declapract-typescript-ehmpathy 0.49.11 → 0.49.13

package/dist/practices/cicd-service/__snapshots__/provision.yml.declapract.integration.test.ts.snap

@@ -0,0 +1,297 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`provision.yml — the D28 rds-jobs gate, end to end given: [case1] an rds-usecase consumer (lambda-service-with-rds) when: [t1] the cicd-service provision declaration is applied then: the emitted rds workflow matches snapshot: provision.yml — rds usecase (emitted superset) 1`] = `
+"name: provision
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - "main"
+      - "master"
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: \${{ github.workflow }}-\${{ github.ref }} # per [workflow] x [branch, tag]
+  cancel-in-progress: true #  cancel workflows for non-latest commits
+
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
+jobs:
+  aws-test-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/test
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prep-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prep
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply (actor_id-gated writer)
+      allow-apply: \${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  github:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/github.repo/resources.ts
+      scope: github
+      access: prod # github repo settings are inherently a prod resource
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply
+      creds-github-app-owner: \${{ github.repository_owner }}
+      creds-github-app-id: \${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
+    secrets:
+      creds-github-app-private-key: \${{ secrets.DECLASTRUCT_GITHUB_CONFORMER_APP_PRIVATE_KEY }}
+
+  sql-schema-prep:
+    uses: ./.github/workflows/.sql-schema-control.yml
+    with:
+      access: prep
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  sql-schema-prod:
+    uses: ./.github/workflows/.sql-schema-control.yml
+    with:
+      access: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply (actor_id-gated writer)
+      allow-apply: \${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  aws-prep-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prep
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply (actor_id-gated writer)
+      allow-apply: \${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+"
+`;
+
+exports[`provision.yml — the D28 rds-jobs gate, end to end given: [case2] a non-rds consumer (lambda-service) when: [t0] the cicd-service provision declaration is applied then: the emitted narrowed workflow matches snapshot (the strip diff a reviewer eyeballs): provision.yml — non-rds usecase (emitted, narrowed) 1`] = `
+"name: provision
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - "main"
+      - "master"
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: \${{ github.workflow }}-\${{ github.ref }} # per [workflow] x [branch, tag]
+  cancel-in-progress: true #  cancel workflows for non-latest commits
+
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
+jobs:
+  aws-test-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/test
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prep-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prep
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply (actor_id-gated writer)
+      allow-apply: \${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  github:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/github.repo/resources.ts
+      scope: github
+      access: prod # github repo settings are inherently a prod resource
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply
+      creds-github-app-owner: \${{ github.repository_owner }}
+      creds-github-app-id: \${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
+    secrets:
+      creds-github-app-private-key: \${{ secrets.DECLASTRUCT_GITHUB_CONFORMER_APP_PRIVATE_KEY }}
+"
+`;
+
+exports[`provision.yml — the D28 rds-jobs gate, end to end given: [case3] the shipped source superset the strip acts on when: [t0] the practice ships its provision.yml superset then: the source superset holds all 4 rds jobs + matches snapshot: provision.yml — source superset (before strip) 1`] = `
+"name: provision
+
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - "main"
+      - "master"
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: \${{ github.workflow }}-\${{ github.ref }} # per [workflow] x [branch, tag]
+  cancel-in-progress: true #  cancel workflows for non-latest commits
+
+permissions:
+  id-token: write # required for oidc; a called workflow cannot exceed its caller's grant
+  contents: read
+
+jobs:
