@starci/eslint-canon-fe 8.1.0 → 8.2.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 8.2.0 - 2026-10-09
+
+- Changed: the bundled runtime copies (engine config, architecture machine, slot manifest, canon pins, failure codes) follow the runtime of 1.0.0-alpha.9; no rule is added or removed. Version 8.1.0 on the registry carries the copies of an earlier runtime.
+
 ## 8.1.0 - 2026-10-08
 
 - New: the `sonar-parity` law (R235 `SCAN_SMELL`): `no-await-in-loop` (S9382), `prefer-code-point` (S7758), `prefer-string-raw` (S7780), `no-nested-conditional` (S3358), `no-void-operator` (S3735), `no-unused-import` (S1128), `prefer-export-from` (S7763) and `no-unused-prop-types` (S6767), each the syntax-tree form of the Sonar rule SonarCloud flagged in the example apps, shared with the back-end canon through the bundled `runtime/scripts/lib/sonar-syntax-rules.mjs`. The factory also turns on the typescript-eslint rules `no-deprecated` (S1874), `no-base-to-string` (S6551) and `require-await` (S7503); `@typescript-eslint/eslint-plugin` becomes a dependency of this package.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/eslint-canon-fe",
-  "version": "8.1.0",
+  "version": "8.2.0",
   "description": "The StarCi front-end lint canon: every rule its laws publish, gathered as one flat-config plugin and attached by one factory.",
   "type": "module",
   "license": "MIT",

package/runtime/config.example.yaml

@@ -185,3 +185,10 @@ sonar: {organization: null}
 #   minFreeRamPct  free-RAM percentage below which no new heavy op starts
 # set them only in the gitignored config.yaml copy, e.g.
 #   resources: {minFreeDiskGb: 5, minFreeDiskPct: 1, minFreeRamPct: 10}
+# release — where the full test suite of a release is judged (scripts/guards/release-suite-mode.mjs; docs/releasing.md "Where the suite runs"). One key:
+#   suite: local   the shipped default: `starci release cut` runs the root suite and the Linux parity container before it pushes, and the pre-push gate asks for their green rows
+#   suite: ci      the owner's recorded choice (2026-10-09): no local full suite and no Linux container; the GitHub ci workflow runs the suite (with coverage, Codecov, SonarCloud) AFTER the push.
+#                  The cut still runs npm run check, npm run test:packages, the specs affected by the release, the live Orca smokes and the example apps; the record lists the root suite as
+#                  delegated, never green. A release can reach GitHub and its tag before the suite has run; a red CI is fixed forward with the next pre-release (starci release ci-status).
+# "none" is refused: the suite does not vanish, it moves to CI. Set it only in the gitignored config.yaml copy: release: {suite: ci}
+release: {suite: local}

