@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/core/gate/partners.js

@@ -13,51 +13,76 @@
  * letting it read as "no partners".
  */
 import { existsSync } from "node:fs";
-import {} from "../c4/likec4.js";
+import { errorText } from "../c4/likec4.js";
 import { serviceResolver } from "../c4/resolve/service.js";
-import { ACTOR_KINDS, EXTERNAL_TAG, landscapeEvidence, maturityGaps, serviceMaturity, MATURITY_LADDER, } from "../vocabulary/maturity.js";
+import { ACTOR_KINDS, EXTERNAL_TAG, INFRA_KINDS, landscapeEvidence, maturityGaps, serviceMaturity, MATURITY_LADDER, } from "../vocabulary/maturity.js";
 import { compareIds } from "../repo/entries.js";
 import { landscapePath, servicePathsAt } from "../repo/paths.js";
 import { enumeratedServices } from "../repo/service-target.js";
+import { ancestorIds } from "../kernel/ids/fqn/ancestors.js";
 /** Is this rung at or above `documented` — the fixed threshold check 1 grades against? */
 export function atLeastDocumented(m) {
     return MATURITY_LADDER.indexOf(m) >= MATURITY_LADDER.indexOf("documented");
 }
-/** The id itself, then each dotted ancestor — the same walk `serviceResolver` resolves through. */
-function selfAndAncestors(id) {
-    const out = [id];
-    for (let dot = id.lastIndexOf("."); dot !== -1; dot = id.lastIndexOf(".", dot - 1)) {
-        out.push(id.slice(0, dot));
-    }
-    return out;
-}
 /**
- * What the map says about one edge END: does it stand for a person, and is it
- * tagged `#external`? Walked up the ancestor chain because both facts are
- * usually written on the containing system while the edge is drawn from a
- * nested element — but the walk STOPS at the first element that stands for a
- * service (an explicit binding or a title naming a real directory,
- * `serviceResolver`'s own first two rungs, checked after that element's own
- * facts are read). What sits above the service boundary is a grouping, and a
- * grouping's `#external` is the grouping's claim, not the service's: without
- * the stop, an adopted service drawn inside an `#external` zone was exempted
- * from `gate.partner-undocumented` and its real rung hidden.
+ * What the map says about one edge END: does it stand for a person, is it
+ * INFRASTRUCTURE, and is it tagged `#external`? Walked up the ancestor chain
+ * because all three facts are usually written on the containing system while
+ * the edge is drawn from a nested element — but the walk STOPS at the first
+ * element that stands for a service (an explicit binding or a title naming a
+ * real directory, `serviceResolver`'s own first two rungs, checked after that
+ * element's own facts are read). What sits above the service boundary is a
+ * grouping, and a grouping's `#external` is the grouping's claim, not the
+ * service's: without the stop, an adopted service drawn inside an `#external`
+ * zone was exempted from `gate.partner-undocumented` and its real rung hidden.
+ *
+ * `infra` is read only off an element that stands for NO service AND sits
+ * inside none, which is the asymmetry the `standsFor` local exists for. That is
+ * `commands/validate/fleet/census.ts` in two steps and in its order:
+ * `serviceLevelElements` drops everything drawn inside a service BEFORE
+ * `drawnSystems` ever applies the kind test, so a service's own interior never
+ * reaches it. Both halves are load-bearing. A `database` bound with
+ * `metadata { service '<id>' }` is an adopted service that happens to be drawn
+ * as a store — its side of the join IS recorded, and dropping it would hide a
+ * real partner's rung. And a store drawn INSIDE its owner — `orderService.db`,
+ * the ordinary way a team draws a private datastore — is that service's
+ * interior: reading the kind off it convicted the WHOLE endpoint as
+ * infrastructure, and `partnerScan` then dropped order-service from the partner
+ * set, so a service this gate exists to grade vanished because of how somebody
+ * drew its storage. The kind is the fallback for an element nothing else
+ * answers for, never the override.
  */
 function endFacts(byId, known, id) {
     let actor = false;
+    let infra = false;
     let external = false;
-    for (const candidate of selfAndAncestors(id)) {
+    // The id itself, then each dotted ancestor — the same walk `serviceResolver`
+    // resolves through, out of the one module that spells it
+    // (`core/kernel/ids/fqn/ancestors.ts`).
+    for (const candidate of ancestorIds(id)) {
         const e = byId.get(candidate);
         if (e === undefined)
             continue;
+        const standsFor = e.service !== undefined || known.has(e.title);
         if (ACTOR_KINDS.has(e.kind.toLowerCase()))
             actor = true;
+        if (!standsFor && INFRA_KINDS.has(e.kind.toLowerCase()))
+            infra = true;
         if (e.tags.includes(EXTERNAL_TAG))
             external = true;
-        if (e.service !== undefined || known.has(e.title))
+        if (standsFor) {
+            // Everything the walk has visited so far was drawn INSIDE this service,
+            // so nothing visited so far was service-LEVEL and no kind read off it
+            // answers for a service — `serviceLevelElements` filtering ahead of the
+            // kind test, spelled as a walk. `actor` and `external` are deliberately
+            // left standing: a person or an `#external` tag written on a container is
+            // still a claim about this endpoint, while the store shape is a claim
+            // about the owner's interior.
+            infra = false;
             break;
+        }
     }
-    return { actor, external };
+    return { actor, infra, external };
 }
 /** How one edge joins the two ends, in the words the finding and the payload both use. */
 function viaOf(r) {
@@ -91,9 +116,11 @@ export async function partnerScan(req) {
             if (doc.errors.length > 0) {
                 landscape = "invalid";
                 const first = doc.errors[0];
+                // Through `errorText` — the raw message had no line, and a dropped
+                // quote's is a parser token list of thousands of lines.
                 landscapeProblem =
                     `${doc.errors.length} parse error(s)` +
-                        (first === undefined ? "" : ` — first: ${first.message}`);
+                        (first === undefined ? "" : ` — first: ${errorText(first)}`);
             }
             else {
                 landscape = "read";
@@ -162,14 +189,28 @@ export async function partnerScan(req) {
             continue;
         if (target === service) {
             const facts = endFacts(byId, known, r.source);
-            // A person is never a deploy participant: the actor exemption every
-            // landscape census applies (drawnSystems, commands/validate/fleet/census.ts).
-            if (!facts.actor)
+            // A person is never a deploy participant, and neither is the fleet's own
+            // infrastructure: the two kind exemptions every landscape census applies
+            // (drawnSystems, commands/validate/fleet/census.ts), spelled here off the
+            // same two sets so a gate and a validate run cannot disagree about what a
+            // partner IS.
+            //
+            // The infra half is the newer one, and it had a measured cost. A
+            // `database` the fleet owns and draws at fleet level joined every service
+            // that reads it, with `maturity: null` because there is no
+            // `services/<title>/` — so `gate.partner-undocumented` told the deployer
+            // to "adopt it, bind it … or tag it #external", three remedies none of
+            // which is true of a Postgres (measured on a one-service fixture,
+            // 2026-09-07). It is dropped from the partner SET rather than exempted
+            // from the finding, which is the actor precedent exactly: `partners` is
+            // the list of counterparties whose DOCS the gate grades, and a store has
+            // none to grade.
+            if (!facts.actor && !facts.infra)
                 join(source, "consumer", r, facts.external);
         }
         else if (source === service) {
             const facts = endFacts(byId, known, r.target);
-            if (!facts.actor)
+            if (!facts.actor && !facts.infra)
                 join(target, "provider", r, facts.external);
         }
     }

package/dist/core/gate/partners.js.map

@@ -1 +1 @@
-{"version":3,"file":"partners.js","sourceRoot":"","sources":["../../../src/core/gate/partners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAuB,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,eAAe,GAEhB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AA0D/D,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,CAAW;IAC3C,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC7E,CAAC;AAED,mGAAmG;AACnG,SAAS,gBAAgB,CAAC,EAAU;IAClC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,KAAK,IAAI,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,QAAQ,CACf,IAAuB,EACvB,KAA0B,EAC1B,EAAU;IAEV,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,SAAS,IAAI,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;QACxD,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QACnD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM;IAC3D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,0FAA0F;AAC1F,SAAS,KAAK,CAAC,CAAM;IACnB,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;KAC/D,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AACxE,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAuB;IACvD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACxC,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,uEAAuE;IACvE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAErE,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,SAAS,GAAkB,QAAQ,CAAC;IACxC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,QAAQ,GAAW,EAAE,CAAC;IAC1B,IAAI,aAAa,GAAU,EAAE,CAAC;IAC9B,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,gBAAgB;oBACd,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,iBAAiB;wBACrC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9D,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,MAAM,CAAC;gBACnB,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBACxB,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,uEAAuE;YACvE,6DAA6D;YAC7D,uEAAuE;YACvE,yCAAyC;YACzC,SAAS,GAAG,SAAS,CAAC;YACtB,gBAAgB,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;IACpC,MAAM,KAAK,GAA2B,MAAM;QAC1C,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;QAClC,CAAC,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE7C,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAE,WAAoB,EAAiB,EAAE;QAC7E,MAAM,KAAK,GAAG;YACZ,KAAK;YACL,QAAQ,EAAE,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACxD,WAAW;SACZ,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAmB,EAAiB,EAAE,CACnD,SAAS,CACP,KAAK,EACL,iBAAiB,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,CAC1F,CAAC;IAEJ,4EAA4E;IAC5E,iEAAiE;IACjE,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,0DAA0D,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAiB,EAAE,CAAM,EAAE,QAAiB,EAAQ,EAAE;QAChF,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;QAC5G,IAAI,IAAI,KAAK,UAAU;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;;YACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,2EAA2E;QAC3E,2CAA2C;QAC3C,IAAI,MAAM,KAAK,MAAM;YAAE,SAAS;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9C,oEAAoE;YACpE,8EAA8E;YAC9E,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ;YAC5D,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YACvF,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YACzB,wEAAwE;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,QAAQ,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ;SAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;QAC1B,gBAAgB,EAAE,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC;QAC/C,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The direct join partners of one service, derived from the LIVING landscape,\n * and the maturity grading of everything on either end of a join.