@starci/eslint-canon-be 3.2.13 → 3.2.15

package/runtime/knowledge/hfs/rules.yaml

@@ -12,12 +12,12 @@
 # (`at`) that emits one of the rule's codes. scripts/checks/check-hfs-rules.mjs holds all of this to the packages, the
 # scripts and modules/kernel/failure-codes.yaml.
 #
-# Every rule is an error from 2.0. There is no baseline, allowlist or suppression file for a product. The runtime gate
+# Every rule is an error. There is no baseline, allowlist or suppression file for a product. The runtime gate
 # (the StarCi runtime repository judged by knowledge/hfs/runtime-slots.yaml) has exactly one, the shrink-only sections of
 # modules/kernel/allowlist.yaml, held by RT_ALLOWLIST_SPRAWL. Codes are quoted: the failure-code
 # scanner reads this file as an emitter of every code it names.
-schema: starci/hfs-rules@2
-version: 2.0.0
+schema: starci/hfs-rules@3
+version: 3.0.0
 gates:
   pre-commit: the managed .husky/pre-commit at the app root - starci app hygiene (staged .starciwork and .starcistacks paths, secrets guard), typecheck, ESLint per side and stylelint on the staged files, prettier --check, the unit specs the staged files touch
   pre-push: typecheck, lint (starci app lint), format:check and the unit specs affected since origin/main; runs every pre-commit rule again
@@ -463,7 +463,6 @@ rules:
     kinds: [lint, design]
     gates: [land, ci]
     failureCodes: ["BE_BACKGROUND_UNOWNED"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: background-unowned}
   - id: R47
@@ -472,7 +471,6 @@ rules:
     kinds: [check, codemod, lint]
     gates: [land, ci]
     failureCodes: ["BE_TEST_TOPOLOGY", "BE_CONTRACT_UNGUARDED"]
-    editions: [full]
     enforcers:
       - {kind: hfs, id: test-topology, at: scripts/hfs/rules/test-topology.mjs}
       - {kind: machine, id: test-kind-unsupported, at: scripts/hfs/architecture/hfs.mjs}
@@ -488,7 +486,6 @@ rules:
     kinds: [lint, design]
     gates: [settle, land, ci]
     failureCodes: ["BE_SPEC_QUALITY"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: spec-no-source-read}
       - {kind: eslint-be, id: e2e-uses-production-transport}
@@ -521,7 +518,7 @@ rules:
       - {kind: eslint-fe, id: no-hardcoded-endpoint-fallback}
   - id: R50
     code: "FE_TRANSPORT_OWNER"
-    law: "One `fetch` per front end, in the transport client: `fe/apps/<app>/src/modules/api/client.ts` of a one-app front end or `fe/packages/<family>-api/src/client.ts` shared by every app; timeout and abort; a client read is SWR whose key carries the identity of its result, and a mutation is tied to its resource."
+    law: "One transport per front end: the browser reaches the back end only through the auth and no-auth Apollo clients and their link chain (retry, error, timeout, token refresh, access token, http) in `fe/apps/<app>/src/modules/api/graphql/clients/` when one app calls the back end, or `fe/packages/<family>-api/src/graphql/clients/` shared by every app that does when several do (an app that calls no back end, such as a marketing landing, holds no transport), and through the one axios instance of `modules/api/rest` for uploads, presigned URLs and auth endpoints; no other `fetch`, HTTP or GraphQL client, and no token or locale held in module state; a component reads through an SWR hook of `hooks/swr` whose key carries the identity of its result, and a mutation hook is tied to its resource."
     kinds: [lint, design]
     gates: [settle, land, ci]
     failureCodes: ["FE_TRANSPORT_OWNER", "FE_EFFECT_FETCH", "FE_SWR_KEY_IDENTITY", "FE_SWR_MUTATION_RESOURCE_IDENTITY"]
@@ -536,7 +533,7 @@ rules:
       - {kind: eslint-fe, id: swr-data-lifecycle}
   - id: R51
     code: "FE_HTTP_STATUS_COLLAPSE"
-    law: "One `Outcome<T>` union per front end (the api slot's `outcome.ts`); 401 and 403 become `refused`."
