feat(kernel): enforce phase exit analysis and inventory coverage

.claude/skills/add-architecture-test/SKILL.md

@@ -58,7 +58,7 @@ them.
 |-----------|----------|
 | **NetArchTest** | Project-graph reference bans, naming conventions on types / namespaces. |
 | **Mono.Cecil (IL scan)** | What a method body does — a constructor called, a member read — which NetArchTest's type-level rules cannot express. It ships with NetArchTest; there is no ArchUnitNET in this repository. |
-| **Roslyn analyzer** | A syntactic pattern the build itself should fail on — `throw new DomainException(...)` outside an invariant guard is `LS0001`. |
+| **Roslyn analyzer** | A compiler diagnostic over source; configured severity controls build failure. `LS0001` flags direct `throw new DomainException(...)`, including invariant guards whose justified local suppressions are checked separately. `LS0002` has its bounded sensitive-name scope in the catalogue. |
 | **Migration scan** | SQL patterns in `.cs` migration files (RLS-enable, policy presence, partition declaration). |
 | **Reflection over conventions** | Marker-attribute presence + matching property / migration shape. |
 | **String / regex scan** | When all else fails — explicit "no file under `Verticals/`", "no `english.*` permission key". |

.claude/skills/add-backend-module/SKILL.md

@@ -72,6 +72,11 @@ backend/src/Modules/<Name>/
     LearnStack.Modules.<Name>.Infrastructure.csproj
 ```
 
+All four projects inherit the analyzer from `backend/src/Directory.Build.props`;
+do not duplicate its project reference or add `LS0001`/`LS0002` to `NoWarn`.
+[The catalogue](../../../docs/standards/21-architecture-tests-catalogue.md#learnstackexception-sensitiveexceptionmessage-roslyn-analyzer)
+owns their distinct scopes and escalation contract.
+
 Project references follow the strict graph in
 [01-architecture-standards.md § Dependency Direction](../../../docs/standards/01-architecture-standards.md):
 
@@ -109,10 +114,11 @@ Forbidden references (architecture test will catch them):
 > entry describes an intended shape; do not write code against it. Two real seams
 > replace it:
 >
-> - **Handlers and validators** are registered today by passing the module's assembly
->   marker to `AddLearnStackMediatRPipeline(params Assembly[])` from the composition
->   root — one call, all modules, and it registers the validators from the same
->   assemblies.
+> - **Handlers and validators** use the shared
+>   `AddLearnStackMediatRPipeline(params Assembly[])` helper. The API's one
+>   `AddLearnStackCrossCuttingFoundation` call invokes it with all module assemblies;
+>   the Seeder calls the helper in its own composition. Both register validators
+>   and the scoped execution coordinators with the same behavior chain.
 > - **The audit catalogue** is a module-owned `IAuditCatalogSource` discovered from DI,
 >   shipped in Phase 02a Packet 9 per
 >   [ADR-0044 § 6](../../../docs/decisions/0044-audit-write-path.md). Register it at both
@@ -129,8 +135,9 @@ Forbidden references (architecture test will catch them):
 Composition root (`LearnStack.Api/Program.cs` and its `Composition/` extensions):
 
 ```csharp
-// Handlers + validators for every module, one call.
-services.AddLearnStackMediatRPipeline(
+// Extend the existing API foundation call; retain every other module marker.
+builder.AddLearnStackCrossCuttingFoundation(
+    deploymentMode,
     typeof(LearnStack.Modules.<Name>.Application.AssemblyMarker).Assembly,
     /* … the other module markers … */);
 
