feat(generate): C3c — emit compose healthcheck: + lower intra-project dependsOn (spec 10)

[gustavobertoi]

Chunk C3c (M2-remainder)

Translates the spec-10 readiness config into the generated compose document, completing the Compose-native (intra-project) enforcement layer.

What

• healthcheck: lowering — a service-declared healthcheck → a Compose-native block with a per-kind test:

  • tcp → nc -z localhost PORT
  • http/https → curl -fsS [-k] -o /dev/null URL
  • exec → ["CMD", <argv...>]
  • pg_isready → pg_isready -p PORT -U USER [-d DB]
  • redis → redis-cli -p PORT [-a AUTH] PING

  Timing is emitted only when set (deterministic). A secret:// redis auth is never embedded (§7.5) — redis-cli reads $REDISCLI_AUTH from the container env.

• intra-project dependsOn lowering → depends_on: { dep: { condition: service_healthy|service_started } }. Cross-project edges (shared services, other projects) are skipped — compose can't express them; the up saga gates them tool-side via internal/health. A missing intra-project target is a generate error.

Scope

The richer generate-time "condition: healthy ⇒ target declares a healthcheck" validation with file:line:col is X2; here compose-go's own consistency check is the backstop (verified by an end-to-end test that it accepts service_healthy only when the target has a healthcheck).

Tests

• Unit: per-kind test lowering, timing-only-when-set, dependsOn classification (intra bare/qualified emitted; shared/other-project skipped; missing target errors), redis secret-auth omission.
• End-to-end: a sibling depends_on: healthy edge reaches compose and compose-go accepts it.
• The devstack-api golden gains its lowered http healthcheck (regenerated; diff is exactly the block).

Gate

make ci + make determinism + make smoke all green.

🤖 Generated with Claude Code