package/runtime/engine/config.mjs

@@ -6,6 +6,7 @@ import {parseYaml} from './yaml.mjs';
 import {isPlainObject as plain} from './plain-object.mjs';
 import {invalid,validateRoots,ROOT_KEYS} from './invalid-config.mjs';
 import {validateSonar} from './sonar-config.mjs';
+import {validateRelease,RELEASE_KEYS} from './release-config.mjs';
 import {validateOrca,ORCA_KEYS} from './orca-config.mjs';
 import {validateResources,RESOURCE_KEYS} from './resources-config.mjs';
 import {ENV_NAME,secretEnv,connectorSecret} from './secrets.mjs';
@@ -242,7 +243,7 @@ export function uatSettings(config=loadConfig()){
 const GRANT=/^([a-z0-9][a-z0-9.-]*)=(\d+)@([a-z]+(?:\+[a-z]+)*)$/;
 /** One grant string `<pool>=<slots>@<role>+<role>` as {pool, slots, roles}, or null when it is not that shape. */
 /** The closed set of top-level config.yaml blocks: the validator accepts these and refuses every other key. */
-export const CONFIG_BLOCKS=Object.freeze(['language','model','effort','models','allocation','kernel','budgets','supervisor','parallel','delegation','connectors','asks','uat','specs','reconciler','debugLoop','orca','roots','resources','sonar','launchTrust','retention']);
+export const CONFIG_BLOCKS=Object.freeze(['language','model','effort','models','allocation','kernel','budgets','supervisor','parallel','delegation','connectors','asks','uat','specs','reconciler','debugLoop','orca','roots','resources','sonar','release','launchTrust','retention']);
 export function parseAllocationGrant(text){
   const m=typeof text==='string'?GRANT.exec(text.trim()):null;
   return m?{pool:m[1],slots:Number(m[2]),roles:m[3].split('+')}:null;
@@ -323,7 +324,7 @@ const validateEarlyConfigBlocks=(config)=>{
   if(config?.launchTrust!==undefined){launchTrustSettings(config);} if(config?.retention!==undefined){workflowPurgeSettings(config);}
   if(config?.connectors!==undefined){validateConnectors(config.connectors);} if(config?.asks!==undefined){validateAsks(config.asks);}
   if(config?.uat!==undefined){validateUat(config.uat);} if(config?.debugLoop!==undefined){validateDebugLoop(config.debugLoop);}
-  if(config?.orca!==undefined){validateOrca(config.orca);} if(config?.roots!==undefined){validateRoots(config.roots);} if(config?.resources!==undefined){validateResources(config.resources);} if(config?.sonar!==undefined){validateSonar(config.sonar);}
+  if(config?.orca!==undefined){validateOrca(config.orca);} if(config?.roots!==undefined){validateRoots(config.roots);} if(config?.resources!==undefined){validateResources(config.resources);} if(config?.sonar!==undefined){validateSonar(config.sonar);} if(config?.release!==undefined){validateRelease(config.release);}
 };
 const validateConfigBlocks=(config,knownProviders,runtimes,profile)=>{
   // specs (owner 2026-09-28): {harness?, unit?, e2e?} booleans - each family a boolean; absent = its default (SPEC_DEFAULTS: harness off, unit on, e2e off; specsSettings).
@@ -416,7 +417,7 @@ export const CONFIG_KEY_TREE=Object.freeze({
   supervisor:Object.freeze(['mode','pollIntervalMs','repos','stallMinutes','kernel','workers','landGate','frozenMinutes']),
   delegation:Object.freeze(['asks','until','excludes','note']),asks:Object.freeze(['autoAcceptRecommended','excludes']),uat:Object.freeze(['maxConcurrent']),
   specs:SPEC_FAMILIES,reconciler:Object.freeze(['enabled','profile','controllers']),debugLoop:Object.freeze(['interval','worktreeLimit']),
-  orca:ORCA_KEYS,roots:ROOT_KEYS,resources:RESOURCE_KEYS,
+  orca:ORCA_KEYS,roots:ROOT_KEYS,resources:RESOURCE_KEYS,release:RELEASE_KEYS,
 });
 export const SPEC_DEFAULTS=Object.freeze({harness:false,unit:true,e2e:false});
 export function specsSettings(config){const specs=plain(config?.specs)?config.specs:{};return Object.fromEntries(SPEC_FAMILIES.map(key=>[key,typeof specs[key]==='boolean'?specs[key]:SPEC_DEFAULTS[key]]));}

package/runtime/engine/release-config.mjs

@@ -0,0 +1,28 @@
+import {isPlainObject as plain} from './plain-object.mjs';
+import {invalid} from './invalid-config.mjs';
+
+/** The keys of the release block. */
+export const RELEASE_KEYS=Object.freeze(['suite']);
+/** Where the full test suite of a release is judged: `local` (the release cut runs it, the shipped default) or `ci` (the GitHub workflow runs it after the push; the cut runs only the affected specs of the release and the rows CI cannot run). */
+export const SUITE_MODES=Object.freeze(['local','ci']);
+export const RELEASE_DEFAULTS=Object.freeze({suite:'local'});
+
+/**
+ * config.yaml `release` - {suite?: local | ci}: who judges the full suite of a release (docs/releasing.md "Where the suite runs"). `local` is the shipped
+ * default: `starci release cut` runs the root suite and the Linux parity container before it pushes. `ci` is the owner's recorded choice (2026-10-09) that
+ * the full suite runs on GitHub only: the cut runs no root suite and no Linux container, and the CI workflow's verdict is read afterwards (`starci release ci-status`).
+ * `none` is refused: the suite does not vanish, it moves to CI, and the value says so.
+ */
+export function validateRelease(release){
+  if(release===null)return;
+  const bad=invalid('release');
+  if(!plain(release))bad(` must be {suite?: ${SUITE_MODES.join(' | ')}} or null.`);
+  for(const key of Object.keys(release))if(!RELEASE_KEYS.includes(key))bad(` has unknown key ${key} (allowed: ${RELEASE_KEYS.join(', ')}).`);
+  const value=release.suite;
+  if(value===undefined||value===null)return;
+  if(value==='none')bad('.suite: "none" is not a mode: write "ci" (no local full suite, CI judges) or "local".');
+  if(!SUITE_MODES.includes(value))bad(`.suite must be ${SUITE_MODES.join(' or ')}, or null.`);
+}
+
+/** The suite mode a validated owner config names; an absent block or key is the shipped default. */
+export const releaseSuiteMode=config=>config?.release?.suite??RELEASE_DEFAULTS.suite;

