@ybotok/loam 0.2.0-alpha.6 → 0.2.0-alpha.9

package/dist/commands/validate/service/contracts/generated.js

@@ -0,0 +1,134 @@
+/**
+ * The generated-contract check: the build's own OpenAPI document against the
+ * copy the docs repo committed.
+ *
+ * It sits beside the HTTP axis (`../api.ts`) rather than inside it because it
+ * reads a different document for a different question. The axis grades the
+ * committed contract against the living spec; this asks whether that committed
+ * contract is still the one the service serves, and it runs only in a service
+ * repo. They used to share one file, and naming the operationIds that moved
+ * pushed it over the line limit.
+ */
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { parse as parseYaml } from "yaml";
+import { resolveInside } from "../../../../core/kernel/path-safety.js";
+import { canonicalJson } from "../../../../core/openapi/digest.js";
+import { openapiFromText } from "../../../../core/openapi/doc.js";
+import {} from "../../../../core/vocabulary/report.js";
+/**
+ * The build's own contract document, compared with the copy the docs repo
+ * committed — `openapi.generated-stale`, `contracts.source-missing`,
+ * `contracts.source-invalid`.
+ *
+ * WHY THIS IS NOT AN EXTRACTOR. It reads no line of service code and derives no
+ * meaning: it parses a standard document the team's own build emitted, at a
+ * path a human wrote into `loam.json`, and compares a digest. That is the same
+ * category as `verify --results` ingesting a cucumber report, and it is the
+ * only thing in the product that can notice the assumption SCHEMA quietly makes
+ * — that the committed `services/<id>/openapi.yaml` is the contract the service
+ * actually serves. Most fleets generate that document; a fleet that copies it
+ * by hand in month one is a fleet whose spine checks grade last quarter's
+ * endpoints by month six, and until now nothing could say so.
+ *
+ * IT NEVER WRITES. The copy stays a human `cp`, reviewed in a pull request,
+ * because that is what makes the docs-repo document a contract somebody agreed
+ * to rather than a cache of whatever the build last produced. loam reports the
+ * divergence and stops.
+ *
+ * THE DIGEST IS OVER CANONICAL JSON, never raw bytes. Two generator versions
+ * that order keys differently, or a YAML dumper that re-wraps a description,
+ * produce identical documents and must not produce a permanent warning nobody
+ * can clear — the lesson `requirementDigest` (core/document/spec.ts) already records.
+ *
+ * THE DIGEST DECIDES, THE operationId SETS EXPLAIN. A reworded description and
+ * 29 vanished endpoints were one identical warning, each costing a manual diff
+ * to tell apart, so a fired warning names the set difference both ways (or says
+ * the sets agree). The sets never fire it on their own: the digest still does.
+ *
+ * Runs only in the SERVICE repo. From the docs repo there is no build output to
+ * read and the whole family stays silent, exactly as `sources` provenance does.
+ */
+export async function generatedContractFindings(service, repoDir, spelled, committedPath) {
+    if (spelled === undefined)
+        return [];
+    let generatedPath;
+    try {
+        // Containment is checked HERE rather than at config load, with the service
+        // in hand so the refusal can name it — and a path that escapes the repo is
+        // a finding, never a thrown config error that would take down every other
+        // command in the repo.
+        generatedPath = resolveInside(repoDir, spelled, `"contracts.openapi"`);
+    }
+    catch (err) {
+        return [{
+                severity: "error",
+                code: "contracts.source-invalid",
+                subject: service,
+                message: `${service}: loam.json names contracts.openapi '${spelled}', which does not resolve inside this repository — ` +
+                    `${err instanceof Error ? err.message : String(err)}`,
+            }];
+    }
+    if (!existsSync(generatedPath)) {
+        return [{
+                severity: "error",
+                code: "contracts.source-missing",
+                subject: service,
+                message: `${service}: loam.json names contracts.openapi '${spelled}', and nothing is there. ` +
+                    "Either the build has not run in this checkout, or the path is wrong — CI that validates before it builds " +
+                    "sees exactly this. Run the build first, or correct the path",
+            }];
+    }
+    const digests = [];
+    const idSets = [];
+    for (const [label, path] of [["generated", generatedPath], ["committed", committedPath]]) {
+        if (label === "committed" && !existsSync(path))
+            return [];
+        let parsed, text;
+        try {
+            text = await readFile(path, "utf8");
+            parsed = parseYaml(text);
+        }
+        catch (err) {
+            // An unreadable GENERATED document is this check's business; an
+            // unreadable committed one is already `openapi.invalid` and must not be
+            // reported twice under two codes.
+            if (label === "committed")
+                return [];
+            return [{
+                    severity: "error",
+                    code: "contracts.source-invalid",
+                    subject: service,
+                    message: `${service}: contracts.openapi '${spelled}' does not parse as YAML or JSON — ` +
+                        `${err instanceof Error ? err.message : String(err)}`,
+                }];
+        }
+        digests.push(createHash("sha256").update(canonicalJson(parsed), "utf8").digest("hex"));
+        // The walk every operation join uses: "served" means what a spine check sees.
+        idSets.push(new Set(openapiFromText(text).ops.map((op) => op.id)));
+    }
+    if (digests[0] === digests[1])
+        return [];
+    const [served, committed] = idSets;
+    const added = [...served].filter((id) => !committed.has(id)).sort();
+    const removed = [...committed].filter((id) => !served.has(id)).sort();
+    const details = [
+        ...added.map((id) => `served, not in the committed copy: ${id}`),
+        ...removed.map((id) => `committed, no longer served: ${id}`),
+    ];
+    const moved = details.length === 0
+        ? "Every operationId matches, so what moved is inside an operation or outside `paths`. "
+        : `${added.length} operation(s) served but not committed, ${removed.length} committed but no longer served (details). `;
+    return [{
+            severity: "warn",
+            code: "openapi.generated-stale",
+            subject: service,
+            message: `${service}: the committed openapi.yaml differs from what this repository's build produces (${spelled}). ${moved}` +
+                "The docs-repo copy is what every operation join is graded against, so the fleet is being checked against a " +
+                "contract this service no longer serves. Review the difference and copy the generated document across — " +
+                "loam never does that for you, because the committed contract is one somebody agreed to, not a cache of the build",
+            ...(details.length === 0 ? {} : { details }),
+        }];
+}
+//# sourceMappingURL=generated.js.map

package/dist/commands/validate/service/contracts/generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/contracts/generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,OAAe,EACf,OAA2B,EAC3B,aAAqB;IAErB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,uBAAuB;QACvB,aAAa,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC;gBACN,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,wCAAwC,OAAO,qDAAqD;oBAC9G,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACxD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC;gBACN,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,wCAAwC,OAAO,2BAA2B;oBACpF,2GAA2G;oBAC3G,6DAA6D;aAChE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,CAAU,EAAE,CAAC;QAClG,IAAI,KAAK,KAAK,WAAW,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1D,IAAI,MAAe,EAAE,IAAY,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gEAAgE;YAChE,wEAAwE;YACxE,kCAAkC;YAClC,IAAI,KAAK,KAAK,WAAW;gBAAE,OAAO,EAAE,CAAC;YACrC,OAAO,CAAC;oBACN,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,OAAO;oBAChB,OAAO,EACL,GAAG,OAAO,wBAAwB,OAAO,qCAAqC;wBAC9E,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;iBACxD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvF,8EAA8E;QAC9E,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAoC,CAAC;IACjE,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG;QACd,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,sCAAsC,EAAE,EAAE,CAAC;QAChE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,gCAAgC,EAAE,EAAE,CAAC;KAC7D,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC;QAChC,CAAC,CAAC,sFAAsF;QACxF,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,2CAA2C,OAAO,CAAC,MAAM,6CAA6C,CAAC;IAC1H,OAAO,CAAC;YACN,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,OAAO;YAChB,OAAO,EACL,GAAG,OAAO,oFAAoF,OAAO,MAAM,KAAK,EAAE;gBAClH,6GAA6G;gBAC7G,yGAAyG;gBACzG,kHAAkH;YACpH,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC7C,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * The generated-contract check: the build's own OpenAPI document against the\n * copy the docs repo committed.\n *\n * It sits beside the HTTP axis (`../api.ts`) rather than inside it because it\n * reads a different document for a different question. The axis grades the\n * committed contract against the living spec; this asks whether that committed\n * contract is still the one the service serves, and it runs only in a service\n * repo. They used to share one file, and naming the operationIds that moved\n * pushed it over the line limit.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { createHash } from \"node:crypto\";\nimport { parse as parseYaml } from \"yaml\";\nimport { resolveInside } from \"../../../../core/kernel/path-safety.js\";\nimport { canonicalJson } from \"../../../../core/openapi/digest.js\";\nimport { openapiFromText } from \"../../../../core/openapi/doc.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\n\n/**\n * The build's own contract document, compared with the copy the docs repo\n * committed — `openapi.generated-stale`, `contracts.source-missing`,\n * `contracts.source-invalid`.\n *\n * WHY THIS IS NOT AN EXTRACTOR. It reads no line of service code and derives no\n * meaning: it parses a standard document the team's own build emitted, at a\n * path a human wrote into `loam.json`, and compares a digest. That is the same\n * category as `verify --results` ingesting a cucumber report, and it is the\n * only thing in the product that can notice the assumption SCHEMA quietly makes\n * — that the committed `services/<id>/openapi.yaml` is the contract the service\n * actually serves. Most fleets generate that document; a fleet that copies it\n * by hand in month one is a fleet whose spine checks grade last quarter's\n * endpoints by month six, and until now nothing could say so.\n *\n * IT NEVER WRITES. The copy stays a human `cp`, reviewed in a pull request,\n * because that is what makes the docs-repo document a contract somebody agreed\n * to rather than a cache of whatever the build last produced. loam reports the\n * divergence and stops.\n *\n * THE DIGEST IS OVER CANONICAL JSON, never raw bytes. Two generator versions\n * that order keys differently, or a YAML dumper that re-wraps a description,\n * produce identical documents and must not produce a permanent warning nobody\n * can clear — the lesson `requirementDigest` (core/document/spec.ts) already records.\n *\n * THE DIGEST DECIDES, THE operationId SETS EXPLAIN. A reworded description and\n * 29 vanished endpoints were one identical warning, each costing a manual diff\n * to tell apart, so a fired warning names the set difference both ways (or says\n * the sets agree). The sets never fire it on their own: the digest still does.\n *\n * Runs only in the SERVICE repo. From the docs repo there is no build output to\n * read and the whole family stays silent, exactly as `sources` provenance does.\n */\nexport async function generatedContractFindings(\n  service: string,\n  repoDir: string,\n  spelled: string | undefined,\n  committedPath: string,\n): Promise<Finding[]> {\n  if (spelled === undefined) return [];\n  let generatedPath: string;\n  try {\n    // Containment is checked HERE rather than at config load, with the service\n    // in hand so the refusal can name it — and a path that escapes the repo is\n    // a finding, never a thrown config error that would take down every other\n    // command in the repo.\n    generatedPath = resolveInside(repoDir, spelled, `\"contracts.openapi\"`);\n  } catch (err) {\n    return [{\n      severity: \"error\",\n      code: \"contracts.source-invalid\",\n      subject: service,\n      message:\n        `${service}: loam.json names contracts.openapi '${spelled}', which does not resolve inside this repository — ` +\n        `${err instanceof Error ? err.message : String(err)}`,\n    }];\n  }\n  if (!existsSync(generatedPath)) {\n    return [{\n      severity: \"error\",\n      code: \"contracts.source-missing\",\n      subject: service,\n      message:\n        `${service}: loam.json names contracts.openapi '${spelled}', and nothing is there. ` +\n        \"Either the build has not run in this checkout, or the path is wrong — CI that validates before it builds \" +\n        \"sees exactly this. Run the build first, or correct the path\",\n    }];\n  }\n  const digests: string[] = [];\n  const idSets: Set<string>[] = [];\n  for (const [label, path] of [[\"generated\", generatedPath], [\"committed\", committedPath]] as const) {\n    if (label === \"committed\" && !existsSync(path)) return [];\n    let parsed: unknown, text: string;\n    try {\n      text = await readFile(path, \"utf8\");\n      parsed = parseYaml(text);\n    } catch (err) {\n      // An unreadable GENERATED document is this check's business; an\n      // unreadable committed one is already `openapi.invalid` and must not be\n      // reported twice under two codes.\n      if (label === \"committed\") return [];\n      return [{\n        severity: \"error\",\n        code: \"contracts.source-invalid\",\n        subject: service,\n        message:\n          `${service}: contracts.openapi '${spelled}' does not parse as YAML or JSON — ` +\n          `${err instanceof Error ? err.message : String(err)}`,\n      }];\n    }\n    digests.push(createHash(\"sha256\").update(canonicalJson(parsed), \"utf8\").digest(\"hex\"));\n    // The walk every operation join uses: \"served\" means what a spine check sees.\n    idSets.push(new Set(openapiFromText(text).ops.map((op) => op.id)));\n  }\n  if (digests[0] === digests[1]) return [];\n  const [served, committed] = idSets as [Set<string>, Set<string>];\n  const added = [...served].filter((id) => !committed.has(id)).sort();\n  const removed = [...committed].filter((id) => !served.has(id)).sort();\n  const details = [\n    ...added.map((id) => `served, not in the committed copy: ${id}`),\n    ...removed.map((id) => `committed, no longer served: ${id}`),\n  ];\n  const moved = details.length === 0\n    ? \"Every operationId matches, so what moved is inside an operation or outside `paths`. \"\n    : `${added.length} operation(s) served but not committed, ${removed.length} committed but no longer served (details). `;\n  return [{\n    severity: \"warn\",\n    code: \"openapi.generated-stale\",\n    subject: service,\n    message:\n      `${service}: the committed openapi.yaml differs from what this repository's build produces (${spelled}). ${moved}` +\n      \"The docs-repo copy is what every operation join is graded against, so the fleet is being checked against a \" +\n      \"contract this service no longer serves. Review the difference and copy the generated document across — \" +\n      \"loam never does that for you, because the committed contract is one somebody agreed to, not a cache of the build\",\n    ...(details.length === 0 ? {} : { details }),\n  }];\n}\n"]}