+    law: "One `GraphQLResponse<T>` envelope (`success`, `message`, `error`, `data`) per front end, declared in `modules/api/graphql/types.ts` (or the shared api package's); a failure is never collapsed into empty data, and an UNAUTHENTICATED or FORBIDDEN answer (401, 403) becomes `refused`: the error link refreshes the token once, then the session sends the user to sign-in."
     kinds: [lint, design]
     gates: [settle, land, ci]
     failureCodes: ["FE_HTTP_STATUS_COLLAPSE", "FE_OUTCOME_KIND_UNHANDLED"]
@@ -547,7 +544,7 @@ rules:
       - {kind: eslint-fe, id: one-outcome-union}
   - id: R52
     code: "FE_WIRE_GENERATED"
-    law: "Wire types generated from the be contract snapshots the fe side reads."
+    law: "Wire types are generated by graphql-codegen from `be/contracts/<app>/schema.graphql`, read in place and never copied, into `modules/api/graphql/__generated__`; an operation's request and response types re-export the generated ones and are never typed by hand."
     kinds: [lint, check, design]
     gates: [settle, land, ci]
     failureCodes: ["FE_WIRE_GENERATED"]
@@ -589,7 +586,7 @@ rules:
       - {kind: eslint-fe, id: client-reaches-server}
   - id: R56
     code: "FE_HOOKS_ARE_HOOKS"
-    law: "`hooks/` hold hooks and one shared file per domain; a product hook is defined only there and imported through its index."
+    law: "`hooks/` hold hooks only: `hooks/swr` (one SWR wrapper per modules/api operation), `hooks/rhf` (forms), `hooks/zustand/<store>`, `hooks/socketio`, `hooks/effects`, `hooks/reuseables` and `hooks/<domain>` with one shared file per domain; a product hook is defined only there and imported through its index."
     kinds: [lint, codemod]
     gates: [settle, land, ci]
     failureCodes: ["FE_HOOKS_ARE_HOOKS", "FE_CUSTOM_HOOK_LOCATION", "FE_BLOCK_PRODUCT_HOOK_DEFINITION", "FE_COMPONENT_DEEP_HOOK_IMPORT"]
@@ -990,13 +987,13 @@ rules:
       - {kind: eslint-fe, id: component-purity}
   - id: R93
     code: "FE_VENDOR_BOUNDARY"
-    law: "Vendor primitives and icons reach components only through their named owner: heroicons through the icon leaf at the glyph scale, every vendor primitive behind a named owner; the Grammar package is imported only through its selected code and style entry and keeps its declared contract."
+    law: "Vendor primitives and icons reach components only through their named owner: the one icon set of knowledge/hfs/fe-stack.yaml through the icon leaf at the glyph scale, every vendor primitive behind a named owner; the Grammar package is imported only through its selected code and style entry and keeps its declared contract."
