            let broken = 0;
+            for (const r of land.relationships) {
+                if (svcOf(r.target) !== me)
+                    continue;
+                if (r.op !== undefined) {
+                    // A contract that cannot be read — broken, or not there at all —
+                    // proves nothing about this edge, neither broken nor resolved.
+                    // Grading the edges against an empty operation set turned ONE root
+                    // cause (the file) into one `spine.op-undefined` per inbound edge, so
+                    // a service with twelve consumers reported twelve landscape defects
+                    // and never named the file. `openapi.invalid` / `service.no-openapi`
+                    // already did, from ./api.js; only op-link-missing (which never reads
+                    // the contract) stays live, and `checked` stays 0 so no false
+                    // spine.resolved is claimed either.
+                    if (contract.unreadable)
+                        continue;
+                    checked += 1;
+                    if (!opset.has(r.op)) {
+                        broken += 1;
+                        findings.push({
+                            severity: "error",
+                            code: "spine.op-undefined",
+                            message: `${service}: landscape edge ${svcOf(r.source)} → ${service} calls '${r.op}', not defined in ${service}'s OpenAPI`,
+                        });
+                    }
+                    else if (contract.deprecated.has(r.op)) {
+                        // The contract holds — the op is defined — but it is marked
+                        // `deprecated: true`: the consumer is standing on a contract being
+                        // retired, and should be migrating off it. Warn per inbound edge;
+                        // a deprecated op nobody calls raises no spine finding at all.
+                        findings.push({
+                            severity: "warn",
+                            code: "spine.op-deprecated",
+                            message: `${service}: landscape edge ${svcOf(r.source)} → ${service} calls '${r.op}', which ${service}'s OpenAPI marks deprecated — the consumer should migrate off it`,
+                        });
+                    }
+                }
+                else if ((r.title ?? "").toLowerCase().startsWith("call")) {
+                    findings.push({
+                        severity: "warn",
+                        code: "spine.op-link-missing",
+                        message: `${service}: landscape edge ${svcOf(r.source)} → ${service} ("${r.title}") has no operation link (metadata { op })`,
+                    });
+                }
+            }
+            if (broken === 0 && checked > 0) {
+                findings.push({
+                    severity: "ok",
+                    code: "spine.resolved",
+                    message: `${service}: landscape spine (${checked} inbound call(s) resolve to OpenAPI)`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=spine.js.map

package/dist/commands/validate/service/spine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spine.js","sourceRoot":"","sources":["../../../../src/commands/validate/service/spine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAkB,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAgB,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAwB,MAAM,UAAU,CAAC;AAsChD,MAAM,UAAU,aAAa,CAAC,KAAY;IACxC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACzD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,kFAAkF;IAClF,mFAAmF;IACnF,mEAAmE;IACnE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,2EAA2E;YAC3E,4DAA4D;YAC5D,EAAE;YACF,0EAA0E;YAC1E,uEAAuE;YACvE,oEAAoE;YACpE,mEAAmE;YACnE,iEAAiE;YACjE,mEAAmE;YACnE,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,sEAAsE;YACtE,mBAAmB;YACnB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxF,2EAA2E;YAC3E,mEAAmE;YACnE,yEAAyE;YACzE,qDAAqD;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,oCAAoC;oBACtF,CAAC,KAAK,CAAC,YAAY,KAAK,IAAI;wBAC1B,CAAC,CAAC,oEAAoE;wBACtE,CAAC,CAAC,EAAE,CAAC;oBACP,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI;wBAC/B,CAAC,CAAC,+DAA+D;wBACjE,CAAC,CAAC,EAAE,CAAC;gBACT,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI;oBAClC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,iEAAiE;wBACjE,iEAAiE;wBACjE,mEAAmE;wBACnE,mEAAmE;wBACnE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;4BAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;4BAChF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvE,CAAC,CAAC;qBACH,CAAC;gBACN,wEAAwE;gBACxE,uEAAuE;gBACvE,2DAA2D;gBAC3D,SAAS,EAAE;oBACT,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,SAAkB,EAAE,CAAC,CAAC;oBAChF,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAgB,EAAE;iBACjD;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,qEAAqE;YACrE,2EAA2E;YAC3E,gDAAgD;YAChD,MAAM,KAAK,GAAG,SAAU,CAAC;YACzB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE;oBAAE,SAAS;gBACrC,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;oBACvB,iEAAiE;oBACjE,+DAA+D;oBAC/D,mEAAmE;oBACnE,sEAAsE;oBACtE,oEAAoE;oBACpE,qEAAqE;oBACrE,sEAAsE