@starci/eslint-canon-be 3.0.10 → 3.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (149) hide show
  1. package/CHANGELOG.md +7 -1
  2. package/README.md +2 -1
  3. package/builders.mjs +1 -1
  4. package/comments.mjs +1 -1
  5. package/config-owner.mjs +1 -1
  6. package/index.mjs +2 -0
  7. package/lib/config.mjs +4 -1
  8. package/lib/doors.mjs +3 -1
  9. package/module-shape.mjs +1 -2
  10. package/package.json +1 -1
  11. package/resilience.mjs +1 -1
  12. package/runtime/config.example.yaml +194 -0
  13. package/runtime/engine/by-code-unit.mjs +12 -0
  14. package/runtime/engine/config.mjs +222 -239
  15. package/runtime/engine/invalid-config.mjs +5 -5
  16. package/runtime/engine/model-config.mjs +90 -0
  17. package/runtime/engine/orca-config.mjs +3 -1
  18. package/runtime/engine/release-config.mjs +28 -0
  19. package/runtime/engine/removed-vocabulary.mjs +28 -0
  20. package/runtime/engine/resources-config.mjs +52 -0
  21. package/runtime/engine/runtime-root.mjs +17 -0
  22. package/runtime/engine/secrets.mjs +35 -31
  23. package/runtime/engine/sonar-config.mjs +21 -0
  24. package/runtime/engine/temp-root.mjs +32 -0
  25. package/runtime/knowledge/hfs/canon-pins.yaml +14 -14
  26. package/runtime/knowledge/hfs/rules.yaml +161 -65
  27. package/runtime/knowledge/hfs/slots.yaml +11 -14
  28. package/runtime/modules/kernel/removed-vocabulary.yaml +268 -0
  29. package/runtime/modules/models/registry.yaml +25 -359
  30. package/runtime/modules/models/runtimes.yaml +126 -265
  31. package/runtime/modules/models/tiers.yaml +66 -0
  32. package/runtime/scripts/api/git/lib.mjs +34 -1
  33. package/runtime/scripts/hfs/allows.mjs +3 -3
  34. package/runtime/scripts/hfs/architecture/ast-walks.mjs +63 -50
  35. package/runtime/scripts/hfs/architecture/automatic-gates.mjs +96 -0
  36. package/runtime/scripts/hfs/architecture/backend.mjs +261 -175
  37. package/runtime/scripts/hfs/architecture/background-unowned.mjs +69 -34
  38. package/runtime/scripts/hfs/architecture/client-reaches-server.mjs +55 -54
  39. package/runtime/scripts/hfs/architecture/clones.mjs +179 -106
  40. package/runtime/scripts/hfs/architecture/config-unread.mjs +5 -22
  41. package/runtime/scripts/hfs/architecture/config.mjs +95 -80
  42. package/runtime/scripts/hfs/architecture/connection-map.mjs +233 -141
  43. package/runtime/scripts/hfs/architecture/constructor-deps.mjs +15 -9
  44. package/runtime/scripts/hfs/architecture/context-coupling.mjs +76 -52
  45. package/runtime/scripts/hfs/architecture/context-map.mjs +215 -141
  46. package/runtime/scripts/hfs/architecture/context-owner.mjs +39 -30
  47. package/runtime/scripts/hfs/architecture/context-platform-tables.mjs +31 -17
  48. package/runtime/scripts/hfs/architecture/context-transaction.mjs +38 -25
  49. package/runtime/scripts/hfs/architecture/contract-fixture-guard.mjs +86 -40
  50. package/runtime/scripts/hfs/architecture/contracts-readonly.mjs +342 -0
  51. package/runtime/scripts/hfs/architecture/contracts.mjs +263 -455
  52. package/runtime/scripts/hfs/architecture/cross-app-duplicate.mjs +43 -34
  53. package/runtime/scripts/hfs/architecture/dead-exports.mjs +201 -154
  54. package/runtime/scripts/hfs/architecture/default-deny.mjs +118 -93
  55. package/runtime/scripts/hfs/architecture/doc-language.mjs +2 -1
