declapract-typescript-ehmpathy 0.49.11 → 0.49.13

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-app-react-native-expo/.declapract.integration.test.ts

@@ -171,16 +171,17 @@ describe('app-react-native-expo — graceful migration of an app-protools-shaped
       });
 
       then('the packageManager pin converges to the blessed exact version', () => {
-        // the fixture is AHEAD of the blessed pin (pnpm@10.32.1). the pnpm
-        // best-practice CONTAINS declares the ONE blessed version (pnpm@10.31.7),
-        // so a consumer ahead of it is pinned BACK on fix — that downgrade is the
-        // wisher-settled org-convergence REQUIREMENT (one blessed pnpm across CI,
-        // local, every repo), not a regression. this characterizes it.
+        // the fixture is OFF the blessed pin (pnpm@10.32.1). the pnpm
+        // best-practice CONTAINS declares the ONE blessed version (pnpm@10.34.5),
+        // so a consumer off it is converged onto the blessed pin on fix — in
+        // either direction. that convergence-to-one-version is the wisher-settled
+        // org-convergence REQUIREMENT (one blessed pnpm across CI, local, every
+        // repo), not a regression. this characterizes it.
         const pkgBefore = JSON.parse(state.before.pkg!);
         expect(pkgBefore.packageManager).toEqual('pnpm@10.32.1');
 
         const pkg = JSON.parse(state.after2.pkg!);
-        expect(pkg.packageManager).toEqual('pnpm@10.31.7');
+        expect(pkg.packageManager).toEqual('pnpm@10.34.5');
       });
 
       then('the inline jest dual-source block is dropped', () => {
@@ -389,6 +390,20 @@ describe('app-react-native-expo — migration-fixture drift guard', () => {
     return parsed['use-cases'][input.usecase].practices;
   };
 
+  // the practices in `of` absent from `reference` — the set-difference the drift asserts on.
+  const getPracticesAbsentFrom = (input: {
+    of: string[];
+    reference: string[];
+  }): string[] =>
+    input.of.filter((practice) => !input.reference.includes(practice));
+
+  // the practices in `of` also present in `reference` — the set-overlap the drift forbids.
+  const getPracticesPresentIn = (input: {
+    of: string[];
+    reference: string[];
+  }): string[] =>
+    input.of.filter((practice) => input.reference.includes(practice));
+
   const repoRoot = path.join(__dirname, '../../..');
 
   given('the real usecase and the fixture usecase', () => {
@@ -410,34 +425,34 @@ describe('app-react-native-expo — migration-fixture drift guard', () => {
 
     when('the fixture subset is measured against the real usecase', () => {
       then('the fixture invents no practice absent from the real usecase', () => {
-        const invented = fixturePractices.filter(
-          (practice) => !realPractices.includes(practice),
-        );
+        const invented = getPracticesAbsentFrom({
+          of: fixturePractices,
+          reference: realPractices,
+        });
         expect(invented).toEqual([]);
       });
 
       then('a fixture practice is never also on the config-only allowlist', () => {
-        const overlap = fixturePractices.filter((practice) =>
-          configOnlyAllowlist.includes(practice),
-        );
+        const overlap = getPracticesPresentIn({
+          of: fixturePractices,
+          reference: configOnlyAllowlist,
+        });
         expect(overlap).toEqual([]);
       });
 
       then('the allowlist names no practice absent from the real usecase', () => {
-        const dead = configOnlyAllowlist.filter(
-          (practice) => !realPractices.includes(practice),
-        );
+        const dead = getPracticesAbsentFrom({
+          of: configOnlyAllowlist,
+          reference: realPractices,
+        });
         expect(dead).toEqual([]);
       });
 