     kinds: [lint, codemod]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["FE_VENDOR_BOUNDARY", "ARCH_GRAMMAR_CONTRACT_INVALID", "ARCH_GRAMMAR_EXPORT_BYPASS"]
     enforcers:
       - {kind: eslint-fe, id: no-vendor-icon-outside-icon-leaf}
-      - {kind: eslint-fe, id: heroicons-is-the-glyph-vendor}
+      - {kind: eslint-fe, id: one-icon-set}
       - {kind: eslint-fe, id: no-off-scale-glyph-size}
       - {kind: eslint-fe, id: no-decorative-icon-in-metric-cell}
       - {kind: eslint-fe, id: vendor-primitive-has-named-owner}
@@ -1040,7 +1037,6 @@ rules:
     kinds: [lint]
     gates: [pre-push, settle, land, ci]
     failureCodes: ["BE_TEST_BUILDER_HOME"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: persisting-builder-in-builders-slot}
   - id: R99
@@ -1049,7 +1045,6 @@ rules:
     kinds: [lint]
     gates: [pre-push, settle, land, ci]
     failureCodes: ["BE_TEST_ROW_BY_BUILDER"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: spec-no-raw-insert}
       - {kind: eslint-be, id: spec-no-repeated-row-literal}
@@ -1059,7 +1054,6 @@ rules:
     kinds: [lint]
     gates: [pre-push, settle, land, ci]
     failureCodes: ["BE_TEST_CONSTRAINTS_ON"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: tests-keep-constraints}
   - id: R101
@@ -1068,7 +1062,6 @@ rules:
     kinds: [lint]
     gates: [pre-push, settle, land, ci]
     failureCodes: ["BE_TEST_BUILDER_ARRANGES"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: builder-arranges-only}
   - id: R102
@@ -1077,7 +1070,6 @@ rules:
     kinds: [check, lint]
     gates: [land, ci]
     failureCodes: ["BE_SPEC_PLACEMENT"]
-    editions: [full]
     enforcers:
       - {kind: hfs, id: spec-placement, at: scripts/hfs/rules/spec-placement.mjs}
       - {kind: eslint-be, id: spec-placement}
@@ -1366,7 +1358,6 @@ rules:
     kinds: [check, codemod]
     gates: [settle, land, ci]
     failureCodes: ["BE_EVENT_CLASS_CONTRACT"]
-    editions: [full]
     enforcers:
       - {kind: hfs, id: event-class-contract, at: scripts/hfs/rules/event-bus.mjs}
   - id: R152
@@ -1375,7 +1366,6 @@ rules:
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_OUTBOX_WRITE_TX"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: outbox-write-tx}
   - id: R153
@@ -1384,7 +1374,6 @@ rules:
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_EVENT_CONSUMER_SHAPE"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: event-consumer-shape}
   - id: R154
@@ -1393,7 +1382,6 @@ rules:
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_QUEUE_PRODUCER_SHAPE"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: queue-producer-shape}
   - id: R155
@@ -1420,7 +1408,6 @@ rules:
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_JOB_WRITE_OUTSIDE_OWNER"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: job-write-owner}
   - id: R158
@@ -1429,7 +1416,6 @@ rules:
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_JOB_FENCE_REQUIRED"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: job-fence-required}
   - id: R159
@@ -1438,7 +1424,6 @@ rules:
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_JOB_RUN_KEY"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: job-run-key}
   - id: R160
@@ -1447,7 +1432,6 @@ rules:
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_JOB_SHAPE"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: job-shape}
   - id: R161
@@ -1456,7 +1440,6 @@ rules:
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_PROJECTION_WRITE_OWNER"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: projection-write-owner}
   - id: R162
@@ -1465,7 +1448,6 @@ rules:
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_PROJECTION_SHAPE"]
-    editions: [full]
     enforcers:
       - {kind: eslint-be, id: projection-shape}
   - id: R163
@@ -1498,7 +1480,6 @@ rules:
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_EVENT_CONTRACT"]
