@starci/eslint-canon-be 3.0.9 → 3.1.0

package/runtime/knowledge/hfs/rules.yaml

@@ -1,4 +1,4 @@
-# knowledge/hfs/rules.yaml - the machine-readable catalog of the HFS rules (the ids run R01 up; an id with no rule is listed under `retired` with its reason, never reused; count the rules, never type the count).
+# knowledge/hfs/rules.yaml - the machine-readable catalog of the HFS rules (count the rules, never type the count).
 #
 # One entry per rule: its id, its finding code, the law in one line, how a violation is fixed
 # (`kinds`), the gates it runs at, the failure codes it reports, and every enforcer that judges it. The prose of each
@@ -21,7 +21,7 @@ version: 2.0.0
 gates:
   pre-commit: the managed .husky/pre-commit at the app root - starci app hygiene (staged .starciwork and .starcistacks paths, secrets guard), typecheck, ESLint per side and stylelint on the staged files, prettier --check, the unit specs the staged files touch
   pre-push: typecheck, lint (starci app lint), format:check and the unit specs affected since origin/main; runs every pre-commit rule again
-  settle: the op gate scripts/gates/gate.mjs over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
+  settle: the op gate `starci gate run` over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
   land: the workflow's finish, the only time main is touched - gate.mjs over the whole workflow branch against its merge-base with main, the merge guard, review.verify of the exact head that lands, the branch rebased onto main, then main fast-forwarded and pushed
   ci: GitHub Actions runs the same pinned starci app lint, format:check, typecheck, unit with the per-file coverage threshold, build:be and build:fe, then the Sonar scan and gate
   sonar: Sonar quality gate (knowledge/sonar-gate.yaml) - the imported lint findings, duplication, cognitive complexity and the coverage of the logic of be/src/modules at 100
@@ -101,14 +101,6 @@ rules:
     failureCodes: ["HFS_AGENT_DATA_TRACKED"]
     enforcers:
       - {kind: work-validate, id: agent-data-tracked, at: scripts/work/validate/check-example-work.mjs}
-  - id: R08
-    code: "HFS_WORK_NODE_RETIRED"
-    law: "Only flat family records, never `work/node`."
-    kinds: [check, codemod]
-    gates: [settle, land, ci]
-    failureCodes: ["HFS_WORK_NODE_RETIRED"]
-    enforcers:
-      - {kind: work-validate, id: work-node-retired, at: scripts/work/validate/check-example-work.mjs}
   - id: R09
     code: "HFS_IDENTITY_CUSTODY"
     law: "An identity points its secret at `secrets/identity-<slug>.enc`; UAT chooses by role."
@@ -346,7 +338,7 @@ rules:
       - {kind: eslint-be, id: entrypoint-only-in-apps}
   - id: R34
     code: "BE_SCHEMA_AUTHORITY"
-    law: "Migrations are the only schema authority, run only by the cli migrate command and the test world; `synchronize` is `false`."
+    law: "Migrations own the application schema and run only through cli migrate or TestWorld; `synchronize` is `false`. TestWorld infrastructure may provision generated write-fault triggers and functions only in its verified private connection, preserving production constraints and existing triggers, holding its operation lock through catalog-confirmed cleanup."
     kinds: [lint, codemod, design]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_SCHEMA_AUTHORITY"]
@@ -483,7 +475,7 @@ rules:
     editions: [full]
     enforcers:
       - {kind: hfs, id: test-topology, at: scripts/hfs/rules/test-topology.mjs}
-      - {kind: machine, id: test-kind-retired, at: scripts/hfs/architecture/hfs.mjs}
+      - {kind: machine, id: test-kind-unsupported, at: scripts/hfs/architecture/hfs.mjs}
       - {kind: eslint-be, id: test-world-files}
       - {kind: machine, id: contract-fixture-guard, at: scripts/hfs/architecture/contract-fixture-guard.mjs}
       - {kind: eslint-be, id: unit-test-colocated}
@@ -1232,15 +1224,6 @@ rules:
     failureCodes: ["RT_SOURCE_NAME"]
     enforcers:
       - {kind: runtime, id: source-name, at: scripts/hfs/runtime-rules/source-name.mjs}
-  - id: R120
-    code: "RT_RETIRED_PRESENT"
-    law: "No path of retired[] and no `from` of moved[] in modules/kernel/retired-paths.yaml is tracked again, and no symbol of its retiredSymbols[] is declared in runtime production code."
-    scope: runtime
-    kinds: [check]
-    gates: [land, runtime]
-    failureCodes: ["RT_RETIRED_PRESENT"]
-    enforcers:
-      - {kind: runtime, id: retired-present, at: scripts/hfs/runtime-rules/retired.mjs}
   - id: R121
     code: "RT_GENERATED_DRIFT"
     law: "A generated root of ruleParams.runtime.generated is git-ignored output of its declared generatedBy: the repo's check regenerates every root, the runtime copies (packages/hfs/runtime, packages/eslint/be/runtime, packages/eslint/fe/runtime) are judged equal to what scripts/hfs/sync-runtime.mjs writes from the single source, and no git-tracked path lies under a generated root."
