fix: replace regex and string hacks with real parsers across ports

.githooks/leak-patterns.sh

@@ -0,0 +1,15 @@
+# Shared leak-scan patterns, sourced by .githooks/pre-commit and .githooks/leak-scan.sh so the
+# local hook and the hosted `leak-scan` status can never disagree about what a leak is.
+# Names NO private project; private names come only from the untracked denylist.
+#
+# /Users/ is the macOS home shape. It was missing from leak-scan.sh until a rename-with-edits
+# slipped past both (audit finding 12).
+
+# Generic, non-sensitive structural patterns (safe to commit):
+LEAK_PATTERNS='/home/[A-Za-z0-9._-]+/|/Users/[A-Za-z0-9._-]+/|~/Development'
+
+# Legitimate matches to ignore (the published npm author email).
+LEAK_ALLOW='doug@dougmealing\.com'
+
+# Diff filter: Added, Copied, Modified and Renamed (a `git mv` plus an edit is a rename).
+LEAK_DIFF_FILTER='ACMR'

.githooks/leak-scan.sh

@@ -15,13 +15,13 @@
 #
 set -uo pipefail
 
-# Generic, non-sensitive structural patterns (safe to commit — name no project):
-PATTERNS='/home/[A-Za-z0-9._-]+/|~/Development'
-
-# Legitimate matches to ignore (the published npm author email).
-ALLOW='doug@dougmealing\.com'
-
 ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
+# Patterns, allow-list and diff filter are shared with .githooks/pre-commit.
+# shellcheck source=leak-patterns.sh
+. "$ROOT/.githooks/leak-patterns.sh"
+PATTERNS="$LEAK_PATTERNS"
+ALLOW="$LEAK_ALLOW"
+
 DENY_FILE="$(git config --get hooks.denyListPath 2>/dev/null || true)"
 [ -z "$DENY_FILE" ] && DENY_FILE="$ROOT/.githooks/deny-list.local"
 if [ -f "$DENY_FILE" ]; then
@@ -30,9 +30,9 @@ if [ -f "$DENY_FILE" ]; then
 fi
 
 if [ -n "${1:-}" ]; then
-  DIFF=$(git diff "$1...HEAD" -U0 --no-color --diff-filter=ACM 2>/dev/null)
+  DIFF=$(git diff "$1...HEAD" -U0 --no-color --diff-filter="$LEAK_DIFF_FILTER" 2>/dev/null)
 else
-  DIFF=$(git diff --cached --diff-filter=ACM -U0 --no-color 2>/dev/null)
+  DIFF=$(git diff --cached --diff-filter="$LEAK_DIFF_FILTER" -U0 --no-color 2>/dev/null)
 fi
 
 # Scan only newly-ADDED lines, attributed to their file; skip the hooks dir itself.

.githooks/pre-commit

@@ -17,19 +17,17 @@
 #
 set -uo pipefail
 
-# Generic, non-sensitive structural patterns — safe to commit (name no project):
-# /Users/ is the macOS home shape. It was missing until a plan doc authored on a Mac
-# committed an absolute developer home path that this hook scanned and passed.
-PATTERNS='/home/[A-Za-z0-9._-]+/|/Users/[A-Za-z0-9._-]+/|~/Development'
-
-# Legitimate matches to ignore (e.g. the published npm author email).
-ALLOW='doug@dougmealing\.com'
+ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
+# Patterns, allow-list and diff filter are shared with .githooks/leak-scan.sh.
+# shellcheck source=leak-patterns.sh
+. "$ROOT/.githooks/leak-patterns.sh"
+PATTERNS="$LEAK_PATTERNS"
+ALLOW="$LEAK_ALLOW"
 
 # Merge in private-name patterns from a denylist. Source priority:
 #   1) git config hooks.denyListPath  -> point at your private denylist file (kept in a private repo)
 #   2) .githooks/deny-list.local      -> untracked local file or symlink
 # If neither resolves, only the generic structural patterns above are enforced.
-ROOT="$(git rev-parse --show-toplevel 2>/dev/null || echo .)"
 DENY_FILE="$(git config --get hooks.denyListPath 2>/dev/null || true)"
 [ -z "$DENY_FILE" ] && DENY_FILE="$ROOT/.githooks/deny-list.local"
 if [ -f "$DENY_FILE" ]; then
@@ -38,7 +36,7 @@ if [ -f "$DENY_FILE" ]; then
 fi
 