-    editions: [full]
     enforcers:
       - {kind: hfs, id: services-event-contract, at: scripts/hfs/rules/services.mjs}
   - id: R167
@@ -1524,7 +1505,6 @@ rules:
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["BE_SAGA_STEP_COMPENSATION"]
-    editions: [full]
     enforcers:
       - {kind: hfs, id: saga-step-compensation, at: scripts/hfs/rules/saga.mjs}
   - id: R170
@@ -1533,7 +1513,6 @@ rules:
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["BE_SAGA_STATE_VERSIONED"]
-    editions: [full]
     enforcers:
       - {kind: hfs, id: saga-state-versioned, at: scripts/hfs/rules/saga.mjs}
   - id: R171
@@ -1542,7 +1521,6 @@ rules:
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["BE_SAGA_EVENT_CONTRACT"]
-    editions: [full]
     enforcers:
       - {kind: hfs, id: saga-event-contract, at: scripts/hfs/rules/saga.mjs}
   - id: R172
@@ -1551,7 +1529,6 @@ rules:
     kinds: [check]
     gates: [land, ci]
     failureCodes: ["BE_SAGA_CONSUMER_DEDUPE"]
-    editions: [full]
     enforcers:
       - {kind: hfs, id: saga-consumer-dedupe, at: scripts/hfs/rules/saga.mjs}
   - id: R173
@@ -1593,7 +1570,6 @@ rules:
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["BE_CONTRACT_BREAKING"]
-    editions: [full]
     enforcers:
       - {kind: hfs, id: contract-compat, at: scripts/hfs/rules/contract-compat.mjs}
   - id: R178
@@ -1646,7 +1622,7 @@ rules:
       - {kind: eslint-be, id: webhook-verify-first}
   - id: R184
     code: "BE_REALTIME_SHAPE"
-    law: "A realtime file is the one door its role names: `<channel>.gateway.ts` holds one `@WebSocketGateway` class with `@SubscribeMessage` handlers and `<x>.subscription.ts` holds one `@Resolver` class with `@Subscription` operations, and neither carries a query, a mutation, a field resolver, a REST route or the other protocol."
+    law: "A realtime file is the one door its role names: `<channel>.gateway.ts` holds one `@WebSocketGateway` class with `@SubscribeMessage` handlers and `<x>.subscription.ts` holds one `@Resolver` class with `@Subscription` operations, and neither carries a query, a mutation, a field resolver, a REST route or the other protocol. A lite app serves the same socket.io gateway from its api process and no graphql-ws subscription (R212 case-2)."
     kinds: [lint]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_REALTIME_SHAPE"]
@@ -1870,12 +1846,29 @@ rules:
       - {kind: runtime, id: slot-id-shape, at: scripts/checks/check-slot-id-shape.mjs}
   - id: R212
     code: "HFS_EDITION_INVALID"
-    law: "hfs.json names an edition the manifest knows (full, or lite; absent means full), and a lite app holds none of what lite does not have: no spec or test file, test script, test dependency or test-tool config, no UAT record, no supabase/functions, no worker app, no event, queue, job, projection or saga pattern, no saga, reactors, jobs or realtime kind."
+    law: "hfs.json names an edition the manifest knows (full, or lite; absent means full). Lite = full minus self-hosted infrastructure: the same monorepo, code structure, slots, patterns and back-end unit specs, every pattern port implemented on Supabase (Postgres, Auth, Storage, Supabase Queues/pgmq for queue and event bus, Postgres locks, pg_cron), the realtime pattern on the same socket.io gateway run inside the be api process (one instance, no Redis adapter), and one front-end standard for both editions (knowledge/hfs/fe-stack.yaml); a lite app holds none of the infrastructure lite does not run: no e2e or contract spec, no `test:e2e`, `test:contract`, `test:stack` or `test:browser` script, no e2e workflow or browser journey, no UAT record, no test container, toxiproxy or browser-runner dependency, no BullMQ, Kafka, Redis or graphql-ws dependency (the libraries lite infraOwners own nowhere), no .starcistacks infra/runtime/seeds tree and no supabase/functions."