@@ -139,6 +146,9 @@ services.AddLearnStackMediatRPipeline(
 // services.AddScoped<I<Name>Provider, <Name>Provider>();
 ```
 
+Do not add a second pipeline registration in the API. Extend the Seeder's
+existing `AddLearnStackMediatRPipeline` call separately with the same assembly.
+
 And, from Packet 9, the module's audit catalogue — one class in the module's
 `Application` project, registered like any other DI service
 (see [add-audit-coverage](../add-audit-coverage/SKILL.md)):

.claude/skills/wire-cross-cutting-foundation/SKILL.md

@@ -5,7 +5,7 @@ description: >
   (`LearnStack.Api`, worker, background-service host) — `IExceptionHandler`,
   8-step MediatR pipeline, `Result<T>.ToActionResult()`, Serilog + OTel,
   `TenantContextSpanProcessor`, `IErrorTrackingProvider`,
-  `IProviderResilience<TPort>`, Roslyn analyzer for `DomainException`. USE
+  `IProviderResilience<TPort>`, and the scoped exception analyzers. USE
   FOR: standing up the foundation in Phase 02a (one-time wiring per host
   process), or restoring it after a composition-root refactor. DO NOT USE
   FOR: adding a new provider adapter ([add-provider-adapter](../add-provider-adapter/SKILL.md)),
@@ -21,7 +21,7 @@ description: >
 Bring up the LearnStack error-handling + logging + observability foundation
 in a backend host. The contract is bound by
 [ADR-0032](../../../docs/decisions/0032-exception-handling-logging-and-observability.md).
-This skill walks the canonical wiring step by step so the eight binding
+This skill walks the canonical wiring step by step so the binding
 sub-decisions land in the right composition-root order and the architecture
 tests pass.
 
@@ -69,8 +69,11 @@ and
 [33-cross-cutting-concerns.md](../../../docs/architecture/33-cross-cutting-concerns.md).
 You should be able to recite, before you write a line of code:
 
-- The eight pipeline behaviors and their order
+- The eight pipeline stages (seven behaviors plus the handler) and their order
   (`Validation → Logging → AuditLog → TenantContext → Authorization → Transaction → OutboxFlush → Handler`).
+- Step 7's historical name denotes the producer enrollment/invariant guard,
+  not a buffered flush. Enqueue inserts immediately in the ambient transaction;
+  its owner drains domain events before MUST audit/commit under ADR-0057.
 - The Sentry-vs-OTel boundary (`ShouldCapture(ex)` table).
 - The Serilog + OTLP wiring rule (no `AddOpenTelemetry().WithLogging()` alongside).
 - The composition-root branching for `IErrorTrackingProvider`.
@@ -208,24 +211,18 @@ and dispatches to `IErrorTrackingProvider.CaptureAsync` only when
 `ShouldCapture(ex)` returns true (see
 [09-error-handling.md § Sentry vs OpenTelemetry — Error Capture Boundary](../../../docs/standards/09-error-handling.md)).
 
-### Step 8: Register the MediatR pipeline (8 behaviors in order)
+### Step 8: Use the shared MediatR registration (7 behaviors plus handler)
 
-```csharp
-services.AddMediatR(cfg =>
-{
-    cfg.RegisterServicesFromAssemblyContaining<AssemblyMarker>();
-
-    // Order matters — outermost first, innermost last.
-    // Architecture test MediatR_Pipeline_Order_Matches_Canonical_Sequence enforces this.
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(ValidationBehavior<,>));
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(LoggingBehavior<,>));
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(AuditLogBehavior<,>));
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(TenantContextBehavior<,>));
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(AuthorizationBehavior<,>));