@@ -1253,7 +1236,7 @@ rules:
       - {kind: runtime, id: generated-untracked, at: scripts/hfs/runtime-rules/generated-untracked.mjs}
   - id: R122
     code: "RT_CITED_PATH_MISSING"
-    law: "A runtime path cited by live prose or contracts (modules outside the contract history, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; a retired or moved path is cited only by history."
+    law: "A runtime path cited by live prose or contracts (modules, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; history (a changelog, a benchmark file) is not read."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1262,13 +1245,13 @@ rules:
       - {kind: runtime, id: cited-path, at: scripts/checks/check-contract-cites.mjs}
   - id: R124
     code: "RT_PINNED_PATH_MOVED"
-    law: "A pinned path of ruleParams.runtime.pinned (persisted outside git) exists, or moved through a modules/kernel/retired-paths.yaml moved[] entry marked quiesced: true, landed with the workers stopped."
+    law: "A pinned path of ruleParams.runtime.pinned (persisted outside git) exists."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
     failureCodes: ["RT_PINNED_PATH_MOVED"]
     enforcers:
-      - {kind: runtime, id: pinned-path, at: scripts/hfs/runtime-rules/retired.mjs}
+      - {kind: runtime, id: pinned-path, at: scripts/hfs/runtime-rules/pinned.mjs}
   - id: R125
     code: "RT_NODE_MODULES_LINK"
     law: "No runtime source creates a junction or a symlink for a node_modules folder, through node:fs (symlink, symlinkSync, directly or through a local wrapper) or a spawned link command (mklink /J or /D, New-Item -ItemType Junction or SymbolicLink, ln -s): every checkout installs its own dependencies with a real npm ci from the cache."
@@ -1736,11 +1719,11 @@ rules:
       - {kind: runtime, id: facts, at: scripts/hfs/runtime-rules/facts.mjs}
   - id: R193
     code: "RT_RULE_ID_UNKNOWN"
-    law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and the ids run from R01 to the last rule with no undeclared gap: an id with no rule is listed under `retired` with its reason (RT_RULE_ID_GAP), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). A retired id is a history name that only the contract changes and the changelogs may still spell; specs and generated copies are not read."
+    law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and rule ids are unique and well-formed (a gap between two ids is fine), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). History paths (changelogs, benchmark findings, .starciwork records), specs and generated copies are not read."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
-    failureCodes: ["RT_RULE_ID_UNKNOWN", "RT_RULE_ID_GAP", "RT_RULE_UNCITED"]
+    failureCodes: ["RT_RULE_ID_UNKNOWN", "RT_RULE_UNCITED"]
     enforcers:
       - {kind: runtime, id: rule-ids, at: scripts/hfs/runtime-rules/rule-ids.mjs}
   - id: R194
@@ -1754,7 +1737,7 @@ rules:
       - {kind: runtime, id: generated-block, at: scripts/hfs/runtime-rules/generated-block.mjs}
   - id: R195
     code: "RT_PROSE_PATH_NO_SLOT"
-    law: "Every product path the knowledge, the docs and the READMEs name (a be/ or fe/ path, whole or with placeholders, globs and braces) is owned by a slot of knowledge/hfs/slots.yaml or is a folder above one; a path no slot owns is prose that invented a place or kept one a slot no longer has. App names are free: a literal app name is one the examples or the starter declare, a placeholder stands for any; a ** glob and a topic file of the knowledge are not paths."
+    law: "Every product path the knowledge, the docs and the READMEs name (a be/ or fe/ path, whole or with placeholders, globs and braces) is owned by a slot of knowledge/hfs/slots.yaml or is a folder above one; a path no slot owns is prose that invented a place or kept one a slot no longer has. App names are free: a literal app name is one a shipped examples/*/hfs.json declares, a placeholder stands for any; a ** glob and a topic file of the knowledge are not paths."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1770,15 +1753,6 @@ rules:
     failureCodes: ["RT_PROSE_RESTATES_SLOTS"]
     enforcers:
       - {kind: runtime, id: prose-restates, at: scripts/hfs/runtime-rules/prose-restates.mjs}
-  - id: R197
-    code: "RT_RETIRED_CLI_CALL"
-    law: "No tracked file invokes a command the unified CLI removed: the retired kernel, hfs, test-stack and top-level runtime spellings listed in the `removed` fields of the catalog and in the dispatcher table; those fields, changelogs and contract-change history are exempt."
-    scope: runtime
-    kinds: [check]
-    gates: [land, runtime]
-    failureCodes: ["RT_RETIRED_CLI_CALL"]
-    enforcers:
-      - {kind: runtime, id: retired-cli, at: scripts/checks/check-retired-cli.mjs}
   - id: R198
     code: "RT_CLI_CATALOG_DRIFT"
     law: "Every generated output of the unified CLI catalog (packages/cli/src/catalog.generated.mjs, docs/cli.md, packages/cli/completions/*) equals what scripts/cli/gen-catalog.mjs writes from modules/cli/commands."
@@ -1799,7 +1773,7 @@ rules:
       - {kind: runtime, id: cli-parity, at: scripts/checks/check-cli-parity.mjs}
   - id: R200
     code: "RT_CLI_APP_ONLY_TEMPLATES"
-    law: "Managed app templates and their generated runtime copies invoke product actions only through `starci app <verb>`; retired hfs and test-stack commands, and any other starci group, are forbidden there."