     kinds: [check]
     gates: [pre-push, settle, land, ci]
     failureCodes: ["HFS_EDITION_INVALID", "HFS_EDITION_FORBIDDEN_PRESENT"]
     enforcers:
       - {kind: hfs, id: edition, at: scripts/hfs/rules/edition.mjs}
+    cases:
+      - id: case-1
+        date: "2026-10-12"
+        source: owner
+        quote: "For a lite app the back end is exactly the same too, only deployed more simply; the fe and be of a lite app are exactly the same as a full app, except there is no e2e - unit tests stay; a lite app has no infra, a monorepo + Supabase; fe and be in a monorepo like a full app. (translated from Vietnamese)"
+        ruling: "Lite = the full architecture minus self-hosted infrastructure. The same be/apps (api, cli, optional worker), be/src/{features,modules}, fe/apps and fe/packages, supabase/, .starcistacks and .starciwork; the same CQRS shape and patterns declared in hfs.json the same way. Only adapters and delivery differ, all on Supabase: schema authority in supabase/migrations; the queue pattern on Supabase Queues (pgmq) behind the same platform/queue ports (outbox to queue, processors, retry and backoff by visibility timeout and read_ct, archive on dead letter), no BullMQ or Redis; the event-bus pattern on pgmq-backed topics (or in process for a single api) behind the same EventPublisher/EventConsumer ports, no Kafka; realtime on Supabase Realtime (replaced by case-2: the socket.io gateway in the api process); cache and locks on Postgres (advisory locks or an unlogged table); schedules on pg_cron (+ pg_net) or the platform scheduler; storage and auth on Supabase. Back-end unit specs are required exactly as in full (unitRoles, logicRoles, 100 per file, @starci/jest-preset doubles, builders); integration specs are optional and run only on the local Supabase CLI stack (`starci supabase start`, no toxiproxy, no own containers); there is no e2e or contract world and no app.ci-e2e. .starcistacks holds env and secret custody only. The front end and the grammar stay exactly as in full: no tests (R97). The queue transport question was confirmed the same day: Supabase Queues (pgmq). Upgrade lite -> full stays additive: swap the adapters, add the e2e and contract world and the stack."
+      - id: case-2
+        date: "2026-10-13"
+        source: owner
+        quote: "Lite and full apps are the same code structure; lite only swaps the infrastructure for Supabase, has no self-hosted infrastructure and no e2e, and saga and jobs are built exactly like full. The front end of lite and full follows starci-academy: the browser calls the back end directly through modules/api/graphql (Apollo auth and no-auth clients with the link chain) and axios only for non-GraphQL calls, hooks/swr wraps every operation and components call hooks only, modules/toast reports mutation outcomes. Forbidden: Server Actions, Next route handlers except health/live, front-end data reads from Supabase (Supabase on the front end is auth only) and the rpc + polling command pattern; modules/db goes away. Every back-end feature exposes GraphQL for the front end; heavy work is a mutation that enqueues a job and the front end follows its progress. (translated from Vietnamese)"
+        ruling: "Lite and full share one code structure; the edition changes only the infrastructure (Supabase Postgres, Auth, Storage, pgmq and pg_cron instead of self-hosted services), runs the socket.io gateway inside the be api process (one instance, no Redis adapter; be.feature.realtime.websocket is legal in lite and the Supabase Realtime door is gone) and has no e2e. The front end is one standard for both editions, catalogued in knowledge/hfs/fe-stack.yaml (one canonical library, HFS home and pattern per concern, versions in canon-pins.yaml): Apollo GraphQL in modules/api/graphql with codegen from be/contracts/<app>/schema.graphql, axios in modules/api/rest for uploads, presigned URLs and auth endpoints, SWR hooks in hooks/swr, react-hook-form with zod in hooks/rhf, redux for app-wide state, zustand for local state, socket.io-client in hooks/socketio, modules/toast for mutation outcomes and modules/auth as the only front-end Supabase importer (auth only). The front end serves no API: no Server Action anywhere (FE_SERVER_ACTION_FORBIDDEN) and no route handler beyond health/live and the fe.route.callback slot (FE_ROUTE_HANDLER_FORBIDDEN); a package outside the catalog's choice is FE_STACK_FORBIDDEN. Back-end features expose GraphQL (be.transport.graphql) for the front end and keep REST for webhooks, the public API and OAuth callbacks; heavy work is a mutation that enqueues a fenced job or saga, and the front end polls a status query with SWR refreshInterval or listens on a socket namespace."