  56. package/runtime/scripts/hfs/architecture/entrypoint.mjs +45 -30
  57. package/runtime/scripts/hfs/architecture/error-codes.mjs +19 -12
  58. package/runtime/scripts/hfs/architecture/error-masked.mjs +39 -26
  59. package/runtime/scripts/hfs/architecture/fe-slot-allows.mjs +2 -1
  60. package/runtime/scripts/hfs/architecture/feature-shape.mjs +26 -20
  61. package/runtime/scripts/hfs/architecture/framework-pinned.mjs +1 -1
  62. package/runtime/scripts/hfs/architecture/frontend-grammar.mjs +190 -0
  63. package/runtime/scripts/hfs/architecture/frontend-routing.mjs +186 -0
  64. package/runtime/scripts/hfs/architecture/frontend-world-render.mjs +311 -0
  65. package/runtime/scripts/hfs/architecture/frontend-world.mjs +328 -0
  66. package/runtime/scripts/hfs/architecture/frontend.mjs +109 -829
  67. package/runtime/scripts/hfs/architecture/hfs-graph.mjs +14 -2
  68. package/runtime/scripts/hfs/architecture/hfs.mjs +120 -288
  69. package/runtime/scripts/hfs/architecture/hooks-are-hooks.mjs +46 -26
  70. package/runtime/scripts/hfs/architecture/i18n-keys.mjs +114 -76
  71. package/runtime/scripts/hfs/architecture/index.mjs +164 -104
  72. package/runtime/scripts/hfs/architecture/injection-token-exported.mjs +33 -28
  73. package/runtime/scripts/hfs/architecture/machine-ast.mjs +180 -144
  74. package/runtime/scripts/hfs/architecture/managed-scripts.mjs +8 -2
  75. package/runtime/scripts/hfs/architecture/module-per-transport.mjs +150 -101
  76. package/runtime/scripts/hfs/architecture/next-data-contract.mjs +51 -43
  77. package/runtime/scripts/hfs/architecture/next-data-key.mjs +338 -0
  78. package/runtime/scripts/hfs/architecture/next-data.mjs +179 -427
  79. package/runtime/scripts/hfs/architecture/owners.mjs +27 -13
  80. package/runtime/scripts/hfs/architecture/package-shape.mjs +51 -23
  81. package/runtime/scripts/hfs/architecture/presentation.mjs +165 -0
  82. package/runtime/scripts/hfs/architecture/reachability.mjs +127 -61
  83. package/runtime/scripts/hfs/architecture/register-once.mjs +112 -63
  84. package/runtime/scripts/hfs/architecture/registration.mjs +187 -110
  85. package/runtime/scripts/hfs/architecture/required-files.mjs +121 -70
  86. package/runtime/scripts/hfs/architecture/route-files-thin.mjs +83 -58
  87. package/runtime/scripts/hfs/architecture/schema-owner.mjs +182 -108
  88. package/runtime/scripts/hfs/architecture/source-names-shape.mjs +318 -0
  89. package/runtime/scripts/hfs/architecture/source-names.mjs +83 -248
  90. package/runtime/scripts/hfs/architecture/sql-owner.mjs +175 -118
  91. package/runtime/scripts/hfs/architecture/sql-returning.mjs +39 -28
  92. package/runtime/scripts/hfs/architecture/sql-tokens.mjs +302 -172
  93. package/runtime/scripts/hfs/architecture/supabase-ast.mjs +1 -1
  94. package/runtime/scripts/hfs/architecture/supabase-be.mjs +55 -45
  95. package/runtime/scripts/hfs/architecture/supabase-results.mjs +182 -0
  96. package/runtime/scripts/hfs/architecture/supabase-tables.mjs +20 -12
  97. package/runtime/scripts/hfs/architecture/supabase.mjs +191 -263
  98. package/runtime/scripts/hfs/architecture/symbols.mjs +175 -99
  99. package/runtime/scripts/hfs/architecture/test-world-files.mjs +82 -41
  100. package/runtime/scripts/hfs/architecture/tiers.mjs +120 -69