\n *\n * The landscape is the only place the fleet's joins are drawn, so the partner\n * set is exactly the edges whose resolved source or target is the gated\n * service — resolved through `serviceResolver` with the ENUMERATED fleet\n * riding in, the same ride that keeps container-modelling landscapes attached\n * everywhere else (an edge into `paymentService.api` is an edge into the\n * service that owns it). A landscape that is absent or does not parse yields\n * NO partner set, never an empty one: `landscape` says which, and the check\n * layer turns \"could not look\" into `gate.partners-unknown` rather than\n * letting it read as \"no partners\".\n */\nimport { existsSync } from \"node:fs\";\nimport { type Elem, type Rel } from \"../c4/likec4.js\";\nimport { serviceResolver } from \"../c4/resolve/service.js\";\nimport {\n  ACTOR_KINDS,\n  EXTERNAL_TAG,\n  landscapeEvidence,\n  maturityGaps,\n  serviceMaturity,\n  MATURITY_LADDER,\n  type Maturity,\n} from \"../vocabulary/maturity.js\";\nimport { compareIds, type ServiceEntry } from \"../repo/entries.js\";\nimport { landscapePath, servicePathsAt } from \"../repo/paths.js\";\nimport { enumeratedServices } from \"../repo/service-target.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\nimport type { GatePartner, LandscapeRead, PartnerRole } from \"./report.js\";\n\nexport interface PartnerScanRequest {\n  docsDir: DocsDir;\n  /** The gated service — a name the enumeration approved (`resolveServiceTarget`). */\n  service: RawServiceId;\n  fleet: FleetContext;\n}\n\n/** One service graded on the adoption ladder, with what the next rung wants. */\nexport interface GradedService {\n  maturity: Maturity;\n  gaps: string[];\n}\n\nexport interface PartnerScan {\n  landscape: LandscapeRead;\n  /**\n   * Why the landscape graded `invalid` — the parse-error tally or the read\n   * failure's own words. Null on `read` and `absent`; the finding that fails\n   * the gate must say what broke, not merely that something did.\n   */\n  landscapeProblem: string | null;\n  /**\n   * The gated service's own rung, graded under the landscape's evidence —\n   * `gate.service-undocumented`'s subject. Fail-closed on the api question:\n   * with no readable map, `landscapeEvidence` assumes an API is expected.\n   */\n  target: GradedService;\n  /**\n   * The same service graded with NO api expected of it — the reading that\n   * does not depend on the landscape at all. The check layer answers from\n   * THIS one when the map is absent or broken: the api question is then\n   * unanswerable, and one unanswerable fact must not convict twice (the\n   * landscape already carries its own finding).\n   */\n  targetWithoutApi: GradedService;\n  /**\n   * The gated service's own enumerated entry — carried so a finding can name\n   * the directory it actually occupies. `services/<id>/` is right only for an\n   * unfiled fleet, and a check that sends a reader to a directory they cannot\n   * open has answered worse than not at all.\n   */\n  targetEntry: ServiceEntry;\n  partners: GatePartner[];\n  /**\n   * The enumerated entries behind the partners that HAVE a `services/`\n   * directory, in `partners` order — what the freshness check walks. Kept as\n   * entries rather than names so the ids that travel on carry the\n   * enumeration's provenance (`RawServiceId`), never a document's.\n   */\n  partnerEntries: ServiceEntry[];\n}\n\n/** Is this rung at or above `documented` — the fixed threshold check 1 grades against? */\nexport function atLeastDocumented(m: Maturity): boolean {\n  return MATURITY_LADDER.indexOf(m) >= MATURITY_LADDER.indexOf(\"documented\");\n}\n\n/** The id itself, then each dotted ancestor — the same walk `serviceResolver` resolves through. */\nfunction selfAndAncestors(id: string): string[] {\n  const out = [id];\n  for (let dot = id.lastIndexOf(\".\"); dot !== -1; dot = id.lastIndexOf(\".\", dot - 1)) {\n    out.push(id.slice(0, dot));\n  }\n  return out;\n}\n\n/**\n * What the map says about one edge END: does it stand for a person, and is it\n * tagged `#external`? Walked up the ancestor chain because both facts are\n * usually written on the containing system while the edge is drawn from a\n * nested element — but the walk STOPS at the first element that stands for a\n * service (an explicit binding or a title naming a real directory,\n * `serviceResolver`'s own first two rungs, checked after that element's own\n * facts are read). What sits above the service boundary is a grouping, and a\n * grouping's `#external` is the grouping's claim, not the service's: without\n * the stop, an adopted service drawn inside an `#external` zone was exempted\n * from `gate.partner-undocumented` and its real rung hidden.\n */\nfunction endFacts(\n  byId: Map<string, Elem>,\n  known: ReadonlySet<string>,\n  id: string,\n): { actor: boolean; external: boolean } {\n  let actor = false;\n  let external = false;\n  for (const candidate of selfAndAncestors(id)) {\n    const e = byId.get(candidate);\n    if (e === undefined) continue;\n    if (ACTOR_KINDS.has(e.kind.toLowerCase())) actor = true;\n    if (e.tags.includes(EXTERNAL_TAG)) external = true;\n    if (e.service !== undefined || known.has(e.title)) break;\n  }\n  return { actor, external };\n}\n\n/** How one edge joins the two ends, in the words the finding and the payload both use. */\nfunction viaOf(r: Rel): string[] {\n  const typed = [\n    ...(r.op === undefined ? [] : [`operation ${r.op}`]),\n    ...(r.publishes === undefined ? [] : [`message ${r.publishes}`]),\n    ...(r.consumes === undefined ? [] : [`message ${r.consumes}`]),\n  ];\n  if (typed.length > 0) return typed;\n  return [r.title === undefined ? \"untyped edge\" : `edge '${r.title}'`];\n}\n\ninterface PartnerAccumulator {\n  consumer: boolean;\n  provider: boolean;\n  external: boolean;\n  via: Set<string>;\n}\n\nexport async function partnerScan(req: PartnerScanRequest): Promise<PartnerScan> {\n  const { docsDir, service, fleet } = req;\n  // The same memoized enumeration the command's resolveServiceTarget already\n  // performed on this FleetContext — one walk answers both questions.\n  const entries = await enumeratedServices(docsDir, fleet);\n  // Keyed as plain strings on purpose: the lookups below arrive from the\n  // resolver, whose names are document-asserted, and only a hit proves a\n  // directory. The VALUES keep the enumeration's provenance.\n  const entryById = new Map<string, ServiceEntry>(entries.map((e) => [e.id, e]));\n  const known: ReadonlySet<string> = new Set(entries.map((e) => e.id));\n\n  const lp = landscapePath(docsDir);\n  let landscape: LandscapeRead = \"absent\";\n  let landscapeProblem: string | null = null;\n  let elements: Elem[] = [];\n  let relationships: Rel[] = [];\n  if (existsSync(lp)) {\n    try {\n      const doc = await fleet.loadLikeC4(lp);\n      if (doc.errors.length > 0) {\n        landscape = \"invalid\";\n        const first = doc.errors[0];\n        landscapeProblem =\n          `${doc.errors.length} parse error(s)` +\n          (first === undefined ? \"\" : ` — first: ${first.message}`);\n      } else {\n        landscape = \"read\";\n        elements = doc.elements;\n        relationships = doc.relationships;\n      }\n    } catch (err) {\n      // A landscape that could not be READ, graded as one that did not PARSE —\n      // commands/validate/fleet/load.ts's containment doctrine, spelled here\n      // because core cannot import it: \"could not be read\" and \"did not parse\"\n      // have the same consequence (nothing may be concluded from this file).\n      // The reason travels into the finding, message-preserving as\n      // `unreadableLandscape` is; the read error must not kill the run — the\n      // other three checks still have answers.\n      landscape = \"invalid\";\n      landscapeProblem = err instanceof Error ? err.message : String(err);\n    }\n  }\n  const parses = landscape === \"read\";\n  const svcOf: (id: string) => string = parses\n    ? serviceResolver(elements, known)\n    : (id: string) => id;\n  const elementIds = elements.map((e) => e.id);\n\n  // One service's ladder rung. `landscapeEvidence` is the ONE shared spelling\n  // of the positive-evidence apiExpected rule (core/vocabulary/maturity.ts);\n  // its own docblock warns against calling it per service inside a FLEET loop,\n  // and this loop is not one — it runs over the gated service and its direct\n  // partners, a handful, never the enumeration.\n  const gradeWith = (entry: ServiceEntry, apiExpected: boolean): GradedService => {\n    const input = {\n      entry,\n      archSpec: existsSync(servicePathsAt(entry.dir).archSpec),\n      apiExpected,\n    };\n    return { maturity: serviceMaturity(input), gaps: maturityGaps(input) };\n  };\n  const grade = (entry: ServiceEntry): GradedService =>\n    gradeWith(\n      entry,\n      landscapeEvidence({ id: entry.id, parses, relationships, elementIds, svcOf }).apiExpected,\n    );\n\n  // Unreachable by construction: the command layer resolved `service` against\n  // the same memoized enumeration this scan just read, and refused\n  // `unknown-service` when no directory answered. Failing closed here beats\n  // grading a service nobody enumerated as if its absence were a rung.\n  const targetEntry = entryById.get(service);\n  if (targetEntry === undefined) {\n    throw new Error(`gate: '${service}' vanished from the enumeration between resolve and scan`);\n  }\n\n  const byId = new Map(elements.map((e) => [e.id, e]));\n  const acc = new Map<string, PartnerAccumulator>();\n  const join = (name: string, role: PartnerRole, r: Rel, external: boolean): void => {\n    const slot = acc.get(name) ?? { consumer: false, provider: false, external: false, via: new Set<string>() };\n    if (role === \"consumer\") slot.consumer = true;\n    else slot.provider = true;\n    slot.external = slot.external || external;\n    for (const v of viaOf(r)) slot.via.add(v);\n    acc.set(name, slot);\n  };\n  for (const r of relationships) {\n    const source = svcOf(r.source);\n    const target = svcOf(r.target);\n    // A self-edge (both ends resolve to the gated service — its own containers\n    // talking to each other) names no partner.\n    if (source === target) continue;\n    if (target === service) {\n      const facts = endFacts(byId, known, r.source);\n      // A person is never a deploy participant: the actor exemption every\n      // landscape census applies (drawnSystems, commands/validate/fleet/census.ts).\n      if (!facts.actor) join(source, \"consumer\", r, facts.external);\n    } else if (source === service) {\n      const facts = endFacts(byId, known, r.target);\n      if (!facts.actor) join(target, \"provider\", r, facts.external);\n    }\n  }\n\n  // Sorted by id so identical state yields identical bytes — the accumulator's\n  // order is the landscape's edge order, which a reformat may shuffle.\n  const joined = [...acc.entries()].sort((a, b) => compareIds(a[0], b[0]));\n  const partners: GatePartner[] = joined.map(([name, slot]) => {\n    const entry = entryById.get(name);\n    return {\n      service: name,\n      maturity: entry === undefined ? null : grade(entry).maturity,\n      role: slot.consumer && slot.provider ? \"both\" : slot.consumer ? \"consumer\" : \"provider\",\n      via: [...slot.via].sort(),\n      // An adopted service is OURS whatever a zone's tag says: `external` and\n      // a maturity rung together must be unrepresentable, or the rung the\n      // payload carries is one the exemption hides and the human view drops.\n      external: entry === undefined && slot.external,\n    };\n  });\n\n  return {\n    landscape,\n    landscapeProblem,\n    targetEntry,\n    target: grade(targetEntry),\n    targetWithoutApi: gradeWith(targetEntry, false),\n    partners,\n    partnerEntries: joined.flatMap(([name]) => {\n      const entry = entryById.get(name);\n      return entry === undefined ? [] : [entry];\n    }),\n  };\n}\n"]}