;oBACtE,8DAA8D;oBAC9D,oCAAoC;oBACpC,IAAI,QAAQ,CAAC,UAAU;wBAAE,SAAS;oBAClC,OAAO,IAAI,CAAC,CAAC;oBACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;wBACrB,MAAM,IAAI,CAAC,CAAC;wBACZ,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,OAAO;4BACjB,IAAI,EAAE,oBAAoB;4BAC1B,OAAO,EAAE,GAAG,OAAO,oBAAoB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC,EAAE,qBAAqB,OAAO,YAAY;yBAC3H,CAAC,CAAC;oBACL,CAAC;yBAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;wBACzC,4DAA4D;wBAC5D,mEAAmE;wBACnE,kEAAkE;wBAClE,+DAA+D;wBAC/D,QAAQ,CAAC,IAAI,CAAC;4BACZ,QAAQ,EAAE,MAAM;4BAChB,IAAI,EAAE,qBAAqB;4BAC3B,OAAO,EAAE,GAAG,OAAO,oBAAoB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC,EAAE,YAAY,OAAO,kEAAkE;yBACxK,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,uBAAuB;wBAC7B,OAAO,EAAE,GAAG,OAAO,oBAAoB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,OAAO,MAAM,CAAC,CAAC,KAAK,4CAA4C;qBAC7H,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,MAAM,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,GAAG,OAAO,sBAAsB,OAAO,sCAAsC;iBACvF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The inbound half of the C4↔API spine: every cross-system edge the living\n * landscape draws INTO this service must resolve to a real operation in its\n * OpenAPI.\n *\n * Separate from `./api.js` because the two grade different documents and the\n * fix lives in different files — a broken edge is the fleet map's mistake, a\n * missing operation is the contract's — but it may conclude nothing without\n * `api.js`'s answer, which is why `ServiceContract` is a parameter rather than\n * a second read of openapi.yaml.\n *\n * The event-side mirror of this check is inside `./events.js`: there the\n * PRODUCER owns the contract and it lives in another repository, so the two\n * could not share a walk even though they share the shape.\n */\nimport { type DeclaredService } from \"../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../core/c4/likec4.js\";\nimport { type DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport { brokenDocumentPaths, errorText } from \"../../../core/c4/likec4.js\";\nimport { type ServiceContract } from \"./api.js\";\n\n/** What the service target hands the spine check. */\nexport interface Spine {\n  service: PathableService;\n  /** The docs root, so a project error's absolute path can be spelled repo-relative. */\n  docsDir: DocsDir;\n  /** The service directory, repo-relative and `/`-separated — the scope location beside the broken file. */\n  treePath: string;\n  /** `service` widened for `===` against the resolver's DOCUMENT text — see service.ts. */\n  me: string;\n  /**\n   * The living landscape, or null when the repo has none. A `--base` run's\n   * changed-edge grade (`../scope.ts`) hands in the same document narrowed to\n   * the edges the branch wrote, which is why every verdict below is per edge\n   * and none of them is about the edges that are absent.\n   */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  contract: ServiceContract;\n  /** True when this run also emits a landscape target — see `ServiceCheck`. */\n  landscapeReported?: boolean;\n  /**\n   * True when this service's `model.likec4` EXTENDS the map rather than\n   * standing alone (`core/c4/service-model/shape.ts`).\n   *\n   * It changes one sentence and no verdict. An extending model is parsed inside\n   * the `architecture/` project, so a map that does not parse takes the model\n   * with it: there is no `c4.invalid` and no `c4.valid` on the service target,\n   * and without this clause the report shows a service whose model is simply\n   * never mentioned. Said here rather than as a finding of its own because it is\n   * the same fact — one unreadable document — and a second code would be a\n   * second thing to fix for one repair.\n   */\n  modelExtends?: boolean;\n}\n\nexport function spineFindings(spine: Spine): Finding[] {\n  const { service, me, land, landSvcOf, contract } = spine;\n  const findings: Finding[] = [];\n\n  // Landscape spine: cross-system edges calling THIS service must resolve to a real\n  // operation in its OpenAPI — the C4↔API contract, checked in the living landscape,\n  // not only in feature mode. Catches dangling / de-linked op edges.\n  if (land !== null) {\n    if (land.errors.length > 0) {\n      // A living landscape that does not parse disables the C4↔API spine check —\n      // that is a broken source of truth, not a skippable detail.\n      //\n      // The parser's own output is attached ONCE per run, and not here when the\n      // run has a landscape target to carry it. One syntax error in one file\n      // becomes N copies of a dozen cascading diagnostics on a fleet of N\n      // services — the report stops being readable at exactly the moment\n      // somebody needs to read it, and the fix is one file either way.\n      // Which DOCUMENT broke, spelled exactly as the fleet arm spells it\n      // (`fleet/landscape.ts`): `land` is the whole `architecture/` project, so\n      // the broken file is as often a `usecases/*.likec4` as the map itself,\n      // and the filename used to be hardcoded here — an agent told to \"fix the\n      // file the message names\" opened a document that parses (verification\n      // 2026-09-04, W2).