  101. package/runtime/scripts/hfs/architecture/transport-owner.mjs +84 -57
  102. package/runtime/scripts/hfs/architecture/type-context.mjs +282 -0
  103. package/runtime/scripts/hfs/architecture/typescript.mjs +116 -276
  104. package/runtime/scripts/hfs/architecture/unit-spec-providers.mjs +84 -62
  105. package/runtime/scripts/hfs/declaration-shape.mjs +77 -36
  106. package/runtime/scripts/hfs/declaration-slots.mjs +1 -1
  107. package/runtime/scripts/hfs/edition-slots.mjs +5 -3
  108. package/runtime/scripts/hfs/linear-text.mjs +30 -0
  109. package/runtime/scripts/hfs/manifest-shape.mjs +164 -63
  110. package/runtime/scripts/hfs/path-findings.mjs +58 -38
  111. package/runtime/scripts/hfs/project-graph.mjs +4 -1
  112. package/runtime/scripts/hfs/repo-identity.mjs +21 -4
  113. package/runtime/scripts/hfs/rule-catalog.mjs +194 -0
  114. package/runtime/scripts/hfs/rule-params-shape.mjs +33 -27
  115. package/runtime/scripts/hfs/rules/fe-no-tests.mjs +36 -16
  116. package/runtime/scripts/hfs/rules/secrets.mjs +4 -3
  117. package/runtime/scripts/hfs/slot-app-view.mjs +102 -0
  118. package/runtime/scripts/hfs/slot-classify.mjs +65 -0
  119. package/runtime/scripts/hfs/slot-errors.mjs +11 -0
  120. package/runtime/scripts/hfs/slot-imports.mjs +76 -0
  121. package/runtime/scripts/hfs/slot-manifest-shape.mjs +73 -0
  122. package/runtime/scripts/hfs/slot-match.mjs +153 -0
  123. package/runtime/scripts/hfs/slot-path.mjs +8 -0
  124. package/runtime/scripts/hfs/slot-required.mjs +76 -0
  125. package/runtime/scripts/hfs/slot-semantic-problems.mjs +148 -0
  126. package/runtime/scripts/hfs/slot-side-problems.mjs +28 -0
  127. package/runtime/scripts/hfs/slots.mjs +74 -695
  128. package/runtime/scripts/hfs/trailing-slashes.mjs +8 -0
  129. package/runtime/scripts/hfs/typescript-programs.mjs +6 -4
  130. package/runtime/scripts/hfs/view.mjs +1 -1
  131. package/runtime/scripts/lib/dockerfile.mjs +56 -33
  132. package/runtime/scripts/lib/git.mjs +2 -2
  133. package/runtime/scripts/lib/i18n.mjs +3 -2
  134. package/runtime/scripts/lib/language.mjs +3 -3
  135. package/runtime/scripts/lib/list.mjs +8 -1
  136. package/runtime/scripts/lib/path-key.mjs +38 -5
  137. package/runtime/scripts/lib/regex.mjs +1 -1
  138. package/runtime/scripts/lib/secret-patterns.mjs +6 -2
  139. package/runtime/scripts/lib/sonar-syntax-rules.mjs +225 -0
  140. package/runtime/scripts/lib/sops-envelope.mjs +95 -48
  141. package/runtime/scripts/lib/stack-services.mjs +1 -2
  142. package/runtime/scripts/lib/ts-ast.mjs +9 -0
  143. package/runtime/scripts/lib/walk.mjs +6 -1
  144. package/runtime/scripts/lib/yaml-cached.mjs +14 -0
  145. package/schema-authority.mjs +1 -1
  146. package/service-deps.mjs +1 -1
  147. package/sonar-parity.mjs +19 -0
  148. package/suppression.mjs +2 -6
  149. package/test-world.mjs +2 -10
@@ -0,0 +1,268 @@
1
+ # Every spelling the runtime refuses by name, each with what replaced it. engine/removed-vocabulary.mjs reads this file:
2
+ # the config and routing-bias refusals take their names and replacements from it, and the `removed-vocabulary` self-check
3
+ # refuses any of these spellings in text an agent or the owner reads, outside this file, CHANGELOG.md and a block marked
4
+ # `[removed-list]` (CONTRIBUTING.md, "Removing or renaming a spelling").