+{"version":3,"file":"partners.js","sourceRoot":"","sources":["../../../src/core/gate/partners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EACL,WAAW,EACX,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,eAAe,GAEhB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAyD7D,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,CAAW;IAC3C,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,QAAQ,CACf,IAAuB,EACvB,KAA0B,EAC1B,EAAU;IAEV,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,6EAA6E;IAC7E,yDAAyD;IACzD,wCAAwC;IACxC,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;QACxD,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,KAAK,GAAG,IAAI,CAAC;QACtE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QACnD,IAAI,SAAS,EAAE,CAAC;YACd,wEAAwE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,8BAA8B;YAC9B,KAAK,GAAG,KAAK,CAAC;YACd,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,0FAA0F;AAC1F,SAAS,KAAK,CAAC,CAAM;IACnB,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChE,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;KAC/D,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AACxE,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAuB;IACvD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACxC,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzD,uEAAuE;IACvE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAuB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAwB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAErE,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,SAAS,GAAkB,QAAQ,CAAC;IACxC,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,QAAQ,GAAW,EAAE,CAAC;IAC1B,IAAI,aAAa,GAAU,EAAE,CAAC;IAC9B,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC5B,mEAAmE;gBACnE,wDAAwD;gBACxD,gBAAgB;oBACd,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,iBAAiB;wBACrC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,MAAM,CAAC;gBACnB,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;gBACxB,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,uEAAuE;YACvE,6DAA6D;YAC7D,uEAAuE;YACvE,yCAAyC;YACzC,SAAS,GAAG,SAAS,CAAC;YACtB,gBAAgB,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;IACpC,MAAM,KAAK,GAA2B,MAAM;QAC1C,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC;QAClC,CAAC,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAE7C,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAE,WAAoB,EAAiB,EAAE;QAC7E,MAAM,KAAK,GAAG;YACZ,KAAK;YACL,QAAQ,EAAE,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YACxD,WAAW;SACZ,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAmB,EAAiB,EAAE,CACnD,SAAS,CACP,KAAK,EACL,iBAAiB,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,CAC1F,CAAC;IAEJ,4EAA4E;IAC5E,iEAAiE;IACjE,0EAA0E;IAC1E,qEAAqE;IACrE,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,0DAA0D,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAiB,EAAE,CAAM,EAAE,QAAiB,EAAQ,EAAE;QAChF,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;QAC5G,IAAI,IAAI,KAAK,UAAU;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;;YACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,2EAA2E;QAC3E,2CAA2C;QAC3C,IAAI,MAAM,KAAK,MAAM;YAAE,SAAS;QAChC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9C,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,cAAc;YACd,EAAE;YACF,iEAAiE;YACjE,0EAA0E;YAC1E,2DAA2D;YAC3D,yEAAyE;YACzE,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,iBAAiB;YACjB,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChF,CAAC;aAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ;YAC5D,IAAI,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;YACvF,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YACzB,wEAAwE;YACxE,oEAAoE;YACpE,uEAAuE;YACvE,QAAQ,EAAE,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ;SAC/C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,SAAS;QACT,gBAAgB;QAChB,WAAW;QACX,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC;QAC1B,gBAAgB,EAAE,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC;QAC/C,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The direct join partners of one service, derived from the LIVING landscape,\n * and the maturity grading of everything on either end of a join.\n *\n * The landscape is the only place the fleet's joins are drawn, so the partner\n * set is exactly the edges whose resolved source or target is the gated\n * service — resolved through `serviceResolver` with the ENUMERATED fleet\n * riding in, the same ride that keeps container-modelling landscapes attached\n * everywhere else (an edge into `paymentService.api` is an edge into the\n * service that owns it). A landscape that is absent or does not parse yields\n * NO partner set, never an empty one: `landscape` says which, and the check\n * layer turns \"could not look\" into `gate.partners-unknown` rather than\n * letting it read as \"no partners\".\n */\nimport { existsSync } from \"node:fs\";\nimport { errorText, type Elem, type Rel } from \"../c4/likec4.js\";\nimport { serviceResolver } from \"../c4/resolve/service.js\";\nimport {\n  ACTOR_KINDS,\n  EXTERNAL_TAG,\n  INFRA_KINDS,\n  landscapeEvidence,\n  maturityGaps,\n  serviceMaturity,\n  MATURITY_LADDER,\n  type Maturity,\n} from \"../vocabulary/maturity.js\";\nimport { compareIds, type ServiceEntry } from \"../repo/entries.js\";\nimport { landscapePath, servicePathsAt } from \"../repo/paths.js\";\nimport { enumeratedServices } from \"../repo/service-target.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport { ancestorIds } from \"../kernel/ids/fqn/ancestors.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\nimport type { GatePartner, LandscapeRead, PartnerRole } from \"./report.js\";\n\nexport interface PartnerScanRequest {\n  docsDir: DocsDir;\n  /** The gated service — a name the enumeration approved (`resolveServiceTarget`). */\n  service: RawServiceId;\n  fleet: FleetContext;\n}\n\n/** One service graded on the adoption ladder, with what the next rung wants. */\nexport interface GradedService {\n  maturity: Maturity;\n  gaps: string[];\n}\n\nexport interface PartnerScan {\n  landscape: LandscapeRead;\n  /**\n   * Why the landscape graded `invalid` — the parse-error tally or the read\n   * failure's own words. Null on `read` and `absent`; the finding that fails\n   * the gate must say what broke, not merely that something did.\n   */\n  landscapeProblem: string | null;\n  /**\n   * The gated service's own rung, graded under the landscape's evidence —\n   * `gate.service-undocumented`'s subject. Fail-closed on the api question:\n   * with no readable map, `landscapeEvidence` assumes an API is expected.\n   */\n  target: GradedService;\n  /**\n   * The same service graded with NO api expected of it — the reading that\n   * does not depend on the landscape at all. The check layer answers from\n   * THIS one when the map is absent or broken: the api question is then\n   * unanswerable, and one unanswerable fact must not convict twice (the\n   * landscape already carries its own finding).\n   */\n  targetWithoutApi: GradedService;\n  /**\n   * The gated service's own enumerated entry — carried so a finding can name\n   * the directory it actually occupies. `services/<id>/` is right only for an\n   * unfiled fleet, and a check that sends a reader to a directory they cannot\n   * open has answered worse than not at all.\n   */\n  targetEntry: ServiceEntry;\n  partners: GatePartner[];\n  /**\n   * The enumerated entries behind the partners that HAVE a `services/`\n   * directory, in `partners` order — what the freshness check walks. Kept as\n   * entries rather than names so the ids that travel on carry the\n   * enumeration's provenance (`RawServiceId`), never a document's.\n   */\n  partnerEntries: ServiceEntry[];\n}\n\n/** Is this rung at or above `documented` — the fixed threshold check 1 grades against? */\nexport function atLeastDocumented(m: Maturity): boolean {\n  return MATURITY_LADDER.indexOf(m) >= MATURITY_LADDER.indexOf(\"documented\");\n}\n\n/**\n * What the map says about one edge END: does it stand for a person, is it\n * INFRASTRUCTURE, and is it tagged `#external`? Walked up the ancestor chain\n * because all three facts are usually written on the containing system while\n * the edge is drawn from a nested element — but the walk STOPS at the first\n * element that stands for a service (an explicit binding or a title naming a\n * real directory, `serviceResolver`'s own first two rungs, checked after that\n * element's own facts are read). What sits above the service boundary is a\n * grouping, and a grouping's `#external` is the grouping's claim, not the\n * service's: without the stop, an adopted service drawn inside an `#external`\n * zone was exempted from `gate.partner-undocumented` and its real rung hidden.\n *\n * `infra` is read only off an element that stands for NO service AND sits\n * inside none, which is the asymmetry the `standsFor` local exists for. That is\n * `commands/validate/fleet/census.ts` in two steps and in its order:\n * `serviceLevelElements` drops everything drawn inside a service BEFORE\n * `drawnSystems` ever applies the kind test, so a service's own interior never\n * reaches it. Both halves are load-bearing. A `database` bound with\n * `metadata { service '<id>' }` is an adopted service that happens to be drawn\n * as a store — its side of the join IS recorded, and dropping it would hide a\n * real partner's rung. And a store drawn INSIDE its owner — `orderService.db`,\n * the ordinary way a team draws a private datastore — is that service's\n * interior: reading the kind off it convicted the WHOLE endpoint as\n * infrastructure, and `partnerScan` then dropped order-service from the partner\n * set, so a service this gate exists to grade vanished because of how somebody\n * drew its storage. The kind is the fallback for an element nothing else\n * answers for, never the override.\n */\nfunction endFacts(\n  byId: Map<string, Elem>,\n  known: ReadonlySet<string>,\n  id: string,\n): { actor: boolean; infra: boolean; external: boolean } {\n  let actor = false;\n  let infra = false;\n  let external = false;\n  // The id itself, then each dotted ancestor — the same walk `serviceResolver`\n  // resolves through, out of the one module that spells it\n  // (`core/kernel/ids/fqn/ancestors.ts`).\n  for (const candidate of ancestorIds(id)) {\n    const e = byId.get(candidate);\n    if (e === undefined) continue;\n    const standsFor = e.service !== undefined || known.has(e.title);\n    if (ACTOR_KINDS.has(e.kind.toLowerCase())) actor = true;\n    if (!standsFor && INFRA_KINDS.has(e.kind.toLowerCase())) infra = true;\n    if (e.tags.includes(EXTERNAL_TAG)) external = true;\n    if (standsFor) {\n      // Everything the walk has visited so far was drawn INSIDE this service,\n      // so nothing visited so far was service-LEVEL and no kind read off it\n      // answers for a service — `serviceLevelElements` filtering ahead of the\n      // kind test, spelled as a walk. `actor` and `external` are deliberately\n      // left standing: a person or an `#external` tag written on a container is\n      // still a claim about this endpoint, while the store shape is a claim\n      // about the owner's interior.\n      infra = false;\n      break;\n    }\n  }\n  return { actor, infra, external };\n}\n\n/** How one edge joins the two ends, in the words the finding and the payload both use. */\nfunction viaOf(r: Rel): string[] {\n  const typed = [\n    ...(r.op === undefined ? [] : [`operation ${r.op}`]),\n    ...(r.publishes === undefined ? [] : [`message ${r.publishes}`]),\n    ...(r.consumes === undefined ? [] : [`message ${r.consumes}`]),\n  ];\n  if (typed.length > 0) return typed;\n  return [r.title === undefined ? \"untyped edge\" : `edge '${r.title}'`];\n}\n\ninterface PartnerAccumulator {\n  consumer: boolean;\n  provider: boolean;\n  external: boolean;\n  via: Set<string>;\n}\n\nexport async function partnerScan(req: PartnerScanRequest): Promise<PartnerScan> {\n  const { docsDir, service, fleet } = req;\n  // The same memoized enumeration the command's resolveServiceTarget already\n  // performed on this FleetContext — one walk answers both questions.