+    law: "Managed app templates and their generated runtime copies invoke product actions only through `starci app <verb>`; any other starci group is forbidden there."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1851,25 +1825,16 @@ rules:
       - {kind: runtime, id: doc-owner, at: scripts/checks/check-doc-owner.mjs}
   - id: R206
     code: "RT_EXAMPLE_COUPLING"
-    law: "Runtime source never couples to a product or its example: no tracked file under scripts/, engine/, packages/, ui/src or ui/api - and no managed template under packages/hfs/templates/ - spells a literal examples/<name>, one of the product names this runtime shipped against (the closed PRODUCT_NAMES list of scripts/lib/example-refs.mjs), an inc-<hash> a product name prefixes, or a host drive path. Specs, tests, the generated runtime copies, contract-change history, changelogs and .starciwork records are out of scope; a read the runtime genuinely makes at run time is declared once in scripts/lib/example-refs.mjs and every consumer names that constant."
+    law: "Runtime source never couples to a product or its example: no tracked file under scripts/, engine/, packages/, ui/src or ui/api - and no managed template under packages/hfs/templates/ - spells a literal examples/<name>, one of the product names this runtime shipped against (the closed PRODUCT_NAMES list of scripts/lib/example-refs.mjs), an inc-<hash> a product name prefixes, or a host drive path. Specs, tests, the generated runtime copies, changelogs and .starciwork records are out of scope; a read the runtime genuinely makes at run time is declared once in scripts/lib/example-refs.mjs and every consumer names that constant."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
     failureCodes: ["RT_EXAMPLE_COUPLING", "RT_PRODUCT_NAME_IN_SOURCE", "RT_HOST_PATH_IN_TEMPLATE"]
     enforcers:
       - {kind: runtime, id: example-coupling, at: scripts/checks/check-example-coupling.mjs}
-  - id: R207
-    code: "RT_RETIRED_NAME_LIVE"
-    law: "A name the retired registry declares dead never appears in a live tracked file — not in prose, a comment, a string literal or a path: every retired[].path and moved[].from of modules/kernel/retired-paths.yaml, and every retiredNames[] naming that is not a path (a deleted app, a layer naming, a verb prefix). History (the contract changes, a changelog, a benchmark finding, a .starciwork record), the registry itself and the files of the check may name what was deleted; a slot manifest's forbids value or forbidden-presence tombstone declares a refusal, not a use."
-    scope: runtime
-    kinds: [check]
-    gates: [land, runtime]
-    failureCodes: ["RT_RETIRED_NAME_LIVE"]
-    enforcers:
-      - {kind: runtime, id: retired-names, at: scripts/checks/check-retired-names.mjs}
   - id: R208
     code: "RT_PORT_RESTATED"
-    law: "Every port literal of the runtime is spelled once, by its owner, and every other file references the owner: the harness UI ports live in modules/models/runtimes.yaml statusApp.port/devPort read through ui/ports.mjs, the local SonarQube host in scripts/gates/sonar-local.mjs DEFAULT_HOST. No in-scope file that is not the owner spells an owned literal in a port position (a scheme://host:NNNN or host:NNNN authority, a *port*/PORT assignment, a listen(NNNN) call), and an unowned literal in a port position of two or more runtime source files gets one owning exported constant the rest reference. Specs, tests, node_modules, the generated runtime copies, contract-change history, changelogs, .starciwork and the product stack declarations (.starcistacks, starcistacks-services - a product owns the ports of the services it runs) are out of scope."
+    law: "Every port literal of the runtime is spelled once, by its owner, and every other file references the owner: the harness UI ports live in modules/models/runtimes.yaml statusApp.port/devPort read through ui/ports.mjs, the local SonarQube host in scripts/gates/sonar-local.mjs DEFAULT_HOST. No in-scope file that is not the owner spells an owned literal in a port position (a scheme://host:NNNN or host:NNNN authority, a *port*/PORT assignment, a listen(NNNN) call), and an unowned literal in a port position of two or more runtime source files gets one owning exported constant the rest reference. Specs, tests, node_modules, the generated runtime copies, changelogs, .starciwork and the product stack declarations (.starcistacks, starcistacks-services - a product owns the ports of the services it runs) are out of scope."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1887,7 +1852,7 @@ rules:
       - {kind: runtime, id: default-once, at: scripts/checks/check-default-once.mjs}
   - id: R210
     code: "RT_VERSION_RESTATED"
-    law: "knowledge/hfs/canon-pins.yaml spells the version of every @starci package and every canon-pinned dependency once; a package.json is the declared install site and a lockfile its resolution. Anywhere else a semver literal equal to a pin - or a name@x.y.z specifier naming one - restates it, except on the declared binding keys a refresher owns and rewrites in place (canon.version of the code-pattern bindings held by check-canon-pins.mjs, provenance.version and identity.version of the grammar snapshots rewritten by scripts/work/ui/grammar-knowledge.mjs). Package manifests, lockfiles, changelogs, contract-change history, specs, tests, the generated runtime copies and .starciwork are out of scope; a restatement is fixed by naming the pin, never the literal."