5
+ # Fields: id; kind (config-key | bias-field | verb | flag | code | vocabulary | file; a file is named by its base name); name (the removed spelling); use (the
6
+ # replacement, worded to finish the sentence "<name> is removed (<use>)"); since (the release that removed it);
7
+ # match (optional regular expression the scan uses instead of the literal name); scan (false when the name is too common
8
+ # a word to scan for).
9
+ kinds: [config-key, bias-field, verb, flag, code, vocabulary, file]
10
+ removed:
11
+ - id: bias-require
12
+ kind: bias-field
13
+ name: require
14
+ use: 'a requirement is now `only`, which keeps just the named members of the tier chain: write each as "<agent>", "<agent>/<model>" or a {pool, provider, model} selector, e.g. {"only":["claude"]}'
15
+ since: 1.0.0-alpha.6
16
+ match: '\brequire\s*:\s*[\[{]|"require"\s*:|\brequire bias\b|\bbias[^\n.]{0,30}`require`'
17
+ - id: config-models-pools
18
+ kind: config-key
19
+ name: models.pools
20
+ use: 'tiers are ordered member chains in modules/models/tiers.yaml; override one with models.tiers'
21
+ since: 1.0.0-alpha.6
22
+ - id: config-models-nonoperation
23
+ kind: config-key
24
+ name: models.nonOperation
25
+ use: 'planner, validator and kernelManager take the frontier tier (modules/models/tiers.yaml seats); remap with models.seats'
26
+ since: 1.0.0-alpha.6
27
+ - id: config-models-selection
28
+ kind: config-key
29
+ name: models.selection
30
+ use: 'selection is always quota-aware; there is no key'
31
+ since: 1.0.0-alpha.6
32
+ - id: config-allocation-shares
33
+ kind: config-key
34
+ name: allocation.shares
35
+ use: 'the picker balances by models.balance (maxStreak, maxSharePercent); there are no per-provider weights'
36
+ since: 1.0.0-alpha.6
37
+ match: 'allocation[. ]shares'
38
+ - id: config-allocation-windowhours
39
+ kind: config-key
40
+ name: allocation.windowHours
41
+ use: 'balance reads the recent picks of one tier (models.balance); there is no window'
42
+ since: 1.0.0-alpha.6
43
+ - id: config-allocation-preferredprovider
44
+ kind: config-key
45
+ name: allocation.preferredProvider
46
+ use: 'an owner preference is a goal routing bias (prefer <agent>)'
47
+ since: 1.0.0-alpha.6
48
+ match: 'preferredProvider'
49
+ - id: config-allocation-policy
50
+ kind: config-key
51
+ name: allocation.policy
52
+ use: 'the picker is the one policy; there is no key'
53
+ since: 1.0.0-alpha.6
54
+ - id: config-allocation-mode
55
+ kind: config-key
56
+ name: allocation.mode
57
+ use: 'allocation holds grants only'
58
+ since: 1.0.0-alpha.6
59
+ - id: config-kernel-group
60
+ kind: config-key
61
+ name: kernel.group
62
+ use: 'the Kernel takes the high tier; pin with kernel.agent / kernel.model (an `only` bias)'
63
+ since: 1.0.0-alpha.6
64
+ - id: config-supervisor-kernel-group
65
+ kind: config-key
66
+ name: supervisor.kernel.group
67
+ use: 'the Supervisor takes the frontier tier; pin with supervisor.kernel.agent / .model (an `only` bias)'
68
+ since: 1.0.0-alpha.6
69
+ - id: config-coredebug
70
+ kind: config-key
71
+ name: coreDebug
72
+ use: 'the debug watcher is a /loop of the calling chat, not a seat; the cadence and the worktree alert limit are debugLoop.interval and debugLoop.worktreeLimit'
73
+ since: 1.0.0-alpha.6
74
+ - id: config-debug
75
+ kind: config-key
76
+ name: debug