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind and the IconButton disclosure props. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.1.0
+    version: 3.2.0
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.1.0
+    version: 8.2.0
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.1.0
+    version: 1.2.0
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.1.0
+    version: 4.2.0
     group: starci
     install: registry
     side: both

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -154,6 +154,58 @@ removed:
     use: 'skills/starci/references/host-startup.md'
     since: 1.0.0-alpha.6
     match: '(?<![\w-])host-maintenance\b'
+  - id: config-drawloop-critic
+    kind: config-key
+    name: allocation.drawLoop.critic
+    use: 'the Critic is picked from its tier (modules/models/tiers.yaml seats.critic, modules/kernel/critic.yaml) with provider independence as a hard filter; its wall bound is allocation.drawLoop.criticTimeoutMs'
+    since: 1.0.0-alpha.9
+    match: 'allocation\.drawLoop\.critic(?![A-Za-z])'
+  - id: config-drawloop-criticwhendrawer
+    kind: config-key
+    name: allocation.drawLoop.criticWhenDrawer
+    use: 'the Critic tier holds a member of every provider and the picker removes the provider of the maker; there is no per-drawer table'
+    since: 1.0.0-alpha.9
+    match: 'criticWhenDrawer'
+  - id: registry-critic-coverage-define-architecture
+    kind: vocabulary
+    name: critic-coverage-define-architecture
+    use: 'the edge-case registry entry is critic-coverage-decision-legs'
+    since: 1.0.0-alpha.9
+  - id: supervisor-grammar-release
+    kind: vocabulary
+    name: grammarRelease
+    use: 'the owner publishes @starci/grammar through starci release publish; the Supervisor changes no runtime code'
+    since: 1.0.0-alpha.9
+  - id: supervise-yaml-worker-land-blocks
+    kind: vocabulary
+    name: supervise.yaml workers
+    use: 'the Supervisor spawns no fix workers and lands nothing: it answers its menu (starci supervisor status) and records runtime defects for Debug'
+    since: 1.0.0-alpha.9
+    match: 'supervise\.yaml\s+(?:workers|landGate)\b|supervise\.yaml\s+kernelSeat/workers'
+  - id: supervisor-fixes-through-lanes
+    kind: vocabulary
+    name: the Supervisor fixes through lanes
+    use: 'the Supervisor records a runtime defect (starci supervisor actions record --item runtime-defect:<cause>) and Debug changes .claude'
+    since: 1.0.0-alpha.9
+    match: 'Supervisor[^\n.]{0,60}\bfix(?:es)?\s+through\s+(?:its\s+own\s+)?(?:staged\s+)?lanes?\b'
+  - id: kernel-ranked-actions
+    kind: vocabulary
+    name: ranked actions
+    use: "the Kernel's menu: the Decide section of starci kernel status, answered with starci kernel decide"
+    since: 1.0.0-alpha.9
+    match: '[Ww]ork the ranked actions|[Ff]irst rca\.actions entry'
+  - id: kernel-run-next-actions
+    kind: vocabulary
+    name: run nextActions
+    use: "the Kernel answers the items of its menu; the runtime performs the mechanical next actions"
+    since: 1.0.0-alpha.9
+    match: 'run nextActions|run each\s+in order and never choose'
+  - id: event-op-reported
+    kind: vocabulary
+    name: op-reported
+    use: 'the event a filed report records is report-filed; no event named op-reported was ever emitted'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])op-reported(?![\w-])'
   - id: file-sonar-secrets-keys
     kind: file
     name: KEYS.md
@@ -166,3 +218,51 @@ removed:
