aw-spec-cli 0.1.5 → 0.1.7

package/assets/docs/components/README.md

@@ -1,74 +0,0 @@
-# Framework Components — Integration Catalog
-
-> Pure technology (domain-agnostic). These docs are the authoritative integration contracts for
-> opt-in AppWeaver framework components. An AI coding agent (or a human) MUST read the relevant
-> component folder **before** wiring the component into a project.
-> Commands: `/aw-spec-add-component`.
-
-Each component is an optional NuGet-distributed building block that plugs into the standard
-AppWeaver layout (see [[folder-structure]]) via the same **provider/registry** registration
-pattern: `AddXxx(builder => builder.UseProvider(...), options => options.Provider = "Key")`.
-Your application code depends only on the component's **abstraction interface** — the concrete
-provider is a single registration decision and is swappable with zero changes to feature code.
-
-## Available components
-
-| Component | Abstraction | Folder | Use when… |
-|---|---|---|---|
-| **Email** | `IEmailService` | [Email](./Email/README.md) | Sending transactional/notification email (MsGraph, SMTP, SendGrid, OAuth2, File). |
-| **QrGenerator** | `IQRGenerator` | [QrGenerator](./QrGenerator/README.md) | Generating QR-code PNG images from text. |
-| **Jobs** | `IJobScheduler` | [Jobs](./Jobs/README.md) | Background jobs — fire-and-forget, delayed, recurring, with progress + status polling. |
-
-## How each component folder is organized
-
-Every folder contains two independent, agent-readable files:
-
-| File | Purpose | Read it to… |
-|---|---|---|
-| `README.md` | Reference — what the component is, its contract, packages, implementations, file map. | Understand the API surface and the available implementations. |
-| `integration.md` | **Agent runbook** — an ordered workflow that asks the user which implementation(s) to use, then adds the matching code. | Drive the integration interactively, end to end. |
-
-## Integration workflow (every component's `integration.md` follows this shape)
-
-1. The agent reads `README.md` + `integration.md` and locates the target projects.
-2. The agent presents the component's **implementation catalog** as a selection list and **asks the
-   user** which implementation(s) to wire — via a multi-select prompt (`AskUserQuestion`,
-   `multiSelect: true`). The user may pick more than one (e.g. a production transport + a local-dev one).
-3. The agent applies the **common steps** once, then the **per-implementation block** for each
-   selected implementation, and sets the default provider.
-4. The agent runs the **verification** checklist and reports what was added.
-
-## Cross-cutting rules (apply to every component)
-
-- **R0.1** — NuGet versions live in `Directory.Packages.props` only (`<PackageVersion>`); project
-  files reference the package **without** a `Version=` attribute (see [[dependency-policy]]).
-- **R0.2** — Register the component in the **startup/host project** — the one project that owns
-  `Program.cs` + the ASP.NET Core web SDK. Its name is template-dependent: `<App>.Service` (Vertical
-  Slice foundation), `<App>.API` (Modular Monolith foundation), and possibly other names as templates
-  are added — so **resolve it by locating `Program.cs`, never by assuming a fixed project name**.
-  These foundations have **no** separate `…Application` / `…Infrastructure` project. Put the
-  `AddXxx(...)` registration in that project's `Extensions/InfrastructureServiceRegistration.cs`
-  (`AddInfrastructure`) when that extension exists, otherwise directly in `Program.cs` before
-  `builder.Build()`. Never register in a feature slice or domain code (see [[clean-architecture]]).
-- **R0.2a** — *(dual local/Aspire startup)* Some foundations split infrastructure registration across
-  **two** methods that `Program.cs` selects at runtime — `if (isAspire) AddAspireInfrastructure(...)`
-  (the Aspire path: `Extensions/AspireInfrastructureExtensions.cs`, typically PostgreSQL + Redis)
-  `else AddInfrastructure(...)` (the local/dev path:
-  `Extensions/InfrastructureServiceRegistration.cs`, typically SQLite + in-memory cache). When
-  **both** methods exist, add the component registration to **both**, or the abstraction is
-  unresolvable in whichever run mode you skipped (e.g. `IEmailService` throws at runtime under
-  Aspire). The registration block is **identical** in both — copy it verbatim — *except*
-  provider-specific calls (connection strings, `UseSqlite(...)` vs `UseNpgsql(...)`, cache provider),
-  which must match each method's existing provider. If only `AddInfrastructure` (or only `Program.cs`)
-  exists, register once as in R0.2.
-- **R0.3** — Inject the **abstraction** (`IEmailService`, `IQRGenerator`, `IJobScheduler`) into
-  handlers — never the concrete provider type (see [[cqrs]]).
-- **R0.4** — Always set `options.Provider = "<Key>"` explicitly. Do not rely on the implicit
-  "first registered" fallback — it is order-dependent and, for Email, hardcoded.
-- **R0.5** — Secrets (client secrets, API keys, SMTP passwords, connection strings) MUST NOT be
-  committed. Use user-secrets / environment variables / key vault (see [[ai-rules]]).
-
-## Related
-
-- [[folder-structure]] · [[clean-architecture]] · [[cqrs]] · [[vertical-slices]] ·
-  [[dependency-policy]] · [[persistence]]