 # Scan only newly-ADDED staged lines, attributed to their file; skip the hooks dir.
-hits=$(git diff --cached --diff-filter=ACM -U0 --no-color 2>/dev/null | awk '
+hits=$(git diff --cached --diff-filter="$LEAK_DIFF_FILTER" -U0 --no-color 2>/dev/null | awk '
   /^\+\+\+ /              { f=$2; sub(/^b\//,"",f); next }
   /^\+/ && !/^\+\+\+/     { if (f !~ /^\.githooks\//) print f "\t" substr($0,2) }
 ' | grep -Ei "$PATTERNS" | grep -vEi "$ALLOW")

AGENTS.md

@@ -71,7 +71,7 @@ PyPI has had no product change since `0.25.0` — nothing is broken.
 - **Kotlin** — `codegen-kotlin` (KotlinPoet on JVM): entity + Exposed table + Spring controller + payload + relations + filter allowlist + validator + stored-proc + output-parser generators. `integration-tests-kotlin` runs the persistence-conformance corpus through Exposed against Testcontainers Postgres.
 
 **Cross-port conformance corpora** (every port runs the shared corpus):
-- Metamodel: `fixtures/conformance/` (413 fixtures; 34 shared corpora in total — per-corpus counts + the corpus x port matrix live in `docs/CONFORMANCE.md`). TS / C# / Java / Python all green.
+- Metamodel: `fixtures/conformance/` (421 fixtures; 34 shared corpora in total — per-corpus counts + the corpus x port matrix live in `docs/CONFORMANCE.md`). TS / C# / Java / Python all green.
 - Render: `fixtures/render-conformance/`. TS / C# / Java / Kotlin / Python byte-identical.
 - Persistence: `fixtures/persistence-conformance/`. **Query** scenarios run on every port (TS / C# / Java / Kotlin / Python), each provisioning its test DB by executing the committed, TS-produced `canonical/schema.postgres.sql` (Postgres only — Derby dropped for the cross-port query corpus, ADR-0015; the FR-044 `report-*` scenarios also run on SQLite, MySQL and D1 where a port has the engine, see [docs/CONFORMANCE.md](docs/CONFORMANCE.md)). The **migration** scenarios are exercised by **TS only** (TS owns schema migrations). **The corpus now gates WRITES, not just reads (SP-H):** an `op: roundtrip` scenario type INSERTs through each port's runtime/ORM write codec (NOT raw SQL), reads the row back, and asserts the wire-normalized value. The `AllTypes` entity (`roundtrip-all-types.yaml`) carries one field of **every** persistable `field.*` subtype — string/int/long/double/float/decimal/boolean/date/time/timestamp(+tz)/currency/enum/uuid/object — plus an **array-of-VO** `field.object @isArray @storage:jsonb` column (`labels`, written as 2-element / empty-`[]` / single-element arrays across the three rows) — so every subtype write+read (incl. the array-of-value-object jsonb codec) round-trips through every port against Testcontainers PG. (`field.byte`/`field.short`/`field.class` were cut as non-functional registration-only stubs — the matrix tracks only genuinely-supported subtypes; see `fixtures/registry-conformance/README.md` → "Per-subtype write-round-trip matrix".)
 - API-contract: `fixtures/api-contract-conformance/`. TS / C# / Java / Kotlin / Python all green — each port runs **two lanes**: a hand-rolled reference server AND its **generated** API artifact booted over HTTP (the deployed controller/routes; TS+C# full-stack vs Testcontainers PG, Java/Kotlin/Python generated controller + in-memory repo behind the consumer seam). The generated fan-out found 10 real deployment bugs golden snapshots missed. Three sub-corpora run the **generated lane only, on all five ports** — `write-through/`, `projection/` (F22: a view-only `object.projection` serves GET list + GET by id and answers every write verb with `405 {"error": "method_not_allowed"}`) and `report/` (FR-044: a view-backed `object.report` serves GET list, answers `POST` with that same `405`, and mounts no `/{id}` route). That is deliberate, not a gap: what is under test is whether a port's GENERATOR emits those routes, and a hand-rolled reference server would answer every scenario by construction. The `m2m/` sub-corpus also gates **TPH x M:N together** (base-declared, subtype-declared, abstract-mid-declared, a non-subtype source onto a subtype TARGET, and the cross-subtype source id answering `200 []`) — the two corpora were originally built disjoint (`tph/` had no relationships, `m2m/` no discriminators), which is precisely how that defect class survived.