\n  const entries = await enumeratedServices(docsDir, fleet);\n  // Keyed as plain strings on purpose: the lookups below arrive from the\n  // resolver, whose names are document-asserted, and only a hit proves a\n  // directory. The VALUES keep the enumeration's provenance.\n  const entryById = new Map<string, ServiceEntry>(entries.map((e) => [e.id, e]));\n  const known: ReadonlySet<string> = new Set(entries.map((e) => e.id));\n\n  const lp = landscapePath(docsDir);\n  let landscape: LandscapeRead = \"absent\";\n  let landscapeProblem: string | null = null;\n  let elements: Elem[] = [];\n  let relationships: Rel[] = [];\n  if (existsSync(lp)) {\n    try {\n      const doc = await fleet.loadLikeC4(lp);\n      if (doc.errors.length > 0) {\n        landscape = \"invalid\";\n        const first = doc.errors[0];\n        // Through `errorText` — the raw message had no line, and a dropped\n        // quote's is a parser token list of thousands of lines.\n        landscapeProblem =\n          `${doc.errors.length} parse error(s)` +\n          (first === undefined ? \"\" : ` — first: ${errorText(first)}`);\n      } else {\n        landscape = \"read\";\n        elements = doc.elements;\n        relationships = doc.relationships;\n      }\n    } catch (err) {\n      // A landscape that could not be READ, graded as one that did not PARSE —\n      // commands/validate/fleet/load.ts's containment doctrine, spelled here\n      // because core cannot import it: \"could not be read\" and \"did not parse\"\n      // have the same consequence (nothing may be concluded from this file).\n      // The reason travels into the finding, message-preserving as\n      // `unreadableLandscape` is; the read error must not kill the run — the\n      // other three checks still have answers.\n      landscape = \"invalid\";\n      landscapeProblem = err instanceof Error ? err.message : String(err);\n    }\n  }\n  const parses = landscape === \"read\";\n  const svcOf: (id: string) => string = parses\n    ? serviceResolver(elements, known)\n    : (id: string) => id;\n  const elementIds = elements.map((e) => e.id);\n\n  // One service's ladder rung. `landscapeEvidence` is the ONE shared spelling\n  // of the positive-evidence apiExpected rule (core/vocabulary/maturity.ts);\n  // its own docblock warns against calling it per service inside a FLEET loop,\n  // and this loop is not one — it runs over the gated service and its direct\n  // partners, a handful, never the enumeration.\n  const gradeWith = (entry: ServiceEntry, apiExpected: boolean): GradedService => {\n    const input = {\n      entry,\n      archSpec: existsSync(servicePathsAt(entry.dir).archSpec),\n      apiExpected,\n    };\n    return { maturity: serviceMaturity(input), gaps: maturityGaps(input) };\n  };\n  const grade = (entry: ServiceEntry): GradedService =>\n    gradeWith(\n      entry,\n      landscapeEvidence({ id: entry.id, parses, relationships, elementIds, svcOf }).apiExpected,\n    );\n\n  // Unreachable by construction: the command layer resolved `service` against\n  // the same memoized enumeration this scan just read, and refused\n  // `unknown-service` when no directory answered. Failing closed here beats\n  // grading a service nobody enumerated as if its absence were a rung.\n  const targetEntry = entryById.get(service);\n  if (targetEntry === undefined) {\n    throw new Error(`gate: '${service}' vanished from the enumeration between resolve and scan`);\n  }\n\n  const byId = new Map(elements.map((e) => [e.id, e]));\n  const acc = new Map<string, PartnerAccumulator>();\n  const join = (name: string, role: PartnerRole, r: Rel, external: boolean): void => {\n    const slot = acc.get(name) ?? { consumer: false, provider: false, external: false, via: new Set<string>() };\n    if (role === \"consumer\") slot.consumer = true;\n    else slot.provider = true;\n    slot.external = slot.external || external;\n    for (const v of viaOf(r)) slot.via.add(v);\n    acc.set(name, slot);\n  };\n  for (const r of relationships) {\n    const source = svcOf(r.source);\n    const target = svcOf(r.target);\n    // A self-edge (both ends resolve to the gated service — its own containers\n    // talking to each other) names no partner.\n    if (source === target) continue;\n    if (target === service) {\n      const facts = endFacts(byId, known, r.source);\n      // A person is never a deploy participant, and neither is the fleet's own\n      // infrastructure: the two kind exemptions every landscape census applies\n      // (drawnSystems, commands/validate/fleet/census.ts), spelled here off the\n      // same two sets so a gate and a validate run cannot disagree about what a\n      // partner IS.\n      //\n      // The infra half is the newer one, and it had a measured cost. A\n      // `database` the fleet owns and draws at fleet level joined every service\n      // that reads it, with `maturity: null` because there is no\n      // `services/<title>/` — so `gate.partner-undocumented` told the deployer\n      // to \"adopt it, bind it … or tag it #external\", three remedies none of\n      // which is true of a Postgres (measured on a one-service fixture,\n      // 2026-09-07). It is dropped from the partner SET rather than exempted\n      // from the finding, which is the actor precedent exactly: `partners` is\n      // the list of counterparties whose DOCS the gate grades, and a store has\n      // none to grade.\n      if (!facts.actor && !facts.infra) join(source, \"consumer\", r, facts.external);\n    } else if (source === service) {\n      const facts = endFacts(byId, known, r.target);\n      if (!facts.actor && !facts.infra) join(target, \"provider\", r, facts.external);\n    }\n  }\n\n  // Sorted by id so identical state yields identical bytes — the accumulator's\n  // order is the landscape's edge order, which a reformat may shuffle.\n  const joined = [...acc.entries()].sort((a, b) => compareIds(a[0], b[0]));\n  const partners: GatePartner[] = joined.map(([name, slot]) => {\n    const entry = entryById.get(name);\n    return {\n      service: name,\n      maturity: entry === undefined ? null : grade(entry).maturity,\n      role: slot.consumer && slot.provider ? \"both\" : slot.consumer ? \"consumer\" : \"provider\",\n      via: [...slot.via].sort(),\n      // An adopted service is OURS whatever a zone's tag says: `external` and\n      // a maturity rung together must be unrepresentable, or the rung the\n      // payload carries is one the exemption hides and the human view drops.\n      external: entry === undefined && slot.external,\n    };\n  });\n\n  return {\n    landscape,\n    landscapeProblem,\n    targetEntry,\n    target: grade(targetEntry),\n    targetWithoutApi: gradeWith(targetEntry, false),\n    partners,\n    partnerEntries: joined.flatMap(([name]) => {\n      const entry = entryById.get(name);\n      return entry === undefined ? [] : [entry];\n    }),\n  };\n}\n"]}

package/dist/core/gate/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/core/gate/report.ts"],"names":[],"mappings":"AAeA,8FAA8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,CAAU,CAAC;AA4D7F;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAA4B;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA4B;IACtD,MAAM,EAAE,GAAG,CAAC,QAA0B,EAAU,EAAE,CAChD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2B,EAAE,EAAU,EAAE,GAAY;IACrF,MAAM,CAAC,GAAG,GAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,WAAW,GACf,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,mCAAmC,CAAC;IACxF,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,oBAAoB;QACtE,OAAO,EAAE,EAAE;QACX,OAAO,EACL,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,sBAAsB,0BAA0B,WAAW,uEAAuE,MAAM,EAAE;YAC9J,sEAAsE;YACtE,sEAAsE;YACtE,wDAAwD;YACxD,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACnB,CAAC,CAAC,iGAAiG;gBACnG,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The gate report — what `loam gate` computes before anything is printed.\n *\n * Shapes, verdict arithmetic and the per-subject containment classifier: no\n * filesystem, no process access, no printing. The four checks build findings\n * (`./checks.ts`, `./verification.ts`), the command layer renders them, and\n * this module is what the two agree through — the same split\n * `core/vocabulary/report.ts` gives `loam validate`, whose `Finding` shape\n * the checks reuse so one breach arrives in one shape whichever command\n * reports it.\n */\nimport type { Finding } from \"../vocabulary/report.js\";\nimport type { Maturity } from \"../vocabulary/maturity.js\";\nimport type { VerificationState } from \"../status/report.js\";\n\n/** The four checks, in report order. A closed set — the payload's `checks[].check` values. */\nexport const GATE_CHECKS = [\"partners\", \"freshness\", \"verification\", \"interrupted\"] as const;\nexport type GateCheckName = (typeof GATE_CHECKS)[number];\n\nexport interface GateCheck {\n  check: GateCheckName;\n  findings: Finding[];\n}\n\n/**\n * How the landscape read came out. `absent` and `invalid` are kept apart from\n * `read` because the partner set derived under either is NOT \"no partners\" —\n * it is \"could not look\", and `gate.partners-unknown` exists to keep a\n * pipeline from reading the empty list as a clean one.\n */\nexport type LandscapeRead = \"read\" | \"absent\" | \"invalid\";\n\n/**\n * What the partner is to the gated service: a `consumer` calls into it, a\n * `provider` is called by it, `both` when the landscape draws edges in both\n * directions.\n */\nexport type PartnerRole = \"consumer\" | \"provider\" | \"both\";\n\nexport interface GatePartner {\n  /** The partner's resolved service name — a directory id when one exists, the drawn name otherwise. */\n  service: string;\n  /**\n   * The partner's rung on the adoption ladder, or null when no `services/`\n   * directory answers to the name at all — the state `gate.partner-undocumented`\n   * names. Null is deliberately not a fifth rung: `empty` means \"exists,\n   * nothing in it\", and a partner nobody adopted is a different fact.\n   */\n  maturity: Maturity | null;\n  role: PartnerRole;\n  /** The joins, sorted: `operation <op>`, `message <name>`, or the untyped edge's title. */\n  via: string[];\n  /** The element is tagged `#external` — somebody else's system, undocumented on purpose. */\n  external: boolean;\n}\n\n/**\n * One active feature touching the gated service, with the verification\n * record's own projection beside it. Every field but `id` is\n * `verificationState`'s (`core/status/verification.ts`) — never a second\n * derivation of \"verified\".\n */\nexport interface GateFeature extends VerificationState {\n  id: string;\n}\n\nexport interface GateReport {\n  service: string;\n  landscape: LandscapeRead;\n  partners: GatePartner[];\n  features: GateFeature[];\n  checks: GateCheck[];\n}\n\nexport type GateVerdict = \"pass\" | \"fail\";\n\n/**\n * Fail iff any check carries an error-severity finding. `--strict` never moves\n * this — like validate's `valid`, the verdict means the same thing in text and\n * JSON whatever the exit code does, so two pipelines reading one repo can\n * grade the same report differently and both be telling the truth\n * (commands/validate/validate.ts documents the stance; gate copies it).\n */\nexport function gateVerdict(checks: readonly GateCheck[]): GateVerdict {\n  return checks.some((c) => c.findings.some((f) => f.severity === \"error\")) ? \"fail\" : \"pass\";\n}\n\nexport function gateSummary(checks: readonly GateCheck[]): { errors: number; warnings: number } {\n  const of = (severity: \"error\" | \"warn\"): number =>\n    checks.reduce((n, c) => n + c.findings.filter((f) => f.severity === severity).length, 0);\n  return { errors: of(\"error\"), warnings: of(\"warn\") };\n}\n\n/**\n * Per-subject containment: one unreadable sibling degrades ONE subject's\n * answer, with its path recorded, instead of killing the report the other\n * subjects still have. The code is validate's own containment code\n * (`guarded`, commands/validate/report.ts), reused so one breach is spelled\n * one way — and it is an ERROR: an unanswerable check fails closed, because\n * \"nobody could look\" must be distinguishable from \"nothing is wrong\" in the\n * exit code as well as the payload. Anything carrying no errno and no path is\n * a real bug, and still escapes untouched (reportRepositoryUnavailable's\n * recognizer).