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(TransactionBehavior<,>));
-    cfg.AddBehavior(typeof(IPipelineBehavior<,>), typeof(OutboxFlushBehavior<,>));
-});
-```
+The foundation call in Step 12 invokes
+`services.AddLearnStackMediatRPipeline(handlerAssemblies)` once. That shared
+helper registers the audit, producer and transaction coordinators, validators
+and `MediatRPipelineRegistration.CanonicalBehaviorOrder`. Do not reconstruct
+the behavior chain with a separate `AddMediatR` call or call the helper again
+after the foundation. A separate registration path can bypass shared services;
+repeating the shared helper is idempotent but needlessly obscures ownership.
+`Registering_The_Pipeline_Twice_Registers_It_Once` protects that idempotency.
+`MediatR_Pipeline_Order_Matches_Canonical_Sequence` verifies
+the actual order, including `OutboxFlushBehavior` at position seven.
 
 Do **not** add an `ExceptionHandlingBehavior`. The `AuditLogBehavior` catches
 handler exceptions, writes the failure audit, and rethrows via
@@ -298,24 +295,37 @@ public async Task<IActionResult> Create(CreateCourseCommand cmd, CancellationTok
 
 No action filter, no `ResultUnwrapBehavior`. Explicit beats magic.
 
-### Step 11: Add the Roslyn analyzer
+### Step 11: Preserve automatic analyzer wiring
+
+`backend/src/Directory.Build.props` automatically references the in-tree
+`backend/analyzers/LearnStack.Analyzers` project with
+`OutputItemType="Analyzer"` and `ReferenceOutputAssembly="false"`. It is not
+a NuGet package. New production C# projects inherit this wiring. Do not add
+project-level
+analyzer references or suppress these diagnostics with `NoWarn`.
+
+- `LS0001` (`LearnStackException-DomainExceptionThrow`) retains its
+  Domain/Application scope through the compiler-visible scope property.
+- `LS0002` (`LearnStackException-SensitiveExceptionMessage`) covers bounded
+  sensitive-name exception expressions in every production C# project. It is
+  not data-flow analysis and covers no JavaScript/TypeScript.
+- Both remain Warning, including CI, in `WarningsNotAsErrors` rather than
+  `NoWarn`. Phase 03 exit promotes them to Error and removes that exemption.
 
-The `LearnStackException-DomainExceptionThrow` analyzer lives in
-`backend/analyzers/` and ships as a NuGet package referenced by
-`Domain` + `Application` projects via
-`<PackageReference Include="LearnStack.Analyzers" ... />`. Severity:
-Warning in Phase 02a, escalates to Error after Phase 03 exit.
+[ADR-0032 Amendment 6](../../../docs/decisions/0032-exception-handling-logging-and-observability.md#amendment-6--sensitive-exception-message-diagnostic-2026-10-25)
+and the [catalogue](../../../docs/standards/21-architecture-tests-catalogue.md#learnstackexception-sensitiveexceptionmessage-roslyn-analyzer)
+own the exact scope, expression limits and proof obligations.
 
-### Step 12: Register module services last
+### Step 12: Pass all module assemblies to the host foundation
 
 Module assemblies reach the foundation as arguments, not as separate registration
 calls. `AddLearnStackCrossCuttingFoundation` discovers their integration-event
-handlers and hands the same assemblies to `AddLearnStackMediatRPipeline` as its
-**last** statement, so behaviors and instrumentation are already wired before any
-module handler is registered:
+handlers and then hands the same assemblies to `AddLearnStackMediatRPipeline`
+for the shared execution services, behavior chain and validator discovery. Keep
+the complete assembly set in this one host call:
 