package/dist/commands/validate/service/events/events.js

@@ -86,7 +86,7 @@ export async function eventAxisFindings(axis) {
             severity: "error",
             code: "asyncapi.invalid",
             subject: service,
-            message: `${service}: asyncapi.yaml does not parse — the event spine is unchecked for this service`,
+            message: `${service}: asyncapi.yaml does not read as AsyncAPI 3.0 (it does not parse, or it declares an older version) — the event spine is unchecked for this service`,
             ...(events.error === undefined ? {} : { details: [events.error] }),
         });
     }

package/dist/commands/validate/service/events/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAIN,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAqB,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAoB,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAyB1D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAe;IACrD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAC9F,IAAI,CAAC;IACP,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9C,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,UAAU,GACd,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/B,MAAM,KAAK,GAA8E,EAAE,CAAC;YAC5F,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACT,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjG,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,WAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,sEAAsE;QACtE,4DAA4D;QAC5D,EAAE;QACF,gEAAgE;QAChE,MAAM,QAAQ,GAAG;YACf,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACvF,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,wBAAwB,KAAK,CAAC,QAAQ,SAAS,QAAQ,CAAC,MAAM,2CAA2C;oBACzG,oGAAoG;gBACtG,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,2EAA2E;QAC3E,8EAA8E;QAC9E,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,OAAO,gFAAgF;YACnG,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,yDAAyD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8GAA8G;aACpN,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,qCAAqC,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oIAAoI;aAC5O,CAAC,CAAC;QACL,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAC9F,4EAA4E;oBAC5E,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,4BAA4B,MAAM,CAAC,YAAY,CAAC,MAAM,iCAAiC;oBACjG,6FAA6F;oBAC7F,+BAA+B;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,6EAA6E;QAC7E,yEAAyE;QACzE,yDAAyD;QACzD,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,CAAC,SAAmC,EAAE,OAAe,EAAW,EAAE,CACjF,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,SAAmC,EAAU,EAAE,CAC7D,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,oBAAoB,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,OAAO,EAAE,GAAG;oBACpH,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACnI,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACrL,CAAC,CAAC;QACL,CAAC;QACD,qEAAqE;QACrE,2EAA2E;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/F,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,yFAAyF;aAC/J,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACxI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7E,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SAC9E,CAAC;KACH,CAAC,IAAI,EAAE,CAAC;IACT,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAElH,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,6CAA6C;IAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC1D,IAAI,WAAW,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,OAAO,kBAAkB,WAAW,4CAA4C;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The async contract axis — AsyncAPI messages on the landscape spine.\n *\n * The HTTP spine (`./spine.js`) and this one are mirror images, and the mirror\n * is the whole reason this is a second axis rather than a second `metadata`\n * key. On the HTTP axis the PROVIDER owns the contract: an edge names an\n * operation and the target's openapi.yaml settles it, locally, in one file.\n * Here the PRODUCER owns the message and the consumer joins to it from another\n * repository — so \"is this message declared\" is local, while \"does anybody\n * publish it\" is a fleet question with no local answer at all. That second\n * question is the only check on either spine that reads other services'\n * contracts; it lives in `./message-producers.js`, and this axis only decides\n * when it is worth paying for — exactly when something actually consumes.\n */\nimport { existsSync } from \"node:fs\";\nimport {\n  type DeclaredService,\n  type PathableService,\n  type RawServiceId,\n} from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { type ServicePaths } from \"../../../../core/repo/paths.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../../../core/document/spec.js\";\nimport { readAsyncapi, slotsOf } from \"../../../../core/asyncapi/read.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { producerFindings } from \"./message-producers.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/** What the service target hands the event axis. */\nexport interface EventAxis {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** `service` widened for `===` against the resolver's DOCUMENT text — see service.ts. */\n  me: string;\n  paths: ServicePaths;\n  /** Every requirement the living spec declares; `event.messages-unlinked` counts what is written. */\n  reqs: Requirement[];\n  /** The ones that still govern something — a REMOVED requirement links nothing. */\n  livingReqs: Requirement[];\n  /** arch.spec.md's requirements, which carry as many event links as spec.md's do. */\n  archReqs: Requirement[];\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  fleet?: FleetContext;\n}\n\nexport async function eventAxisFindings(axis: EventAxis): Promise<Finding[]> {\n  const { docsDir, service, me, paths, reqs, livingReqs, archReqs, land, landSvcOf, known, fleet } =\n    axis;\n  const findings: Finding[] = [];\n\n  // Where this axis started, so the closing ok-finding can be \"nothing here\n  // broke\" rather than a second, independently-computed claim about the same\n  // facts. A positive finding derived from the same walk cannot disagree with it.\n  const eventFindingsAt = findings.length;\n  const events = await readAsyncapi(paths.asyncapi, fleet);\n  const sentHere = new Set(events.sent);\n  const receivedHere = new Set(events.received);\n\n  // Every edge that binds THIS service to a message: `publishes` binds the\n  // edge's source (a service produces what it declares an `action: send` for),\n  // `consumes` binds its target. One edge may legitimately carry both — a relay\n  // that reads one topic and writes another is a single arrow in most fleet maps.\n  const eventEdges =\n    land === null || land.errors.length > 0\n      ? []\n      : land.relationships.flatMap((r) => {\n          const bound: { direction: \"publishes\" | \"consumes\"; message: string; other: string }[] = [];\n          if (r.publishes !== undefined && landSvcOf!(r.source) === me) {\n            bound.push({ direction: \"publishes\", message: r.publishes, other: landSvcOf!(r.target) });\n          }\n          if (r.consumes !== undefined && landSvcOf!(r.target) === me) {\n            bound.push({ direction: \"consumes\", message: r.consumes, other: landSvcOf!(r.source) });\n          }\n          return bound;\n        });\n  // Both requirement namespaces, and a REMOVED requirement links nothing —\n  // the `livingReqs` rule the API axis already follows, applied to the pair.\n  const eventLinks = [...livingReqs, ...archReqs.filter((r) => r.kind !== \"REMOVED\")].flatMap((r) => [\n    ...r.publishes.map((m) => ({ direction: \"publishes\" as const, message: m, requirement: r.name })),\n    ...r.consumes.map((m) => ({ direction: \"consumes\" as const, message: m, requirement: r.name })),\n  ]);\n\n  if (!existsSync(paths.asyncapi)) {\n    // Deliberately TWO grades, not the three `service.no-openapi` uses. Its\n    // middle grade — warn when the landscape cannot prove nobody calls this\n    // service — rests on HTTP being the default: most services expose one, so\n    // \"I could not look\" is worth saying. An event contract is genuinely\n    // optional; most services in a legacy fleet touch no topic at all. Warning\n    // every one of them the moment a landscape fails to parse would put a\n    // finding on the whole fleet that names a file nobody owes.\n    //\n    // So: something already joins into the absent file, or silence.\n    const dangling = [\n      ...new Set([...eventEdges.map((e) => e.message), ...eventLinks.map((e) => e.message)]),\n    ].sort();\n    if (dangling.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"service.no-asyncapi\",\n        subject: service,\n        message:\n          `No async contract at ${paths.asyncapi}, and ${dangling.length} message link(s) already point into it — ` +\n          `every landscape edge and requirement naming one of them resolves to nothing until the file is back`,\n        details: dangling,\n      });\n    }\n  } else if (events.unreadable) {\n    // The openapi.invalid discipline: a contract that EXISTS but does not read\n    // is a broken source of truth, not an empty one. Grading the links against\n    // an empty message set would turn one file into one `spine.message-undefined`\n    // per edge, every one of them pointing at the landscape.\n    findings.push({\n      severity: \"error\",\n      code: \"asyncapi.invalid\",\n      subject: service,\n      message: `${service}: asyncapi.yaml does not parse — the event spine is unchecked for this service`,\n      ...(events.error === undefined ? {} : { details: [events.error] }),\n    });\n  } else {\n    // Feature-only bookkeeping published to the fleet — the openapi axis's\n    // `openapi.remove-marker-living` discipline, one code for every depth the\n    // reader collects markers at (slots and inline channel messages alike).\n    if (events.markers.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"asyncapi.remove-marker-living\",\n        subject: service,\n        message: `${service}: living asyncapi.yaml carries x-loam-remove: true at ${events.markers.join(\", \")} — removal markers are valid only in feature deltas; retire a slot through a feature's asyncapi.yaml instead`,\n      });\n    }\n    for (const name of events.duplicateNames) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.duplicate-message\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares message '${name}' in ${slotsOf(events, name).join(\" and \")} — every join on the name (an edge's metadata { publishes }, a requirement's Publishes: line) picks one of those slots arbitrarily`,\n      });\n    }\n    // The contract-depth probes. Form validated and depth did not: a payload\n    // of bare `type: object` and a `$ref` to nothing both read as cleanly as\n    // a full schema, while a reader still cannot rebuild the payload from the\n    // green contract. Presence probes only — a non-JSON schemaFormat\n    // is skipped, so Avro stays a document change.\n    const empties = events.messages.filter((m) => m.payloadEmpty === true).map((m) => m.name);\n    if (empties.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.payload-undescribed\",\n        subject: service,\n        message:\n          `${service}: ${empties.length} message(s) declare no payload shape (${empties.join(\", \")}) — ` +\n          `the name joins the spine, but nothing defines what a consumer would read; ` +\n          `declare properties, or a schemaFormat for a non-JSON schema`,\n      });\n    }\n    if (events.danglingRefs.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.ref-unresolved\",\n        subject: service,\n        message:\n          `${service}: asyncapi.yaml contains ${events.danglingRefs.length} internal $ref(s) that resolve ` +\n          `to nothing in the document — whatever they were meant to carry is silently absent from the ` +\n          `spine's view of this contract`,\n        details: events.danglingRefs,\n      });\n    }\n    // Local resolution, both directions and both sources of a claim. An edge and\n    // a requirement making the same broken claim get the same sentence under\n    // different codes, matching how `spine.op-undefined` and\n    // `spec-api.op-undefined` split the HTTP axis: one is the fleet map's\n    // mistake, the other is this document's, and the fix is in a different file.\n    const declares = (direction: \"publishes\" | \"consumes\", message: string): boolean =>\n      direction === \"publishes\" ? sentHere.has(message) : receivedHere.has(message);\n    const action = (direction: \"publishes\" | \"consumes\"): string =>\n      direction === \"publishes\" ? \"send\" : \"receive\";\n    for (const e of eventEdges) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spine.message-undefined\",\n        subject: service,\n        message:\n          `${service}: landscape edge ${e.direction === \"publishes\" ? `${service} → ${e.other}` : `${e.other} → ${service}`} ` +\n          `${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    for (const e of eventLinks) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spec-event.message-undefined\",\n        subject: service,\n        message: `${service}: requirement '${e.requirement}' ${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    // The migration-debt case, `api.ops-unlinked`'s twin: a contract and\n    // requirements that never name each other leave this axis vacuously green.\n    if (events.messages.length > 0 && reqs.length + archReqs.length > 0 && eventLinks.length === 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.messages-unlinked\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares ${events.messages.length} message(s) but no requirement links any — the event axis is unchecked for this service`,\n      });\n    }\n    // `api.ungoverned`'s event twin, and the per-message half the check above\n    // cannot see: `event.messages-unlinked` fires only when ZERO links exist,\n    // so a contract with five declared messages and three governed ones\n    // reported nothing about the other two. The join is against requirement\n    // lines ONLY, deliberately ignoring landscape edges — an edge is a claim\n    // about traffic, a requirement is governance — exactly as the API axis\n    // ignores inbound edges when grading coverage.\n    const governed = new Set(eventLinks.map((e) => e.message));\n    const orphans = [...new Set(events.messages.map((m) => m.name))].filter((name) => !governed.has(name));\n    if (orphans.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.ungoverned\",\n        subject: service,\n        message: `${service}: ${orphans.length} message(s) not governed by any requirement's Publishes:/Consumes: line — ${orphans.join(\", \")}`,\n      });\n    }\n  }\n\n  // The consumed-message list is the handover to the fleet question in\n  // ./message-producers.js — a fleet where nothing consumes walks nothing.\n  const consumed = [\n    ...new Set([\n      ...eventEdges.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n      ...eventLinks.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n    ]),\n  ].sort();\n  findings.push(...(await producerFindings({ docsDir, service, land, landSvcOf, known, events, consumed, fleet })));\n\n  // Positive confirmation, on the same rule `spine.resolved` follows: claimed\n  // only where the axis actually checked something. A service that touches no\n  // topic says nothing here — an \"event axis clean\" on every worker in the fleet\n  // would be a green tick for work nobody did.