77
+ use: 'the debug watcher is started by the /starci skill in the calling chat; there is no switch (debugLoop.interval sets its cadence)'
78
+ since: 1.0.0-alpha.6
79
+ scan: false
80
+ - id: vocabulary-sol-opus
81
+ kind: vocabulary
82
+ name: sol-opus
83
+ use: 'a pool of two providers is a tier chain of members (modules/models/tiers.yaml)'
84
+ since: 1.0.0-alpha.6
85
+ - id: seat-core-debug
86
+ kind: vocabulary
87
+ name: core-debug seat
88
+ use: 'the debug watcher is a /loop of the calling chat running `starci debug digest`'
89
+ since: 1.0.0-alpha.6
90
+ match: '\bcore-debug\s+(?:seat|watcher|worker|pass)\b'
91
+ - id: verb-debug-pass
92
+ kind: verb
93
+ name: debug pass
94
+ use: '`starci debug digest` (read-only) and `starci debug run <probe>`'
95
+ since: 1.0.0-alpha.6
96
+ match: '(?<![\w-])debug pass\b'
97
+ - id: config-supervisor-landgate-push
98
+ kind: config-key
99
+ name: supervisor.landGate.push
100
+ use: 'a land fast-forwards local main only and never pushes; the remote main of the runtime moves once per release, through starci release cut'
101
+ since: 1.0.0-alpha.7
102
+ match: 'landGate\.push\b'
103
+ - id: flag-land-no-push
104
+ kind: flag
105
+ name: --no-push
106
+ use: 'a land never pushes, so there is nothing to leave unpushed'
107
+ since: 1.0.0-alpha.7
108
+ - id: code-landed-push-owed
109
+ kind: code
110
+ name: landed-push-owed
111
+ use: 'a land has no push step; the outcome is landed'
112
+ since: 1.0.0-alpha.7
113
+ - id: flag-caller-agent
114
+ kind: flag
115
+ name: --caller-agent
116
+ use: 'the debug digest runs in the calling chat; it takes no caller flag'
117
+ since: 1.0.0-alpha.6
118
+ - id: flag-caller-model
119
+ kind: flag
120
+ name: --caller-model
121
+ use: 'the debug digest runs in the calling chat; it takes no caller flag'
122
+ since: 1.0.0-alpha.6
123
+ - id: flag-caller-effort
124
+ kind: flag
125
+ name: --caller-effort
126
+ use: 'the debug digest runs in the calling chat; it takes no caller flag'
127
+ since: 1.0.0-alpha.6
128
+ - id: code-workflow-debug-not-ready
129
+ kind: code
130
+ name: workflow-debug-not-ready
131
+ use: 'there is no debug seat to be ready; the digest reads the ledger directly'
132
+ since: 1.0.0-alpha.6
133
+ - id: file-core-debug
134
+ kind: file
135
+ name: core-debug.mjs
136
+ use: 'the debug watcher is a /loop of the calling chat running `starci debug digest`; the core-watch probe is scripts/reconciler/core-watch.mjs'
137
+ since: 1.0.0-alpha.6
138
+ match: '(?<![\w-])core-debug\.mjs\b'
139
+ - id: file-debug-pass
140
+ kind: file
141
+ name: debug-pass.mjs
142
+ use: '`starci debug digest` (read-only)'
143
+ since: 1.0.0-alpha.6
144
+ match: '(?<![\w-])debug-pass\.mjs\b'
145
+ - id: file-caller-context
146
+ kind: file
147
+ name: caller-context.mjs
148
+ use: 'there is no declared caller context; the debug digest runs in the calling chat'
149
+ since: 1.0.0-alpha.6
150
+ match: '(?<![\w-])caller-context\b'
151
+ - id: file-host-maintenance
152
+ kind: file
153
+ name: host-maintenance.md
154
+ use: 'skills/starci/references/host-startup.md'
155
+ since: 1.0.0-alpha.6
156
+ match: '(?<![\w-])host-maintenance\b'
157
+ - id: config-drawloop-critic
158
+ kind: config-key
159
+ name: allocation.drawLoop.critic
160