+    law: "knowledge/hfs/canon-pins.yaml spells the version of every @starci package and every canon-pinned dependency once; a package.json is the declared install site and a lockfile its resolution. Anywhere else a semver literal equal to a pin - or a name@x.y.z specifier naming one - restates it, except on the declared binding keys a refresher owns and rewrites in place (canon.version of the code-pattern bindings held by check-canon-pins.mjs, provenance.version and identity.version of the grammar snapshots rewritten by scripts/work/ui/grammar-knowledge.mjs). Package manifests, lockfiles, changelogs, specs, tests, the generated runtime copies and .starciwork are out of scope; a restatement is fixed by naming the pin, never the literal."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1979,7 +1944,7 @@ rules:
       - {kind: hfs, id: lite-secret-custody, at: scripts/hfs/rules/supabase-secrets.mjs}
   - id: R221
     code: "CI_TRIGGERS_RELEASE_ONLY"
-    law: "The only workflow triggers are a push of release tags and a person dispatching it: every tracked workflow of the runtime, its examples and the hfs app templates (so every scaffolded app inherits it) declares an `on` that holds only `push` filtered to `tags: ['v*']` (no branches, paths or ignore filter beside it) and `workflow_dispatch`. A branch push, a pull_request, a schedule, a workflow_call or any other event refuses the workflow: CI runs once per release, on its tag, and Codecov and Sonar upload only from that run."
+    law: "The only workflow triggers are a push of release tags, a person dispatching it and, in the runtime's own workflows (`.github/workflows/` at the root), a push to `main`: every tracked workflow declares an `on` that holds only `push` filtered to `tags: ['v*']` (and, in the runtime's own workflows, `branches: [main]`; no paths or ignore filter beside them) and `workflow_dispatch`. The examples and the hfs app templates (so every scaffolded app inherits it) take the tag and the dispatch only: an app's CI runs once per release, on its tag. A push to any other branch, a pull_request, a schedule, a workflow_call or any other event refuses the workflow."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -2015,7 +1980,7 @@ rules:
       - {kind: runtime, id: protected-zone, at: scripts/hfs/runtime-rules/rights-policy.mjs}
   - id: R225
     code: "RT_HOOK_SHAPE"
-    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags) and runs no npm test, jest, typecheck or lint."
+    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags; the runtime's own hook is scripts/guards/release-push-gate.mjs, which judges main and v* tags against the release definition and lets every other ref through) and runs no npm test, jest, typecheck or lint."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -2024,7 +1989,7 @@ rules:
       - {kind: runtime, id: hook-shape, at: scripts/hfs/runtime-rules/hook-shape.mjs}
   - id: R226
     code: "RT_SPEC_OVER_BUDGET"
-    law: "Every recorded spec duration should stay within the shared per-file land budget in modules/kernel/spec-durations.yaml: for alpha.4 an over-budget spec is an advisory info finding ranked by its excess (it does not fail the check stage; the budget turns blocking in alpha.5), and every recorded spec path must still exist. An over-budget spec is repaired without removing tests or assertions: share a per-process fixture, remove per-test install or boot, inject the clock and never lengthen a timeout; stale rows are refreshed from the current land record."
+    law: "Every recorded spec duration should stay within the shared per-file land budget in modules/kernel/spec-durations.yaml: an over-budget spec is an advisory info finding ranked by its excess (it does not fail the check stage), and every recorded spec path must still exist. An over-budget spec is repaired without removing tests or assertions: share a per-process fixture, remove per-test install or boot, inject the clock and never lengthen a timeout; stale rows are refreshed from the current land record."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -2040,20 +2005,88 @@ rules:
     failureCodes: ["RT_SYNTAX_INVALID"]
     enforcers:
       - {kind: runtime, id: syntax, at: scripts/hfs/runtime-rules/syntax.mjs}
-retired:
-  - {id: R66, reason: "FE_E2E_SHAPE retired with eslint-canon-fe 7.0.0: a front end has no tests by standard"}
-  - {id: R67, reason: "FE_SPEC_QUALITY retired with eslint-canon-fe 7.0.0: a front end has no tests by standard"}
-  - {id: R123, reason: "RT_PENDING_STALE retired with the pending list itself: ruleParams.runtime.pending and its pending-ratchet enforcer are gone; nothing ratchets a tolerated-finding list"}
-  - {id: R128, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R129, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R130, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R131, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R132, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R133, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R134, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R135, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R136, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R137, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R138, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R139, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R140, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - id: R228
+    code: "RT_IDENTIFIER_UNDECLARED"
+    law: "Every identifier a runtime ES module (scripts/, engine/ without the vendored yaml bundle, ui/api/, packages/cli/bin and src) reads or writes resolves, by scope analysis over its TypeScript syntax tree, to a declaration, import, parameter or Node global of an enclosing scope. A re-export (export {x} from './y.mjs') binds x in no local scope; require, module, exports and __dirname are not globals of a module; browser globals resolve only inside a function that a module hands to page.evaluate, here or through an import. A name a refactor left behind is refused before the line that reads it runs."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_IDENTIFIER_UNDECLARED"]
+    enforcers:
+      - {kind: runtime, id: undeclared-identifiers, at: scripts/checks/check-undeclared-identifiers.mjs}
+  - id: R229
+    code: "RT_REMOVED_VOCABULARY"