       then('every real usecase practice is classified — exercised or config-only', () => {
-        const classified = new Set([
-          ...fixturePractices,
-          ...configOnlyAllowlist,
-        ]);
-        const unclassified = realPractices.filter(
-          (practice) => !classified.has(practice),
-        );
+        const unclassified = getPracticesAbsentFrom({
+          of: realPractices,
+          reference: [...fixturePractices, ...configOnlyAllowlist],
+        });
         expect(unclassified).toEqual([]);
       });
     });
@@ -662,6 +677,91 @@ describe('useCases.yml — resolved-practice characterization', () => {
  * .note = a practice-set parity guard below pins this fixture's usecase === the real
  *         `src/useCases.yml` usecase, so the smoke can never silently test a stale set.
  */
+/**
+ * .what = a clamp on the expo `deploy.yml` prod job's `if:` test-gate precedence — the prod
+ *         job must bind the `needs.test` gate to EVERY trigger branch, so a `v*` tag push
+ *         cannot deploy to prod on a FAILED test.
+ * .why  = github-actions `&&` binds tighter than `||`, so an `if:` written
+ *         `(tag) || (access==prod) && always() && (test ok)` parses as `tag || (access &&
+ *         always && test)` — the test gate binds ONLY to the access branch, so a `v*` TAG
+ *         PUSH deploys to prod even when `test` FAILED. the correct shape wraps both trigger
+ *         branches in one OUTER group the gate applies to:
+ *         `((tag) || access==prod) && always() && (test ok)`. this is the silent-break class
+ *         the wish fights — an untested build reaches prod, every gate green. the clamp reads
+ *         the raw prod `if:` and reddens on the un-grouped (bug) shape. it mirrors the
+ *         cicd-service prod-gate clamp so both service and app deploy callers hold the guard.
+ * .note = a filesystem walk → integration suite per rule.forbid.unit.remote-boundaries; no
+ *         credential, no network — the boundary alone classifies it. the clamp lives at the
+ *         practice root, never under best-practice/, so it is a declaration and not a template.
+ */
+/**
+ * .what = whether the prod job's collapsed `if:` wraps BOTH trigger branches in ONE outer group
+ *         that the ` && always()` test-gate binds over — the correct precedence.
+ * .why  = a pure transformer leaf, named so the assertion below reads intent rather than a raw
+ *         precedence regex a reader must simulate. the buggy single-group shape opens one paren
+ *         `(startsWith`; the correct shape opens a second, OUTER paren `((startsWith` that the
+ *         ` && always()` gate closes over, so the gate binds to the tag-push branch too, not the
+ *         access branch alone.
+ */
+const isProdGateGroupedCorrectly = (input: { collapsedIf: string }): boolean =>
+  /\(\(startsWith\(github\.ref, 'refs\/tags\/'\).*\|\| github\.event\.inputs\.access == 'prod'\) &&\s*always\(\)/.test(
+    input.collapsedIf,
+  );
+
+describe('cicd-app-react-native-expo — prod test-gate precedence (silent-break clamp)', () => {
+  const readProdIf = (): string => {
+    const text = readFileSync(
+      `${__dirname}/best-practice/.github/workflows/deploy.yml`,
+      'utf-8',
+    );
+    // yaml.parse already returns `any`; annotate (not cast) to read the untyped workflow doc, as
+    // the peer cicd-service clamp does with its `parsed: any` annotation (no rule.forbid.as-cast cast)
+    const parsed: any = yaml.parse(text);
+    return (parsed.jobs?.prod?.if ?? '').replace(/\s+/g, ' ').trim();
+  };
+
+  given('[case1] the expo deploy.yml prod job', () => {
+    when('[t0] the prod job gates on the test result across every trigger branch', () => {
+      then('the two trigger branches sit in one outer group the test-gate binds to', () => {
+        const collapsed = readProdIf();
+        // guard the shape: an absent `if` leaves collapsed empty, a clean red not a crash
+        expect(collapsed.length).toBeGreaterThan(0);
+        // teeth: revert the outer paren and isProdGateGroupedCorrectly reddens.
+        expect(isProdGateGroupedCorrectly({ collapsedIf: collapsed })).toEqual(
+          true,
+        );
+      });
+
+      then('the buggy per-branch group (access alone in parens after `||`) is absent', () => {
+        // teeth: the precedence bug wraps the access branch in its OWN parens after the `||`
+        // (`|| (github.event.inputs.access == 'prod') &&`), which lets the tag branch stand alone.
+        // the correct shape leaves the access branch bare inside the outer group.
+        expect(readProdIf()).not.toContain(
+          "|| (github.event.inputs.access == 'prod') &&",
+        );
+      });
+
+      then('the test-result gate itself is present (guards the above from vacuity)', () => {
+        expect(readProdIf()).toContain(
+          "always() && (needs.test.result == 'success' || needs.test.result == 'skipped')",
+        );
+      });
+    });
+
+    when('[t1] the emitted prod-job gate is snapshotted for review', () => {
+      // the regex + toContain clamps above prove the SHAPE; this snapshots the emitted
+      // `if:` gate itself so a reviewer vibechecks the actual precedence group, and any
+      // drift (a reword, an operand reshuffle, a lost outer paren) shows as a diff. per
+      // rule.require.contract-snapshot-exhaustiveness, and mirrors the peer cicd-service clamp.
+      then('the prod job `if:` gate matches snapshot', () => {
+        expect(readProdIf()).toMatchSnapshot(
+          'deploy.yml prod job if: (test-gate precedence)',
+        );
+      });
+    });
+  });
+});
+
 describe('app-react-native-expo — full-usecase evaluation smoke', () => {
   const repoRoot = path.join(__dirname, '../../..');
   const sorted = (input: string[]): string[] => [...input].sort();