\n  const eventChecks = eventEdges.length + eventLinks.length;\n  if (eventChecks > 0 && findings.length === eventFindingsAt) {\n    findings.push({\n      severity: \"ok\",\n      code: \"event.covered\",\n      message: `${service}: event spine (${eventChecks} message link(s) resolve to asyncapi.yaml)`,\n    });\n  }\n\n  return findings;\n}\n"]}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAIN,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAqB,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAoB,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAyB1D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAe;IACrD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAC9F,IAAI,CAAC;IACP,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE9C,yEAAyE;IACzE,6EAA6E;IAC7E,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,UAAU,GACd,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/B,MAAM,KAAK,GAA8E,EAAE,CAAC;YAC5F,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACT,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjG,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,WAAoB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACjG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,UAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC,CAAC;IAEH,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,sEAAsE;QACtE,4DAA4D;QAC5D,EAAE;QACF,gEAAgE;QAChE,MAAM,QAAQ,GAAG;YACf,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;SACvF,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,wBAAwB,KAAK,CAAC,QAAQ,SAAS,QAAQ,CAAC,MAAM,2CAA2C;oBACzG,oGAAoG;gBACtG,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,2EAA2E;QAC3E,2EAA2E;QAC3E,8EAA8E;QAC9E,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,OAAO,oJAAoJ;YACvK,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,yDAAyD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,8GAA8G;aACpN,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,qCAAqC,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,oIAAoI;aAC5O,CAAC,CAAC;QACL,CAAC;QACD,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAC9F,4EAA4E;oBAC5E,6DAA6D;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,4BAA4B,MAAM,CAAC,YAAY,CAAC,MAAM,iCAAiC;oBACjG,6FAA6F;oBAC7F,+BAA+B;gBACjC,OAAO,EAAE,MAAM,CAAC,YAAY;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,6EAA6E;QAC7E,yEAAyE;QACzE,yDAAyD;QACzD,sEAAsE;QACtE,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,CAAC,SAAmC,EAAE,OAAe,EAAW,EAAE,CACjF,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,SAAmC,EAAU,EAAE,CAC7D,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,OAAO,oBAAoB,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,OAAO,EAAE,GAAG;oBACpH,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACnI,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC/C,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,kBAAkB,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,UAAU,OAAO,uDAAuD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS;aACrL,CAAC,CAAC;QACL,CAAC;QACD,qEAAqE;QACrE,2EAA2E;QAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/F,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,4BAA4B,MAAM,CAAC,QAAQ,CAAC,MAAM,yFAAyF;aAC/J,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACvG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,CAAC,MAAM,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACxI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,yEAAyE;IACzE,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7E,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SAC9E,CAAC;KACH,CAAC,IAAI,EAAE,CAAC;IACT,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAElH,4EAA4E;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,6CAA6C;IAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC1D,IAAI,WAAW,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,GAAG,OAAO,kBAAkB,WAAW,4CAA4C;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The async contract axis — AsyncAPI messages on the landscape spine.\n *\n * The HTTP spine (`./spine.js`) and this one are mirror images, and the mirror\n * is the whole reason this is a second axis rather than a second `metadata`\n * key. On the HTTP axis the PROVIDER owns the contract: an edge names an\n * operation and the target's openapi.yaml settles it, locally, in one file.\n * Here the PRODUCER owns the message and the consumer joins to it from another\n * repository — so \"is this message declared\" is local, while \"does anybody\n * publish it\" is a fleet question with no local answer at all. That second\n * question is the only check on either spine that reads other services'\n * contracts; it lives in `./message-producers.js`, and this axis only decides\n * when it is worth paying for — exactly when something actually consumes.\n */\nimport { existsSync } from \"node:fs\";\nimport {\n  type DeclaredService,\n  type PathableService,\n  type RawServiceId,\n} from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { type ServicePaths } from \"../../../../core/repo/paths.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { type Requirement } from \"../../../../core/document/spec.js\";\nimport { readAsyncapi, slotsOf } from \"../../../../core/asyncapi/read.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { producerFindings } from \"./message-producers.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/** What the service target hands the event axis. */\nexport interface EventAxis {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** `service` widened for `===` against the resolver's DOCUMENT text — see service.ts. */\n  me: string;\n  paths: ServicePaths;\n  /** Every requirement the living spec declares; `event.messages-unlinked` counts what is written. */\n  reqs: Requirement[];\n  /** The ones that still govern something — a REMOVED requirement links nothing. */\n  livingReqs: Requirement[];\n  /** arch.spec.md's requirements, which carry as many event links as spec.md's do. */\n  archReqs: Requirement[];\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  fleet: FleetContext;\n}\n\nexport async function eventAxisFindings(axis: EventAxis): Promise<Finding[]> {\n  const { docsDir, service, me, paths, reqs, livingReqs, archReqs, land, landSvcOf, known, fleet } =\n    axis;\n  const findings: Finding[] = [];\n\n  // Where this axis started, so the closing ok-finding can be \"nothing here\n  // broke\" rather than a second, independently-computed claim about the same\n  // facts. A positive finding derived from the same walk cannot disagree with it.\n  const eventFindingsAt = findings.length;\n  const events = await readAsyncapi(paths.asyncapi, fleet);\n  const sentHere = new Set(events.sent);\n  const receivedHere = new Set(events.received);\n\n  // Every edge that binds THIS service to a message: `publishes` binds the\n  // edge's source (a service produces what it declares an `action: send` for),\n  // `consumes` binds its target. One edge may legitimately carry both — a relay\n  // that reads one topic and writes another is a single arrow in most fleet maps.\n  const eventEdges =\n    land === null || land.errors.length > 0\n      ? []\n      : land.relationships.flatMap((r) => {\n          const bound: { direction: \"publishes\" | \"consumes\"; message: string; other: string }[] = [];\n          if (r.publishes !== undefined && landSvcOf!(r.source) === me) {\n            bound.push({ direction: \"publishes\", message: r.publishes, other: landSvcOf!(r.target) });\n          }\n          if (r.consumes !== undefined && landSvcOf!(r.target) === me) {\n            bound.push({ direction: \"consumes\", message: r.consumes, other: landSvcOf!(r.source) });\n          }\n          return bound;\n        });\n  // Both requirement namespaces, and a REMOVED requirement links nothing —\n  // the `livingReqs` rule the API axis already follows, applied to the pair.\n  const eventLinks = [...livingReqs, ...archReqs.filter((r) => r.kind !== \"REMOVED\")].flatMap((r) => [\n    ...r.publishes.map((m) => ({ direction: \"publishes\" as const, message: m, requirement: r.name })),\n    ...r.consumes.map((m) => ({ direction: \"consumes\" as const, message: m, requirement: r.name })),\n  ]);\n\n  if (!existsSync(paths.asyncapi)) {\n    // Deliberately TWO grades, not the three `service.no-openapi` uses. Its\n    // middle grade — warn when the landscape cannot prove nobody calls this\n    // service — rests on HTTP being the default: most services expose one, so\n    // \"I could not look\" is worth saying. An event contract is genuinely\n    // optional; most services in a legacy fleet touch no topic at all. Warning\n    // every one of them the moment a landscape fails to parse would put a\n    // finding on the whole fleet that names a file nobody owes.\n    //\n    // So: something already joins into the absent file, or silence.\n    const dangling = [\n      ...new Set([...eventEdges.map((e) => e.message), ...eventLinks.map((e) => e.message)]),\n    ].sort();\n    if (dangling.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"service.no-asyncapi\",\n        subject: service,\n        message:\n          `No async contract at ${paths.asyncapi}, and ${dangling.length} message link(s) already point into it — ` +\n          `every landscape edge and requirement naming one of them resolves to nothing until the file is back`,\n        details: dangling,\n      });\n    }\n  } else if (events.unreadable) {\n    // The openapi.invalid discipline: a contract that EXISTS but does not read\n    // is a broken source of truth, not an empty one. Grading the links against\n    // an empty message set would turn one file into one `spine.message-undefined`\n    // per edge, every one of them pointing at the landscape.\n    findings.push({\n      severity: \"error\",\n      code: \"asyncapi.invalid\",\n      subject: service,\n      message: `${service}: asyncapi.yaml does not read as AsyncAPI 3.0 (it does not parse, or it declares an older version) — the event spine is unchecked for this service`,\n      ...(events.error === undefined ? {} : { details: [events.error] }),\n    });\n  } else {\n    // Feature-only bookkeeping published to the fleet — the openapi axis's\n    // `openapi.remove-marker-living` discipline, one code for every depth the\n    // reader collects markers at (slots and inline channel messages alike).\n    if (events.markers.length > 0) {\n      findings.push({\n        severity: \"error\",\n        code: \"asyncapi.remove-marker-living\",\n        subject: service,\n        message: `${service}: living asyncapi.yaml carries x-loam-remove: true at ${events.markers.join(\", \")} — removal markers are valid only in feature deltas; retire a slot through a feature's asyncapi.yaml instead`,\n      });\n    }\n    for (const name of events.duplicateNames) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.duplicate-message\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares message '${name}' in ${slotsOf(events, name).join(\" and \")} — every join on the name (an edge's metadata { publishes }, a requirement's Publishes: line) picks one of those slots arbitrarily`,\n      });\n    }\n    // The contract-depth probes. Form validated and depth did not: a payload\n    // of bare `type: object` and a `$ref` to nothing both read as cleanly as\n    // a full schema, while a reader still cannot rebuild the payload from the\n    // green contract. Presence probes only — a non-JSON schemaFormat\n    // is skipped, so Avro stays a document change.\n    const empties = events.messages.filter((m) => m.payloadEmpty === true).map((m) => m.name);\n    if (empties.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.payload-undescribed\",\n        subject: service,\n        message:\n          `${service}: ${empties.length} message(s) declare no payload shape (${empties.join(\", \")}) — ` +\n          `the name joins the spine, but nothing defines what a consumer would read; ` +\n          `declare properties, or a schemaFormat for a non-JSON schema`,\n      });\n    }\n    if (events.danglingRefs.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.ref-unresolved\",\n        subject: service,\n        message:\n          `${service}: asyncapi.yaml contains ${events.danglingRefs.length} internal $ref(s) that resolve ` +\n          `to nothing in the document — whatever they were meant to carry is silently absent from the ` +\n          `spine's view of this contract`,\n        details: events.danglingRefs,\n      });\n    }\n    // Local resolution, both directions and both sources of a claim. An edge and\n    // a requirement making the same broken claim get the same sentence under\n    // different codes, matching how `spine.op-undefined` and\n    // `spec-api.op-undefined` split the HTTP axis: one is the fleet map's\n    // mistake, the other is this document's, and the fix is in a different file.\n    const declares = (direction: \"publishes\" | \"consumes\", message: string): boolean =>\n      direction === \"publishes\" ? sentHere.has(message) : receivedHere.has(message);\n    const action = (direction: \"publishes\" | \"consumes\"): string =>\n      direction === \"publishes\" ? \"send\" : \"receive\";\n    for (const e of eventEdges) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spine.message-undefined\",\n        subject: service,\n        message:\n          `${service}: landscape edge ${e.direction === \"publishes\" ? `${service} → ${e.other}` : `${e.other} → ${service}`} ` +\n          `${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    for (const e of eventLinks) {\n      if (declares(e.direction, e.message)) continue;\n      findings.push({\n        severity: \"error\",\n        code: \"spec-event.message-undefined\",\n        subject: service,\n        message: `${service}: requirement '${e.requirement}' ${e.direction} '${e.message}', but ${service}'s asyncapi.yaml declares no operation with action: ${action(e.direction)} for it`,\n      });\n    }\n    // The migration-debt case, `api.ops-unlinked`'s twin: a contract and\n    // requirements that never name each other leave this axis vacuously green.\n    if (events.messages.length > 0 && reqs.length + archReqs.length > 0 && eventLinks.length === 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.messages-unlinked\",\n        subject: service,\n        message: `${service}: asyncapi.yaml declares ${events.messages.length} message(s) but no requirement links any — the event axis is unchecked for this service`,\n      });\n    }\n    // `api.ungoverned`'s event twin, and the per-message half the check above\n    // cannot see: `event.messages-unlinked` fires only when ZERO links exist,\n    // so a contract with five declared messages and three governed ones\n    // reported nothing about the other two. The join is against requirement\n    // lines ONLY, deliberately ignoring landscape edges — an edge is a claim\n    // about traffic, a requirement is governance — exactly as the API axis\n    // ignores inbound edges when grading coverage.\n    const governed = new Set(eventLinks.map((e) => e.message));\n    const orphans = [...new Set(events.messages.map((m) => m.name))].filter((name) => !governed.has(name));\n    if (orphans.length > 0) {\n      findings.push({\n        severity: \"warn\",\n        code: \"event.ungoverned\",\n        subject: service,\n        message: `${service}: ${orphans.length} message(s) not governed by any requirement's Publishes:/Consumes: line — ${orphans.join(\", \")}`,\n      });\n    }\n  }\n\n  // The consumed-message list is the handover to the fleet question in\n  // ./message-producers.js — a fleet where nothing consumes walks nothing.\n  const consumed = [\n    ...new Set([\n      ...eventEdges.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n      ...eventLinks.filter((e) => e.direction === \"consumes\").map((e) => e.message),\n    ]),\n  ].sort();\n  findings.push(...(await producerFindings({ docsDir, service, land, landSvcOf, known, events, consumed, fleet })));\n\n  // Positive confirmation, on the same rule `spine.resolved` follows: claimed\n  // only where the axis actually checked something. A service that touches no\n  // topic says nothing here — an \"event axis clean\" on every worker in the fleet\n  // would be a green tick for work nobody did.\n  const eventChecks = eventEdges.length + eventLinks.length;\n  if (eventChecks > 0 && findings.length === eventFindingsAt) {\n    findings.push({\n      severity: \"ok\",\n      code: \"event.covered\",\n      message: `${service}: event spine (${eventChecks} message link(s) resolve to asyncapi.yaml)`,\n    });\n  }\n\n  return findings;\n}\n"]}