     use: 'the examples are analysed on SonarCloud with the SONAR_TOKEN of the runtime secret.env (runtimeSecrets in their services.sonar declaration)'
     since: 1.0.0-alpha.7
     match: 'sonarqube-(?:lite-app|shape-slot|starci-ecommerce-app)-token'
+  - id: vocab-menu-kinds-moved-to-controllers
+    kind: vocabulary
+    name: the menu kinds of the origins the controllers now move
+    use: 'the Job controller enqueues a red node, a stale proof or attempt, the asset leg and the credential ask itself (scripts/kernel/next-moves.mjs); the Kernel menu keeps leg-ready, draw-redraw, seam-duty and move-unbuilt'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:node-rework|stale-redispatch|enqueue-asset-leg|enqueue-credential-ask|rework-node)(?![\w-])'
+  - id: vocab-sonar-stack-sealed-members
+    kind: vocabulary
+    name: ext/sonar secrets custody
+    use: 'the stack secrets are the secret.env variables SONARQUBE_DB_PASSWORD, SONARQUBE_ADMIN_PASSWORD, SONARQUBE_ADMIN_TOKEN and CLOUDFLARE_TUNNEL_TOKEN, passed by starci gate sonar up; ext/sonar tracks no sealed member'
+    since: 1.0.0-alpha.9
+    match: 'ext/sonar/secrets/(?:sonarqube-(?:db|admin|analysis)-(?:password|token)|cloudflare-starci-local-services-tunnel-token)'
+  - id: vocab-ecommerce-sealed-demo-secrets
+    kind: vocabulary
+    name: ecommerce sealed demo secrets
+    use: 'the ecommerce example carries demo-only defaults in its compose files and declares no sealed secret (secrets: [])'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:keycloak|minio)-env(?:\.enc)?(?![\w-])'
+  - id: vocab-handover-step-mechanical-pending
+    kind: vocabulary
+    name: the handover-step menu mode mechanical-pending and its choice rerun-handover-review
+    use: 'the Job controller enqueues handover.review itself when the handover is due or its ask was answered approve or question (next action handover-review, scripts/kernel/handover-move.mjs); the handover-step item holds only the typed routing of a reported defect'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:mechanical-pending|rerun-handover-review)(?![\w-])'
+  - id: vocab-card-delivery-bound
+    kind: vocabulary
+    name: the agent card delivery keys maxInlineChars, fileName and fileDirectory
+    use: 'one bound, one directory and one cleanup serve every card: allocation.promptFile in modules/models/runtimes.yaml (scripts/agent/prompt-file.mjs); a card keeps delivery.mode and delivery.prompt'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:maxInlineChars|fileDirectory)(?![\w-])'
+  - id: vocab-backoff-factor-keys
+    kind: vocabulary
+    name: the growth factor of allocation.dispatchRefusal and of the backoff of modules/reconciler/host.yaml
+    use: 'every backoff is the one retry budget (scripts/lib/retry-budget.mjs), which doubles its interval up to a cap: declare baseMs/capMs or minMs/maxMs only'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:dispatchRefusal|backoff):\s*\{[^}\n]*\bfactor\b'
+  - id: vocab-wake-terminal-bound
+    kind: vocabulary
+    name: the independent wake character bound
+    use: 'allocation.promptFile.maxChars is the terminal bound owned by scripts/agent/prompt-file.mjs'
+    since: 1.0.0-alpha.9
+    match: '(?<![\w-])(?:allocation\.)?wake\.maxChars|\bwake:\s*\{\s*maxChars\b'
+  - id: vocab-draft-probe-mutations
+    kind: vocabulary
+    name: draft probe mutation fields
+    use: 'probeDraft reads only and returns verdict, draft and sends; a foreign draft receives no keys'
+    since: 1.0.0-alpha.9
+    match: '\b(?:draftProbe|probeDraft)\.(?:restore|restored|removed|after)\b'