+    law: "No text an agent or the owner reads teaches a spelling the runtime refuses. The refused names - config keys, routing-bias fields, verbs, flags, codes and vocabulary - are the one list modules/kernel/removed-vocabulary.yaml, each with its replacement and the release that removed it; the config and routing-bias refusals read the same list. Every tracked file of skills/, docs/, README.md, CONTEXT.md, CONTRIBUTING.md, modules/ and knowledge/ (Markdown and yaml) is scanned line by line, and a line that spells a listed name is a finding naming file:line, the name and its replacement, (and every tests/**/*.spec.mjs, where a name is allowed only on a line or under a test title that says refuse, reject, removed, throws or unknown) unless the file is the list, CHANGELOG.md, or the line or block carries the [removed-list] marker (a marker alone on a comment line covers the lines up to the next blank one). Removing or renaming a key, flag, verb, field or code adds its entry to the list in the same commit."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_REMOVED_VOCABULARY"]
+    enforcers:
+      - {kind: runtime, id: removed-vocabulary, at: scripts/checks/check-removed-vocabulary.mjs}
+  - id: R230
+    code: "RT_PROSE_COMMAND_UNKNOWN"
+    law: "A command an instruction shows exists as written. Every `starci <group> <verb>` in a backticked span, fenced code line or yaml example item of skills/, docs/, README.md, CONTEXT.md, CONTRIBUTING.md and modules/ names a verb of the CLI catalog (modules/cli/commands) in a catalogued group, and every --flag on it is a flag of that verb or a global flag; the text after a lone -- belongs to another program and a [removed-list] marked line is exempt. The catalog is generated into the valid set, never typed twice."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_PROSE_COMMAND_UNKNOWN"]
+    enforcers:
+      - {kind: runtime, id: prose-commands, at: scripts/checks/check-prose-commands.mjs}
+  - id: R231
+    code: "RT_DOCUMENTED_DEFAULT_DRIFT"
+    law: "A default a document states equals the value the code reads. A document states a default by citing its key - default <value> = `<key>` - where the key is a config.yaml path (resolved through the validator's settings reader, so an absent block yields its code default) or <yaml file under modules/>:<dotted path>; the check resolves the key and compares, and a key that resolves to nothing is a finding. docs/, README.md, CONTEXT.md, config.example.yaml and modules/ prose and yaml are scanned; a bare number stated as a default without its key is not judged, so the owner of a default is cited, never retyped."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_DOCUMENTED_DEFAULT_DRIFT"]
+    enforcers:
+      - {kind: runtime, id: documented-defaults, at: scripts/checks/check-documented-defaults.mjs}
+  - id: R232
+    code: "RT_ROLES_CONTRACT_DRIFT"
+    law: "A role is described once. modules/kernel/roles.yaml holds, per role, its scope, what it does, what it must clean up, what it never does, whom it reports to and who oversees it; a Markdown surface of the role carries the block generated from it, a yaml or script surface cites modules/kernel/roles.yaml#<role>, and no surface teaches a spelling the role's contradicts list names."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_ROLES_CONTRACT_DRIFT"]
+    enforcers:
+      - {kind: runtime, id: roles-contract, at: scripts/checks/check-roles-contract.mjs}
+  - id: R233
+    code: "RT_EDGE_CASE_REGISTRY"
+    law: "Every edge case met is a declared entry of modules/reconciler/edge-cases.yaml with its family, its real occurrence and a status of covered or open; a covered entry names the rule that handles it and the spec that reproduces it, and both exist, and an open entry says why."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_EDGE_CASE_REGISTRY"]
+    enforcers:
+      - {kind: runtime, id: edge-case-registry, at: scripts/checks/check-edge-case-registry.mjs}
+  - id: R234
+    code: "RT_SECRET_TRACKED"
+    law: "The runtime repository is public and tracks no secret material, not even ciphertext: no tracked *.enc member and no tracked secret.env or .env file, except the paths ruleParams.runtime.heldSecrets names with their reason (a list that only shrinks). Every secret the host needs lives in the one untracked .claude/secret.env, read only through engine/secrets.mjs, its names listed in the tracked secret.env.example; a product repository keeps its own custody in its own repository. Two Sonar servers, no overlap: SonarCloud serves everything that lives in the runtime repository (the runtime and the example apps, token SONAR_TOKEN), the self-hosted ext/sonar serves product repositories only."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_SECRET_TRACKED"]
+    enforcers:
+      - {kind: runtime, id: secret-tracked, at: scripts/hfs/runtime-rules/secret-tracked.mjs}
+  - id: R235
+    code: "SCAN_SMELL"
+    law: "Code carries none of the smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (S9382; an endless loop is spared), no `charCodeAt`/`fromCharCode` (S7758), no string that only escapes backslashes (S7780; a Next `matcher` is spared, it is read statically), no nested conditional expression (S3358), no `void` on anything but a call (S3735), no unused import (S1128), no import that is only handed on instead of `export ... from` (S7763), no prop of a component's props type the component never reads (S6767, front end), and, through typescript-eslint with type information, no deprecated API (S1874), no object turned into text (S6551) and no `async` function that never awaits and returns no promise (S7503). The files a unit or an end-to-end spec names are outside the scan, so outside these rules."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["SCAN_SMELL"]
+    enforcers:
+      - {kind: eslint-be, id: no-await-in-loop}
+      - {kind: eslint-be, id: prefer-code-point}
+      - {kind: eslint-be, id: prefer-string-raw}
+      - {kind: eslint-be, id: no-nested-conditional}
+      - {kind: eslint-be, id: no-void-operator}
+      - {kind: eslint-be, id: no-unused-import}
+      - {kind: eslint-be, id: prefer-export-from}
+      - {kind: eslint-fe, id: no-await-in-loop}
+      - {kind: eslint-fe, id: prefer-code-point}
+      - {kind: eslint-fe, id: prefer-string-raw}
+      - {kind: eslint-fe, id: no-nested-conditional}
+      - {kind: eslint-fe, id: no-void-operator}
+      - {kind: eslint-fe, id: no-unused-import}
+      - {kind: eslint-fe, id: prefer-export-from}
+      - {kind: eslint-fe, id: no-unused-prop-types}

package/runtime/knowledge/hfs/slots.yaml