\n      const broken = brokenDocumentPaths(spine.docsDir, land.errors);\n      const named = broken.length === 0 ? \"architecture/landscape.likec4\" : broken.join(\", \");\n      // The verb agrees with the LIST, not with the count after it: `named` is a\n      // comma-joined series once two documents broke, and \"a, b, c has 6\n      // error(s)\" is a sentence a reader trips over — the same care `remedy()`\n      // in model/diverged.ts takes over \"the kind differ\".\n      const verb = broken.length > 1 ? \"have\" : \"has\";\n      findings.push({\n        severity: \"error\",\n        code: \"spine.landscape-invalid\",\n        subject: service,\n        message:\n          `${service}: ${named} ${verb} ${land.errors.length} error(s) — spine check impossible` +\n          (spine.modelExtends === true\n            ? \" — and model.likec4 extends it, so the model cannot be read either\"\n            : \"\") +\n          (spine.landscapeReported === true\n            ? \"; the parser output is reported once, on the landscape target\"\n            : \"\"),\n        ...(spine.landscapeReported === true\n          ? {}\n          : {\n              // Every line carries its own file once more than one document is\n              // broken, the fleet arm's rule verbatim: a bare `L8:` across two\n              // documents is unactionable. The prefix is `brokenDocumentPaths`'s\n              // spelling of that one error's document, as the message's list is.\n              details: land.errors.map((e) => {\n                const [file] = broken.length < 2 ? [] : brokenDocumentPaths(spine.docsDir, [e]);\n                return file === undefined ? errorText(e) : `${file} ${errorText(e)}`;\n              }),\n            }),\n        // The broken document first, the service second: the finding is about a\n        // file under `architecture/` and is FILED on this service, and without\n        // the pair the payload carried only the service directory.\n        locations: [\n          ...(broken.length === 0 ? [] : [{ path: broken[0]!, role: \"primary\" as const }]),\n          { path: spine.treePath, role: \"scope\" as const },\n        ],\n      });\n    } else {\n      // Which element IS this service is the binding's call, then a title that\n      // names a real services/<id>/, and an edge into a modelled container\n      // counts as an edge into its service — matching the exact id alone meant a\n      // container edge left the spine without a word.\n      const svcOf = landSvcOf!;\n      const opset = new Set(contract.ops);\n      let checked = 0;\n      let broken = 0;\n      for (const r of land.relationships) {\n        if (svcOf(r.target) !== me) continue;\n        if (r.op !== undefined) {\n          // A contract that cannot be read — broken, or not there at all —\n          // proves nothing about this edge, neither broken nor resolved.\n          // Grading the edges against an empty operation set turned ONE root\n          // cause (the file) into one `spine.op-undefined` per inbound edge, so\n          // a service with twelve consumers reported twelve landscape defects\n          // and never named the file. `openapi.invalid` / `service.no-openapi`\n          // already did, from ./api.js; only op-link-missing (which never reads\n          // the contract) stays live, and `checked` stays 0 so no false\n          // spine.resolved is claimed either.\n          if (contract.unreadable) continue;\n          checked += 1;\n          if (!opset.has(r.op)) {\n            broken += 1;\n            findings.push({\n              severity: \"error\",\n              code: \"spine.op-undefined\",\n              message: `${service}: landscape edge ${svcOf(r.source)} → ${service} calls '${r.op}', not defined in ${service}'s OpenAPI`,\n            });\n          } else if (contract.deprecated.has(r.op)) {\n            // The contract holds — the op is defined — but it is marked\n            // `deprecated: true`: the consumer is standing on a contract being\n            // retired, and should be migrating off it. Warn per inbound edge;\n            // a deprecated op nobody calls raises no spine finding at all.\n            findings.push({\n              severity: \"warn\",\n              code: \"spine.op-deprecated\",\n              message: `${service}: landscape edge ${svcOf(r.source)} → ${service} calls '${r.op}', which ${service}'s OpenAPI marks deprecated — the consumer should migrate off it`,\n            });\n          }\n        } else if ((r.title ?? \"\").toLowerCase().startsWith(\"call\")) {\n          findings.push({\n            severity: \"warn\",\n            code: \"spine.op-link-missing\",\n            message: `${service}: landscape edge ${svcOf(r.source)} → ${service} (\"${r.title}\") has no operation link (metadata { op })`,\n          });\n        }\n      }\n      if (broken === 0 && checked > 0) {\n        findings.push({\n          severity: \"ok\",\n          code: \"spine.resolved\",\n          message: `${service}: landscape spine (${checked} inbound call(s) resolve to OpenAPI)`,\n        });\n      }\n    }\n  }\n\n  return findings;\n}\n"]}