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-app-react-native-expo/__snapshots__/.declapract.integration.test.ts.snap

@@ -6,9 +6,9 @@ exports[`app-react-native-expo — graceful migration of an app-protools-shaped
 on:
   workflow_call:
     inputs:
-      stage:
+      access:
         type: string
-        description: "the stage of infrastructure to deploy against (e.g., prod, prep)"
+        description: "the access to deploy with (test | prep | prod)"
         required: true
       build:
         type: string
@@ -16,7 +16,7 @@ on:
         required: true
       github-environment:
         type: string
-        description: "the github environment that the apply step will be executed in"
+        description: "github environment for the deploy jobs"
         required: true
       creds-aws-region:
         type: string
@@ -53,7 +53,12 @@ jobs:
           - android
     name: \${{ matrix.platform }}
     runs-on: ubuntu-24.04
-    environment: \${{ inputs.github-environment }}
+    environment:
+      # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so no
+      # "deployed to <env>" status accretes on the PR timeline. the environment is ALWAYS
+      # declared — for prep and prod alike.
+      name: \${{ inputs.github-environment }}
+      deployment: false
     needs: [install]
     steps:
       - name: checkout
@@ -92,9 +97,14 @@ jobs:
   deploy-web:
     name: web
     runs-on: ubuntu-24.04
-    environment: \${{ inputs.github-environment }}
+    environment:
+      # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so no
+      # "deployed to <env>" status accretes on the PR timeline. the environment is ALWAYS
+      # declared — for prep and prod alike.
+      name: \${{ inputs.github-environment }}
+      deployment: false
     needs: [install]
-    if: \${{ inputs.stage == 'prod' && inputs.app-web-deployment-s3-bucket }}
+    if: \${{ inputs.access == 'prod' && inputs.app-web-deployment-s3-bucket }}
     steps:
       - name: checkout
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -137,7 +147,7 @@ exports[`app-react-native-expo — graceful migration of an app-protools-shaped
 on:
   workflow_call:
     inputs:
-      stage:
+      access:
         type: string
         required: true
 