package/assets/docs/domain/domain-driven-design.md

@@ -1,212 +0,0 @@
-# Domain-Driven Design Standards (Tactical Patterns)
-
-> Pure technology (domain-agnostic) — generic DDD tactical patterns; the business model, canonical aggregates + invariants are in [[domain-driven-design.domain]]. NON-NEGOTIABLE. Commands: `/aw-spec-specify`.
-
-> Note: this file lives under `domain/` because DDD is a domain-modeling methodology, but the
-> rules here are domain-agnostic and reusable. The business-specific model is in the companion
-> `.domain.md`.
-
-## Ubiquitous language & bounded contexts
-
-- Use a consistent ubiquitous language across each bounded context.
-- Each bounded context = one module with `Domain / Features / Persistence / Shared`
-  (see [[modular-monolith]]).
-
-## Aggregate design
-
-- Every entity exposed to the Application layer is reached through an **Aggregate Root**.
-- Aggregate roots implement `IAggregateRoot`, `EntityBase<TId>`, and the
-  audit/soft-delete/concurrency/domain-event interfaces they need:
-  `IFullAuditedObject` or `IAuditableEntityBase`, `ISoftDeletable`, `IConcurrencyTracked`,
-  `IHasDomainEvents`, `INamedEntity<TId>` when listable.
-
-### Aggregate root responsibilities
-
-- Enforce all invariants for the aggregate.
-- Own the lifecycle of its child entities.
-- Raise domain events for state transitions.
-
-### Child entity ownership
-
-- Child entities implement `IAggregateChild` and expose `GetAggregateRoot()`.
-- They are mutated **only** through methods on the aggregate root.
-
-## Transactional / consistency boundaries
-
-- **Transaction boundary equals aggregate boundary**: a single command mutates a single
-  aggregate per transaction.
-- Cross-aggregate effects flow through **domain events** or **follow-up commands**
-  (see [[eventing]], [[cqrs]]).
-
-## Strongly typed IDs
-
-- IDs are **strongly-typed Vogen value objects** (`<Aggregate>Id` as
-  `[ValueObject<Guid>] partial struct`).
-- Raw `Guid` parameters at the Application boundary **MUST be wrapped** at the handler edge.
-
-## Value objects
-
-- Value Objects are **sealed**, have **private constructors**, **validate in the constructor**,
-  throw `DomainException` on invariant violations, and expose a `From(...)` factory.
-
-## Domain events
-
-- Derive from `DomainEventBase`, are immutable, added inside aggregate methods via
-  `AddDomainEvent(...)`, published explicitly by command handlers. See [[eventing]].
-
-## Domain services, repositories, specifications
-
-- Invariants are enforced **inside the aggregate**; validators check request shape only.
-- Repository usage is limited to `IRepository<T>` / `IReadRepository<T>` + `Specification<T>`.
-- Specification pattern: query composition lives in the Domain. See [[persistence]].
-
-## Domain exception handling
-
-- Exceptions are thrown by the Domain only (`DomainException`, `InvariantViolationException`).
-  Application code returns `Result<T>` (see [[cqrs]]).
-
-## Encapsulation, immutability, audit-awareness
-
-- **Rich domain model** — no public setters on aggregates, no business logic in handlers.
-- Soft-delete and audit behavior are first-class on protected aggregates
-  (see [[persistence]], [[auditing]]).
-
-## Anti-patterns (FORBIDDEN)
-
-- **Anemic domain models** — no public setters, no "manager/service" classes mutating
-  aggregate state from outside, no primitive-typed IDs, no business logic in handlers.
-- Cross-aggregate EF navigation properties — reference by strongly-typed ID only.
-- Cross-bounded-context interaction except via Shared DTOs / `IMediator` / anti-corruption
-  adapters.
-
-## Canonical example (agent reference — `<SampleProjectName>` sample)
-
-Aggregate root with a strongly-typed Vogen ID, owned child collection, concurrency token,
-domain events, and an invariant enforced **inside** the aggregate:
-
-```csharp
-// <SampleProjectName>.Service/Projects/Domain/Project.cs
-[ValueObject<Guid>]
-public partial struct ProjectId { }
-
-public class Project :
-    EntityBase<ProjectId>, IAggregateRoot, IFullAuditedObject, IFieldAudited,
-    ISoftDeletable, IConcurrencyTracked, IHasDomainEvents, INamedEntity<ProjectId>
-{
-    private readonly List<ProjectTask> _tasks = new();
-
-    public string Name { get; set; } = default!;               // INamedEntity
-    public ProjectCode Code { get; private set; } = default!;   // value object
-    public ProjectStatus Status { get; private set; }
-    public TaskUserId? OwnerId { get; private set; }            // cross-aggregate ref by ID only
-    public IReadOnlyCollection<ProjectTask> Tasks => _tasks.AsReadOnly();
-