 ```csharp
-// The shipped entry point, and the only one: AddLearnStackCrossCuttingFoundation
+// The shipped host entry point, called once: AddLearnStackCrossCuttingFoundation
 // on the WebApplicationBuilder, taking the deployment mode and the assemblies whose
 // integration-event handlers should be discovered.
 builder.AddLearnStackCrossCuttingFoundation(

.github/CONTRIBUTING.md

@@ -167,8 +167,10 @@ it.
 `make test` starts Testcontainers since Phase 02a Packet 6, so it needs a Docker
 socket and takes noticeably longer than it did. The Docker-bound cases are split
 out by `[Trait("Requires","Docker")]`; to skip them, run
-`dotnet test backend/LearnStack.slnx --filter "Requires!=Docker"`, which is
-exactly what CI's `backend` job runs.
+`dotnet test backend/LearnStack.slnx --filter "Requires!=Docker"` locally.
+CI partitions that population into base and architecture producers, with exact
+coverage checked by the required backend aggregate under
+[ADR-0063](../docs/decisions/0063-complete-bounded-ci-test-shards.md).
 
 The pre-commit hook (activated by `make install`) runs, on staged files only:
 `dotnet format` on `*.cs`; prettier on JS / TS / JSON / Markdown **under

CLAUDE.md

@@ -367,6 +367,10 @@ rules:
   The Roslyn analyzer `LearnStackException-DomainExceptionThrow` flags
   violations; full catalogue entry in
   [docs/standards/21-architecture-tests-catalogue.md](docs/standards/21-architecture-tests-catalogue.md).
+- Silence the production `LS0002` sensitive-exception-message guard project-wide.
+  Its automatic wiring and bounded scope are in the
+  [same catalogue](docs/standards/21-architecture-tests-catalogue.md#learnstackexception-sensitiveexceptionmessage-roslyn-analyzer).
+  A clean report is not data-flow secrecy or a redaction guarantee.
 - Throw `FluentValidation.ValidationException` from `ValidationBehavior` —
   the behavior returns `Result.Fail(validation_failed)` and never throws.
 - Reference `Sentry.SentrySdk` directly from any module assembly — error

README.md

@@ -77,7 +77,7 @@ skeleton. Current packet state lives in the
 | **Customization** | Content types, level taxonomies, exact-definition and generation-cached batched display readers, text-card metadata validation, create-only provisioning defaults and semantic built-in seed verification | Remaining authoring capabilities across [Phases 04–08a](docs/roadmap/README.md) |
 | **Audit** | Classified write path and transactional durability for business changes | Operational hardening in [Phase 11](docs/roadmap/phase-11-production-hardening.md) |
 | **Education** | Course and Lesson aggregates, translations, protected-content policy, scoped authoring commands, complete demo seeds and isolated public GET/HEAD reads | Full versioned curriculum in [Phase 05](docs/roadmap/phase-05-education-learning-content.md) |
-| **API foundation** | Error contracts, validation, tenancy, concurrency, observability, durable events/subscriber delivery, background jobs, the closed tenant bearer/AccountSite boundary and development realm reconciliation | Phase-exit enforcement in [Phase 02b](docs/roadmap/phase-02b-events-auth.md) |
+| **API foundation** | Error contracts, validation, tenancy, concurrency, observability, durable events/subscriber delivery, background jobs, the closed tenant bearer/AccountSite boundary and development realm reconciliation | Membership and permissions in [Phase 03](docs/roadmap/phase-03-identity-admin.md); current exit state in [Phase 02b](docs/roadmap/phase-02b-events-auth.md) |
 | **Frontend** | Native TLS ingress, live locale entry, trusted server caller, localized catalog/course/lesson pages, safe themes, accessibility controls/manual smoke, generated typed SDK and optional bounded native BFF session scaffolds | Full renderer/Studio and Playwright Test/axe in [Phase 06](docs/roadmap/phase-06-renderer-admin-studio.md) |
 
 **Four modules contain domain implementations:** Tenancy, Customization, Audit and

backend/Directory.Build.props

@@ -7,15 +7,11 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <TreatWarningsAsErrors Condition="'$(CI)' == 'true'">true</TreatWarningsAsErrors>
     <!--
-      LS0001 ("LearnStackException-DomainExceptionThrow", ADR-0032
-      § Sub-decision 4 + Amendment 1) is a Warning until the Phase 03 exit
-      gate, then escalates to Error. Keep it OUT of TreatWarningsAsErrors
-      until then so a legitimate aggregate-invariant `throw new
-      DomainException(...)` does not break CI before the documented
-      escalation point. Remove LS0001 from this list when the analyzer's
-      default severity flips to Error after Phase 03 exit.
+      ADR-0032 Amendments 1/6 keep LS0001 and LS0002 as Warnings until
+      Phase 03 exit, including CI. They remain visible, not suppressed.
+      Remove both exemptions when their default severities become Error.
     -->
-    <WarningsNotAsErrors>$(WarningsNotAsErrors);LS0001</WarningsNotAsErrors>
+    <WarningsNotAsErrors>$(WarningsNotAsErrors);LS0001;LS0002</WarningsNotAsErrors>
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <AnalysisLevel>latest</AnalysisLevel>
     <!--

