fix: PR #3 review-3 — seed health-check + pre-commit output + roadmap clarity

One inline + three nitpicks from the review. The fourth nitpick
(frontend tsconfig _comment field) was already closed in 1a5f245.

Inline (scripts/seed.sh):
- The health-check loop captured only `.Health`; a service with no
  healthcheck (empty Health column) was treated as already-healthy.
  All current dev.yml services carry a healthcheck per Standards 12,
  but the policy should be enforced not assumed. Rewrote the awk to
  consume `{{.Name}}\t{{.State}}\t{{.Health}}` and flag three
  distinct failure shapes — service not running, service running
  but with no healthcheck defined, service running but healthcheck
  not yet `healthy`. Each shape prints its own diagnostic so the
  developer can see whether to wait or to fix a missing healthcheck.

Nitpick (.githooks/pre-commit):
- Leakwatch failure path piped scanner output to `/dev/null`, leaving
  the developer guessing which detector fired. Now captures stdout +
  stderr, replays it before exiting 1 — exit code drives the gate,
  scanner output drives the diagnosis.

Nitpicks (docs/roadmap/phase-01-repository-tooling.md):
- The CI Baseline section listed Integration / OpenAPI-diff /
  Lighthouse as plain bullets, contradicting the in-progress status
  block above that calls them deferred. Each now carries an inline
  *(scaffolded as `if: false` placeholder; activates in Phase 0Xx
  when …)* note so Scope and Status read coherently.
- "Optional `learnstack-hub` compose overlay for local Hub
  development" was ambiguous about ownership — could be read as
  "lives in this repo." Rewritten to "Optional **external**
  `learnstack-hub` compose overlay (maintained in the separate
  `learnstack-hub` repository per ADR-0019)" so location + ownership
  are unambiguous.

Skipped:
- Action SHA pinning (.github/workflows/ci.yml): genuine supply-
  chain hardening recommendation, but maintaining SHA pins without
  Renovate / Dependabot is operationally heavy for a Phase 01 PR.
  Track for Phase 11 production-hardening — the addition there
  bundles SHA pinning + a Renovate config in one change. The
  current `@v4` / `@v5` major-tag pins are the GitHub-recommended
  Phase-01-grade posture.

Verification: `bash -n` clean on both shell scripts; `python3
yaml.safe_load` clean on ci.yml; roadmap links resolve under the
new sibling-relative + repo-relative auditor.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: cemililik

.githooks/pre-commit

@@ -102,8 +102,13 @@ if command -v leakwatch >/dev/null 2>&1; then
         for f in "${all_staged[@]}"; do
             # Skip files that don't exist (D for delete in --diff-filter).
             [[ -f "$f" ]] || continue
-            if ! leakwatch scan fs "$f" --config .leakwatch.yaml --min-severity medium --no-verify >/dev/null; then
-                printf "\npre-commit: leakwatch found a likely secret in %s\n" "$f" >&2
+            # Capture stdout+stderr; on failure replay the scanner output to
+            # the developer (suppressing it would leave them guessing which
+            # detector fired). Exit code drives the gate; output drives the
+            # diagnosis.
+            if ! scan_output=$(leakwatch scan fs "$f" --config .leakwatch.yaml --min-severity medium --no-verify 2>&1); then
+                printf "\npre-commit: leakwatch found a likely secret in %s\n\n" "$f" >&2
+                printf "%s\n\n" "$scan_output" >&2
                 printf "If it is a legitimate dev credential, add an inline\n" >&2
                 printf "\`# leakwatch:ignore\` comment or extend .leakwatchignore.\n" >&2
                 exit 1

docs/roadmap/phase-01-repository-tooling.md

@@ -201,8 +201,11 @@ Docker Compose under `infra/compose/`:
 - **Dapr sidecar** + placement service.
 - **APISIX** (file-driven standalone `data_plane` mode per ADR-0015 — no etcd, no Admin API, no dashboard companion).
 - Optional Jaeger or Tempo (for trace inspection).
-- Optional `learnstack-hub` compose overlay for local Hub development (depends on
-  the same Keycloak / Postgres / Kafka / Vault / APISIX stack).
+- Optional **external** `learnstack-hub` compose overlay (maintained in the
+  separate `learnstack-hub` repository per
+  [ADR-0019](../decisions/0019-learnstack-hub.md)) for local Hub development —
+  depends on the same Keycloak / Postgres / Kafka / Vault / APISIX stack but
+  never ships in this repo.
 
 Two compose files:
 
@@ -221,10 +224,16 @@ Two compose files:
 
 - GitHub Actions workflow.
 - Backend build and unit + architecture + contract tests.
-- Integration tests with Testcontainers PostgreSQL.
+- Integration tests with Testcontainers PostgreSQL — *scaffolded as
+  `if: false` placeholder; activates in Phase 02a when the first
+  integration test lands (see Status note above).*
 - Frontend install, typecheck, build, lint, component tests.
-- OpenAPI breaking-change check.
-- Lighthouse budget check on representative public pages.
+- OpenAPI breaking-change check — *scaffolded as `if: false` placeholder;
+  activates in Phase 03 when the first real `/api/v1/*` endpoint replaces
+  the `/healthz` placeholder.*
+- Lighthouse budget check on representative public pages — *scaffolded as
+  `if: false` placeholder; activates in Phase 04 when the first content-
+  bearing public page ships.*
 - Required status checks on `main`.
 
 ## Deliverables

scripts/seed.sh

@@ -47,8 +47,20 @@ fi
 
 elapsed=0
 while true; do
-    not_healthy=$(docker compose -f "$COMPOSE_FILE" ps --format '{{.Name}}\t{{.Health}}' \
-                  | awk -F'\t' '$2 != "healthy" && $2 != "" {print $1 " (" $2 ")"}')
+    # Capture BOTH .State and .Health so we can distinguish:
+    #   - service running + healthcheck reports `healthy`  → ok
+    #   - service running + healthcheck still `starting`   → wait
+    #   - service running + NO healthcheck defined         → flag (every
+    #     service in dev.yml carries one per Standards 12 § Local Infra;
+    #     an empty Health column means a future regression)
+    #   - service not running (exited, dead, restarting)   → flag
+    not_healthy=$(docker compose -f "$COMPOSE_FILE" \
+                  ps --format '{{.Name}}\t{{.State}}\t{{.Health}}' \
+                  | awk -F'\t' '
+                      $2 != "running"            { print $1 " (state=" $2 ")"; next }
+                      $3 == ""                   { print $1 " (no healthcheck)"; next }
+                      $3 != "healthy"            { print $1 " (health=" $3 ")"; next }
+                    ')
     [[ -z "$not_healthy" ]] && break
     if (( elapsed >= HEALTH_TIMEOUT_SECONDS )); then
         red "Services still not healthy after ${HEALTH_TIMEOUT_SECONDS}s — inspect with:"
@@ -61,7 +73,7 @@ while true; do
     sleep 3
     elapsed=$(( elapsed + 3 ))
 done
-green "  ✓ All compose services healthy."
+green "  ✓ All compose services running + healthcheck-green."
 
 # ─── Step 2: Keycloak realm verification ─────────────────────────────────
 # Realm import happens during Keycloak's first boot — even after the