@@ -169,15 +179,15 @@ exports[`app-react-native-expo — graceful migration of an app-protools-shaped
 "{
   "name": "app-protools-native",
   "version": "1.0.0",
-  "packageManager": "pnpm@10.31.7",
+  "packageManager": "pnpm@10.34.5",
   "scripts": {
     "install:deps": "npm install",
     "start": "expo start",
     "start:hot:proxy": "npx local-ssl-proxy --source 3447 --target 8081",
-    "start:hot:prep": "STAGE=prep npx expo start --clear --dev-client",
+    "start:hot:prep": "ACCESS=prep npx expo start --clear --dev-client",
     "start:hot:prep:link": "echo '🚀 https://localhost.protools.prep.ahbode.dev:3447'",
     "start:hot:prep:proxy": "npm run start:hot:prep:link && npm run start:hot:proxy",
-    "start:hot:prod": "STAGE=prod npx expo start --clear --dev-client",
+    "start:hot:prod": "ACCESS=prod npx expo start --clear --dev-client",
     "start:hot:prod:link": "echo '🚀 https://localhost.protools.ahbode.dev:3447'",
     "start:hot:prod:proxy": "npm run start:hot:prod:link && npm run start:hot:proxy",
     "start:cold:proxy": "npx local-ssl-proxy --source 3449 --target 3000",
@@ -201,14 +211,14 @@ exports[`app-react-native-expo — graceful migration of an app-protools-shaped
     "open:store:android": "https://play.google.com/console/u/0/developers/",
     "open:store:ios": "browser https://appstoreconnect.apple.com/apps/",
     "fix": "npm run fix:format && npm run fix:lint",
-    "prepare": "if [ -e .git ] && [ -z $CI ]; then npm run prepare:husky && npm run prepare:rhachet; fi",
+    "prepare": "if [ -e .git ] && [ -z \\"\${CI:-}\\" ]; then npm run prepare:husky && npm run prepare:rhachet; fi",
     "prepush": "npm run test && npm run build",
     "preversion": "npm run prepush",
     "postversion": "git push origin HEAD --tags --no-verify",
-    "prepare:rhachet": "rhachet init --keys --hooks --roles mechanic behaver driver reviewer librarian ergonomist architect dispatcher learner operator observer deployer playwright enroller",
+    "prepare:rhachet": "rhachet init --keys --hooks --roles mechanic behaver driver reviewer librarian ergonomist architect dispatcher learner achiever telepath operator observer deployer playwright enroller",
     "upgrade:rhachet": "rhachet upgrade",
-    "test:unit": "set -eu && jest -c ./jest.unit.config.ts --forceExit --verbose --passWithNoTests $([ -n \\"\${CI:-}\\" ] && echo '--ci') $([ \\"\${THOROUGH:-}\\" != \\"true\\" ] && echo '--changedSince=main') $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
-    "test:integration": "set -eu && jest -c ./jest.integration.config.ts --forceExit --verbose --passWithNoTests $([ -n \\"\${CI:-}\\" ] && echo '--ci') $([ \\"\${THOROUGH:-}\\" != \\"true\\" ] && echo '--changedSince=main') $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
+    "test:unit": "set -eu && jest -c ./jest.unit.config.ts --forceExit --verbose --passWithNoTests $([ -n \\"\${CI:-}\\" ] && echo '--ci') $([ \\"\${THOROUGH:-}\\" != \\"true\\" ] && echo '--changedSince=origin/main') $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
+    "test:integration": "set -eu && jest -c ./jest.integration.config.ts --forceExit --verbose --passWithNoTests $([ -n \\"\${CI:-}\\" ] && echo '--ci') $([ \\"\${THOROUGH:-}\\" != \\"true\\" ] && echo '--changedSince=origin/main') $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
     "test:acceptance:locally": "set -eu && npm run build && LOCALLY=true jest -c ./jest.acceptance.config.ts --forceExit --verbose --runInBand --passWithNoTests $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
     "test": "set -eu && npm run test:commits && npm run test:types && npm run test:format && npm run test:lint && npm run test:unit && npm run test:integration && npm run test:acceptance:locally",
     "test:acceptance": "set -eu && npm run build && jest -c ./jest.acceptance.config.ts --forceExit --verbose --runInBand --passWithNoTests $([ -n \\"\${CI:-}\\" ] && echo '--ci') $([ \\"\${RESNAP:-}\\" = \\"true\\" ] && echo '--updateSnapshot')",
@@ -218,35 +228,34 @@ exports[`app-react-native-expo — graceful migration of an app-protools-shaped
   },
   "devDependencies": {
     "expo": "54.0.0",
-    "rhachet": "1.43.1",
-    "rhachet-brains-anthropic": "0.4.1",
-    "rhachet-brains-fireworksai": "0.1.3",
+    "rhachet": "1.47.5",
+    "rhachet-brains-anthropic": "0.4.3",
+    "rhachet-brains-fireworksai": "0.1.6",
     "rhachet-brains-xai": "0.3.3",
-    "rhachet-roles-bhrain": "0.29.24",
+    "rhachet-roles-bhrain": "0.34.1",
     "rhachet-roles-bhrowser": "0.1.0",
-    "rhachet-roles-bhuild": "0.21.22",
-    "rhachet-roles-ehmpathy": "1.38.1",
-    "rhachet-roles-ghlitch": "0.2.5",
+    "rhachet-roles-bhuild": "0.21.36",
+    "rhachet-roles-ehmpathy": "1.38.12",
+    "rhachet-roles-ghlitch": "0.3.0",
     "rhachet-roles-rhachet": "0.1.7",
     "@jest/globals": "30.2.0",
     "@types/jest": "30.0.0",
     "jest": "30.2.0",
     "esbuild-register": "3.6.0",
-    "test-fns": "1.15.8",
+    "test-fns": "1.17.0",
     "tsx": "4.20.6",
-    "jest-expo": "54.0.0",
-    "@babel/core": "7.24.0",
-    "babel-preset-expo": "12.0.0",
-    "react-test-renderer": "19.0.0",
-    "isomorphic-fetch": "3.0.0",
+    "jest-expo": "^54.0.0",
+    "@babel/core": "^7.24.0",
+    "babel-preset-expo": "^12.0.0",
+    "isomorphic-fetch": "^3.0.0",
     "typescript": "5.4.5"
   },
   "dependencies": {
     "expo": "51.0.22",
     "expo-dev-client": "4.0.20",
     "expo-updates": "0.25.21",
-    "domain-objects": "0.31.13",
-    "type-fns": "1.21.3"
+    "domain-objects": "0.34.0",
+    "type-fns": "1.21.4"
   },
   "author": "ahbode",
   "repository": "ahbode/app-protools-native",
@@ -287,3 +296,5 @@ exports[`app-react-native-expo — graceful migration of an app-protools-shaped
 }
 "
 `;
+
+exports[`cicd-app-react-native-expo — prod test-gate precedence (silent-break clamp) given: [case1] the expo deploy.yml prod job when: [t1] the emitted prod-job gate is snapshotted for review then: the prod job \`if:\` gate matches snapshot: deploy.yml prod job if: (test-gate precedence) 1`] = `"((startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch') || github.event.inputs.access == 'prod') && always() && (needs.test.result == 'success' || needs.test.result == 'skipped')"`;