-    public byte[] RowVersion { get; set; } = Array.Empty<byte>();  // IConcurrencyTracked
-
-    private readonly List<DomainEventBase> _domainEvents = new();
-    [NotMapped] public IEnumerable<DomainEventBase> DomainEvents => _domainEvents.AsReadOnly();
-    public void ClearDomainEvents() => _domainEvents.Clear();
-
-    private Project() { }   // EF Core ctor
-
-    public Project(string code, string name, DateOnly startDate, TaskUserId? ownerId)
-    {
-        Id = ProjectId.From(Guid.NewGuid());
-        Code = ProjectCode.From(code);          // VO validates in its ctor
-        Name = ProjectTitle.From(name).Value;
-        Status = ProjectStatus.Planning;
-        OwnerId = ownerId;
-        AddDomainEvent(new ProjectCreatedEvent(Id.Value, Code.Value, Name));
-    }
-
-    // Invariant lives in the aggregate — never in the handler/validator.
-    public ProjectTask AddTask(string title, TaskPriority priority)
-    {
-        if (Status is ProjectStatus.Cancelled or ProjectStatus.Archived)
-            throw new DomainException("Cannot add tasks to a Cancelled or Archived project.");
-        var task = new ProjectTask(Id, title, priority);
-        _tasks.Add(task);
-        AddDomainEvent(new TaskCreatedEvent(Id.Value, task.Id.Value, task.Title.Value));
-        return task;
-    }
-
-    private void AddDomainEvent(DomainEventBase e) => _domainEvents.Add(e);
-}
-```
-
-Value object — sealed, private ctor, validates in the ctor, `From(...)` factory,
-throws `DomainException`:
-
-```csharp
-// <SampleProjectName>.Service/Projects/Domain/ProjectCode.cs
-public sealed class ProjectCode : IEquatable<ProjectCode>
-{
-    private static readonly Regex _valid = new(@"^[A-Z0-9][A-Z0-9\-]{1,14}$", RegexOptions.Compiled);
-    public string Value { get; private set; } = default!;
-
-    private ProjectCode() { }
-    private ProjectCode(string value)
-    {
-        if (string.IsNullOrWhiteSpace(value))
-            throw new DomainException("Project code cannot be empty.");
-        var trimmed = value.Trim().ToUpperInvariant();
-        if (!_valid.IsMatch(trimmed))
-            throw new DomainException("Project code must be uppercase alphanumeric with hyphens.");
-        Value = trimmed;
-    }
-
-    public static ProjectCode From(string value) => new(value);
-    public bool Equals(ProjectCode? o) => o is not null && Value == o.Value;
-    public override bool Equals(object? obj) => Equals(obj as ProjectCode);
-    public override int GetHashCode() => HashCode.Combine(Value);
-}
-```
-
-Child entity — implements `IAggregateChild`, exposes `GetAggregateRoot()`, has only `private`
-setters, and is mutated **only** through methods the parent aggregate calls:
-
-```csharp
-// <SampleProjectName>.Service/Projects/Domain/ProjectTask.cs
-[ValueObject<Guid>]
-public partial struct ProjectTaskId { }
-
-public class ProjectTask : EntityBase<ProjectTaskId>, IAggregateChild
-{
-    public ProjectId ProjectId { get; private set; }            // FK back to the root
-    public TaskTitle Title { get; private set; } = default!;    // value object
-    public ProjectTaskStatus Status { get; private set; }
-    public TaskUserId? AssigneeId { get; private set; }         // cross-aggregate ref by ID
-
-    public Project Project { get; private set; } = default!;    // EF-only nav, private setter
-    public object GetAggregateRoot() => Project;                // IAggregateChild
-
-    private ProjectTask() { }                                   // EF Core ctor
-    public ProjectTask(ProjectId projectId, string title, TaskPriority priority)
-    {
-        Id = ProjectTaskId.From(Guid.NewGuid());
-        ProjectId = projectId;
-        Title = TaskTitle.From(title);
-        Status = ProjectTaskStatus.Open;
-        Priority = priority;
-    }
-
-    // State-machine invariant lives on the child; the parent calls it (project.ChangeTaskStatus).
-    public void ChangeStatus(ProjectTaskStatus newStatus)
-    {
-        if (Status == ProjectTaskStatus.Cancelled)
-            throw new DomainException("A cancelled task cannot be re-opened.");
-        Status = newStatus;
-    }
-
-    public void AssignTo(TaskUserId assigneeId) => AssigneeId = assigneeId;
-}
-```
-
-> The aggregate root mutates children only through its own methods (e.g. `Project.AssignTask`
-> calls `task.AssignTo(...)` and raises the domain event) — callers never touch `ProjectTask`
-> directly. EF mapping for the owned collection is in [[persistence]].
-
-## Related
-
-- [[modular-monolith]] · [[clean-architecture]] · [[cqrs]] · [[persistence]] ·
-  [[eventing]] · [[domain-driven-design.domain]]