\n */\nexport function unreadableSubject(kind: \"service\" | \"feature\", id: string, err: unknown): Finding {\n  const e = err as NodeJS.ErrnoException;\n  if (e.path === undefined && typeof e.errno !== \"number\") throw err;\n  const reason = err instanceof Error ? err.message : String(err);\n  const consequence =\n    kind === \"service\" ? \"its freshness is unknown\" : \"its verification state is unknown\";\n  return {\n    severity: \"error\",\n    code: kind === \"service\" ? \"service.unreadable\" : \"feature.unreadable\",\n    subject: id,\n    message:\n      `${id}: ${e.path ?? \"one of its documents\"} could not be read, so ${consequence} — nobody could look, which is not the same as nothing being wrong. ${reason}` +\n      // The same sentence reportRepositoryUnavailable carries, for the same\n      // reason: Node reports EISDIR from read() with no path at all, so the\n      // commonest malformed-docs shape arrives here nameless.\n      (e.path === undefined\n        ? \" The failure named no path — that is how Node reports a directory sitting where a file belongs.\"\n        : \"\"),\n  };\n}\n"]}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/core/gate/report.ts"],"names":[],"mappings":"AAeA,8FAA8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,CAAU,CAAC;AAoG7F;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAA4B;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAA4B;IACtD,MAAM,EAAE,GAAG,CAAC,QAA0B,EAAU,EAAE,CAChD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3F,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2B,EAAE,EAAU,EAAE,GAAY;IACrF,MAAM,CAAC,GAAG,GAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,GAAG,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,WAAW,GACf,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,mCAAmC,CAAC;IACxF,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,oBAAoB;QACtE,OAAO,EAAE,EAAE;QACX,OAAO,EACL,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,sBAAsB,0BAA0B,WAAW,uEAAuE,MAAM,EAAE;YAC9J,sEAAsE;YACtE,sEAAsE;YACtE,wDAAwD;YACxD,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS;gBACnB,CAAC,CAAC,iGAAiG;gBACnG,CAAC,CAAC,EAAE,CAAC;KACV,CAAC;AACJ,CAAC","sourcesContent":["/**\n * The gate report — what `loam gate` computes before anything is printed.\n *\n * Shapes, verdict arithmetic and the per-subject containment classifier: no\n * filesystem, no process access, no printing. The four checks build findings\n * (`./checks.ts`, `./verification.ts`), the command layer renders them, and\n * this module is what the two agree through — the same split\n * `core/vocabulary/report.ts` gives `loam validate`, whose `Finding` shape\n * the checks reuse so one breach arrives in one shape whichever command\n * reports it.\n */\nimport type { Finding } from \"../vocabulary/report.js\";\nimport type { Maturity } from \"../vocabulary/maturity.js\";\nimport type { VerificationState } from \"../status/report.js\";\n\n/** The four checks, in report order. A closed set — the payload's `checks[].check` values. */\nexport const GATE_CHECKS = [\"partners\", \"freshness\", \"verification\", \"interrupted\"] as const;\nexport type GateCheckName = (typeof GATE_CHECKS)[number];\n\nexport interface GateCheck {\n  check: GateCheckName;\n  findings: Finding[];\n}\n\n/**\n * How the landscape read came out. `absent` and `invalid` are kept apart from\n * `read` because the partner set derived under either is NOT \"no partners\" —\n * it is \"could not look\", and `gate.partners-unknown` exists to keep a\n * pipeline from reading the empty list as a clean one.\n */\nexport type LandscapeRead = \"read\" | \"absent\" | \"invalid\";\n\n/**\n * What the partner is to the gated service: a `consumer` calls into it, a\n * `provider` is called by it, `both` when the landscape draws edges in both\n * directions.\n */\nexport type PartnerRole = \"consumer\" | \"provider\" | \"both\";\n\nexport interface GatePartner {\n  /** The partner's resolved service name — a directory id when one exists, the drawn name otherwise. */\n  service: string;\n  /**\n   * The partner's rung on the adoption ladder, or null when no `services/`\n   * directory answers to the name at all — the state `gate.partner-undocumented`\n   * names. Null is deliberately not a fifth rung: `empty` means \"exists,\n   * nothing in it\", and a partner nobody adopted is a different fact.\n   */\n  maturity: Maturity | null;\n  role: PartnerRole;\n  /** The joins, sorted: `operation <op>`, `message <name>`, or the untyped edge's title. */\n  via: string[];\n  /** The element is tagged `#external` — somebody else's system, undocumented on purpose. */\n  external: boolean;\n}\n\n/**\n * One feature touching the gated service — every active one, plus, under\n * `--since`, every one archived after the ref — with the verification\n * record's own projection beside it. Every field but `id` and `archived` is\n * `verificationState`'s (`core/status/verification.ts`) — never a second\n * derivation of \"verified\".\n */\nexport interface GateFeature extends VerificationState {\n  id: string;\n  /**\n   * Present, and true, only on a row `--since` added: the feature shipped\n   * after the ref, so its record is frozen history. Absent rather than\n   * `false` on the in-flight rows, so a payload without `--since` is byte for\n   * byte the one it was before the flag existed.\n   */\n  archived?: true;\n  /**\n   * Present only beside `archived`: the checklist digest `loam archive`\n   * captured as the feature merged — what its frozen record was graded\n   * against, so a record that had stopped answering the feature before it\n   * shipped reads `stale` — or null when that archive captured none (a loam\n   * that predates the capture, or a feature that had no record then). Under\n   * null a record is read as frozen history, exactly as before the capture\n   * existed, and the row says so rather than letting that reading pass for a\n   * checked one.\n   */\n  checklistAtArchive?: string | null;\n}\n\n/**\n * `--since <ref>`, resolved: the docs-repo commit a deploy pipeline last\n * shipped from, and the `features/archive/` directory names that already\n * existed there AND still hold what they held then. Without it the\n * verification check reads in-flight features only, and a feature drops out of\n * the gate the moment it is archived — which under `--strict` made archiving\n * the cheapest way past an unverified-feature warning. With it, every feature\n * archived AFTER the ref is graded too: its directory absent there, or changed\n * since — a feature unarchived, edited and archived again ships again, at the\n * same path. Nothing is stored: the pipeline already knows its last deployed\n * docs commit, and git already knows what was archived at it.\n */\nexport interface GateSince {\n  ref: string;\n  commit: string;\n  /** Archive directory names an earlier deploy already shipped exactly as they stand — the ones this gate leaves out. */\n  shippedAtRef: ReadonlySet<string>;\n}\n\nexport interface GateReport {\n  service: string;\n  /** The `--since` bound the report was computed under, or null for in-flight features only. */\n  since: { ref: string; commit: string } | null;\n  landscape: LandscapeRead;\n  partners: GatePartner[];\n  features: GateFeature[];\n  checks: GateCheck[];\n}\n\nexport type GateVerdict = \"pass\" | \"fail\";\n\n/**\n * Fail iff any check carries an error-severity finding. `--strict` never moves\n * this — like validate's `valid`, the verdict means the same thing in text and\n * JSON whatever the exit code does, so two pipelines reading one repo can\n * grade the same report differently and both be telling the truth\n * (commands/validate/validate.ts documents the stance; gate copies it).\n */\nexport function gateVerdict(checks: readonly GateCheck[]): GateVerdict {\n  return checks.some((c) => c.findings.some((f) => f.severity === \"error\")) ? \"fail\" : \"pass\";\n}\n\nexport function gateSummary(checks: readonly GateCheck[]): { errors: number; warnings: number } {\n  const of = (severity: \"error\" | \"warn\"): number =>\n    checks.reduce((n, c) => n + c.findings.filter((f) => f.severity === severity).length, 0);\n  return { errors: of(\"error\"), warnings: of(\"warn\") };\n}\n\n/**\n * Per-subject containment: one unreadable sibling degrades ONE subject's\n * answer, with its path recorded, instead of killing the report the other\n * subjects still have. The code is validate's own containment code\n * (`guarded`, commands/validate/report.ts), reused so one breach is spelled\n * one way — and it is an ERROR: an unanswerable check fails closed, because\n * \"nobody could look\" must be distinguishable from \"nothing is wrong\" in the\n * exit code as well as the payload. Anything carrying no errno and no path is\n * a real bug, and still escapes untouched (reportRepositoryUnavailable's\n * recognizer).\n */\nexport function unreadableSubject(kind: \"service\" | \"feature\", id: string, err: unknown): Finding {\n  const e = err as NodeJS.ErrnoException;\n  if (e.path === undefined && typeof e.errno !== \"number\") throw err;\n  const reason = err instanceof Error ? err.message : String(err);\n  const consequence =\n    kind === \"service\" ? \"its freshness is unknown\" : \"its verification state is unknown\";\n  return {\n    severity: \"error\",\n    code: kind === \"service\" ? \"service.unreadable\" : \"feature.unreadable\",\n    subject: id,\n    message:\n      `${id}: ${e.path ?? \"one of its documents\"} could not be read, so ${consequence} — nobody could look, which is not the same as nothing being wrong. ${reason}` +\n      // The same sentence reportRepositoryUnavailable carries, for the same\n      // reason: Node reports EISDIR from read() with no path at all, so the\n      // commonest malformed-docs shape arrives here nameless.\n      (e.path === undefined\n        ? \" The failure named no path — that is how Node reports a directory sitting where a file belongs.\"\n        : \"\"),\n  };\n}\n"]}

package/dist/core/gate/verification.js

@@ -6,25 +6,52 @@
  * limit; this is the one check with a per-feature phase of its own, so it is
  * the seam.
  *
+ * Without `--since` it reads IN-FLIGHT features only, so a feature leaves the
+ * check the moment it is archived — and archive reads no verification record,
+ * deliberately (verify never gates the merge). Under `--strict` that made
+ * archiving the cheapest way past this check's warning, on a draft service
+ * and on a vouched one alike when the feature changed only a contract
+ * (`content_digest` covers the spec bodies, not openapi.yaml/asyncapi.yaml, so
+ * freshness cannot catch it either). `--since <ref>` closes it without any
+ * deployment state: every feature archived after the docs commit the pipeline last
+ * deployed from is graded too, by the same `verificationState`, under the
+ * same code, its row marked `archived: true` — "archived after" meaning its
+ * archive directory was absent at the ref OR differs from what it held there,
+ * since a feature unarchived, edited and archived again ships again from the
+ * same path. Its record is frozen, but not ungraded: it is held to the
+ * checklist `loam archive` captured as the feature merged
+ * (`readSnapshotChecklist`), so a record that had stopped answering the
+ * feature before it shipped is `stale` — archiving it no longer reads it
+ * `verified` again. An archive that captured none (an older loam) is read as
+ * frozen history, as before, and the row says so.
+ *
  * Report, never fail: every finding here is a warning, by the item's own
  * design — a deploy gate that hard-failed on unverified work would teach
  * everyone that the cheapest way past it is an empty record.