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-app-react-native-expo/best-practice/.github/workflows/.deploy-expo.yml

@@ -3,9 +3,9 @@ name: .deploy-expo
 on:
   workflow_call:
     inputs:
-      stage:
+      access:
         type: string
-        description: "the stage of infrastructure to deploy against (e.g., prod, prep)"
+        description: "the access to deploy with (test | prep | prod)"
         required: true
       build:
         type: string
@@ -13,7 +13,7 @@ on:
         required: true
       github-environment:
         type: string
-        description: "the github environment that the apply step will be executed in"
+        description: "github environment for the deploy jobs"
         required: true
       creds-aws-region:
         type: string
@@ -50,7 +50,12 @@ jobs:
           - android
     name: ${{ matrix.platform }}
     runs-on: ubuntu-24.04
-    environment: ${{ inputs.github-environment }}
+    environment:
+      # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so no
+      # "deployed to <env>" status accretes on the PR timeline. the environment is ALWAYS
+      # declared — for prep and prod alike.
+      name: ${{ inputs.github-environment }}
+      deployment: false
     needs: [install]
     steps:
       - name: checkout
@@ -89,9 +94,14 @@ jobs:
   deploy-web:
     name: web
     runs-on: ubuntu-24.04
-    environment: ${{ inputs.github-environment }}
+    environment:
+      # deployment: false keeps the built-in gate but suppresses the auto-Deployment, so no
+      # "deployed to <env>" status accretes on the PR timeline. the environment is ALWAYS
+      # declared — for prep and prod alike.
+      name: ${{ inputs.github-environment }}
+      deployment: false
     needs: [install]
-    if: ${{ inputs.stage == 'prod' && inputs.app-web-deployment-s3-bucket }}
+    if: ${{ inputs.access == 'prod' && inputs.app-web-deployment-s3-bucket }}
     steps:
       - name: checkout
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-app-react-native-expo/best-practice/.github/workflows/deploy.yml