package/runtime/modules/models/runtimes.yaml

@@ -93,9 +93,20 @@ allocation:
   # the decision doorbell; still the same turn turnInterruptGraceMs later, the seat is replaced (KERNEL_TURN_OVERDUE,
   # scripts/reconciler/controllers/host.mjs turnStep). A busy turn defers every doorbell and notice (kernel-busy).
   liveness: {activeUnclassifiedMs: 120000, activeStaleMs: 600000, quietMs: 1200000, launchGraceMs: 90000,
-    kernelTurnBudgetMs: 1200000, supervisorTurnBudgetMs: 1800000, turnInterruptGraceMs: 300000}
+    kernelTurnBudgetMs: 1200000, supervisorTurnBudgetMs: 1800000, turnInterruptGraceMs: 300000,
+    # The watchdog's replacement of a Kernel seat runs start-workflow (worktree check, install, Orca launch, attestation): bounded here, under the Host controller's
+    # seats.kernel.timeoutMs that kills the whole watchdog pass. A start that outlives it is killed and recorded kernel-start-failed (start-timeout), never lost silently.
+    kernelStartTimeoutMs: 600000}
   # one local git read over a job's owned paths (scripts/kernel/owned-path-effects.mjs ownedPathEffects, job-artifacts.mjs).
   settleGit: {commandMs: 15000}
+  # prompt-file.mjs owns terminal delivery, wake bounds, file placement and cleanup.
+  promptFile: {maxChars: 2000, ttlMs: 86400000}
+  # opVerbs: the bound of the "your verbs" block of an [Op] prompt (scripts/kernel/op-prompt-verbs.mjs): the starci calls the op's contract names,
+  # each with the flags the contract uses and the required ones, one line per verb. A worker that has the exact call never runs --help
+  # (a measured op spent 15 of its 135 turns on it). `standing` verbs are printed in full by the prompt's own reporting and logging blocks;
+  # `omitGroups` are the verbs of the Kernel and above, which an op's contract names only to say who runs them.
+  opVerbs: {maxVerbs: 20, maxChars: 3000, lineChars: 190, standing: ["kernel report", "kernel log", "kernel op-contract"],
+    omitGroups: [kernel, supervisor, workflow, reconciler]}
   # Typed logs (scripts/kernel/typed-logs.mjs, the ledger's logs table): perJobCap rows a job's own writes
   # may store before one log.truncated row closes them (derived event rows are never capped); dataMaxBytes bounds
   # one row's data after redaction. diff: the caps of a job patch's pre-structured <patch>.json
@@ -187,6 +198,13 @@ allocation:
   # replacement takes over the loop's lock within handoverMs or is stopped. The reconciler engine checks every checkMs; an engine whose
   # revision still differs from the live one that long past minIntervalMs + checkMs + handoverMs is a drift row (scripts/reconciler/drift.mjs).
   selfReload: {minIntervalMs: 300000, handoverMs: 30000, checkMs: 60000, driftGraceMs: 120000}
+  # deploy (scripts/reconciler/runtime-deploy.mjs): a deploy waits up to waitMs, polling every pollMs, for the settles, Critic runs and prepared
+  # decisions in flight to finish; after the engine restart it waits up to verifyMs for the new leader's fresh heartbeat on the new revision. The affected-spec child
+  # may run its declared budget (modules/supervisor/affected-tests.yaml) plus affectedMarginMs before the deploy stops it.
+  deploy: {waitMs: 1800000, pollMs: 5000, verifyMs: 120000, affectedMarginMs: 300000}
+  # dispatchRefusal (scripts/kernel/dispatch-refusal-memo.mjs): a ready job whose dispatch is refused for the same cause is tried again after baseMs, then twice as long each time (the one retry budget), up to capMs; a change of
+  # the cause's fingerprint (runtime revision, a ruling, a resource the refusal names) tries it at once.
+  dispatchRefusal: {baseMs: 60000, capMs: 900000}
   # footprint (scripts/guards/footprint-scan.mjs): one host-wide scan at most every everyMs; a crashed
   # tick's claim lock is cleared after lockStaleMs.
   footprint: {everyMs: 600000, lockStaleMs: 60000}
@@ -194,12 +212,15 @@ allocation:
   jobGuard: {ttlMs: 604800000}
   # landGate (scripts/supervisor/land.mjs): a land waits waitMs for its turn at the gate; its spec run may take
   # specsBaseMs plus perSpecMs for every spec it runs, specConcurrency spec files at a time.
-  landGate: {waitMs: 1800000, specsBaseMs: 600000, perSpecMs: 60000, specConcurrency: 6}
+  landGate: {waitMs: 1800000, specsBaseMs: 600000, perSpecMs: 60000, specConcurrency: 6, cliVerbs: 12}