+      - id: case-3
+        date: "2026-10-13"
+        source: owner
+        quote: "As the student proposes. (translated from Vietnamese; the owner adopted the proposed HFS standard for front end and back end, lite = full)"
+        ruling: "One HFS tree for both editions: the repository root, be/ (apps, contracts, features, modules, tests) and fe/apps/<app>/src have the same shape in lite and full, and code above the platform/integrations seam is the same. The editions differ only behind that seam: the database and its migration authority (lite supabase/migrations; full TypeORM entities and migrations in be.persistence), the auth provider (lite Supabase Auth through fe.modules.auth and a JWKS-verified back end; full the app's identity provider), object storage (lite Supabase Storage; full S3-compatible storage), queue and jobs (lite pgmq and pg_cron; full BullMQ) behind platform/queue, realtime (lite the socket.io gateway in the api process, one instance; full socket.io scaled with a Redis adapter), the event-bus adapter (lite outbox and pgmq; full outbox and Kafka) and hosting; lite has no e2e. Migration baseline at the cutover of an existing app: the live schema is dumped into one baseline migration written to the current standard and marked applied on production without a re-run, the older migrations move to app.supabase.migrations.archive (supabase/migrations/_archive/, never applied and never judged), and new migrations append after the baseline. Assets: static templates, copy and presets are TS constants in the owning domain capability (<x>.templates.ts) and user-editable ones are seed rows; small build-time binaries such as fonts live in be.assets (be/src/assets/<kind>/); large and user media live in object storage and are fetched at runtime; there is no be/resources/."
+
   - id: R213
     code: "DB_MIGRATION_SHAPE"
     law: "A migration is `supabase/migrations/<ts14>_<kebab>.sql`; the stamp is a valid UTC instant not in the future, new migrations sort strictly after every migration on the base branch, and a migration already on the base is immutable (a diff or a removal is a finding); a file that does not parse as PostgreSQL is a shape failure."
@@ -1910,27 +1903,19 @@ rules:
       - {kind: hfs, id: db-config-types, at: scripts/hfs/rules/database.mjs}
   - id: R217
     code: "FE_SUPABASE_CLIENT_OWNER"
-    law: "The database has one door per side: `@supabase/ssr` and `@supabase/supabase-js` are imported and called only by the fe db owner (`fe.modules.db`, `fe.package.db`) and, on the back end, by `be.integrations.supabase`, and every client carries the committed `Database` type; the front end has no route handler beyond health/live and the auth callback slot, and holds no credential: `fe/` names no service-role or `*_SECRET`, `*_PRIVATE`, `*_TOKEN`, `*_PASSWORD` value (public configuration is read once by `modules/config`)."
+    law: "Supabase has one door per side: on the front end `@supabase/supabase-js` and `@supabase/ssr` are imported only by `fe.modules.auth` and only their auth API is called (sign-in, sign-out, session, access token; never `.from`, `.rpc`, `.storage` or `.channel`, so the front end reads and writes no data through Supabase), and on the back end only `be.integrations.supabase` imports them, every back-end client carrying the committed `Database` type; the front end holds no credential: `fe/` names no service-role or `*_SECRET`, `*_PRIVATE`, `*_TOKEN`, `*_PASSWORD` value (public configuration is read once by `modules/config`)."
     kinds: [check, design]
     gates: [pre-push, settle, land, ci]
-    failureCodes: ["FE_SUPABASE_CLIENT_OWNER", "BE_SUPABASE_CLIENT_OWNER", "FE_ROUTE_HANDLER_FORBIDDEN", "FE_SERVICE_ROLE_FORBIDDEN"]
+    failureCodes: ["FE_SUPABASE_CLIENT_OWNER", "BE_SUPABASE_CLIENT_OWNER", "FE_SERVICE_ROLE_FORBIDDEN"]
     enforcers:
       - {kind: machine, id: supabase-client-owner, at: scripts/hfs/architecture/supabase.mjs}
       - {kind: machine, id: supabase-service-role, at: scripts/hfs/architecture/supabase.mjs}
-  - id: R218
-    code: "FE_DB_RESULT_TYPED"
-    law: "A Supabase result is typed by `Database` inference and never swallowed: no explicit generic on `single`/`maybeSingle`/`returns`, no cast or non-null assertion on a result, every list read carries `.limit()` or a keyset bound, every awaited call reads `error` or hands the whole result to `toOutcome`, and a failure never becomes empty data."