@@ -9,8 +9,8 @@ on:
       - 'master'
   workflow_dispatch:
     inputs:
-      stage:
-        description: 'which stage do you want to deploy to?'
+      access:
+        description: 'which access do you want to deploy with?'
         type: choice
         options:
           - prep
@@ -40,7 +40,7 @@ jobs:
     if: github.event_name != 'workflow_dispatch' || github.event.inputs.thoroughly == 'true'
     with:
       creds-aws-region: us-east-1
-      creds-aws-role-arn: arn:aws:iam::@declapract{variable.awsAccountId.prep}:role/@declapract{variable.projectName}-github-actions-prep
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
     secrets: inherit # keyrack firewall in .test.yml filters to declared keys
 
   prep:
@@ -48,14 +48,14 @@ jobs:
     needs: [test]
     # dont deploy on merge to main by default, since builds are expensive
     if: |
-      ((github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' && false) || github.event.inputs.stage == 'prep') &&
+      ((github.ref == 'refs/heads/main' && github.event_name != 'workflow_dispatch' && false) || github.event.inputs.access == 'prep') &&
       always() && (needs.test.result == 'success' || needs.test.result == 'skipped')
     with:
-      stage: prep
+      access: prep
+      github-environment: preparation # deployment:false keeps the gate and suppresses the PR-timeline spam
       build: development
-      github-environment: prep
       creds-aws-region: us-east-1
-      creds-aws-role-arn: arn:aws:iam::@declapract{variable.awsAccountId.prep}:role/@declapract{variable.projectName}-github-actions-prep
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
     secrets:
       expo-token: ${{ secrets.EXPO_TOKEN }}
 
@@ -63,14 +63,14 @@ jobs:
     uses: ./.github/workflows/.deploy-expo.yml
     needs: [test]
     if: |
-      (startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch') || (github.event.inputs.stage == 'prod') &&
+      ((startsWith(github.ref, 'refs/tags/') && github.event_name != 'workflow_dispatch') || github.event.inputs.access == 'prod') &&
       always() && (needs.test.result == 'success' || needs.test.result == 'skipped')
     with:
-      stage: prod
+      access: prod
       build: production
-      github-environment: prod
+      github-environment: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply (actor_id-gated writer)
       creds-aws-region: us-east-1
-      creds-aws-role-arn: arn:aws:iam::@declapract{variable.awsAccountId.prod}:role/@declapract{variable.projectName}-github-actions-prod
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
       app-web-deployment-s3-bucket: s3://@declapract{variable.projectName}-@declapract{variable.infrastructureNamespaceId}-prod
     secrets:
       expo-token: ${{ secrets.EXPO_TOKEN }}

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-app-react-native-expo/best-practice/.github/workflows/test.yml

@@ -20,8 +20,6 @@ jobs:
   suite:
     uses: ./.github/workflows/.test.yml
     with:
-      aws-region: us-east-1
-      aws-account-id: '@declapract{variable.awsAccountId.prep}'
-    secrets:
-      aws-access-key-id: ${{ secrets.PREP_AWS_ACCESS_KEY_ID }}
-      aws-secret-access-key: ${{ secrets.PREP_AWS_SECRET_ACCESS_KEY }}
+      creds-aws-region: us-east-1
+      creds-aws-role-arn: ${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }} # use aws auth via oidc, if this repo supplies it
+    secrets: inherit # keyrack firewall in .test.yml filters to declared keys