package/assets/docs/domainspecs/healthcare/ai-rules.domain.md

@@ -1,34 +0,0 @@
-# AI Operational Rules — Healthcare Domain Addenda
-
-> Technology base: [[ai-rules]]. Commands: **ALL**.
-
-## Context & codes
-- FHIR types: use the **official FHIR .NET SDK**, version-matched (R4/R5) to the endpoint (see [[fhir]]).
-- Confirm coded values against the Terminology module's value sets; never invent ICD/SNOMED/LOINC/CPT codes (see [[terminology]]).
-
-## Generation
-- A complete slice adds a FHIR projector + FHIR-validator test when applicable (see [[fhir]], [[testing.domain]]).
-- Generated FHIR resources MUST honor declared IG profiles and pass the FHIR validator (see [[fhir]]).
-- Comments are reserved for clinical intent (generic rule in [[ai-rules]]).
-
-## PHI masking
-- MUST NOT log, echo, or commit any field of `Patient`/`Encounter`/`Observation`/`MedicationRequest`/`ClinicalNote`/`DiagnosticReport`/`Claim`/`Coverage` other than the strongly-typed ID.
-- Apply field-level redaction in every generated example payload (see [[data-classification.domain]], [[hipaa]]).
-
-## Tests
-- MUST use the synthetic-PHI fixture library (`<SampleProjectName>.TestFixtures`); never inline fabricated PHI.
-- Never invent ICD/SNOMED/LOINC/CPT/HCPCS/RxNorm/CVX codes — use a sentinel constant (see [[testing.domain]], [[terminology]]).
-
-## Security-touching code
-- MUST NOT modify authorization handlers, scope evaluators, consent checks, audit emitters, or encryption code without an explicit security-reviewer-attached prompt (see [[authorization.domain]], [[auditing.domain]], [[consent]]).
-- FHIR profile changes: regenerate the IG artifacts + CapabilityStatement in the **same commit** (see [[fhir]], [[api-versioning.domain]]).
-
-## Refusal conditions — extend [[ai-rules]]; refuse to:
-- Embed any PHI test fixture in code/config.
-- Disable a consent check globally.
-- Bypass Interop adapters by writing aggregates directly from an external feed (see [[hl7]], [[eventing.domain]]).
-- Generate de-identification logic without a documented method (Safe Harbor / Expert Determination) (see [[hipaa]]).
-- Return PHI in error messages, logs, or trace attributes (see [[data-classification.domain]]).
-
-## Related
-- [[ai-rules]] · [[fhir]] · [[terminology]] · [[hipaa]] · [[consent]] · [[data-classification.domain]] · [[auditing.domain]] · [[authorization.domain]] · [[testing.domain]]

package/assets/docs/domainspecs/healthcare/api-versioning.domain.md

@@ -1,17 +0,0 @@
-# API Versioning — Healthcare Domain Addenda (FHIR)
-
-> Technology base: [[api-versioning]]. Commands: `/aw-spec-specify`, `/aw-spec-gate`.
-
-## FHIR versioning
-- R4 default; R5 is **additive** under a versioned path (`/fhir/R5/...`).
-- Breaking FHIR changes require a **new version path** + a published CapabilityStatement diff (see [[fhir]]).
-- FHIR list endpoints use Bundle/searchset semantics (`_count`, `_offset`/`_page`, `_total`).
-
-## Concurrency at the edge
-- FHIR resources honor `If-Match` via the aggregate's concurrency token → FHIR **weak** ETag at the projection boundary (see [[persistence.domain]]).
-
-## CapabilityStatement
-- Published for FHIR (beyond generic OpenAPI/AsyncAPI); regenerates cleanly in CI; diff reviewed for breaking changes (see [[fhir]], [[coding-standards.domain]]).
-
-## Related
-- [[api-versioning]] · [[fhir]] · [[persistence.domain]] · [[coding-standards.domain]]