+ use: 'the Critic is picked from its tier (modules/models/tiers.yaml seats.critic, modules/kernel/critic.yaml) with provider independence as a hard filter; its wall bound is allocation.drawLoop.criticTimeoutMs'
161
+ since: 1.0.0-alpha.9
162
+ match: 'allocation\.drawLoop\.critic(?![A-Za-z])'
163
+ - id: config-drawloop-criticwhendrawer
164
+ kind: config-key
165
+ name: allocation.drawLoop.criticWhenDrawer
166
+ use: 'the Critic tier holds a member of every provider and the picker removes the provider of the maker; there is no per-drawer table'
167
+ since: 1.0.0-alpha.9
168
+ match: 'criticWhenDrawer'
169
+ - id: registry-critic-coverage-define-architecture
170
+ kind: vocabulary
171
+ name: critic-coverage-define-architecture
172
+ use: 'the edge-case registry entry is critic-coverage-decision-legs'
173
+ since: 1.0.0-alpha.9
174
+ - id: supervisor-grammar-release
175
+ kind: vocabulary
176
+ name: grammarRelease
177
+ use: 'the owner publishes @starci/grammar through starci release publish; the Supervisor changes no runtime code'
178
+ since: 1.0.0-alpha.9
179
+ - id: supervise-yaml-worker-land-blocks
180
+ kind: vocabulary
181
+ name: supervise.yaml workers
182
+ use: 'the Supervisor spawns no fix workers and lands nothing: it answers its menu (starci supervisor status) and records runtime defects for Debug'
183
+ since: 1.0.0-alpha.9
184
+ match: 'supervise\.yaml\s+(?:workers|landGate)\b|supervise\.yaml\s+kernelSeat/workers'
185
+ - id: supervisor-fixes-through-lanes
186
+ kind: vocabulary
187
+ name: the Supervisor fixes through lanes
188
+ use: 'the Supervisor records a runtime defect (starci supervisor actions record --item runtime-defect:<cause>) and Debug changes .claude'
189
+ since: 1.0.0-alpha.9
190
+ match: 'Supervisor[^\n.]{0,60}\bfix(?:es)?\s+through\s+(?:its\s+own\s+)?(?:staged\s+)?lanes?\b'
191
+ - id: kernel-ranked-actions
192
+ kind: vocabulary
193
+ name: ranked actions
194
+ use: "the Kernel's menu: the Decide section of starci kernel status, answered with starci kernel decide"
195
+ since: 1.0.0-alpha.9
196
+ match: '[Ww]ork the ranked actions|[Ff]irst rca\.actions entry'
197
+ - id: kernel-run-next-actions
198
+ kind: vocabulary
199
+ name: run nextActions
200
+ use: "the Kernel answers the items of its menu; the runtime performs the mechanical next actions"
201
+ since: 1.0.0-alpha.9
202
+ match: 'run nextActions|run each\s+in order and never choose'
203
+ - id: event-op-reported
204
+ kind: vocabulary
205
+ name: op-reported
206
+ use: 'the event a filed report records is report-filed; no event named op-reported was ever emitted'
207
+ since: 1.0.0-alpha.9
208
+ match: '(?<![\w-])op-reported(?![\w-])'
209
+ - id: file-sonar-secrets-keys
210
+ kind: file
211
+ name: KEYS.md
212
+ use: 'secret.env.example lists the names of the host secrets; ext/sonar/README.md describes the stack'
213
+ since: 1.0.0-alpha.7
214
+ match: '(?<![\w/.-])secrets/KEYS\.md'
215
+ - id: vocab-example-sonar-token-member
216
+ kind: vocabulary
217
+ name: per-example Sonar token custody
218
+ use: 'the examples are analysed on SonarCloud with the SONAR_TOKEN of the runtime secret.env (runtimeSecrets in their services.sonar declaration)'
219
+ since: 1.0.0-alpha.7
220
+ match: 'sonarqube-(?:lite-app|shape-slot|starci-ecommerce-app)-token'
221
+ - id: vocab-menu-kinds-moved-to-controllers
222
+ kind: vocabulary
223