  */
 import { inOrder } from "../kernel/concurrency.js";
 import { verificationState } from "../status/verification.js";
+import { readSnapshotChecklist } from "../staging/snapshot/manifest.js";
 import { listFeatures } from "../repo/repo.js";
 import { featurePaths } from "../repo/paths.js";
 import { compareIds } from "../repo/entries.js";
 import { unreadableSubject } from "./report.js";
 export async function verificationCheck(req) {
-    const active = await listFeatures(req.docsDir, {}, req.fleet);
+    const { since } = req;
+    const all = await listFeatures(req.docsDir, { includeArchived: since !== undefined }, req.fleet);
     // "Touching" = carries a specs/<svc>/ delta — the same definition
     // `status --service` answers with. A feature whose C4 delta merely draws an
     // edge into the service is deliberately out: counting it needs a delta parse
-    // per active feature, and it can be added additively if a fleet asks.
-    const touching = active
+    // per active feature, and it can be added additively if a fleet asks. An
+    // archived feature keeps its specs/ under features/archive/, so the one
+    // definition answers for both sides. "Archived after the ref" is "its
+    // archive directory was not there at the ref, or is not what it was there";
+    // a feature whose directory was there UNCHANGED shipped in an earlier
+    // deploy and is not this one's to answer for (`GateSince`).
+    const touching = all
         .filter((f) => f.services.includes(req.service))
-        .sort((a, b) => compareIds(a.id, b.id));
+        .filter((f) => !f.archived || (since !== undefined && !since.shippedAtRef.has(f.dirName)))
+        .sort((a, b) => compareIds(a.id, b.id) || compareIds(a.dirName, b.dirName));
     // COST ACCEPTED: each touching feature with a record derives its checklist,
     // which parses its delta. That is the per-feature cost
     // core/status/fleet/fleet.ts refuses for the WHOLE fleet; a deploy-time
@@ -34,12 +61,20 @@ export async function verificationCheck(req) {
     // run, not one per feature) and the batch prefetch below genuinely seeds
     // the delta parses. The prefetch is an accelerator only: a host that cannot
     // batch degrades to per-feature parses with identical findings.
-    await req.fleet.prefetchLikeC4(touching.filter((f) => f.has.delta).map((f) => featurePaths(f.dir).delta));
+    // An archived feature never derives a checklist (its record is frozen, see
+    // `verificationState`, and held to the one its archive captured), so
+    // prefetching its delta would parse for nobody.
+    await req.fleet.prefetchLikeC4(touching.filter((f) => !f.archived && f.has.delta).map((f) => featurePaths(f.dir).delta));
     // inOrder caps the workspaces in flight and keeps the rows in feature order.
     const rows = await inOrder(touching, async (f) => {
         try {
-            const { state, notice } = await verificationState(req.docsDir, f, req.fleet);
-            return { kind: "read", feature: f, state, notice };
+            if (!f.archived) {
+                const { state, notice } = await verificationState(req.docsDir, f, { fleet: req.fleet });
+                return { kind: "read", feature: f, state, notice };
+            }
+            const shipped = await readSnapshotChecklist(f.dir);
+            const { state, notice } = await verificationState(req.docsDir, f, { fleet: req.fleet, shipped });
+            return { kind: "read", feature: f, state, notice, shipped };
         }
         catch (err) {
             return { kind: "unreadable", finding: unreadableSubject("feature", f.id, err) };
@@ -52,12 +87,16 @@ export async function verificationCheck(req) {
             findings.push(row.finding);
             continue;
         }
-        features.push({ id: row.feature.id, ...row.state });
-        findings.push(...featureFindings(row, req.service));
+        features.push({
+            id: row.feature.id,
+            ...row.state,
+            ...(row.shipped === undefined ? {} : { archived: true, checklistAtArchive: row.shipped }),
+        });
+        findings.push(...featureFindings(row, req.service, since?.ref));
     }
     return { features, findings };
 }
-function featureFindings(row, service) {
+function featureFindings(row, service, since) {
     const { feature, state, notice } = row;
     if (state.verdict === "verified")
         return [];
@@ -80,18 +119,42 @@ function featureFindings(row, service) {
     }
     const verify = `\`loam verify ${feature.id} --json\``;
     const open = state.unconfirmed + state.unanswered;
+    const claimsOpen = `${open} of ${state.claims} claim(s) on ${feature.id} are open (${state.unconfirmed} unconfirmed, ${state.unanswered} unanswered)`;
     const message = () => {
+        // A row `--since` added. Its record is frozen history: `loam verify` reads
+        // it back and refuses to re-record it (commands/verify/verify.ts), so the
+        // in-flight remedies below — derive, answer, re-derive — would send a
+        // deploy pipeline to a command that cannot run. What it CAN be told is
+        // that this deploy carries the feature unchecked, and the one way to
+        // reopen it. An archived record is `stale` only against the checklist its
+        // archive captured — the feature had moved under it before it shipped.
+        if (feature.archived) {
+            const shipped = `${feature.id} touches '${service}' and was archived after ${since ?? "the --since ref"}`;
+            const reopen = `Its record is frozen history: ${verify} reads it back, and \`loam unarchive ${feature.id}\` re-opens the feature if its claims must be answered before this deploy.`;
+            if (state.state === "absent")
+                return `${shipped} with no verification record — nothing was checked before it shipped. ${reopen}`;
+            // The file that failed may be one service's `verification/<svc>.yaml`
+            // as well as the one-file record; `loam verify` names which.
+            if (state.state === "unreadable")
+                return `${shipped} with a verification record that does not read as a record — ${verify} names the file that failed. ${reopen}`;
+            if (state.state === "stale") {
+                return `${shipped}, and it had moved after its record was written — the record answers a checklist that was no longer the one it asked when it was archived, so what shipped was not what was checked. ${reopen}`;
+            }
+            return state.claims === 0
+                ? `${shipped} with a record that answers no claims at all. ${reopen}`
+                : `${shipped}, and ${claimsOpen}. ${reopen}`;
+        }
         switch (state.state) {
             case "absent":
                 return `${feature.id} touches '${service}' and has no verification record — nothing has been checked. Derive the checklist and answer it: ${verify}.`;
             case "unreadable":
-                return `${feature.id}'s verification.yaml exists but does not read as a record — repair or delete it, then re-run ${verify}; nothing will overwrite it while it is unreadable.`;
+                return `${feature.id}'s verification record does not read as a record — ${verify} names the file that failed and its safe repair (never delete a file other services' attestations may be in); nothing will overwrite it while it is unreadable.`;
             case "stale":
                 return `${feature.id} moved after its record was written — the answers answer a checklist that is no longer the one being asked. Re-derive and re-answer: ${verify}.`;
             case "recorded":
                 return state.claims === 0
                     ? `${feature.id}'s record answers no claims at all — nothing was asked, so nothing was checked. ${verify} re-derives the checklist.`
-                    : `${open} of ${state.claims} claim(s) on ${feature.id} are open (${state.unconfirmed} unconfirmed, ${state.unanswered} unanswered) — close them with evidence: ${verify}.`;
+                    : `${claimsOpen} — close them with evidence: ${verify}.`;
             default: {
                 // A fifth record state must land here as a build failure, not fall
                 // through into some rung nobody decided (verificationStatus holds the

package/dist/core/gate/verification.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../../src/core/gate/verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AAOnE,OAAO,EAAE,iBAAiB,EAAoB,MAAM,aAAa,CAAC;AAYlE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAA6B;IAE7B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9D,kEAAkE;IAClE,4EAA4E;IAC5E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,QAAQ,GAAG,MAAM;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,uDAAuD;IACvD,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAC5B,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAC1E,CAAC;IACF,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAA4B,EAAE;QACzE,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CACtB,GAAqF,EACrF,OAAe;IAEf,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvC,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,4DAA4D;QAC5D,OAAO,MAAM,KAAK,IAAI;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,OAAO,CAAC,EAAE;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;iBACnE;aACF,CAAC;IACR,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;IAClD,MAAM,OAAO,GAAG,GAAW,EAAE;QAC3B,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,QAAQ;gBACX,OAAO,GAAG,OAAO,CAAC,EAAE,aAAa,OAAO,oGAAoG,MAAM,GAAG,CAAC;YACxJ,KAAK,YAAY;gBACf,OAAO,GAAG,OAAO,CAAC,EAAE,gGAAgG,MAAM,qDAAqD,CAAC;YAClL,KAAK,OAAO;gBACV,OAAO,GAAG,OAAO,CAAC,EAAE,wIAAwI,MAAM,GAAG,CAAC;YACxK,KAAK,UAAU;gBACb,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;oBACvB,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,mFAAmF,MAAM,4BAA4B;oBACpI,CAAC,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,MAAM,gBAAgB,OAAO,CAAC,EAAE,cAAc,KAAK,CAAC,WAAW,iBAAiB,KAAK,CAAC,UAAU,4CAA4C,MAAM,GAAG,CAAC;YAChL,SAAS,CAAC;gBACR,mEAAmE;gBACnE,sEAAsE;gBACtE,mCAAmC;gBACnC,MAAM,WAAW,GAAU,KAAK,CAAC,KAAK,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,OAAO,EAAE,OAAO,EAAE;SACnB;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Check 3 of `loam gate`: the verification records of every active feature\n * touching the gated service, read through `verificationState`'s own graded\n * verdicts — never a re-derivation of \"verified\" (that module's header is the\n * contract). Split from `./checks.ts` when the four checks outgrew the line\n * limit; this is the one check with a per-feature phase of its own, so it is\n * the seam.\n *\n * Report, never fail: every finding here is a warning, by the item's own\n * design — a deploy gate that hard-failed on unverified work would teach\n * everyone that the cheapest way past it is an empty record.\n */\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { verificationState } from \"../status/verification.js\";\nimport { listFeatures } from \"../repo/repo.js\";\nimport { featurePaths } from \"../repo/paths.js\";\nimport { compareIds, type FeatureEntry } from \"../repo/entries.js\";\nimport type { Finding } from \"../vocabulary/report.js\";\nimport type { VerificationState } from \"../status/report.js\";\nimport type { VerifyNotice } from \"../verify/record.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\nimport { unreadableSubject, type GateFeature } from \"./report.js\";\n\ntype VerificationRow =\n  | { kind: \"read\"; feature: FeatureEntry; state: VerificationState; notice: VerifyNotice | null }\n  | { kind: \"unreadable\"; finding: Finding };\n\nexport interface VerificationCheckRequest {\n  docsDir: DocsDir;\n  service: RawServiceId;\n  fleet: FleetContext;\n}\n\nexport async function verificationCheck(\n  req: VerificationCheckRequest,\n): Promise<{ features: GateFeature[]; findings: Finding[] }> {\n  const active = await listFeatures(req.docsDir, {}, req.fleet);\n  // \"Touching\" = carries a specs/<svc>/ delta — the same definition\n  // `status --service` answers with. A feature whose C4 delta merely draws an\n  // edge into the service is deliberately out: counting it needs a delta parse\n  // per active feature, and it can be added additively if a fleet asks.