+  aws-test-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/test
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prep-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prep
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-terraform:
+    uses: ./.github/workflows/.terraform.yml
+    with:
+      working-directory: provision/aws/environments/prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply (actor_id-gated writer)
+      allow-apply: \${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  github:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/github.repo/resources.ts
+      scope: github
+      access: prod # github repo settings are inherently a prod resource
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply
+      creds-github-app-owner: \${{ github.repository_owner }}
+      creds-github-app-id: \${{ vars.DECLASTRUCT_GITHUB_CONFORMER_APP_ID }}
+    secrets:
+      creds-github-app-private-key: \${{ secrets.DECLASTRUCT_GITHUB_CONFORMER_APP_PRIVATE_KEY }}
+
+  sql-schema-prep:
+    uses: ./.github/workflows/.sql-schema-control.yml
+    with:
+      access: prep
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  sql-schema-prod:
+    uses: ./.github/workflows/.sql-schema-control.yml
+    with:
+      access: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply (actor_id-gated writer)
+      allow-apply: \${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+
+  aws-prep-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prep
+      github-environment-plan: preparation
+      github-environment-apply: preparation
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PREP_OIDC_ROLE_ARN }}
+
+  aws-prod-declastruct:
+    uses: ./.github/workflows/.declastruct.yml
+    with:
+      wish-path: provision/aws/resources.ts
+      scope: aws
+      access: prod
+      github-environment-plan: production-on-else-plan
+      github-environment-apply: \${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) && 'production-on-main' || 'production-on-else-apply' }} # main/tag => on-main; else => on-else-apply (actor_id-gated writer)
+      allow-apply: \${{ startsWith(github.ref, 'refs/tags/') }} # only apply to prod on tags
+      creds-aws-region: us-east-1
+      creds-aws-role-arn-plan: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_PLAN_ROLE_ARN }}
+      creds-aws-role-arn-apply: \${{ vars.CREDS_CICD_AWS_PROD_OIDC_APPLY_ROLE_ARN }}
+"
+`;

package/dist/practices/cicd-service/acceptanceContempFleetGuard.declapract.integration.test.ts

@@ -0,0 +1,89 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { given, then, useBeforeAll, when } from 'test-fns';
+
+/**
+ * .what = the contemp-only acceptance guard. it clamps the shipped `.deploy-sls.yml` template so a
+ *         future edit cannot re-introduce the D31 dual-fleet acceptance fan-out. two invariants:
+ *         (1) the acceptance step is a single ACCESS-keyed `npm run test:acceptance` run; (2) no
+ *         `ACCEPTANCE_FLEET` selector (ancient or contemp) survives in the acceptance block.
+ * .why  = the assure job deploys the contemp fleet (the service's own access-tier slug, -prep- at
+ *         prep, -prod- at prod). dual-publish ships the SAME artifact under the ancient (-dev-) slug
+ *         too, so a run against contemp proves the deployed code — the ancient slug is an inbound
+ *         alias, never a second target for the self-acceptance gate. a fan-out that also runs an
+ *         ancient arm, or soft-skips a contemp arm off `access == 'prep'`, is dead weight at best and
+ *         an all-404 run at worst. absent this clamp, a future edit that re-splits the step reddens
+ *         no template test — the exact silent-regression class the wish exists to remove.
+ * .teeth = split the acceptance step back into an ancient arm and a contemp arm, or key it off any
+ *          `ACCEPTANCE_FLEET` value — and the matched case reddens.
+ * .note = INTEGRATION by `rule.forbid.unit.remote-boundaries`: it reads a shipped template file off
+ *         the filesystem. no credential, no network. it lives at the cicd-service practice ROOT
+ *         (never under best-practice/, which the #583 guard forbids for test artifacts) and anchors
+ *         its read on __dirname/best-practice, so a nested `jest src/...` run finds the template
+ *         wherever it is invoked from.
+ * .boundary = this guards the SHIPPED TEMPLATE against a re-split. a consumer-plan-time check is the
+ *          fuller durable guard, but it needs the could-not-fire plan signal
+ *          (ehmpathy/declapract#107), so it is a tracked upstream follow-on, not permitted-to-close
+ *          in this repo.