package/assets/docs/domainspecs/healthcare/auditing.domain.md

@@ -1,97 +0,0 @@
-# Auditing — Healthcare Domain Addenda (ATNA)
-
-> Technology base: [[auditing]]. NON-NEGOTIABLE. Consumed by `/aw-spec-specify` (LIFTS the
-> auditing requirement into the spec) and `/aw-spec-gate` (VALIDATES the spec/design realise it).
-> `/aw-spec-design` and `/aw-spec-implement` never load this file — auditing reaches them through
-> the spec's **declared audit level per aggregate**, and the enablement mechanics live in the
-> technical base [[auditing]]. Keep this file technology-agnostic (levels + rules, **no code**).
-
-## Two auditing levels (framework-supported)
-
-AppWeaver auditing has exactly **two levels** for entity state-change auditing; the framework's
-audit interceptor populates every audit field automatically (handlers NEVER assign audit fields):
-
-| Level | Captures | Depth |
-|---|---|---|
-| **Basic** | who/when lifecycle — created / modified / (soft-)deleted, by whom and when; one audit entry per aggregate root per save (who · action · resource type · resource id · timestamp · correlation) | entity-level (Created/Updated/Deleted) — **no** before/after values |
-| **Advanced** | everything Basic captures **plus field-level before/after** — each changed property's previous → new value | entity-level **+ property-level previous/new value** |
-
-- **Advanced is REQUIRED whenever the spec asks for "previous value / new value"** — before/after
-  values exist ONLY at the Advanced tier.
-- Child entities fold their changes into the owning aggregate root's audit entry.
-- Beyond state-change auditing, healthcare additionally requires **PHI access (read) auditing** —
-  a separate mandatory concern (see below), not one of the two write-levels.
-
-> Code realisation — marker interfaces (Basic = `IAuditedObject` / `IFullAuditedObject`; Advanced =
-> `+ IFieldAudited`), the one-time composition, and the audit query API — lives in the technical
-> base. See [[auditing]]; `/aw-spec-design` and `/aw-spec-implement` get the HOW from there.
-
-## Aggregate assignment rule (how specify decides the level)
-
-`/aw-spec-specify` MUST assign an audit level to every aggregate it models and LIFT it into the
-spec as an explicit, developer-editable declaration:
-
-- Every **PHI-bearing main aggregate** of the requirement → **Advanced** (regulated PHI change
-  history requires field-level before/after).
-- **Supporting aggregates** (collaborating/referenced roots, no PHI) → **Basic** by default.
-- A developer MAY raise or lower a level afterwards by editing the spec declaration — the level is
-  a **spec** decision, never a design or implementation one. `/aw-spec-design` then follows the
-  declared level.
-
-Lift it as one line the gate can check, e.g. under Constraints:
-
-> **CN-0xx**: Auditing level — `<PHIAggregate>` uses **Advanced** (field-level before/after)
-> auditing; `<SupportingAggregate…>` use **Basic** (lifecycle) auditing; all PHI access and change
-> is audit-mandatory and append-only. — lifted from auditing.domain.
-
-Declare the **level** — do NOT enumerate the audit record's field shape in the spec (next section).
-
-## PHI access auditing (ATNA — mandatory)
-
-Distinct from state-change auditing: every PHI **read/access**, authentication, consent change,
-export, and break-the-glass MUST emit an audit event (a PHI-access-audit pipeline behavior runs on
-every mediator request). Audit-mandatory triggers:
-
-- Every PHI **read** and **write**; every authentication; every consent change; every export
-  (`$export`, bulk / report download); every **break-the-glass**; every privileged admin action;
-  every IdP / role change. See [[authorization.domain]].
-
-## Spec-required vs framework-emitted (what the gate checks)
-
-The audit record's field shape is **framework-emitted** — the interceptor populates it; it is NOT
-spec-authored content. Fields the platform always supplies:
-
-- `timestamp`, acting `subjectId` (user), `action`, `resourceType`, `resourceId`, `sourceIp`,
-  `correlationId`, `tenantId`, and the physical record layout.
-
-Split for the gate:
-
-- **Spec-required** (specify lifts it; the gate checks the spec + design carry it): the **audit
-  level per aggregate**; that PHI access/change is **audit-mandatory** and **append-only**; and the
-  ATNA business capture — **patientId** (whose PHI), **subjectRole**, **outcome** (grant/deny),
-  **reason** (break-the-glass justification), and **Previous Value / New Value** (Advanced).
-- **Framework-emitted** (NEVER a spec/design gap — always populated by the platform): the fields
-  listed above. The gate MUST NOT raise a LIFT-FAILURE for them; they are guaranteed by the
-  framework, not authored in the spec.
-
-## Queryable audit (framework-provided)
-
-The audit store is queryable out of the box (by resource identity, by user/subject, by tenant, and
-by action/time with paging — see [[auditing]]). A spec "queryable audit trail for compliance /
-ATNA review" success criterion is therefore satisfied by the framework's audit query API; design
-references it and does **NOT** need a bespoke audit read port/model.
-
-## Retention & format
-
-- **Append-only**; retained **>= 6 years**; exportable as FHIR `AuditEvent` (see
-  [[domain-driven-design.domain]], [[persistence.domain]]).
-
-## Telemetry & breach
-
-- **PHI, full SSN, payment-card numbers, government IDs MUST NEVER** appear in logs, metric labels,
-  exception messages, or traces (see [[data-classification.domain]]).
-- Anomalous PHI access (volume spikes, off-hours mass reads, repeated denials) emits **Critical**
-  alerts (see [[hipaa]]).
-
-## Related
-- [[auditing]] · [[hipaa]] · [[data-classification.domain]] · [[authorization.domain]] · [[consent]] · [[fhir]] · [[cqrs.domain]] · [[persistence.domain]] · [[domain-driven-design.domain]]