\n  const touching = active\n    .filter((f) => f.services.includes(req.service))\n    .sort((a, b) => compareIds(a.id, b.id));\n  // COST ACCEPTED: each touching feature with a record derives its checklist,\n  // which parses its delta. That is the per-feature cost\n  // core/status/fleet/fleet.ts refuses for the WHOLE fleet; a deploy-time\n  // command scoped to one service pays it for that service's features only —\n  // with the invocation's context threaded through `verificationState` into\n  // the derivation, so its enumerations are memo hits (one fleet walk per\n  // run, not one per feature) and the batch prefetch below genuinely seeds\n  // the delta parses. The prefetch is an accelerator only: a host that cannot\n  // batch degrades to per-feature parses with identical findings.\n  await req.fleet.prefetchLikeC4(\n    touching.filter((f) => f.has.delta).map((f) => featurePaths(f.dir).delta),\n  );\n  // inOrder caps the workspaces in flight and keeps the rows in feature order.\n  const rows = await inOrder(touching, async (f): Promise<VerificationRow> => {\n    try {\n      const { state, notice } = await verificationState(req.docsDir, f, req.fleet);\n      return { kind: \"read\", feature: f, state, notice };\n    } catch (err) {\n      return { kind: \"unreadable\", finding: unreadableSubject(\"feature\", f.id, err) };\n    }\n  });\n  const features: GateFeature[] = [];\n  const findings: Finding[] = [];\n  for (const row of rows) {\n    if (row.kind === \"unreadable\") {\n      findings.push(row.finding);\n      continue;\n    }\n    features.push({ id: row.feature.id, ...row.state });\n    findings.push(...featureFindings(row, req.service));\n  }\n  return { features, findings };\n}\n\nfunction featureFindings(\n  row: { feature: FeatureEntry; state: VerificationState; notice: VerifyNotice | null },\n  service: string,\n): Finding[] {\n  const { feature, state, notice } = row;\n  if (state.verdict === \"verified\") return [];\n  if (state.verdict === \"attested\") {\n    // attestedNotice's own words — the one notice verify, list and status all\n    // show, converted to a Finding rather than re-derived. The code string\n    // (`verify.scenario-attested`) is spelled literally at its one emit site,\n    // core/verify/record.ts, where the drift guard collects it.\n    return notice === null\n      ? []\n      : [\n          {\n            severity: notice.severity,\n            code: notice.code,\n            subject: feature.id,\n            message: notice.message,\n            ...(notice.claims === undefined ? {} : { details: notice.claims }),\n          },\n        ];\n  }\n  const verify = `\\`loam verify ${feature.id} --json\\``;\n  const open = state.unconfirmed + state.unanswered;\n  const message = (): string => {\n    switch (state.state) {\n      case \"absent\":\n        return `${feature.id} touches '${service}' and has no verification record — nothing has been checked. Derive the checklist and answer it: ${verify}.`;\n      case \"unreadable\":\n        return `${feature.id}'s verification.yaml exists but does not read as a record — repair or delete it, then re-run ${verify}; nothing will overwrite it while it is unreadable.`;\n      case \"stale\":\n        return `${feature.id} moved after its record was written — the answers answer a checklist that is no longer the one being asked. Re-derive and re-answer: ${verify}.`;\n      case \"recorded\":\n        return state.claims === 0\n          ? `${feature.id}'s record answers no claims at all — nothing was asked, so nothing was checked. ${verify} re-derives the checklist.`\n          : `${open} of ${state.claims} claim(s) on ${feature.id} are open (${state.unconfirmed} unconfirmed, ${state.unanswered} unanswered) — close them with evidence: ${verify}.`;\n      default: {\n        // A fifth record state must land here as a build failure, not fall\n        // through into some rung nobody decided (verificationStatus holds the\n        // same guard for the same reason).\n        const unreachable: never = state.state;\n        throw new Error(`gate: no wording for verification state '${String(unreachable)}'`);\n      }\n    }\n  };\n  return [\n    {\n      severity: \"warn\",\n      code: \"gate.feature-unverified\",\n      subject: feature.id,\n      message: message(),\n    },\n  ];\n}\n"]}
+{"version":3,"file":"verification.js","sourceRoot":"","sources":["../../../src/core/gate/verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAqB,MAAM,oBAAoB,CAAC;AAOnE,OAAO,EAAE,iBAAiB,EAAoC,MAAM,aAAa,CAAC;AAuBlF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,KAAK,SAAS,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACjG,kEAAkE;IAClE,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,4EAA4E;IAC5E,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,GAAG;SACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACzF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,4EAA4E;IAC5E,uDAAuD;IACvD,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,2EAA2E;IAC3E,qEAAqE;IACrE,gDAAgD;IAChD,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAC5B,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CACzF,CAAC;IACF,6EAA6E;IAC7E,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAA4B,EAAE;QACzE,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAChB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;gBACxF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACrD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE;YAClB,GAAG,GAAG,CAAC,KAAK;YACZ,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;SAC1F,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CACtB,GAAY,EACZ,OAAe,EACf,KAAyB;IAEzB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACvC,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAC5C,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACjC,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,4DAA4D;QAC5D,OAAO,MAAM,KAAK,IAAI;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE;oBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,OAAO,EAAE,OAAO,CAAC,EAAE;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;iBACnE;aACF,CAAC;IACR,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;IAClD,MAAM,UAAU,GAAG,GAAG,IAAI,OAAO,KAAK,CAAC,MAAM,gBAAgB,OAAO,CAAC,EAAE,cAAc,KAAK,CAAC,WAAW,iBAAiB,KAAK,CAAC,UAAU,cAAc,CAAC;IACtJ,MAAM,OAAO,GAAG,GAAW,EAAE;QAC3B,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,EAAE,aAAa,OAAO,4BAA4B,KAAK,IAAI,iBAAiB,EAAE,CAAC;YAC1G,MAAM,MAAM,GAAG,iCAAiC,MAAM,wCAAwC,OAAO,CAAC,EAAE,4EAA4E,CAAC;YACrL,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,GAAG,OAAO,yEAAyE,MAAM,EAAE,CAAC;YACjI,sEAAsE;YACtE,6DAA6D;YAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY;gBAAE,OAAO,GAAG,OAAO,gEAAgE,MAAM,gCAAgC,MAAM,EAAE,CAAC;YAClK,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC5B,OAAO,GAAG,OAAO,wLAAwL,MAAM,EAAE,CAAC;YACpN,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;gBACvB,CAAC,CAAC,GAAG,OAAO,iDAAiD,MAAM,EAAE;gBACrE,CAAC,CAAC,GAAG,OAAO,SAAS,UAAU,KAAK,MAAM,EAAE,CAAC;QACjD,CAAC;QACD,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;YACpB,KAAK,QAAQ;gBACX,OAAO,GAAG,OAAO,CAAC,EAAE,aAAa,OAAO,oGAAoG,MAAM,GAAG,CAAC;YACxJ,KAAK,YAAY;gBACf,OAAO,GAAG,OAAO,CAAC,EAAE,sDAAsD,MAAM,iKAAiK,CAAC;YACpP,KAAK,OAAO;gBACV,OAAO,GAAG,OAAO,CAAC,EAAE,wIAAwI,MAAM,GAAG,CAAC;YACxK,KAAK,UAAU;gBACb,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;oBACvB,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,mFAAmF,MAAM,4BAA4B;oBACpI,CAAC,CAAC,GAAG,UAAU,gCAAgC,MAAM,GAAG,CAAC;YAC7D,SAAS,CAAC;gBACR,mEAAmE;gBACnE,sEAAsE;gBACtE,mCAAmC;gBACnC,MAAM,WAAW,GAAU,KAAK,CAAC,KAAK,CAAC;gBACvC,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,OAAO,CAAC,EAAE;YACnB,OAAO,EAAE,OAAO,EAAE;SACnB;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Check 3 of `loam gate`: the verification records of every active feature\n * touching the gated service, read through `verificationState`'s own graded\n * verdicts — never a re-derivation of \"verified\" (that module's header is the\n * contract). Split from `./checks.ts` when the four checks outgrew the line\n * limit; this is the one check with a per-feature phase of its own, so it is\n * the seam.\n *\n * Without `--since` it reads IN-FLIGHT features only, so a feature leaves the\n * check the moment it is archived — and archive reads no verification record,\n * deliberately (verify never gates the merge). Under `--strict` that made\n * archiving the cheapest way past this check's warning, on a draft service\n * and on a vouched one alike when the feature changed only a contract\n * (`content_digest` covers the spec bodies, not openapi.yaml/asyncapi.yaml, so\n * freshness cannot catch it either). `--since <ref>` closes it without any\n * deployment state: every feature archived after the docs commit the pipeline last\n * deployed from is graded too, by the same `verificationState`, under the\n * same code, its row marked `archived: true` — \"archived after\" meaning its\n * archive directory was absent at the ref OR differs from what it held there,\n * since a feature unarchived, edited and archived again ships again from the\n * same path. Its record is frozen, but not ungraded: it is held to the\n * checklist `loam archive` captured as the feature merged\n * (`readSnapshotChecklist`), so a record that had stopped answering the\n * feature before it shipped is `stale` — archiving it no longer reads it\n * `verified` again. An archive that captured none (an older loam) is read as\n * frozen history, as before, and the row says so.\n *\n * Report, never fail: every finding here is a warning, by the item's own\n * design — a deploy gate that hard-failed on unverified work would teach\n * everyone that the cheapest way past it is an empty record.\n */\nimport { inOrder } from \"../kernel/concurrency.js\";\nimport { verificationState } from \"../status/verification.js\";\nimport { readSnapshotChecklist } from \"../staging/snapshot/manifest.js\";\nimport { listFeatures } from \"../repo/repo.js\";\nimport { featurePaths } from \"../repo/paths.js\";\nimport { compareIds, type FeatureEntry } from \"../repo/entries.js\";\nimport type { Finding } from \"../vocabulary/report.js\";\nimport type { VerificationState } from \"../status/report.js\";\nimport type { VerifyNotice } from \"../verify/record.js\";\nimport type { FleetContext } from \"../fleet-context.js\";\nimport type { DocsDir } from \"../kernel/ids/dirs.js\";\nimport type { RawServiceId } from \"../kernel/ids/service.js\";\nimport { unreadableSubject, type GateFeature, type GateSince } from \"./report.js\";\n\n/**\n * One graded feature. `shipped` is set only on an archived row: the checklist\n * digest its archive captured, or null when it captured none.\n */\ninterface ReadRow {\n  kind: \"read\";\n  feature: FeatureEntry;\n  state: VerificationState;\n  notice: VerifyNotice | null;\n  shipped?: string | null;\n}\n\ntype VerificationRow = ReadRow | { kind: \"unreadable\"; finding: Finding };\n\nexport interface VerificationCheckRequest {\n  docsDir: DocsDir;\n  service: RawServiceId;\n  fleet: FleetContext;\n  since?: GateSince;\n}\n\nexport async function verificationCheck(\n  req: VerificationCheckRequest,\n): Promise<{ features: GateFeature[]; findings: Finding[] }> {\n  const { since } = req;\n  const all = await listFeatures(req.docsDir, { includeArchived: since !