+ */
+
+const DEPLOY_SLS_YML = join(
+  __dirname,
+  'best-practice/.github/workflows/.deploy-sls.yml',
+);
+
+// the acceptance-job block: from the contemp-fleet comment through the single test:acceptance run. a
+// re-split into two fleet arms changes what this block holds. the `[ \t]*` prefix captures the
+// comment line's own indent, so the snapshotted block reads as uniformly-indented yaml (the first
+// line aligns with its continuations) rather than a fragment with a dedented head line.
+const getAcceptanceBlock = (src: string): string =>
+  src.match(
+    /[ \t]*# acceptance targets the contemp fleet[\s\S]*?npm run test:acceptance\n/,
+  )?.[0] ?? '';
+
+describe('contemp-only acceptance guard — the shipped deploy template cannot re-split into a dual fleet fan-out', () => {
+  const scene = useBeforeAll(() => ({
+    yml: readFileSync(DEPLOY_SLS_YML, 'utf8'),
+  }));
+
+  given('[case1] the acceptance-job block', () => {
+    when('[t0] the block is read from the shipped deploy template', () => {
+      then('the acceptance step is one ACCESS-keyed test:acceptance run', () => {
+        // teeth: the single contemp run is keyed on the access alone
+        expect(getAcceptanceBlock(scene.yml)).toContain(
+          'ACCESS=${{ inputs.access }} npm run test:acceptance',
+        );
+      });
+
+      then('no ancient fleet arm survives (a re-split reddens)', () => {
+        // teeth: re-add an ancient arm and this literal reappears in the block
+        expect(getAcceptanceBlock(scene.yml)).not.toContain(
+          'ACCEPTANCE_FLEET=ancient',
+        );
+      });
+
+      then('no ACCEPTANCE_FLEET selector survives (a re-split reddens)', () => {
+        // teeth: any fleet selector — ancient or contemp — signals the fan-out is back
+        expect(getAcceptanceBlock(scene.yml)).not.toContain('ACCEPTANCE_FLEET');
+      });
+    });
+  });
+
+  given('[case2] the acceptance-job block as a whole', () => {
+    when('[t0] the block is read from the shipped deploy template', () => {
+      then('a non-empty block was matched (guards the above from vacuity)', () => {
+        // else a template that renamed the comment would pass case1 with no real block to assert on
+        expect(getAcceptanceBlock(scene.yml).length).toBeGreaterThan(0);
+      });
+
+      then('the acceptance-job block matches snapshot (a reworded step reddens)', () => {
+        // the acceptance block is CI-faced output; snapshot it so a reword vibechecks in a review
+        // rather than slips past the toContain asserts above (rule.require.snapshots)
+        expect(getAcceptanceBlock(scene.yml)).toMatchSnapshot(
+          'deploy-sls acceptance-job block',
+        );
+      });
+    });
+  });
+});

package/dist/practices/cicd-service/bad-practices/rds-jobs-in-non-rds-service/.declapract.integration.test.ts

@@ -0,0 +1,153 @@
+import fs from 'fs/promises';
+import path from 'node:path';
+
+import { executeApply } from 'declapract';
+import { genTempDir, given, then, useBeforeAll, when } from 'test-fns';
+
+// executeApply is slow (full usecase evaluation), so widen the jest budget
+jest.setTimeout(180_000); // 3 minutes
+
+/**
+ * .what = end-to-end proof of the retroactive rds-jobs STRIP, run through the REAL declapract apply
+ *   pipeline against a genTempDir consumer that is ALREADY stamped with the full provision.yml
+ *   superset. per `rule.require.declapract-integration-tests`, a `fix` that transforms a yaml file
+ *   with logic is REQUIRED to carry a pipeline test — a unit test of `check`/`fix` never exercises
+ *   the glob→file match, the `projectPractices` derivation through a real usecase, nor the file a
+ *   consumer actually ends up with.