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-app-react-native-expo/best-practice/package.json

@@ -6,10 +6,10 @@
   },
   "scripts": {
     "start:hot:proxy": "npx local-ssl-proxy --source 3447 --target 8081",
-    "start:hot:prep": "STAGE=prep npx expo start --clear --dev-client",
+    "start:hot:prep": "ACCESS=prep npx expo start --clear --dev-client",
     "start:hot:prep:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prep}:@declapract{variable.app.web.port.hot}'",
     "start:hot:prep:proxy": "npm run start:hot:prep:link && npm run start:hot:proxy",
-    "start:hot:prod": "STAGE=prod npx expo start --clear --dev-client",
+    "start:hot:prod": "ACCESS=prod npx expo start --clear --dev-client",
     "start:hot:prod:link": "echo '🚀 https://localhost.@declapract{variable.app.web.domain.prod}:@declapract{variable.app.web.port.hot}'",
     "start:hot:prod:proxy": "npm run start:hot:prod:link && npm run start:hot:proxy",
     "start:cold:proxy": "npx local-ssl-proxy --source 3449 --target 3000",

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-common/.declapract.integration.test.ts

@@ -331,6 +331,31 @@ describe('cicd-common workflow templates', () => {
         expect(fileAfter.contents).not.toContain('@declapract{');
       });
 
+      /**
+       * .what = #595 — the PR acceptance shard defaults to IN-PROCESS (LOCALLY=true), so a
+       *         fleetless service (one that publishes only dev/prep, no `test` fleet) inherits a
+       *         green PR gate rather than 404ing against a `svc-<name>-test-*` slug that does not
+       *         exist. this is the delivered template, through the real pipeline — so it proves a
+       *         consumer receives the in-process default, not that the source file merely holds it.
+       * .teeth = both acceptance shard steps (explicit + dynamic) carry `LOCALLY=true`, and NO
+       *          acceptance step runs a bare `THOROUGH=true npm run test:acceptance` without it —
+       *          the cloud-invoke default that regressed a fleetless service to all-404. revert
+       *          either step to the bare command and the count assertions redden.
+       */
+      then('the acceptance shard defaults to in-process (LOCALLY=true) -- #595 fleetless gate', () => {
+        // every `test:acceptance` shard command carries LOCALLY=true (the explicit + both dynamic branches)
+        const acceptanceRuns = (
+          fileAfter.contents.match(/npm run test:acceptance/g) || []
+        ).length;
+        const localAcceptanceRuns = (
+          fileAfter.contents.match(/LOCALLY=true THOROUGH=true npm run test:acceptance/g) || []
+        ).length;
+        expect(acceptanceRuns).toBeGreaterThan(0);
+        // teeth: EVERY acceptance run carries LOCALLY=true — a bare cloud-invoke step (the all-404
+        // regression) would make localAcceptanceRuns < acceptanceRuns.
+        expect(localAcceptanceRuns).toEqual(acceptanceRuns);
+      });
+
       /**
        * .why = the wish's third acceptance criterion — "the pin is LEGIBLE: a reader can tell
        *        WHICH version each SHA corresponds to" — is the one criterion no assertion can

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-common/__snapshots__/.declapract.integration.test.ts.snap

@@ -338,16 +338,7 @@ jobs:
 