package/dist/commands/validate/service/events/message-producers.js

@@ -11,7 +11,7 @@ import {} from "../../../../core/vocabulary/report.js";
 import { producersByMessage } from "../../../../core/asyncapi/producers.js";
 import {} from "../../../../core/asyncapi/model.js";
 import { FleetContext } from "../../../../core/fleet-context.js";
-import { externalProducerOf } from "../../checks/fleet-shape.js";
+import { externalProducerOf } from "../../../../core/c4/resolve/external.js";
 // The fleet question, and the one check on either spine that a single
 // repository cannot answer: a consumer joins to a message whose schema lives
 // in the producer's contract, in the producer's repo. Paid only when something

package/dist/commands/validate/service/events/message-producers.js.map

@@ -1 +1 @@
-{"version":3,"file":"message-producers.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/message-producers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAiE,MAAM,wCAAwC,CAAC;AACvH,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAoB,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAwBjE,sEAAsE;AACtE,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAuB;IAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACnD,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,mCAAmC;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,qEAAqE;YACrE,kEAAkE;YAClE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAChE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;gBAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,OAAO;wBAChB,OAAO,EACL,GAAG,OAAO,eAAe,OAAO,WAAW,GAAG,sCAAsC;4BACpF,uFAAuF;4BACvF,wFAAwF;4BACxF,aAAa;qBAChB,CAAC,CAAC;gBACL,CAAC;gBACD,mEAAmE;gBACnE,sEAAsE;YACxE,CAAC;iBAAM,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,oJAAoJ;iBAC9L,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,YAAY,GAAG,CAAC,MAAM,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,4HAA4H;aAC1O,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The fleet question the event axis asks: who produces what this service\n * consumes. Split out of `./events.js` along the seam its own header always\n * named — the local axis grades one service's files, while this is the only\n * check on either spine that reads OTHER services' contracts, and the two\n * subjects share nothing but the consumed-message list the axis hands over.\n */\nimport { type DeclaredService, type PathableService, type RawServiceId } from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { producersByMessage } from \"../../../../core/asyncapi/producers.js\";\nimport { type AsyncapiDoc } from \"../../../../core/asyncapi/model.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { externalProducerOf } from \"../../checks/fleet-shape.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/**\n * What the producer question is asked over. One record rather than a parameter\n * list: everything here is already bound together as one service's view of the\n * fleet, and the 4-parameter limit says so too.\n */\nexport interface ProducerQuestion {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  /** This service's own parsed contract — the local-shape half of the external answer. */\n  events: AsyncapiDoc;\n  /** The deduped message names this service consumes, from edges and requirement lines alike. */\n  consumed: readonly string[];\n  fleet?: FleetContext;\n}\n\n// The fleet question, and the one check on either spine that a single\n// repository cannot answer: a consumer joins to a message whose schema lives\n// in the producer's contract, in the producer's repo. Paid only when something\n// actually consumes — a fleet where nobody has adopted the axis walks nothing.\nexport async function producerFindings(input: ProducerQuestion): Promise<Finding[]> {\n  const { docsDir, service, land, landSvcOf, known, events, consumed, fleet } = input;\n  const findings: Finding[] = [];\n  if (consumed.length === 0) return findings;\n  const producers = await producersByMessage(docsDir, [...known], fleet);\n  for (const message of consumed) {\n    const who = producers.byMessage.get(message) ?? [];\n    // \"Nobody produces this\" is an argument from absence, and it is only\n    // sound over a fleet loam could actually read. One unreadable contract\n    // anywhere suspends it — that service may be the producer, and the\n    // alternative is blaming every consumer for somebody else's broken YAML.\n    // The external answer and the contested answer below rest on positive\n    // evidence and need no such guard.\n    if (who.length === 0) {\n      // A message produced OUTSIDE the fleet used to be inexpressible: the\n      // landscape said the producer was #external, and this error fired\n      // anyway — so honesty cost a red build, and the exit ramp people took\n      // was deleting the link. The landscape already carries the answer; an\n      // external producer shifts the contract question to the one file that\n      // can settle it, this service's own asyncapi.yaml.\n      const ext = externalProducerOf(message, land, landSvcOf, known);\n      if (ext !== null) {\n        const local = events.messages.find((m) => m.name === message);\n        if (local === undefined || local.payloadEmpty === true) {\n          findings.push({\n            severity: \"warn\",\n            code: \"spine.message-external\",\n            subject: service,\n            message:\n              `${service}: consumes '${message}' from '${ext}', a system outside the fleet — the ` +\n              `producer declares no contract here, so the only payload definition is this service's ` +\n              `own asyncapi.yaml, and it currently defines no shape for it; declare the message with ` +\n              `its payload`,\n          });\n        }\n        // A carried contract closes the question: the landscape states the\n        // external dependency, the consumer owns the schema — nothing to say.\n      } else if (producers.unreadable.length === 0) {\n        findings.push({\n          severity: \"error\",\n          code: \"spine.message-unproduced\",\n          subject: service,\n          message: `${service}: consumes '${message}', but no service in the fleet and no #external element declares it is sent — the message has no producer anywhere, so nothing defines its payload`,\n        });\n      }\n    } else if (who.length > 1) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.message-contested\",\n        subject: service,\n        message: `${service}: consumes '${message}', which ${who.length} services declare they send (${who.join(\", \")}) — every consumer's join picks one of them arbitrarily, so the payload this service reads is whichever one happens to win`,\n      });\n    }\n  }\n  return findings;\n}\n"]}
+{"version":3,"file":"message-producers.js","sourceRoot":"","sources":["../../../../../src/commands/validate/service/events/message-producers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAiE,MAAM,wCAAwC,CAAC;AACvH,OAAO,EAAkB,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAgB,MAAM,uCAAuC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAoB,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAwB7E,sEAAsE;AACtE,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAuB;IAC5D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpF,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACvE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACnD,qEAAqE;QACrE,uEAAuE;QACvE,mEAAmE;QACnE,yEAAyE;QACzE,sEAAsE;QACtE,mCAAmC;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,qEAAqE;YACrE,kEAAkE;YAClE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,mDAAmD;YACnD,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAChE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;gBAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;oBACvD,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,MAAM;wBAChB,IAAI,EAAE,wBAAwB;wBAC9B,OAAO,EAAE,OAAO;wBAChB,OAAO,EACL,GAAG,OAAO,eAAe,OAAO,WAAW,GAAG,sCAAsC;4BACpF,uFAAuF;4BACvF,wFAAwF;4BACxF,aAAa;qBAChB,CAAC,CAAC;gBACL,CAAC;gBACD,mEAAmE;gBACnE,sEAAsE;YACxE,CAAC;iBAAM,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO,EAAE,OAAO;oBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,oJAAoJ;iBAC9L,CAAC,CAAC;YACL,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,GAAG,OAAO,eAAe,OAAO,YAAY,GAAG,CAAC,MAAM,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,4HAA4H;aAC1O,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * The fleet question the event axis asks: who produces what this service\n * consumes. Split out of `./events.js` along the seam its own header always\n * named — the local axis grades one service's files, while this is the only\n * check on either spine that reads OTHER services' contracts, and the two\n * subjects share nothing but the consumed-message list the axis hands over.\n */\nimport { type DeclaredService, type PathableService, type RawServiceId } from \"../../../../core/kernel/ids/service.js\";\nimport { type LoadedDoc } from \"../../../../core/c4/likec4.js\";\nimport { type Finding } from \"../../../../core/vocabulary/report.js\";\nimport { producersByMessage } from \"../../../../core/asyncapi/producers.js\";\nimport { type AsyncapiDoc } from \"../../../../core/asyncapi/model.js\";\nimport { FleetContext } from \"../../../../core/fleet-context.js\";\nimport { externalProducerOf } from \"../../../../core/c4/resolve/external.js\";\nimport type { DocsDir } from \"../../../../core/kernel/ids/dirs.js\";\n\n/**\n * What the producer question is asked over. One record rather than a parameter\n * list: everything here is already bound together as one service's view of the\n * fleet, and the 4-parameter limit says so too.\n */\nexport interface ProducerQuestion {\n  docsDir: DocsDir;\n  service: PathableService;\n  /** The living landscape, or null when the repo has none. */\n  land: LoadedDoc | null;\n  /** Its element→service resolver; null exactly when `land` is. */\n  landSvcOf: ((id: string) => DeclaredService) | null;\n  /** Service directories that exist — the fleet the producer question is asked over. */\n  known: ReadonlySet<RawServiceId>;\n  /** This service's own parsed contract — the local-shape half of the external answer. */\n  events: AsyncapiDoc;\n  /** The deduped message names this service consumes, from edges and requirement lines alike. */\n  consumed: readonly string[];\n  fleet: FleetContext;\n}\n\n// The fleet question, and the one check on either spine that a single\n// repository cannot answer: a consumer joins to a message whose schema lives\n// in the producer's contract, in the producer's repo. Paid only when something\n// actually consumes — a fleet where nobody has adopted the axis walks nothing.\nexport async function producerFindings(input: ProducerQuestion): Promise<Finding[]> {\n  const { docsDir, service, land, landSvcOf, known, events, consumed, fleet } = input;\n  const findings: Finding[] = [];\n  if (consumed.length === 0) return findings;\n  const producers = await producersByMessage(docsDir, [...known], fleet);\n  for (const message of consumed) {\n    const who = producers.byMessage.get(message) ?? [];\n    // \"Nobody produces this\" is an argument from absence, and it is only\n    // sound over a fleet loam could actually read. One unreadable contract\n    // anywhere suspends it — that service may be the producer, and the\n    // alternative is blaming every consumer for somebody else's broken YAML.\n    // The external answer and the contested answer below rest on positive\n    // evidence and need no such guard.\n    if (who.length === 0) {\n      // A message produced OUTSIDE the fleet used to be inexpressible: the\n      // landscape said the producer was #external, and this error fired\n      // anyway — so honesty cost a red build, and the exit ramp people took\n      // was deleting the link. The landscape already carries the answer; an\n      // external producer shifts the contract question to the one file that\n      // can settle it, this service's own asyncapi.yaml.\n      const ext = externalProducerOf(message, land, landSvcOf, known);\n      if (ext !== null) {\n        const local = events.messages.find((m) => m.name === message);\n        if (local === undefined || local.payloadEmpty === true) {\n          findings.push({\n            severity: \"warn\",\n            code: \"spine.message-external\",\n            subject: service,\n            message:\n              `${service}: consumes '${message}' from '${ext}', a system outside the fleet — the ` +\n              `producer declares no contract here, so the only payload definition is this service's ` +\n              `own asyncapi.yaml, and it currently defines no shape for it; declare the message with ` +\n              `its payload`,\n          });\n        }\n        // A carried contract closes the question: the landscape states the\n        // external dependency, the consumer owns the schema — nothing to say.\n      } else if (producers.unreadable.length === 0) {\n        findings.push({\n          severity: \"error\",\n          code: \"spine.message-unproduced\",\n          subject: service,\n          message: `${service}: consumes '${message}', but no service in the fleet and no #external element declares it is sent — the message has no producer anywhere, so nothing defines its payload`,\n        });\n      }\n    } else if (who.length > 1) {\n      findings.push({\n        severity: \"warn\",\n        code: \"asyncapi.message-contested\",\n        subject: service,\n        message: `${service}: consumes '${message}', which ${who.length} services declare they send (${who.join(\", \")}) — every consumer's join picks one of them arbitrarily, so the payload this service reads is whichever one happens to win`,\n      });\n    }\n  }\n  return findings;\n}\n"]}