+ name: the menu kinds of the origins the controllers now move
224
+ use: 'the Job controller enqueues a red node, a stale proof or attempt, the asset leg and the credential ask itself (scripts/kernel/next-moves.mjs); the Kernel menu keeps leg-ready, draw-redraw, seam-duty and move-unbuilt'
225
+ since: 1.0.0-alpha.9
226
+ match: '(?<![\w-])(?:node-rework|stale-redispatch|enqueue-asset-leg|enqueue-credential-ask|rework-node)(?![\w-])'
227
+ - id: vocab-sonar-stack-sealed-members
228
+ kind: vocabulary
229
+ name: ext/sonar secrets custody
230
+ use: 'the stack secrets are the secret.env variables SONARQUBE_DB_PASSWORD, SONARQUBE_ADMIN_PASSWORD, SONARQUBE_ADMIN_TOKEN and CLOUDFLARE_TUNNEL_TOKEN, passed by starci gate sonar up; ext/sonar tracks no sealed member'
231
+ since: 1.0.0-alpha.9
232
+ match: 'ext/sonar/secrets/(?:sonarqube-(?:db|admin|analysis)-(?:password|token)|cloudflare-starci-local-services-tunnel-token)'
233
+ - id: vocab-ecommerce-sealed-demo-secrets
234
+ kind: vocabulary
235
+ name: ecommerce sealed demo secrets
236
+ use: 'the ecommerce example carries demo-only defaults in its compose files and declares no sealed secret (secrets: [])'
237
+ since: 1.0.0-alpha.9
238
+ match: '(?<![\w-])(?:keycloak|minio)-env(?:\.enc)?(?![\w-])'
239
+ - id: vocab-handover-step-mechanical-pending
240
+ kind: vocabulary
241
+ name: the handover-step menu mode mechanical-pending and its choice rerun-handover-review
242
+ use: 'the Job controller enqueues handover.review itself when the handover is due or its ask was answered approve or question (next action handover-review, scripts/kernel/handover-move.mjs); the handover-step item holds only the typed routing of a reported defect'
243
+ since: 1.0.0-alpha.9
244
+ match: '(?<![\w-])(?:mechanical-pending|rerun-handover-review)(?![\w-])'
245
+ - id: vocab-card-delivery-bound
246
+ kind: vocabulary
247
+ name: the agent card delivery keys maxInlineChars, fileName and fileDirectory
248
+ use: 'one bound, one directory and one cleanup serve every card: allocation.promptFile in modules/models/runtimes.yaml (scripts/agent/prompt-file.mjs); a card keeps delivery.mode and delivery.prompt'
249
+ since: 1.0.0-alpha.9
250
+ match: '(?<![\w-])(?:maxInlineChars|fileDirectory)(?![\w-])'
251
+ - id: vocab-backoff-factor-keys
252
+ kind: vocabulary
253
+ name: the growth factor of allocation.dispatchRefusal and of the backoff of modules/reconciler/host.yaml
254
+ use: 'every backoff is the one retry budget (scripts/lib/retry-budget.mjs), which doubles its interval up to a cap: declare baseMs/capMs or minMs/maxMs only'
255
+ since: 1.0.0-alpha.9
256
+ match: '(?<![\w-])(?:dispatchRefusal|backoff):\s*\{[^}\n]*\bfactor\b'
257
+ - id: vocab-wake-terminal-bound
258
+ kind: vocabulary
259
+ name: the independent wake character bound
260
+ use: 'allocation.promptFile.maxChars is the terminal bound owned by scripts/agent/prompt-file.mjs'
261
+ since: 1.0.0-alpha.9
262
+ match: '(?<![\w-])(?:allocation\.)?wake\.maxChars|\bwake:\s*\{\s*maxChars\b'
263
+ - id: vocab-draft-probe-mutations
264
+ kind: vocabulary
265
+ name: draft probe mutation fields
266
+ use: 'probeDraft reads only and returns verdict, draft and sends; a foreign draft receives no keys'
267
+ since: 1.0.0-alpha.9
268
+ match: '\b(?:draftProbe|probeDraft)\.(?:restore|restored|removed|after)\b'