mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
Marc-André Bombeck
3989d9e9f9
The inventory walked a flat, hand-written array of route trees, so its coverage grew only when somebody remembered to grow it. It had stopped growing: the coach, environment, mental-health, inbound-document and MCP trees were all outside it, and so was the doctor-report export route the header already named as a doctorReport surface. Every route in the first four turned out to be gated, so nothing leaked — but that was the authors' care rather than the inventory's, and a green run claimed more than it covered. The trees are declared per module key as an exhaustive Record<ModuleKey, …>: a new registry key does not compile without an entry, one test asserts every key is declared, another asserts every declared tree exists, and a third discovers an API directory named after a module key on disk and fails when it is not declared. An empty array is now a claim with a reason beside it (glucose and recovery ride the measurement engine), not a silence. Walking the newly covered trees classifies every route: coach, environment, mental-health, the document vault and /api/export/health-record all gate directly. The seven /api/mcp routes are the credential surface behind the remote endpoint and go on the exempt list with the reason written out — the endpoint itself lives outside /api and carries the gate, so a credential minted while the module is off is inert. That refusal is added to the behavioural list so deleting its proof fails here. /api/export/health-record joins /api/fhir as a key-pinned tree: both serve the whole-record aggregate, so doctorReport is the only correct key.