package/assets/docs/domainspecs/healthcare/authorization.domain.md

@@ -1,26 +0,0 @@
-# Authorization — Healthcare Domain Addenda
-
-> Technology base: [[authorization]]. Commands: `/aw-spec-constitution`, `/aw-spec-specify`, `/aw-spec-gate`.
-
-## Roles
-`SystemAdmin`, `ComplianceOfficer`, `Physician`, `Nurse`, `LabTechnician`, `Radiologist`, `Pharmacist`, `BillingClerk`, `FrontDesk`, `Patient`, `ExternalSystem`, `ResearchAnalyst` (de-identified scope only). Per-route matrix: `docs/security/authorization-matrix.md`.
-
-## SMART-on-FHIR scopes
-- Scopes (`patient/*.read`, `user/Observation.read`, `system/*.write`, `launch/patient`) MUST be enforced on **every FHIR endpoint**.
-- App launch (EHR + standalone): **PKCE mandatory; implicit flow FORBIDDEN** (see [[fhir]]).
-
-## PHI minimum-necessary
-- The PHI-access pipeline returns only fields the caller's role + scopes authorize; field-level redaction lives in projection extensions (see [[hipaa]], [[data-classification.domain]]).
-
-## Consent & break-the-glass
-- Pipeline checks **consent state** before releasing PHI outside the treating-provider context (see [[consent]]).
-- Break-the-glass = explicit emergency-access command: documented reason + high-priority audit + real-time alert (see [[consent]], [[auditing.domain]]).
-
-## Audit-mandatory
-Every PHI read/write, authentication, consent change, export, break-the-glass, privileged admin action, IdP/role change (see [[auditing.domain]]).
-
-## Anonymous allowlist
-- Adds `/metadata` (FHIR CapabilityStatement) to the generic allowlist (see [[fhir]]).
-
-## Related
-- [[authorization]] · [[hipaa]] · [[consent]] · [[auditing.domain]] · [[data-classification.domain]] · [[fhir]]