       - name: report slow tests
         if: always() && hashFiles('jest-results.json') != ''
-        run: |
-          set -eu
-          jq -r '.testResults[] | select(.perfStats.runtime != null) | "\\(.name):\\(.perfStats.runtime)"' jest-results.json | while IFS=: read -r name runtime; do
-            seconds=$((runtime / 1000))
-            if [[ $seconds -ge 30 ]]; then
-              echo "::warning file=\${name}::slow test: \${seconds}s"
-            elif [[ $seconds -ge 10 ]]; then
-              echo "::notice file=\${name}::test duration: \${seconds}s"
-            fi
-          done
+        run: bash .github/workflows/report-slow-tests.sh jest-results.json
 
   test-shards-acceptance:
     runs-on: ubuntu-24.04
@@ -402,12 +393,18 @@ jobs:
       - name: build
         run: npm run build
 
+      # .why = the PR acceptance gate runs IN-PROCESS (LOCALLY=true), not against a deployed fleet.
+      #        a PR has no deployed lambda to invoke, and a service that publishes only dev/prep (no
+      #        \`test\` fleet) would target \`svc-<name>-test-*\` — a slug that does not exist — and 404
+      #        on every call. in-process runs the handler directly, so a fleetless service inherits a
+      #        green PR gate out of the box rather than hand-patching LOCALLY=true into this shard.
+      #        the deployed-fleet acceptance run is a separate post-deploy grain (.deploy-sls.yml).
       - name: test:acceptance (explicit \${{ matrix.shard.index }})
         if: matrix.shard.type == 'explicit'
         run: |
           set -eu
           patterns='\${{ join(matrix.shard.patterns, '|') }}'
-          THOROUGH=true npm run test:acceptance -- --testPathPatterns="$patterns" --json --outputFile=jest-results.json
+          LOCALLY=true THOROUGH=true npm run test:acceptance -- --testPathPatterns="$patterns" --json --outputFile=jest-results.json
 
       - name: test:acceptance (dynamic \${{ matrix.shard.shard }}/\${{ matrix.shard.total }})
         if: matrix.shard.type == 'dynamic'
@@ -415,23 +412,14 @@ jobs:
           set -eu
           exclude='\${{ needs.enshard.outputs.acceptance-patterns }}'
           if [[ -n "$exclude" ]]; then
-            THOROUGH=true npm run test:acceptance -- --testPathIgnorePatterns="$exclude" --shard=\${{ matrix.shard.shard }}/\${{ matrix.shard.total }} --json --outputFile=jest-results.json
+            LOCALLY=true THOROUGH=true npm run test:acceptance -- --testPathIgnorePatterns="$exclude" --shard=\${{ matrix.shard.shard }}/\${{ matrix.shard.total }} --json --outputFile=jest-results.json
           else
-            THOROUGH=true npm run test:acceptance -- --shard=\${{ matrix.shard.shard }}/\${{ matrix.shard.total }} --json --outputFile=jest-results.json
+            LOCALLY=true THOROUGH=true npm run test:acceptance -- --shard=\${{ matrix.shard.shard }}/\${{ matrix.shard.total }} --json --outputFile=jest-results.json
           fi
 
       - name: report slow tests
         if: always() && hashFiles('jest-results.json') != ''
-        run: |
-          set -eu
-          jq -r '.testResults[] | select(.perfStats.runtime != null) | "\\(.name):\\(.perfStats.runtime)"' jest-results.json | while IFS=: read -r name runtime; do
-            seconds=$((runtime / 1000))
-            if [[ $seconds -ge 30 ]]; then
-              echo "::warning file=\${name}::slow test: \${seconds}s"
-            elif [[ $seconds -ge 10 ]]; then
-              echo "::notice file=\${name}::test duration: \${seconds}s"
-            fi
-          done
+        run: bash .github/workflows/report-slow-tests.sh jest-results.json
 
   # union job: aggregates shard results into single status for pr merge constraints
   test-integration:

package/dist/.test/assets/expo-fullusecase/declarations/practices/cicd-common/__snapshots__/declastruct-insync-grep.declapract.integration.test.ts.snap

@@ -0,0 +1,3 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`cicd-common .declastruct.yml in-sync grep given: the shipped .declastruct.yml when: the apply-gate grep is read then: the emitted apply-gate grep line matches snapshot: declastruct apply-gate grep 1`] = `"if grep -qF "everything is in sync" ./plan.log"`;