== undefined }, req.fleet);\n  // \"Touching\" = carries a specs/<svc>/ delta — the same definition\n  // `status --service` answers with. A feature whose C4 delta merely draws an\n  // edge into the service is deliberately out: counting it needs a delta parse\n  // per active feature, and it can be added additively if a fleet asks. An\n  // archived feature keeps its specs/ under features/archive/, so the one\n  // definition answers for both sides. \"Archived after the ref\" is \"its\n  // archive directory was not there at the ref, or is not what it was there\";\n  // a feature whose directory was there UNCHANGED shipped in an earlier\n  // deploy and is not this one's to answer for (`GateSince`).\n  const touching = all\n    .filter((f) => f.services.includes(req.service))\n    .filter((f) => !f.archived || (since !== undefined && !since.shippedAtRef.has(f.dirName)))\n    .sort((a, b) => compareIds(a.id, b.id) || compareIds(a.dirName, b.dirName));\n  // COST ACCEPTED: each touching feature with a record derives its checklist,\n  // which parses its delta. That is the per-feature cost\n  // core/status/fleet/fleet.ts refuses for the WHOLE fleet; a deploy-time\n  // command scoped to one service pays it for that service's features only —\n  // with the invocation's context threaded through `verificationState` into\n  // the derivation, so its enumerations are memo hits (one fleet walk per\n  // run, not one per feature) and the batch prefetch below genuinely seeds\n  // the delta parses. The prefetch is an accelerator only: a host that cannot\n  // batch degrades to per-feature parses with identical findings.\n  // An archived feature never derives a checklist (its record is frozen, see\n  // `verificationState`, and held to the one its archive captured), so\n  // prefetching its delta would parse for nobody.\n  await req.fleet.prefetchLikeC4(\n    touching.filter((f) => !f.archived && f.has.delta).map((f) => featurePaths(f.dir).delta),\n  );\n  // inOrder caps the workspaces in flight and keeps the rows in feature order.\n  const rows = await inOrder(touching, async (f): Promise<VerificationRow> => {\n    try {\n      if (!f.archived) {\n        const { state, notice } = await verificationState(req.docsDir, f, { fleet: req.fleet });\n        return { kind: \"read\", feature: f, state, notice };\n      }\n      const shipped = await readSnapshotChecklist(f.dir);\n      const { state, notice } = await verificationState(req.docsDir, f, { fleet: req.fleet, shipped });\n      return { kind: \"read\", feature: f, state, notice, shipped };\n    } catch (err) {\n      return { kind: \"unreadable\", finding: unreadableSubject(\"feature\", f.id, err) };\n    }\n  });\n  const features: GateFeature[] = [];\n  const findings: Finding[] = [];\n  for (const row of rows) {\n    if (row.kind === \"unreadable\") {\n      findings.push(row.finding);\n      continue;\n    }\n    features.push({\n      id: row.feature.id,\n      ...row.state,\n      ...(row.shipped === undefined ? {} : { archived: true, checklistAtArchive: row.shipped }),\n    });\n    findings.push(...featureFindings(row, req.service, since?.ref));\n  }\n  return { features, findings };\n}\n\nfunction featureFindings(\n  row: ReadRow,\n  service: string,\n  since: string | undefined,\n): Finding[] {\n  const { feature, state, notice } = row;\n  if (state.verdict === \"verified\") return [];\n  if (state.verdict === \"attested\") {\n    // attestedNotice's own words — the one notice verify, list and status all\n    // show, converted to a Finding rather than re-derived. The code string\n    // (`verify.scenario-attested`) is spelled literally at its one emit site,\n    // core/verify/record.ts, where the drift guard collects it.\n    return notice === null\n      ? []\n      : [\n          {\n            severity: notice.severity,\n            code: notice.code,\n            subject: feature.id,\n            message: notice.message,\n            ...(notice.claims === undefined ? {} : { details: notice.claims }),\n          },\n        ];\n  }\n  const verify = `\\`loam verify ${feature.id} --json\\``;\n  const open = state.unconfirmed + state.unanswered;\n  const claimsOpen = `${open} of ${state.claims} claim(s) on ${feature.id} are open (${state.unconfirmed} unconfirmed, ${state.unanswered} unanswered)`;\n  const message = (): string => {\n    // A row `--since` added. Its record is frozen history: `loam verify` reads\n    // it back and refuses to re-record it (commands/verify/verify.ts), so the\n    // in-flight remedies below — derive, answer, re-derive — would send a\n    // deploy pipeline to a command that cannot run. What it CAN be told is\n    // that this deploy carries the feature unchecked, and the one way to\n    // reopen it. An archived record is `stale` only against the checklist its\n    // archive captured — the feature had moved under it before it shipped.\n    if (feature.archived) {\n      const shipped = `${feature.id} touches '${service}' and was archived after ${since ?? \"the --since ref\"}`;\n      const reopen = `Its record is frozen history: ${verify} reads it back, and \\`loam unarchive ${feature.id}\\` re-opens the feature if its claims must be answered before this deploy.`;\n      if (state.state === \"absent\") return `${shipped} with no verification record — nothing was checked before it shipped. ${reopen}`;\n      // The file that failed may be one service's `verification/<svc>.yaml`\n      // as well as the one-file record; `loam verify` names which.\n      if (state.state === \"unreadable\") return `${shipped} with a verification record that does not read as a record — ${verify} names the file that failed. ${reopen}`;\n      if (state.state === \"stale\") {\n        return `${shipped}, and it had moved after its record was written — the record answers a checklist that was no longer the one it asked when it was archived, so what shipped was not what was checked. ${reopen}`;\n      }\n      return state.claims === 0\n        ? `${shipped} with a record that answers no claims at all. ${reopen}`\n        : `${shipped}, and ${claimsOpen}. ${reopen}`;\n    }\n    switch (state.state) {\n      case \"absent\":\n        return `${feature.id} touches '${service}' and has no verification record — nothing has been checked. Derive the checklist and answer it: ${verify}.`;\n      case \"unreadable\":\n        return `${feature.id}'s verification record does not read as a record — ${verify} names the file that failed and its safe repair (never delete a file other services' attestations may be in); nothing will overwrite it while it is unreadable.`;\n      case \"stale\":\n        return `${feature.id} moved after its record was written — the answers answer a checklist that is no longer the one being asked. Re-derive and re-answer: ${verify}.`;\n      case \"recorded\":\n        return state.claims === 0\n          ? `${feature.id}'s record answers no claims at all — nothing was asked, so nothing was checked. ${verify} re-derives the checklist.`\n          : `${claimsOpen} — close them with evidence: ${verify}.`;\n      default: {\n        // A fifth record state must land here as a build failure, not fall\n        // through into some rung nobody decided (verificationStatus holds the\n        // same guard for the same reason).\n        const unreachable: never = state.state;\n        throw new Error(`gate: no wording for verification state '${String(unreachable)}'`);\n      }\n    }\n  };\n  return [\n    {\n      severity: \"warn\",\n      code: \"gate.feature-unverified\",\n      subject: feature.id,\n      message: message(),\n    },\n  ];\n}\n"]}

package/dist/core/gherkin/stale.js

@@ -7,13 +7,13 @@
  * whole comparison is by digest rather than by name, so a reworded scenario
  * reads as stale rather than as missing plus new.
  */
-import { existsSync, statSync } from "node:fs";
-import { readdir, readFile, realpath } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { readdir, readFile } from "node:fs/promises";
 import { join, relative, sep } from "node:path";
-import { parseRequirements } from "../document/parse.js";
 import { SPEC_AXES } from "../repo/paths.js";
 import { locateServicePaths } from "../repo/service-target.js";
 import { listFeatures } from "../repo/repo.js";
+import { entryIs, markDescended } from "../repo/tree/fs.js";
 import { UnsafePathError } from "../kernel/path-safety.js";
 import { gherkinRoot, scenarioDigest } from "./stamp.js";
 import { axisLabel } from "./emit.js";
@@ -88,10 +88,7 @@ export async function gherkinFindings(ctx) {
         const state = { file: axis.file, reqNames: new Set(), digests: new Set(), scenarios: [] };
         const path = paths[axis.key];
         if (existsSync(path)) {
-            const reqs = ctx.fleet === undefined
-                ? parseRequirements(await readFile(path, "utf8"))
-                : await ctx.fleet.readRequirements(path);
-            for (const r of reqs) {
+            for (const r of await ctx.fleet.readRequirements(path)) {
                 if (r.kind === "REMOVED")
                     continue;
                 state.reqNames.add(r.name);
@@ -174,9 +171,10 @@ export async function gherkinFindings(ctx) {
  * enumeration is part of the output contract, so the order cannot depend on
  * the filesystem's. Dot-entries are skipped, like every other walk in loam.
  *
- * Symlinks are FOLLOWED — repo.ts's `entryIs` and brief/brief.ts's `hasMarkdown` are
- * the same rule for the same reason. A `Dirent` from `readdir(withFileTypes)`
- * never follows one, so `isFile()` and `isDirectory()` are both false for a
+ * Symlinks are FOLLOWED, through `repo/tree/fs.ts`'s `entryIs` — the rule
+ * every enumeration shares (brief/brief.ts's `hasEntry` too), for the same
+ * reason. A `Dirent` from `readdir(withFileTypes)` never follows one, so
+ * `isFile()` and `isDirectory()` are both false for a
  * symlinked `.feature`: it was invisible to the orphan scan (`loam gherkin`
  * left it behind forever) and invisible to the staleness scan (it graded as no
  * coverage at all). Composing a suite out of links is legitimate, so they are
@@ -186,29 +184,19 @@ export async function gherkinFindings(ctx) {
 export async function featureFilesUnder(root) {
     const out = [];
     // Following links means a cycle is now possible; every directory is entered
-    // once by its resolved path, so a loop terminates instead of hanging.
+    // once by its resolved path (`markDescended`), so a loop terminates instead
+    // of hanging.
     const entered = new Set();
     const walk = async (dir) => {
-        if (!existsSync(dir))
+        if (!markDescended(dir, entered))
             return;
-        let resolved;
-        try {
-            resolved = await realpath(dir);
-        }
-        catch {
-            return;
-        }
-        if (entered.has(resolved))
-            return;
-        entered.add(resolved);
         for (const entry of await readdir(dir, { withFileTypes: true })) {
             if (entry.name.startsWith("."))
                 continue;
             const abs = join(dir, entry.name);
-            const what = entryKind(abs, entry);
-            if (what === "dir")
+            if (entryIs(dir, entry, "dir"))
                 await walk(abs);
-            else if (what === "file" && entry.name.endsWith(".feature"))
+            else if (entry.name.endsWith(".feature") && entryIs(dir, entry, "file"))
                 out.push(abs);
         }
     };
@@ -219,16 +207,4 @@ export async function featureFilesUnder(root) {
         return ra < rb ? -1 : ra > rb ? 1 : 0;
     });
 }
-/** What an entry IS, resolving a symlink to find out. Nothing when it dangles. */
-function entryKind(abs, e) {
-    if (!e.isSymbolicLink())
-        return e.isDirectory() ? "dir" : e.isFile() ? "file" : null;
-    try {
-        const s = statSync(abs);
-        return s.isDirectory() ? "dir" : s.isFile() ? "file" : null;
-    }
-    catch {
-        return null;
-    }
-}
 //# sourceMappingURL=stale.js.map