@@ -1,7 +1,7 @@
 # HFS slot manifest (owner-approved 2026-09-29, decisions 1-10 in the owner decisions record).
 # The one place that says what may exist in a StarCi product repository and where. A product is ONE app repository
 # (hfs 4, manifest major 2): the app root holds the one package.json, lockfile and node_modules, the hfs.json of kind app,
-# the CI, the hooks and .starciwork (slots of profile `app`); `be/` and `fe/` are its two sides, each laid out as the old
+# the CI, the hooks and .starciwork (slots of profile `app`); `be/` and `fe/` are its two sides, each laid out as a
 # standalone repository root (slots of profile be or fe, paths relative to the side folder). Every tracked path of every
 # repository must match exactly one slot. Checks, lint factories, the architecture machine, templates and the why
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
@@ -20,9 +20,6 @@ versioning:
     change or remove an existing slot, make an optional slot required, promote a rule warn to error, change the
     direction matrix. Needs owner approval and a migration lane per repo. There is no compatibility window: the old
     MAJOR is refused the day the new one lands (owner ruling: no backward compatibility).
-  retire: >-
-    a slot is never edited in place; it gets retiredIn (a major) and a successor slot id. After that major a
-    path matching a retired slot is HFS_SLOT_RETIRED (error).
   pins: knowledge/hfs/canon-pins.yaml carries the exact versions of every @starci/* package and framework this MAJOR supports.
 # 2.1.0 is such a minor: it ADDS the edition mechanism (the `editions` list, the per-slot `editions`, `litePresence`, `lite`
 # overlays and `provider`, and `sides.<side>.reads` of an app-root tree) and the lite slots; an app without `edition` in its
@@ -83,7 +80,7 @@ versioning:
 #               requiredInstances), each shaped as the same field in the slot body; every other field is the edition's.
 #               Under lite `tests` is none on every slot: a lite app has no test world.
 #   provider    the hfs.json connections[].provider that enables this opt-in slot (supabase); never an app kind.
-#   since / retiredIn / successor   lifecycle.
+#   since       the manifest version that introduced the slot.
 presenceValues: [required, optional, opt-in, forbidden]
 trackedValues: [tracked, ignored, external]
 testValues: [unit-beside, e2e, none]
@@ -177,7 +174,7 @@ ruleParams:
       http: [platform/http]
       https: [platform/http]
       cache-manager: [integrations/cache, integrations/redis]
-      "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability (retired local rule must-use-cache-service)
+      "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability
       redis: [integrations/cache, integrations/redis]
       ioredis: [integrations/cache, integrations/redis]
       bullmq: [platform/queue]               # pattern queue: BullMQ jobs and job schedulers (the relay of the outbox into queues)
@@ -389,7 +386,7 @@ slots:
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL]
   - id: app.tool-config-optional
     profiles: [app]
-    path: .npmrc
+    path: "{.npmrc,.npmignore}"     # .npmignore: npm reads the nearest ignore file instead of the root files negations, so an app that ships inside another package keeps its sealed credentials out of the tarball here
     presence: optional
     tracked: tracked
     tier: none
@@ -530,12 +527,12 @@ slots:
              "features/<feature>/<family>/<name>/index.yaml", "features/<feature>/br/<rule>/ac/<name>/index.yaml",
              "features/<feature>/ui/<name>/assets/<approved-file>", "features/<feature>/uat/<name>/{index,accounts,fixtures}.yaml",
              "features/<feature>/uat/<name>/{seed,cleanup}.sql", "_resources/{identities,environments,fixtures}/<slug>/resource.yaml"]
-    forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/, "work/node records"]
+    forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/]
     # Lite keeps the product catalog, feature overviews, grammar and brand drawing records; UAT records belong to the forbidden slot below.