backend/analyzers/LearnStack.Analyzers/AnalyzerReleases.Unshipped.md

@@ -6,3 +6,4 @@
 Rule ID | Category | Severity | Notes
 --------|----------|----------|------------
 LS0001 | Design | Warning | Rule "LearnStackException-DomainExceptionThrow" (ADR-0032 § Sub-decision 4 + Amendment 1). DomainException is reserved for programmer errors; expected business-rule violations return Result.Fail(business_rule_violation, ...). Roslyn diagnostic ids must be valid identifiers, so the wire id is LS0001; the hyphenated string is the human-readable rule name. Severity escalates to Error after Phase 03 exit.
+LS0002 | Security | Warning | Rule "LearnStackException-SensitiveExceptionMessage" (ADR-0032 Amendment 6). Bounded sensitive-name checks on directly thrown exception string arguments across production C# projects. Severity escalates to Error after Phase 03 exit.

backend/analyzers/LearnStack.Analyzers/DomainExceptionThrowAnalyzer.cs

@@ -23,14 +23,19 @@ namespace LearnStack.Analyzers;
 /// help text; the wire-level id is <c>LS0001</c>. See ADR-0032 Amendment 1.
 /// </para>
 /// <para>
-/// Severity: <see cref="DiagnosticSeverity.Warning"/> in Phase 02a. Per
+/// Severity: <see cref="DiagnosticSeverity.Warning"/> until Phase 03 exit. Per
 /// ADR-0032 the severity escalates to <see cref="DiagnosticSeverity.Error"/>
 /// after Phase 03 exit when every existing call site has been migrated.
 /// Until then <c>LS0001</c> is listed in <c>WarningsNotAsErrors</c>
 /// (Directory.Build.props) so a legitimate aggregate-invariant throw does
 /// not break CI under <c>TreatWarningsAsErrors</c> before the documented
 /// escalation point.
 /// </para>
+/// <para>
+/// The assembly also carries LS0002 and is loaded by every production project.
+/// The compiler-visible LearnStackAnalyzeDomainExceptionThrow property keeps
+/// this rule scoped to Domain / Application (ADR-0032 Amendment 6).
+/// </para>
 /// </remarks>
 [DiagnosticAnalyzer(LanguageNames.CSharp)]
 public sealed class DomainExceptionThrowAnalyzer : DiagnosticAnalyzer
@@ -71,8 +76,18 @@ public override void Initialize(AnalysisContext context)
         if (context is null) throw new System.ArgumentNullException(nameof(context));
         context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
         context.EnableConcurrentExecution();
-        context.RegisterSyntaxNodeAction(AnalyzeThrowExpression, SyntaxKind.ThrowExpression);
-        context.RegisterSyntaxNodeAction(AnalyzeThrowStatement, SyntaxKind.ThrowStatement);
+        context.RegisterCompilationStartAction(start =>
+        {
+            if (start.Options.AnalyzerConfigOptionsProvider.GlobalOptions.TryGetValue(
+                    "build_property.LearnStackAnalyzeDomainExceptionThrow", out var enabled)
+                && string.Equals(enabled, "false", System.StringComparison.OrdinalIgnoreCase))
+            {
+                return;
+            }
+
+            start.RegisterSyntaxNodeAction(AnalyzeThrowExpression, SyntaxKind.ThrowExpression);
+            start.RegisterSyntaxNodeAction(AnalyzeThrowStatement, SyntaxKind.ThrowStatement);
+        });
     }
 
     private static void AnalyzeThrowStatement(SyntaxNodeAnalysisContext context)

backend/analyzers/LearnStack.Analyzers/LearnStack.Analyzers.csproj

@@ -22,6 +22,12 @@
     </PackageReference>
   </ItemGroup>
 
+  <ItemGroup>
+    <!-- Compile the canonical matcher without a runtime SharedKernel dependency. -->
+    <Compile Include="..\..\src\LearnStack.SharedKernel\Secrets\SensitiveTokenMatcher.cs"
+             Link="Secrets\SensitiveTokenMatcher.cs" />
+  </ItemGroup>
+
   <ItemGroup>
     <!-- Roslyn release-tracking rule (RS2008) requires these markdown files
          to live alongside the analyzer assembly. -->