package/assets/docs/domainspecs/healthcare/clinical-terms.md

@@ -1,20 +0,0 @@
-# Glossary — Clinical Terms
-
-> Ubiquitous language for clinical aggregates. Commands: `/aw-spec-constitution`, `/aw-spec-specify`. See [[domain-driven-design.domain]] (modeling) + [[terminology]] (coding).
-
-| Term | Definition |
-|---|---|
-| **MRN** | Patient identifier, **unique per tenant** on `Patient` (Patients); cross-referenced via PIX/PDQ (see [[integration-terms]]). |
-| **Encounter** | Clinical interaction (inpatient/outpatient/emergency); owns Admission/Transfer/Discharge; not Closeable with open Orders/Results/ChargeItems/unsigned ClinicalNotes (Encounters). |
-| **Observation** | A discrete measurement/finding — vitals/social history (EMR) or lab result (Lab); coded LOINC/SNOMED (see [[terminology]]). |
-| **Coverage** | Patient insurance record (Insurance); required (or documented self-pay) before admission. |
-| **PractitionerRole** | A Practitioner's role within an Organization/Location (Identity) — drives role-based auth (see [[authorization.domain]]). |
-| **CarePlan** | A planned set of clinical activities (EMR). |
-| **DiagnosticReport** | A finalized result set with interpretation — radiology (Radiology) or lab (Lab). |
-| **ClinicalNote** | Documentation entry; once **Signed** immutable; corrections are addenda; deletion forbidden (supersede via Amend). |
-| **ProblemList / AllergyIntolerance / MedicationStatement / Immunization / Procedure / ServiceRequest** | EMR aggregates; coded SNOMED/ICD/RxNorm/CVX as applicable. |
-| **MedicationRequest / MedicationDispense / MedicationAdministration** | Pharmacy aggregates; dispense blocked on allergy/interaction/contraindication without documented override. |
-| **Consent** | First-class aggregate governing PHI disclosure; withdrawal blocks disclosure immediately (see [[consent]]). |
-
-## Related
-- [[integration-terms]] · [[domain-driven-design.domain]] · [[terminology]] · [[fhir]]

package/assets/docs/domainspecs/healthcare/coding-standards.domain.md

@@ -1,26 +0,0 @@
-# Coding Standards — Healthcare Domain Addenda
-
-> Technology base: [[coding-standards]]. Commands: `/aw-spec-gate`.
-
-## Coded value objects
-- Follow the FHIR pattern: `Codeable`, `Coding`, `Quantity`, `Period`, `Range`, `Ratio`, `Identifier`, `HumanName`, `Address`, `ContactPoint` (see [[terminology]]).
-- The Domain may additionally throw `ConsentDeniedException` (see [[consent]]).
-
-## Forbidden patterns — extend [[coding-standards]]
-- **H1.** Hard delete of any clinical/financial/audit/PHI-bearing aggregate (see [[persistence.domain]]).
-- **H2.** Hard-coded IdP issuer / FHIR server / HL7 endpoint URLs, or PHI test fixtures, in source.
-- **H3.** Logging/emitting any PHI element, full SSN/government ID (see [[data-classification.domain]]).
-- **H4.** Storing patient data (names, MRNs, DOBs, diagnoses, meds, labs, imaging) as free text when a coded vocabulary applies (see [[terminology]]).
-- **H5.** A second FHIR write path bypassing the canonical aggregate (see [[fhir]]).
-- **H6.** Storing/transmitting PHI to any non-production environment (see [[hipaa]]).
-- **H7.** FHIR errors not using `OperationOutcome` with HTTP 422 (see [[fhir]]).
-
-## Quality gates — extend [[coding-standards]]
-- **HG1.** FHIR CapabilityStatement regenerates cleanly; diff reviewed (see [[fhir]]).
-- **HG2.** FHIR validator passes for every modified resource/profile/example.
-- **HG3.** Grep: no PHI string literals in tests outside sanctioned fixtures; no MediatR/AutoMapper.
-- **HG4.** PHI-logging analyzer passes — no Patient/Encounter/Observation/MedicationRequest field logged except the ID (see [[data-classification.domain]]).
-- **HG5.** Security-reviewer sign-off for any PHI-access change.
-
-## Related
-- [[coding-standards]] · [[terminology]] · [[fhir]] · [[hipaa]] · [[consent]] · [[data-classification.domain]] · [[persistence.domain]]