package/dist/commands/validate/service/evidence-pins.js

@@ -3,11 +3,19 @@
  * this service has attested, its pins graded against THIS working tree.
  *
  * Service-repo-scoped like `sources.*` and the gherkin chain — the citations
- * resolve only inside the service's own repository. From the docs repo the
- * whole family is silent by design: every pin would grade `unresolved` there,
- * which would be a lie about the code rather than about the record, and
+ * resolve only inside the service's own repository. From the docs repo this
+ * TARGET is silent by design: every pin would grade `unresolved` there, which
+ * would be a lie about the code rather than about the record, and
  * `sources.unverifiable-from-here` already names the blind spot once per
- * service.
+ * service. One code of the family is not about the code at all —
+ * `evidence.record-unreadable` is about the record, which lives in the docs
+ * repo — so the FEATURE target (`../feature.ts`) raises it too, from anywhere,
+ * through `featureRecordFindings` below:
+ * with only this target raising it, `validate --all` in the docs repo stayed
+ * green over a conflict-marked record that `verify` refused and `status`,
+ * `gate` and `tasks` all reported. In a service repo's `--all` the same file
+ * is therefore named twice, once per target: here as this service's pins
+ * going unchecked, there as the feature's record itself.
  *
  * ARCHIVED records are deliberately not linted (a v1 non-goal, recorded here):
  * a frozen record is history, post-ship code drift is normal evolution, and
@@ -24,9 +32,9 @@
 import { repoPath } from "../../../core/envelope/json.js";
 import { inOrder } from "../../../core/kernel/concurrency.js";
 import {} from "../../../core/kernel/ids/service.js";
+import {} from "../../../core/repo/entries.js";
 import { listFeatures } from "../../../core/repo/repo.js";
-import { readVerificationState } from "../../../core/verify/file.js";
-import { verificationPath } from "../../../core/verify/record.js";
+import { readVerificationState } from "../../../core/verify/read/file.js";
 import { lintEvidencePins } from "../../../core/verify/pins/lint.js";
 import {} from "../../../core/vocabulary/report.js";
 export async function evidencePinFindings(docsDir, service, repoDir, fleet) {
@@ -49,7 +57,7 @@ export async function evidencePinFindings(docsDir, service, repoDir, fleet) {
         // this service, so the finding fires regardless of attestation.
         const read = await readVerificationState(feature.dir);
         if (read.state === "unreadable") {
-            return { feature: feature.id, path: repoPath(docsDir, verificationPath(feature.dir)), unreadable: read.reason };
+            return { feature: feature.id, path: repoPath(docsDir, read.path), unreadable: read.reason, advice: read.advice };
         }
         if (read.state === "absent" || read.verification.schema !== 2)
             return null;
@@ -69,9 +77,7 @@ export async function evidencePinFindings(docsDir, service, repoDir, fleet) {
                 severity: "warn",
                 code: "evidence.record-unreadable",
                 subject: service,
-                message: `${me}: ${entry.feature}: ${entry.path} exists but cannot be read as a verification record (${entry.unreadable}) — ` +
-                    "none of its evidence was checked. It is plain YAML: repair it by hand, or re-record " +
-                    `(\`loam verify ${entry.feature} --service ${me} --record answers.json\`); loam never overwrites a record it could not read`,
+                message: recordUnreadableMessage(`${me}: ${entry.feature}`, entry),
             });
             continue;
         }
@@ -124,6 +130,46 @@ export async function evidencePinFindings(docsDir, service, repoDir, fleet) {
     }
     return findings;
 }
+/**
+ * `evidence.record-unreadable` on the FEATURE target (`../feature.ts`), from
+ * anywhere — the docs repo included, which is where the record lives. Kept
+ * here, beside the service target's emission, so one module owns the code and
+ * its words: the record read is the same `readVerificationState`, the path is
+ * made docs-relative the same way, and the message is the same sentence.
+ * Readability only — an `ok` record contributes nothing here, its verdict is
+ * `verify`'s and `status`'s to state — and a warn for the reasons the header
+ * gives: `valid` and `loam archive` are untouched, `--strict` is the lever.
+ */
+export async function featureRecordFindings(docsDir, feature) {
+    const read = await readVerificationState(feature.dir);
+    if (read.state !== "unreadable")
+        return [];
+    const path = repoPath(docsDir, read.path);
+    return [
+        {
+            severity: "warn",
+            code: "evidence.record-unreadable",
+            message: recordUnreadableMessage(feature.id, { path, unreadable: read.reason, advice: read.advice }),
+            locations: [{ path, role: "primary" }],
+        },
+    ];
+}
+/**
+ * The sentence `evidence.record-unreadable` carries, for both targets that
+ * raise it. Each emission spells the code literally (the codes-drift
+ * collector resolves the `code` slot, as `drift` above says); only the words
+ * are shared, so the two cannot drift into two descriptions of one file.
+ *
+ * The reader's own recipe for the one file that failed, never a fixed one:
+ * "re-record" alone sent this finding's reader into `--record`'s refusal of
+ * the very same file, and the safe repair differs between a service's own
+ * attestation file and the one-file record other services' evidence may sit
+ * in. `path` is docs-relative.
+ */
+function recordUnreadableMessage(label, file) {
+    return (`${label}: ${file.path} exists but cannot be read as a verification record (${file.unreadable}) — ` +
+        `none of its evidence was checked. ${file.advice} loam never overwrites a record it could not read`);
+}
 /** One drift as a detail line: which claim, which citation, what changed. */
 function detailLine(d) {
     return `${d.claim} ${d.evidence} — ${d.what}`;