+ * .why = the best-practice D28 gate is `CONTAINS`, so it is fix-forward for FRESH scaffolds only — a
+ *   pre-stamped non-rds repo carries the superset, CONTAINS passes, no best-practice fix fires, and
+ *   the 4 rds jobs (which reference `persist-with-rds` files the repo does not ship) fail its
+ *   provision workflow. this bad-practice is the retroactive half. only a real apply proves
+ *   declapract (1) matches the declaration to `.github/workflows/provision.yml`, (2) derives
+ *   `projectPractices` from the resolved usecase (persist-with-rds ABSENT for `service-without-rds`,
+ *   PRESENT for `service-with-rds`), (3) strips the rds tail for the non-rds repo, and (4) leaves the
+ *   rds repo's superset intact.
+ * .note = the apply is scoped by `file` ONLY, never by `practice`. a `--practice cicd-service` filter
+ *   narrows `projectPractices` to `['cicd-service']` (getDesiredPractices), which would strip
+ *   `persist-with-rds` from the derivation and silence the rds guard. file-only keeps every usecase
+ *   practice in `projectPractices` while it applies just the provision.yml plan.
+ * .note = the fixture already HOLDS a provision.yml (the superset), unlike the D28 fresh-scaffold
+ *   test whose fixture starts with none. that pre-stamped state is the exact D28 retroactive gap
+ *   this strip closes.
+ * .note = the emitted file is snapshotted in full (both usecases), so a reviewer eyeballs the exact
+ *   strip diff, per `rule.require.declapract-integration-tests`.
+ */
+
+const FIXTURE =
+  './src/practices/cicd-service/.test/assets/demo-repo-pre-stamped-nords';
+const DECLARATIONS_MIRROR = './src/.test/assets/cicd-service/declarations';
+const PROVISION_PATH = '.github/workflows/provision.yml';
+
+const RDS_JOBS = [
+  'sql-schema-prep:',
+  'sql-schema-prod:',
+  'aws-prep-declastruct:',
+  'aws-prod-declastruct:',
+];
+const GENERIC_JOBS = [
+  'github:',
+  'aws-test-terraform:',
+  'aws-prep-terraform:',
+  'aws-prod-terraform:',
+];
+
+describe('rds-jobs-in-non-rds-service — the retroactive strip, end to end', () => {
+  given('[case1] a pre-stamped non-rds consumer (lambda-service)', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-cicd-service-strip-rds-nords',
+      clone: FIXTURE,
+      symlink: [
+        { at: 'declarations', to: DECLARATIONS_MIRROR },
+        { at: 'node_modules', to: 'node_modules' },
+      ],
+    });
+
+    const read = (rel: string) => fs.readFile(path.join(tempDir, rel), 'utf-8');
+    const applyProvision = () =>
+      executeApply({
+        config: path.join(tempDir, 'declapract.use.nords.yml'),
+        file: PROVISION_PATH,
+      });
+
+    const state = useBeforeAll(async () => {
+      const before = await read(PROVISION_PATH);
+      await applyProvision();
+      const after1 = await read(PROVISION_PATH);
+      await applyProvision(); // second apply — prove a fixed point
+      const after2 = await read(PROVISION_PATH);
+      return { before, after1, after2 };
+    }, 170_000);
+
+    when('[t0] before the strip', () => {
+      then('the pre-stamped file carries ALL 4 rds jobs', () => {
+        for (const job of RDS_JOBS) expect(state.before).toContain(job);
+      });
+
+      then('the pre-stamped superset matches snapshot (the before diff)', () => {
+        expect(state.before).toMatchSnapshot(
+          'provision.yml — pre-stamped superset (before strip)',
+        );
+      });
+    });
+
+    when('[t1] the bad-practice strip is applied', () => {
+      then('all 4 rds jobs are stripped', () => {
+        for (const job of RDS_JOBS) expect(state.after1).not.toContain(job);
+      });
+
+      then('the generic jobs survive the strip', () => {