package/assets/docs/domainspecs/healthcare/comandrulemap.md

@@ -1,100 +0,0 @@
-# Healthcare Domain — Command → Rule-File Map
-
-Per-command list of the **healthcare domain** rule files loaded (via `resolve-domain`
-+ the `domain-select` module, into the sticky standards set) for the spec-anchored
-orchestrator pipeline.
-
-**The model (see `.aw-spec/RULE-PARTITION.md`):** domain files feed
-only three consumers — **specify** (authors them into the spec as FR/BR/CN-/DC-/IC-),
-**constitution** (the domain principles), and the **gates** (conformance checklist).
-**design** and **implement** load **NO** domain file — the domain reaches them solely
-through the spec/design (as CN-/DC-/IC- ids).
-
-- All paths are workspace-relative and live in `docs/domainspecs/healthcare/`.
-- `resolve-domain --command <name>` collects the `- ` bullets under `## /<name>`.
-- This file is the **canonical source** for the healthcare domain mapping; `/aw-spec-orch
-  select-domain` selects this folder as active.
-
----
-
-## /aw-spec-constitution
-<!-- Domain identity/regulatory/interop sources that become domain principles XVI+ in
-     constitution.domain.md (authored from docs/healthcare-constitution.my-ref.md + these). -->
-- docs/domainspecs/healthcare/domain-requirements.md
-- docs/domainspecs/healthcare/clinical-terms.md
-- docs/domainspecs/healthcare/terminology.md
-- docs/domainspecs/healthcare/consent.md
-- docs/domainspecs/healthcare/hipaa.md
-- docs/domainspecs/healthcare/fhir.md
-- docs/domainspecs/healthcare/hl7.md
-- docs/domainspecs/healthcare/dicom.md
-- docs/domainspecs/healthcare/data-classification.domain.md
-- docs/domainspecs/healthcare/auditing.domain.md
-- docs/domainspecs/healthcare/authorization.domain.md
-- docs/domainspecs/healthcare/zero-trust.domain.md
-- docs/domainspecs/healthcare/ai-rules.domain.md
-
-## /aw-spec-specify
-<!-- The FULL domain set. Specify models the domain COMPLETELY and LIFTS the constraint
-     overlays into the spec's CN-/DC-/IC- sections (design/implement never see these files). -->
-- docs/domainspecs/healthcare/domain-requirements.md
-- docs/domainspecs/healthcare/domain-driven-design.domain.md
-- docs/domainspecs/healthcare/clinical-terms.md
-- docs/domainspecs/healthcare/terminology.md
-- docs/domainspecs/healthcare/integration-terms.md
-- docs/domainspecs/healthcare/consent.md
-- docs/domainspecs/healthcare/hipaa.md
-- docs/domainspecs/healthcare/fhir.md
-- docs/domainspecs/healthcare/hl7.md
-- docs/domainspecs/healthcare/dicom.md
-- docs/domainspecs/healthcare/data-classification.domain.md
-- docs/domainspecs/healthcare/persistence.domain.md
-- docs/domainspecs/healthcare/cqrs.domain.md
-- docs/domainspecs/healthcare/eventing.domain.md
-- docs/domainspecs/healthcare/auditing.domain.md
-- docs/domainspecs/healthcare/authorization.domain.md
-- docs/domainspecs/healthcare/zero-trust.domain.md
-- docs/domainspecs/healthcare/api-versioning.domain.md
-- docs/domainspecs/healthcare/vertical-slices.domain.md
-
-## /aw-spec-design
-_None — design loads no domain file. Domain reaches design only through the spec (BR-/CN-/DC-/IC-)._
-
-## /aw-spec-implement
-_None — implement loads no domain file. Domain reaches implement only through design.md. Framework
-components are added separately via `/aw-spec-orch add-component`._
-
-## /aw-spec-gate
-<!-- Conformance checklist for the gates (analyze-design · analyze-slice): the domain-derived
-     constraints design/implement were NOT given as authoring input, VALIDATED against the
-     output. Domain re-enters here as a check, never as authoring input. -->
-- docs/domainspecs/healthcare/persistence.domain.md
-- docs/domainspecs/healthcare/cqrs.domain.md
-- docs/domainspecs/healthcare/eventing.domain.md
-- docs/domainspecs/healthcare/auditing.domain.md
-- docs/domainspecs/healthcare/authorization.domain.md
-- docs/domainspecs/healthcare/zero-trust.domain.md
-- docs/domainspecs/healthcare/data-classification.domain.md
-- docs/domainspecs/healthcare/api-versioning.domain.md
-- docs/domainspecs/healthcare/vertical-slices.domain.md
-- docs/domainspecs/healthcare/folder-structure.domain.md
-- docs/domainspecs/healthcare/coding-standards.domain.md
-- docs/domainspecs/healthcare/dependency-policy.domain.md
-- docs/domainspecs/healthcare/testing.domain.md
-- docs/domainspecs/healthcare/ai-rules.domain.md
-
----
-
-## Quick reference (command → domain file count)
-
-| Command | Domain rule files | Role |
-|---|---|---|
-| /aw-spec-constitution | 13 | domain principles (XVI+) |
-| /aw-spec-specify | 19 | author into spec (lift → CN-/DC-/IC-) |
-| /aw-spec-design | 0 | none — spec is the only domain input |
-| /aw-spec-implement | 0 | none — design is the only domain input |
-| /aw-spec-gate | 14 | conformance checklist (validate, don't author) |
-
-> Retired in the orchestrator pipeline: `/aw-spec-plan`, `/aw-spec-tasks`, `/aw-spec-taskplan`,
-> `/aw-spec-clarify`, `/aw-spec-analyze` (clarify folds into specify; plan/tasks into design). The
-> collapsed tiers `/aw-spec-fast-implement` and `/aw-spec-minimal-implementation` are pending a ruling.