package/dist/commands/validate/service/evidence-pins.js.map

@@ -1 +1 @@
-{"version":3,"file":"evidence-pins.js","sourceRoot":"","sources":["../../../../src/commands/validate/service/evidence-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAA+B,MAAM,mCAAmC,CAAC;AAClG,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAIlE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAwB,EACxB,OAA2B,EAC3B,KAAoB;IAEpB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,EAAE,GAAW,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAKxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAmB,EAAE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAClH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,wDAAwD,KAAK,CAAC,UAAU,MAAM;oBACpH,sFAAsF;oBACtF,kBAAkB,KAAK,CAAC,OAAO,cAAc,EAAE,6EAA6E;aAC/H,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAChC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QACnE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACxB,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAE,QAAgB,EAAQ,EAAE;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI;gBACJ,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,MAAM,CAAC,MAAM,6BAA6B,QAAQ,KAAK;oBAC7E,uFAAuF;oBACvF,kBAAkB,OAAO,cAAc,EAAE,wDAAwD;gBACnG,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;aAChC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,KAAK,CACH,YAAY,EACZ,qBAAqB,EACrB,sIAAsI,CACvI,CAAC;QACF,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,4EAA4E,CAAC,CAAC;QAC/G,KAAK,CAAC,cAAc,EAAE,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;QACpG,KAAK,CACH,eAAe,EACf,wBAAwB,EACxB,0EAA0E,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,mEAAmE;gBACnE,mEAAmE;gBACnE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,IAAI,CAAC,QAAQ,uDAAuD;oBAC1F,wDAAwD,OAAO,cAAc,EAAE,wCAAwC;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,EAAE,KAAK,OAAO,2BAA2B,aAAa,yDAAyD;SAC5H,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,CAAW;IAC7B,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC","sourcesContent":["/**\n * The evidence-pin re-check as validate findings: every ACTIVE feature record\n * this service has attested, its pins graded against THIS working tree.\n *\n * Service-repo-scoped like `sources.*` and the gherkin chain — the citations\n * resolve only inside the service's own repository. From the docs repo the\n * whole family is silent by design: every pin would grade `unresolved` there,\n * which would be a lie about the code rather than about the record, and\n * `sources.unverifiable-from-here` already names the blind spot once per\n * service.\n *\n * ARCHIVED records are deliberately not linted (a v1 non-goal, recorded here):\n * a frozen record is history, post-ship code drift is normal evolution, and\n * grading it would turn every service's CI permanently yellow the week after\n * every ship. If audit-time re-checks of shipped records are ever wanted, the\n * same `lintEvidencePins` call over `listFeatures` include-archived is the\n * whole change — behind an explicit flag, so the default stays quiet.\n *\n * Everything here demotes reviewer confidence only: warns never flip `valid`,\n * `--strict` may gate on them as it gates on any warning, and no grade ever\n * moves a verdict — `attested` never silently becomes `verified` and a drifted\n * pin never un-confirms a claim.\n */\nimport { repoPath } from \"../../../core/envelope/json.js\";\nimport { inOrder } from \"../../../core/kernel/concurrency.js\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { listFeatures } from \"../../../core/repo/repo.js\";\nimport { readVerificationState } from \"../../../core/verify/file.js\";\nimport { verificationPath } from \"../../../core/verify/record.js\";\nimport { lintEvidencePins, type PinDrift, type PinLint } from \"../../../core/verify/pins/lint.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport type { FleetContext } from \"../../../core/fleet-context.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\n\nexport async function evidencePinFindings(\n  docsDir: DocsDir,\n  service: PathableService,\n  repoDir: string | undefined,\n  fleet?: FleetContext,\n): Promise<Finding[]> {\n  if (repoDir === undefined) return [];\n  // Membership questions cross the provenance line through plain strings by\n  // design (kernel/ids/service.ts) — record subjects are document text.\n  const me: string = service;\n  // ACTIVE features only — see the header for why archived records stay frozen.\n  const features = await listFeatures(docsDir, {}, fleet);\n  type Linted =\n    | null\n    | { feature: string; path: string; unreadable: string }\n    | { feature: string; lint: PinLint };\n  const lints = await inOrder(features, async (feature): Promise<Linted> => {\n    // Three states, graded apart on purpose. ABSENT is a feature nobody has\n    // verified — legitimate silence. UNREADABLE is somebody's record this run\n    // could not use, and it must be a finding here rather than a skip: the\n    // damage that most plausibly breaks a record in a service repo's CI is a\n    // hand edit to the very pins this family grades, and a lint that went\n    // silent over it would turn \"someone broke the record\" into a green run —\n    // `verify` names the same file `record-unreadable`, but this CI job never\n    // runs verify. An unreadable record also cannot say whether it attests\n    // this service, so the finding fires regardless of attestation.\n    const read = await readVerificationState(feature.dir);\n    if (read.state === \"unreadable\") {\n      return { feature: feature.id, path: repoPath(docsDir, verificationPath(feature.dir)), unreadable: read.reason };\n    }\n    if (read.state === \"absent\" || read.verification.schema !== 2) return null;\n    if (!(read.verification.attestations ?? []).some((a) => a.service === me)) return null;\n    return { feature: feature.id, lint: await lintEvidencePins(read.verification.claims, me, repoDir) };\n  });\n\n  const findings: Finding[] = [];\n  let checked = 0;\n  let pinnedRecords = 0;\n  let drifted = false;\n  for (const entry of lints) {\n    if (entry === null) continue;\n    if (\"unreadable\" in entry) {\n      findings.push({\n        severity: \"warn\",\n        code: \"evidence.record-unreadable\",\n        subject: service,\n        message:\n          `${me}: ${entry.feature}: ${entry.path} exists but cannot be read as a verification record (${entry.unreadable}) — ` +\n          \"none of its evidence was checked. It is plain YAML: repair it by hand, or re-record \" +\n          `(\\`loam verify ${entry.feature} --service ${me} --record answers.json\\`); loam never overwrites a record it could not read`,\n      });\n      continue;\n    }\n    const { feature, lint } = entry;\n    if (lint.checked > 0 || lint.drifts.length > 0) pinnedRecords += 1;\n    checked += lint.checked;\n    // The code is spelled as a literal at each call below, and the grade rides\n    // beside it rather than being sliced back out of the code string — the\n    // codes-drift collector resolves the `code` slot, and a derivation would\n    // be a second definition of the pairing free to drift from the first.\n    const drift = (grade: PinDrift[\"grade\"], code: string, sentence: string): void => {\n      const drifts = lint.drifts.filter((d) => d.grade === grade);\n      if (drifts.length === 0) return;\n      drifted = true;\n      findings.push({\n        severity: \"warn\",\n        code,\n        subject: service,\n        message:\n          `${me}: ${feature}: ${drifts.length} recorded evidence pin(s) ${sentence} — ` +\n          \"a reading priority for the reviewer, never a verdict change; re-answer and re-record \" +\n          `(\\`loam verify ${feature} --service ${me} --record answers.json\\`) once the evidence is re-read`,\n        details: drifts.map(detailLine),\n      });\n    };\n    drift(\n      \"unresolved\",\n      \"evidence.unresolved\",\n      \"cannot be re-checked in this working tree: the cited file is gone, unreadable, not a regular file, or the cited line is past its end\",\n    );\n    drift(\"moved\", \"evidence.moved\", \"cite a file that changed since the record, though each cited line survives\");\n    drift(\"line-changed\", \"evidence.line-changed\", \"cite line(s) that no longer say what was recorded\");\n    drift(\n      \"token-missing\",\n      \"evidence.token-missing\",\n      \"cite file(s) that no longer contain the literal string the claim asserts\",\n    );\n    if (lint.unpinned > 0) {\n      findings.push({\n        severity: \"ok\",\n        // The pre-content_digest-vouch precedent: a record from before the\n        // capability existed is not wrong, it is unfindable-by-this-check.\n        code: \"evidence.unpinned\",\n        subject: service,\n        message:\n          `${me}: ${feature}: ${lint.unpinned} agent-confirmed citation(s) carry no evidence pin — ` +\n          `recorded before pins existed; the next \\`loam verify ${feature} --service ${me} --record\\` makes them drift-checkable`,\n      });\n    }\n  }\n  if (checked > 0 && !drifted) {\n    findings.push({\n      severity: \"ok\",\n      code: \"evidence.checked\",\n      subject: service,\n      message: `${me}: ${checked} evidence pin(s) across ${pinnedRecords} feature record(s) re-checked against this working tree`,\n    });\n  }\n  return findings;\n}\n\n/** One drift as a detail line: which claim, which citation, what changed. */\nfunction detailLine(d: PinDrift): string {\n  return `${d.claim} ${d.evidence} — ${d.what}`;\n}\n"]}