     lite:
       requires: [.gitignore, workspace.yaml, index.yaml]
       allows: [workspace.yaml, index.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml", "features/<feature>/ui/<name>/index.yaml", "features/<feature>/ui/<name>/assets/<approved-file>"]
-    rules: [HFS_AGENT_DATA_TRACKED, HFS_WORK_NODE_RETIRED, HFS_IDENTITY_CUSTODY]
+    rules: [HFS_AGENT_DATA_TRACKED, HFS_IDENTITY_CUSTODY]
   - id: app.starciwork.uat
     profiles: [app]
     # The UAT records of the full edition: a lite app has no UAT (no tests, no record of one), so the trees are forbidden paths
@@ -699,7 +696,7 @@ slots:
     goesTo: "a be feature: webhooks/<provider> for a third-party callback, api for an endpoint, a cli command on a schedule (pg_cron / pg_net)"
     since: 2.1.0
 
-  # ----- side root (both sides): what the old standalone repository root held, less the app-root files ----------
+  # ----- side root (both sides): what a standalone repository root holds, less the app-root files ----------
   - id: repo.side-root-forbidden
     profiles: [be, fe]
     path: "{package.json,package-lock.json,hfs.json,README.md,.gitignore,.gitattributes,.husky/,.github/,.starciwork/,.starcistacks/,supabase/,.sops.yaml,sonar-project.properties,codecov.yml,.prettierrc,.prettierignore,scripts/}"
@@ -1640,7 +1637,7 @@ slots:
     coverage: none
     why: provider sandbox contracts, skipped without sandbox config; run only by test:contract, never part of test or test:e2e
     rules: [BE_TEST_TOPOLOGY]
-  - id: be.tests.e2e-world-retired
+  - id: be.tests.e2e-world-dir
     profiles: [be]
     path: "src/tests/e2e/world/"
     presence: forbidden
@@ -1694,15 +1691,15 @@ slots:
     tier: route
     roles: {proxy: proxy.ts, instrumentation: instrumentation.ts, instrumentation-client: instrumentation-client.ts}
     tests: none
-    rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16 (fe.source-root-retired)
-  - id: fe.source-root-retired
+    rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16 (fe.source-root-middleware)
+  - id: fe.source-root-middleware
     profiles: [fe]
     path: "apps/<app>/src/{middleware.ts,middleware.js}"
     presence: forbidden
     tracked: external
     tier: none
     tests: none
-    goesTo: "apps/<app>/src/proxy.ts: Next >= 16 renamed middleware to proxy and refuses the old name"
+    goesTo: "apps/<app>/src/proxy.ts: Next >= 16 reads proxy.ts and refuses middleware.ts"
     rules: [FE_NEXT_CONVENTIONS]
   - id: fe.route.callback
     profiles: [fe]

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -0,0 +1,168 @@
+# Every spelling the runtime refuses by name, each with what replaced it. engine/removed-vocabulary.mjs reads this file:
+# the config and routing-bias refusals take their names and replacements from it, and the `removed-vocabulary` self-check
+# refuses any of these spellings in text an agent or the owner reads, outside this file, CHANGELOG.md and a block marked
+# `[removed-list]` (CONTRIBUTING.md, "Removing or renaming a spelling").
+# Fields: id; kind (config-key | bias-field | verb | flag | code | vocabulary | file; a file is named by its base name); name (the removed spelling); use (the
+# replacement, worded to finish the sentence "<name> is removed (<use>)"); since (the release that removed it);
+# match (optional regular expression the scan uses instead of the literal name); scan (false when the name is too common
+# a word to scan for).
+kinds: [config-key, bias-field, verb, flag, code, vocabulary, file]
+removed:
+  - id: bias-require
+    kind: bias-field
+    name: require
+    use: 'a requirement is now `only`, which keeps just the named members of the tier chain: write each as "<agent>", "<agent>/<model>" or a {pool, provider, model} selector, e.g. {"only":["claude"]}'
+    since: 1.0.0-alpha.6
+    match: '\brequire\s*:\s*[\[{]|"require"\s*:|\brequire bias\b|\bbias[^\n.]{0,30}`require`'
+  - id: config-models-pools
+    kind: config-key
+    name: models.pools
+    use: 'tiers are ordered member chains in modules/models/tiers.yaml; override one with models.tiers'
+    since: 1.0.0-alpha.6
+  - id: config-models-nonoperation
+    kind: config-key
+    name: models.nonOperation
+    use: 'planner, validator and kernelManager take the frontier tier (modules/models/tiers.yaml seats); remap with models.seats'
+    since: 1.0.0-alpha.6
+  - id: config-models-selection
+    kind: config-key
+    name: models.selection
+    use: 'selection is always quota-aware; there is no key'
+    since: 1.0.0-alpha.6
+  - id: config-allocation-shares
+    kind: config-key
+    name: allocation.shares
+    use: 'the picker balances by models.balance (maxStreak, maxSharePercent); there are no per-provider weights'
+    since: 1.0.0-alpha.6
+    match: 'allocation[. ]shares'
+  - id: config-allocation-windowhours
+    kind: config-key
+    name: allocation.windowHours
+    use: 'balance reads the recent picks of one tier (models.balance); there is no window'
+    since: 1.0.0-alpha.6