-    kinds: [check, design]
-    gates: [pre-push, settle, land, ci]
-    failureCodes: ["FE_DB_RESULT_TYPED", "FE_DB_ERROR_HANDLED"]
-    enforcers:
-      - {kind: machine, id: supabase-result, at: scripts/hfs/architecture/supabase.mjs}
   - id: R219
-    code: "FE_AUTH_SESSION_TRUST"
-    law: "The principal is verified, never trusted: server code never calls `auth.getSession()` (`getClaims()` through `getPrincipal()`, `auth.getUser()` for money, account security and role changes); a `write-*.ts` Server Action awaits `getPrincipal()` first, refuses an anonymous principal (the sign-in action is the one exception) and parses its input by a schema before any use; a back-end principal comes only from a Supabase access token verified against the project JWKS (signature, issuer, audience, expiry, pinned algorithm), never decoded unverified and never from the request body."
+    code: "BE_SUPABASE_JWT_VERIFIED"
+    law: "The principal is verified, never trusted: a back-end principal comes only from a Supabase access token verified against the project JWKS (signature, issuer, audience, expiry, pinned algorithm), never decoded unverified and never from the request body."
     kinds: [check, design]
     gates: [pre-push, settle, land, ci]
-    failureCodes: ["FE_AUTH_SESSION_TRUST", "FE_DB_WRITE_SHAPE", "BE_SUPABASE_JWT_VERIFIED"]
+    failureCodes: ["BE_SUPABASE_JWT_VERIFIED"]
     enforcers:
       - {kind: machine, id: supabase-principal, at: scripts/hfs/architecture/supabase.mjs}
   - id: R220
@@ -2153,3 +2138,21 @@ rules:
     failureCodes: ["RT_OP_JUDGE_UNDECLARED"]
     enforcers:
       - {kind: runtime, id: op-judge, at: scripts/checks/check-op-judge.mjs}
+  - id: R243
+    code: "FE_SERVER_ACTION_FORBIDDEN"
+    law: "The front end serves no API, in every app and edition (R212 case-2): no file under `fe/` carries a `\"use server\"` directive (module or function level), and the only route handlers are `app/health/live/route.ts` and the auth callback of the `fe.route.callback` slot; reads and writes reach the back end through `modules/api` and the SWR hooks, and a webhook, cron, public API or third-party callback is a back-end feature."
+    kinds: [check, lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_SERVER_ACTION_FORBIDDEN", "FE_ROUTE_HANDLER_FORBIDDEN"]
+    enforcers:
+      - {kind: machine, id: server-action-forbidden, at: scripts/hfs/architecture/server-action.mjs}
+      - {kind: eslint-fe, id: no-server-action}
+  - id: R244
+    code: "FE_STACK_FORBIDDEN"
+    law: "A front end uses the one canonical library of each concern of knowledge/hfs/fe-stack.yaml: no front-end package.json (an app or a `fe/packages/*` package) depends on, and no source file under `fe/` imports, a package that the catalog lists under a concern's `forbids`; a missing concern is added to the catalog (with its pin in canon-pins.yaml), never installed beside it."
+    kinds: [check, lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_STACK_FORBIDDEN"]
+    enforcers:
+      - {kind: hfs, id: fe-stack, at: scripts/hfs/rules/fe-stack.mjs}
+      - {kind: eslint-fe, id: fe-stack-import}