+{"version":3,"file":"evidence-pins.js","sourceRoot":"","sources":["../../../../src/commands/validate/service/evidence-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAqB,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAA+B,MAAM,mCAAmC,CAAC;AAClG,OAAO,EAAgB,MAAM,oCAAoC,CAAC;AAIlE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,OAAwB,EACxB,OAA2B,EAC3B,KAAmB;IAEnB,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,EAAE,GAAW,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAKxD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAmB,EAAE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAChC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACnH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,uBAAuB,CAAC,GAAG,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC;aACnE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAChC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QACnE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACxB,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,KAAK,GAAG,CAAC,KAAwB,EAAE,IAAY,EAAE,QAAgB,EAAQ,EAAE;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI;gBACJ,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,MAAM,CAAC,MAAM,6BAA6B,QAAQ,KAAK;oBAC7E,uFAAuF;oBACvF,kBAAkB,OAAO,cAAc,EAAE,wDAAwD;gBACnG,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;aAChC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,KAAK,CACH,YAAY,EACZ,qBAAqB,EACrB,sIAAsI,CACvI,CAAC;QACF,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,4EAA4E,CAAC,CAAC;QAC/G,KAAK,CAAC,cAAc,EAAE,uBAAuB,EAAE,mDAAmD,CAAC,CAAC;QACpG,KAAK,CACH,eAAe,EACf,wBAAwB,EACxB,0EAA0E,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,IAAI;gBACd,mEAAmE;gBACnE,mEAAmE;gBACnE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,OAAO;gBAChB,OAAO,EACL,GAAG,EAAE,KAAK,OAAO,KAAK,IAAI,CAAC,QAAQ,uDAAuD;oBAC1F,wDAAwD,OAAO,cAAc,EAAE,wCAAwC;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,GAAG,EAAE,KAAK,OAAO,2BAA2B,aAAa,yDAAyD;SAC5H,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAgB,EAAE,OAAqB;IACjF,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,KAAK,KAAK,YAAY;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO;QACL;YACE,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACpG,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SACvC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,uBAAuB,CAC9B,KAAa,EACb,IAA0D;IAE1D,OAAO,CACL,GAAG,KAAK,KAAK,IAAI,CAAC,IAAI,wDAAwD,IAAI,CAAC,UAAU,MAAM;QACnG,qCAAqC,IAAI,CAAC,MAAM,mDAAmD,CACpG,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,CAAW;IAC7B,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC","sourcesContent":["/**\n * The evidence-pin re-check as validate findings: every ACTIVE feature record\n * this service has attested, its pins graded against THIS working tree.\n *\n * Service-repo-scoped like `sources.*` and the gherkin chain — the citations\n * resolve only inside the service's own repository. From the docs repo this\n * TARGET is silent by design: every pin would grade `unresolved` there, which\n * would be a lie about the code rather than about the record, and\n * `sources.unverifiable-from-here` already names the blind spot once per\n * service. One code of the family is not about the code at all —\n * `evidence.record-unreadable` is about the record, which lives in the docs\n * repo — so the FEATURE target (`../feature.ts`) raises it too, from anywhere,\n * through `featureRecordFindings` below:\n * with only this target raising it, `validate --all` in the docs repo stayed\n * green over a conflict-marked record that `verify` refused and `status`,\n * `gate` and `tasks` all reported. In a service repo's `--all` the same file\n * is therefore named twice, once per target: here as this service's pins\n * going unchecked, there as the feature's record itself.\n *\n * ARCHIVED records are deliberately not linted (a v1 non-goal, recorded here):\n * a frozen record is history, post-ship code drift is normal evolution, and\n * grading it would turn every service's CI permanently yellow the week after\n * every ship. If audit-time re-checks of shipped records are ever wanted, the\n * same `lintEvidencePins` call over `listFeatures` include-archived is the\n * whole change — behind an explicit flag, so the default stays quiet.\n *\n * Everything here demotes reviewer confidence only: warns never flip `valid`,\n * `--strict` may gate on them as it gates on any warning, and no grade ever\n * moves a verdict — `attested` never silently becomes `verified` and a drifted\n * pin never un-confirms a claim.\n */\nimport { repoPath } from \"../../../core/envelope/json.js\";\nimport { inOrder } from \"../../../core/kernel/concurrency.js\";\nimport { type PathableService } from \"../../../core/kernel/ids/service.js\";\nimport { type FeatureEntry } from \"../../../core/repo/entries.js\";\nimport { listFeatures } from \"../../../core/repo/repo.js\";\nimport { readVerificationState } from \"../../../core/verify/read/file.js\";\nimport { lintEvidencePins, type PinDrift, type PinLint } from \"../../../core/verify/pins/lint.js\";\nimport { type Finding } from \"../../../core/vocabulary/report.js\";\nimport type { FleetContext } from \"../../../core/fleet-context.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\n\nexport async function evidencePinFindings(\n  docsDir: DocsDir,\n  service: PathableService,\n  repoDir: string | undefined,\n  fleet: FleetContext,\n): Promise<Finding[]> {\n  if (repoDir === undefined) return [];\n  // Membership questions cross the provenance line through plain strings by\n  // design (kernel/ids/service.ts) — record subjects are document text.\n  const me: string = service;\n  // ACTIVE features only — see the header for why archived records stay frozen.\n  const features = await listFeatures(docsDir, {}, fleet);\n  type Linted =\n    | null\n    | { feature: string; path: string; unreadable: string; advice: string }\n    | { feature: string; lint: PinLint };\n  const lints = await inOrder(features, async (feature): Promise<Linted> => {\n    // Three states, graded apart on purpose. ABSENT is a feature nobody has\n    // verified — legitimate silence. UNREADABLE is somebody's record this run\n    // could not use, and it must be a finding here rather than a skip: the\n    // damage that most plausibly breaks a record in a service repo's CI is a\n    // hand edit to the very pins this family grades, and a lint that went\n    // silent over it would turn \"someone broke the record\" into a green run —\n    // `verify` names the same file `record-unreadable`, but this CI job never\n    // runs verify. An unreadable record also cannot say whether it attests\n    // this service, so the finding fires regardless of attestation.\n    const read = await readVerificationState(feature.dir);\n    if (read.state === \"unreadable\") {\n      return { feature: feature.id, path: repoPath(docsDir, read.path), unreadable: read.reason, advice: read.advice };\n    }\n    if (read.state === \"absent\" || read.verification.schema !== 2) return null;\n    if (!(read.verification.attestations ?? []).some((a) => a.service === me)) return null;\n    return { feature: feature.id, lint: await lintEvidencePins(read.verification.claims, me, repoDir) };\n  });\n\n  const findings: Finding[] = [];\n  let checked = 0;\n  let pinnedRecords = 0;\n  let drifted = false;\n  for (const entry of lints) {\n    if (entry === null) continue;\n    if (\"unreadable\" in entry) {\n      findings.push({\n        severity: \"warn\",\n        code: \"evidence.record-unreadable\",\n        subject: service,\n        message: recordUnreadableMessage(`${me}: ${entry.feature}`, entry),\n      });\n      continue;\n    }\n    const { feature, lint } = entry;\n    if (lint.checked > 0 || lint.drifts.length > 0) pinnedRecords += 1;\n    checked += lint.checked;\n    // The code is spelled as a literal at each call below, and the grade rides\n    // beside it rather than being sliced back out of the code string — the\n    // codes-drift collector resolves the `code` slot, and a derivation would\n    // be a second definition of the pairing free to drift from the first.\n    const drift = (grade: PinDrift[\"grade\"], code: string, sentence: string): void => {\n      const drifts = lint.drifts.filter((d) => d.grade === grade);\n      if (drifts.length === 0) return;\n      drifted = true;\n      findings.push({\n        severity: \"warn\",\n        code,\n        subject: service,\n        message:\n          `${me}: ${feature}: ${drifts.length} recorded evidence pin(s) ${sentence} — ` +\n          \"a reading priority for the reviewer, never a verdict change; re-answer and re-record \" +\n          `(\\`loam verify ${feature} --service ${me} --record answers.json\\`) once the evidence is re-read`,\n        details: drifts.map(detailLine),\n      });\n    };\n    drift(\n      \"unresolved\",\n      \"evidence.unresolved\",\n      \"cannot be re-checked in this working tree: the cited file is gone, unreadable, not a regular file, or the cited line is past its end\",\n    );\n    drift(\"moved\", \"evidence.moved\", \"cite a file that changed since the record, though each cited line survives\");\n    drift(\"line-changed\", \"evidence.line-changed\", \"cite line(s) that no longer say what was recorded\");\n    drift(\n      \"token-missing\",\n      \"evidence.token-missing\",\n      \"cite file(s) that no longer contain the literal string the claim asserts\",\n    );\n    if (lint.unpinned > 0) {\n      findings.push({\n        severity: \"ok\",\n        // The pre-content_digest-vouch precedent: a record from before the\n        // capability existed is not wrong, it is unfindable-by-this-check.\n        code: \"evidence.unpinned\",\n        subject: service,\n        message:\n          `${me}: ${feature}: ${lint.unpinned} agent-confirmed citation(s) carry no evidence pin — ` +\n          `recorded before pins existed; the next \\`loam verify ${feature} --service ${me} --record\\` makes them drift-checkable`,\n      });\n    }\n  }\n  if (checked > 0 && !drifted) {\n    findings.push({\n      severity: \"ok\",\n      code: \"evidence.checked\",\n      subject: service,\n      message: `${me}: ${checked} evidence pin(s) across ${pinnedRecords} feature record(s) re-checked against this working tree`,\n    });\n  }\n  return findings;\n}\n\n/**\n * `evidence.record-unreadable` on the FEATURE target (`../feature.ts`), from\n * anywhere — the docs repo included, which is where the record lives. Kept\n * here, beside the service target's emission, so one module owns the code and\n * its words: the record read is the same `readVerificationState`, the path is\n * made docs-relative the same way, and the message is the same sentence.\n * Readability only — an `ok` record contributes nothing here, its verdict is\n * `verify`'s and `status`'s to state — and a warn for the reasons the header\n * gives: `valid` and `loam archive` are untouched, `--strict` is the lever.\n */\nexport async function featureRecordFindings(docsDir: DocsDir, feature: FeatureEntry): Promise<Finding[]> {\n  const read = await readVerificationState(feature.dir);\n  if (read.state !== \"unreadable\") return [];\n  const path = repoPath(docsDir, read.path);\n  return [\n    {\n      severity: \"warn\",\n      code: \"evidence.record-unreadable\",\n      message: recordUnreadableMessage(feature.id, { path, unreadable: read.reason, advice: read.advice }),\n      locations: [{ path, role: \"primary\" }],\n    },\n  ];\n}\n\n/**\n * The sentence `evidence.record-unreadable` carries, for both targets that\n * raise it. Each emission spells the code literally (the codes-drift\n * collector resolves the `code` slot, as `drift` above says); only the words\n * are shared, so the two cannot drift into two descriptions of one file.\n *\n * The reader's own recipe for the one file that failed, never a fixed one:\n * \"re-record\" alone sent this finding's reader into `--record`'s refusal of\n * the very same file, and the safe repair differs between a service's own\n * attestation file and the one-file record other services' evidence may sit\n * in. `path` is docs-relative.\n */\nfunction recordUnreadableMessage(\n  label: string,\n  file: { path: string; unreadable: string; advice: string },\n): string {\n  return (\n    `${label}: ${file.path} exists but cannot be read as a verification record (${file.unreadable}) — ` +\n    `none of its evidence was checked. ${file.advice} loam never overwrites a record it could not read`\n  );\n}\n\n/** One drift as a detail line: which claim, which citation, what changed. */\nfunction detailLine(d: PinDrift): string {\n  return `${d.claim} ${d.evidence} — ${d.what}`;\n}\n"]}