+  - id: config-allocation-preferredprovider
+    kind: config-key
+    name: allocation.preferredProvider
+    use: 'an owner preference is a goal routing bias (prefer <agent>)'
+    since: 1.0.0-alpha.6
+    match: 'preferredProvider'
+  - id: config-allocation-policy
+    kind: config-key
+    name: allocation.policy
+    use: 'the picker is the one policy; there is no key'
+    since: 1.0.0-alpha.6
+  - id: config-allocation-mode
+    kind: config-key
+    name: allocation.mode
+    use: 'allocation holds grants only'
+    since: 1.0.0-alpha.6
+  - id: config-kernel-group
+    kind: config-key
+    name: kernel.group
+    use: 'the Kernel takes the high tier; pin with kernel.agent / kernel.model (an `only` bias)'
+    since: 1.0.0-alpha.6
+  - id: config-supervisor-kernel-group
+    kind: config-key
+    name: supervisor.kernel.group
+    use: 'the Supervisor takes the frontier tier; pin with supervisor.kernel.agent / .model (an `only` bias)'
+    since: 1.0.0-alpha.6
+  - id: config-coredebug
+    kind: config-key
+    name: coreDebug
+    use: 'the debug watcher is a /loop of the calling chat, not a seat; the cadence and the worktree alert limit are debugLoop.interval and debugLoop.worktreeLimit'
+    since: 1.0.0-alpha.6
+  - id: config-debug
+    kind: config-key
+    name: debug
+    use: 'the debug watcher is started by the /starci skill in the calling chat; there is no switch (debugLoop.interval sets its cadence)'
+    since: 1.0.0-alpha.6
+    scan: false
+  - id: vocabulary-sol-opus
+    kind: vocabulary
+    name: sol-opus
+    use: 'a pool of two providers is a tier chain of members (modules/models/tiers.yaml)'
+    since: 1.0.0-alpha.6
+  - id: seat-core-debug
+    kind: vocabulary
+    name: core-debug seat
+    use: 'the debug watcher is a /loop of the calling chat running `starci debug digest`'
+    since: 1.0.0-alpha.6
+    match: '\bcore-debug\s+(?:seat|watcher|worker|pass)\b'
+  - id: verb-debug-pass
+    kind: verb
+    name: debug pass
+    use: '`starci debug digest` (read-only) and `starci debug run <probe>`'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])debug pass\b'
+  - id: config-supervisor-landgate-push
+    kind: config-key
+    name: supervisor.landGate.push
+    use: 'a land fast-forwards local main only and never pushes; the remote main of the runtime moves once per release, through starci release cut'
+    since: 1.0.0-alpha.7
+    match: 'landGate\.push\b'
+  - id: flag-land-no-push
+    kind: flag
+    name: --no-push
+    use: 'a land never pushes, so there is nothing to leave unpushed'
+    since: 1.0.0-alpha.7
+  - id: code-landed-push-owed
+    kind: code
+    name: landed-push-owed
+    use: 'a land has no push step; the outcome is landed'
+    since: 1.0.0-alpha.7
+  - id: flag-caller-agent
+    kind: flag
+    name: --caller-agent
+    use: 'the debug digest runs in the calling chat; it takes no caller flag'
+    since: 1.0.0-alpha.6
+  - id: flag-caller-model
+    kind: flag
+    name: --caller-model
+    use: 'the debug digest runs in the calling chat; it takes no caller flag'
+    since: 1.0.0-alpha.6
+  - id: flag-caller-effort
+    kind: flag
+    name: --caller-effort
+    use: 'the debug digest runs in the calling chat; it takes no caller flag'
+    since: 1.0.0-alpha.6
+  - id: code-workflow-debug-not-ready
+    kind: code
+    name: workflow-debug-not-ready
+    use: 'there is no debug seat to be ready; the digest reads the ledger directly'
+    since: 1.0.0-alpha.6
+  - id: file-core-debug
+    kind: file
+    name: core-debug.mjs
+    use: 'the debug watcher is a /loop of the calling chat running `starci debug digest`; the core-watch probe is scripts/reconciler/core-watch.mjs'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])core-debug\.mjs\b'
+  - id: file-debug-pass
+    kind: file
+    name: debug-pass.mjs
+    use: '`starci debug digest` (read-only)'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])debug-pass\.mjs\b'
+  - id: file-caller-context
+    kind: file
+    name: caller-context.mjs
+    use: 'there is no declared caller context; the debug digest runs in the calling chat'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])caller-context\b'
+  - id: file-host-maintenance
+    kind: file
+    name: host-maintenance.md
+    use: 'skills/starci/references/host-startup.md'
+    since: 1.0.0-alpha.6
+    match: '(?<![\w-])host-maintenance\b'
+  - id: file-sonar-secrets-keys
+    kind: file
+    name: KEYS.md
+    use: 'secret.env.example lists the names of the host secrets; ext/sonar/README.md describes the stack'
+    since: 1.0.0-alpha.7
+    match: '(?<![\w/.-])secrets/KEYS\.md'
+  - id: vocab-example-sonar-token-member
+    kind: vocabulary
+    name: per-example Sonar token custody
+    use: 'the examples are analysed on SonarCloud with the SONAR_TOKEN of the runtime secret.env (runtimeSecrets in their services.sonar declaration)'
+    since: 1.0.0-alpha.7
+    match: 'sonarqube-(?:lite-app|shape-slot|starci-ecommerce-app)-token'