+        for (const job of GENERIC_JOBS) expect(state.after1).toContain(job);
+      });
+
+      then(
+        'the stripped workflow matches snapshot (the strip diff a reviewer eyeballs)',
+        () => {
+          expect(state.after1).toMatchSnapshot(
+            'provision.yml — non-rds usecase (after strip)',
+          );
+        },
+      );
+    });
+
+    when('[t2] the strip is applied a second time', () => {
+      then('the second apply is a no-op (idempotent)', () => {
+        expect(state.after2).toEqual(state.after1);
+      });
+    });
+  });
+
+  given('[case2] a pre-stamped rds consumer (lambda-service-with-rds)', () => {
+    const tempDir = genTempDir({
+      slug: 'declapract-cicd-service-strip-rds-rds',
+      clone: FIXTURE,
+      symlink: [
+        { at: 'declarations', to: DECLARATIONS_MIRROR },
+        { at: 'node_modules', to: 'node_modules' },
+      ],
+    });
+
+    const read = (rel: string) => fs.readFile(path.join(tempDir, rel), 'utf-8');
+    const applyProvision = () =>
+      executeApply({
+        config: path.join(tempDir, 'declapract.use.rds.yml'),
+        file: PROVISION_PATH,
+      });
+
+    const state = useBeforeAll(async () => {
+      const before = await read(PROVISION_PATH);
+      await applyProvision();
+      const after1 = await read(PROVISION_PATH);
+      return { before, after1 };
+    }, 170_000);
+
+    when('[t0] the declaration is applied to an rds consumer', () => {
+      then('the rds repo KEEPS all 4 rds jobs — the strip does not fire', () => {
+        for (const job of RDS_JOBS) expect(state.after1).toContain(job);
+      });
+
+      then('the file is unchanged (an rds superset is already conformant)', () => {
+        expect(state.after1).toEqual(state.before);
+      });
+    });
+  });
+});

package/dist/practices/cicd-service/bad-practices/rds-jobs-in-non-rds-service/.declapract.readme.md

@@ -0,0 +1,38 @@
+# rds-jobs-in-non-rds-service
+
+## .what
+
+detects a non-rds service whose `.github/workflows/provision.yml` still carries the 4 rds-coupled
+jobs (`sql-schema-{prep,prod}`, `aws-{prep,prod}-declastruct`), and strips them.
+
+## .why
+
+the best-practice `provision.yml` gate omits those 4 jobs for a non-rds usecase — but it is a
+`CONTAINS` check, so it is fix-forward for **fresh** scaffolds only. a superset satisfies `CONTAINS`,
+so a non-rds repo stamped **before** the gate keeps the full superset, no best-practice fix fires,
+and its provision workflow fails: the 4 rds jobs reference `persist-with-rds` files (the schema +
+daos `.sql-schema-control.yml` callee, the `provision/aws/resources.ts` declastruct callee) that a
+non-rds service does not ship.
+
+this bad-practice is the retroactive half of that gate — it repairs a pre-stamped consumer without a
+hand edit.
+
+## .the check
+
+- **detected** (return) when `persist-with-rds` is NOT in `context.projectPractices` AND the file
+  still holds the rds-jobs tail.
+- **not detected** (throw) when the repo IS an rds service (it legitimately keeps those jobs), or the
+  rds tail is already gone.
+
+## .the fix
+
+reuses the best-practice's own `withoutRdsJobs` + `RDS_JOBS_ANCHOR`, so the truncation boundary lives
+in one place and cannot drift between the fresh-scaffold gate and this retroactive strip. on an
+anchor miss the helper throws loud rather than truncate to the whole superset — a silent re-ship of
+all 4 rds jobs is the exact break this strip exists to close.
+
+## .idempotency
+
+the fix strips the rds tail; a second pass finds the tail gone, so `check` throws (skip) and the fix
+never re-fires. a direct second `fix` call throws loud (the anchor is absent) — check gates fix, so
+the pipeline re-run is a clean no-op.