package/dist/commands/validate/service/service.js

@@ -18,13 +18,10 @@ import {} from "../../../core/kernel/ids/service.js";
 import { landscapePath as landscapeFile, permissionsPath } from "../../../core/repo/paths.js";
 import { locateServicePaths } from "../../../core/repo/service-target.js";
 import { readVocabulary } from "../../../core/permissions/permissions.js";
-import { readCapabilityVocabulary } from "../../../core/capabilities/capabilities.js";
-import { capabilityRequirementIndex, capabilityUnknownFindings } from "../../../core/capabilities/findings.js";
-import { realizesStaleFindings, realizesUnknownFindings } from "../../../core/capabilities/realizes/findings.js";
-import { parseRequirements, readRequirementsDocument } from "../../../core/document/parse.js";
+import { capabilityRequirementIndex, capabilityUnknownIssues } from "../../../core/capabilities/findings.js";
+import { realizesStaleFindings, realizesUnknownIssues } from "../../../core/capabilities/realizes/findings.js";
 import { requiresUnknownFindings } from "../checks/requirements.js";
 import { listServices } from "../../../core/repo/repo.js";
-import {} from "../../../core/c4/likec4.js";
 import {} from "../../../core/vocabulary/report.js";
 import { closeIds } from "../../../core/c4/arch.js";
 import { serviceProvenance } from "../../../core/provenance/findings.js";
@@ -35,7 +32,8 @@ import { interruptedCommitFinding } from "../../../core/staging/recovery/finding
 import { FleetContext } from "../../../core/fleet-context.js";
 import { serviceLinkFindings } from "../links/corpus.js";
 import { sourceScopeFindings } from "../checks/sources.js";
-import { apiAxisFindings, generatedContractFindings } from "./api.js";
+import { apiAxisFindings } from "./api.js";
+import { generatedContractFindings } from "./contracts/generated.js";
 import { evidencePinFindings } from "./evidence-pins.js";
 import { spineFindings } from "./spine.js";
 import { eventAxisFindings } from "./events/events.js";
@@ -91,15 +89,6 @@ export async function validateService(check) {
     // through the same resolver: an extending model's own slice is exactly the
     // elements this set makes resolvable.
     const known = new Set((await listServices(docsDir, fleet)).map((s) => s.id));
-    /**
-     * The read index this target reads the fleet map and the model through.
-     *
-     * A single-service run may arrive without one, and it gets its own rather
-     * than a second reading rule: `serviceModel` needs the enumeration and a
-     * document memo to answer at all, and both live here. Request-scoped like
-     * every other `FleetContext` — created for this call, dropped with it.
-     */
-    const context = fleet ?? new FleetContext();
     // C4 model. Its absence is an error — this is where `adopt` comes in — but it
     // must NOT silence the rest of the gate stack: `loam archive` of a feature
     // introducing a new service creates exactly this state (spec.md, arch.spec.md,
@@ -133,7 +122,7 @@ export async function validateService(check) {
         });
     }
     else {
-        model = await context.serviceModel(docsDir, paths);
+        model = await fleet.serviceModel(docsDir, paths);
         elements = model.doc.elements;
         relationships = model.doc.relationships;
         if (!model.mapUnreadable && model.doc.errors.length === 0) {
@@ -174,7 +163,7 @@ export async function validateService(check) {
     // Still gated on the landscape FILE existing: `land === null` means "this repo
     // draws no fleet", and a repo with an `architecture/usecases/` and no map is
     // that state, not a map that loaded empty.
-    const land = preloaded ?? (existsSync(landscapeFile(docsDir)) ? await context.architecture(docsDir) : null);
+    const land = preloaded ?? (existsSync(landscapeFile(docsDir)) ? await fleet.architecture(docsDir) : null);
     // Where a standalone model's copies of the map's elements have drifted. After
     // `c4.valid` because it is a claim about a model that parsed, and silent for
     // an extending model, which has no copy to diverge.
@@ -233,13 +222,14 @@ export async function validateService(check) {
         elements,
         relationships,
         // The one fact that tells "this service models nothing" apart from "this
-        // service's model could not be read": both arrive here as empty lists, and
+        // service's model could not be read" — its map does not parse, or it does
+        // not itself (`c4.invalid` above): both arrive here as empty lists, and
         // only the second one must silence `covers.unknown`.
-        mapUnreadable: model?.mapUnreadable === true,
+        modelUnreadable: model !== null && (model.mapUnreadable || model.doc.errors.length > 0),
         land,
         known,
         docsDir,
-        fleet: context,
+        fleet,
     })));
     // The service's own use cases, GRADED — scanned beside the model above. Here
     // rather than on the fleet target because the hops name this service's
@@ -261,20 +251,20 @@ export async function validateService(check) {
     // rides the same loop against ITS fleet vocabulary; under --all the fleet
     // memo makes that one parse for the whole run.
     const vocabulary = await readVocabulary(permissionsPath(docsDir));
-    const capabilities = fleet === undefined ? await readCapabilityVocabulary(docsDir) : await fleet.capabilities(docsDir);
+    const capabilities = await fleet.capabilities(docsDir);
     // The requirement-level index behind `Realizes:`. Built once for both axes,
-    // and behind the same ladder `capabilityUnknownFindings` applies — an absent
+    // and behind the same ladder `capabilityUnknownIssues` applies — an absent
     // or unreadable vocabulary means no reads and no grades at all, so a fleet
     // that has not adopted the axis pays nothing for a line it never wrote.
-    const capabilityReqs = await capabilityRequirementIndex(capabilities, fleet === undefined ? async (p) => parseRequirements(await readRequirementsDocument(p)) : (p) => fleet.readRequirements(p));
+    const capabilityReqs = await capabilityRequirementIndex(capabilities, (p) => fleet.readRequirements(p));
     for (const [label, docReqs] of [
         ["spec.md", reqs],
         ["arch.spec.md", archReqs],
     ]) {
         const target = { where: `${service}: ${label}`, subject: service };
         findings.push(...requiresUnknownFindings(docReqs, target, vocabulary));
-        findings.push(...capabilityUnknownFindings(docReqs, target, capabilities));
-        findings.push(...realizesUnknownFindings(docReqs, target, capabilityReqs));
+        findings.push(...capabilityUnknownIssues(docReqs, target, capabilities));
+        findings.push(...realizesUnknownIssues(docReqs, target, capabilityReqs));
         findings.push(...realizesStaleFindings(docReqs, target, capabilityReqs));
         // The grammar guard, last in the loop: it grades the KEYS the three checks
         // above resolve values from, so a line none of them saw is reported here
@@ -287,7 +277,7 @@ export async function validateService(check) {
     // document checks and adds no input any of them depend on.
     findings.push(...(await serviceLinkFindings({ docsDir, subject: service, fleet }, paths)));
     // Provenance last: who vouched for this, and what code it was written from.
-    findings.push(...(await serviceProvenance(docsDir, service, { repoDir, fleet })));
+    findings.push(...(await serviceProvenance(docsDir, service, { repoDir, loamOwned: check.loamOwned, fleet })));
     findings.push(...(await sourceScopeFindings(docsDir, service, repoDir, fleet)));
     // The build's own contract against the committed copy. Service-repo only:
     // from the docs repo there is no build output to read, and the family stays