   # workerClose (scripts/machine/worker-close.mjs; owner rule: a finished worker is closed COMPLETELY): after worker-release and the terminal
   # close the runtime waits verifyMs for every process of that terminal's shell tree to end (polled every pollMs); a survivor proven to belong
   # to the tree is stopped and given stopVerifyMs to end before the finding is raised.
   # A finished [Worker] job whose terminal has no recorded closure is closed again by the Job controller's worker sweep (scripts/supervisor/supervisor-watchdog.mjs):
   # every leftoverRetryMs (doubling to leftoverRetryMaxMs) for at most leftoverRetryAttempts attempts, each failure recorded with its reason on the job.
+  # uatSlot (scripts/uat/slot-collect.mjs, slot-lessee.mjs): a held UAT run checks its lessee (its attempt, the process that launched it) every watchMs and ends with it;
+  # the Host pass ends a slot whose lessee is gone, and a slot that recorded no lessee at all once it has been held unknownHoldMs (3 hours: a UAT run is minutes).
+  uatSlot: {watchMs: 5000, unknownHoldMs: 10800000}
   workerClose: {verifyMs: 10000, pollMs: 1000, stopVerifyMs: 5000, leftoverRetryMs: 60000, leftoverRetryMaxMs: 900000, leftoverRetryAttempts: 12}
   # providerReservation (scripts/machine/provider-reservation-reap.mjs): an admission whose receipt stayed `reserved` this long never reached
   # worker-start (the consume moves it to `launching` first), so its launcher died and the slot is released. A receipt with no terminal handle and no
@@ -238,20 +259,26 @@ allocation:
   quitAgent: {waitMs: 6000}
   # drawRender (scripts/work/draw-render.mjs): a capture waits settleMs after document.fonts.ready.
   drawRender: {settleMs: 500}
+  # layoutRender (scripts/work/layout-render.mjs): the runtime serves the product app for one capture; readyMs is how long the dev server may take to answer
+  # its first request (a cold Next compile), navigateMs the page load, settleMs the wait after fonts are ready, stopMs the grace before a still-running server is killed.
+  # publicOriginKeys are the scaffold's public-origin variables (its README: the product app's own address and the product app the landing hands over to); each gets the render's origin.
+  layoutRender: {readyMs: 180000, navigateMs: 90000, settleMs: 500, stopMs: 5000, publicOriginKeys: [NEXT_PUBLIC_SITE_URL, NEXT_PUBLIC_APP_URL]}
   # drawLoop (scripts/work/draw-loop.mjs, scripts/work/draw/draw-taste.mjs; owner rulings 2026-09-27): interface.draw
   # draws -> shoots -> evaluates -> fixes in rounds. A loop stops when every machine metric passes and the
   # independent critic's beauty is at least beautyMin, after maxRounds, or after stallRounds rounds in a row that
   # neither cut the failures nor raised the beauty; the best round is kept. Taste thresholds: accentBudget is the
   # largest share of the render the accent colour may fill (the brand art band excluded), bandsPerCardMax the most
   # hairline bands one card splits into, badgesPerEntityMax the most badges one entity carries. critic is the fresh,
-  # context-free Orca worker that scores beauty and hierarchy against the product's brand.direction rubric: started
+  # context-free Orca worker that scores beauty and hierarchy against the product's brand.direction rubric: picked through
+  # the tier picker from the Critic tier (modules/models/tiers.yaml seats.critic, modules/kernel/critic.yaml) with the
+  # independence rule as a hard filter, then started
   # through orchestration worker-start --agent <provider> --model --effort (scripts/agent/lib.mjs startAgent) on a
   # runtime worktree detached at the empty tree (draw-critic.mjs criticWorkspace; Orca refuses a bare temp dir) holding only the PNGs, the HTML and the rubric; it writes verdict.json and reports worker_done; a
-  # critic with no worker_done within timeoutMs is stopped and released (outcome timeout, no beauty). The critic is a DIFFERENT model from the drawer: a Codex drawer (the high tier's second member)
-  # is judged by criticWhenDrawer.codex; for any other drawer the critic is Codex. The images a drawer asks of the imagegen call
-  # (starci work imagegen) do not make the call's model the drawer. When the drawer (the op's provider, bound to its
-  # terminal - scripts/guards/op-context.mjs - or draw-loop.mjs round --drawer) is the critic's provider the round is
-  # judged by criticWhenDrawer.<drawer> instead, and a round with no independent critic has no beauty. directionPrerequisite: interface.draw needs an ACCEPTED brand.direction
+  # critic with no worker_done within criticTimeoutMs is stopped and released (outcome timeout, no beauty). The critic is a member of ANOTHER PROVIDER than
+  # the drawer: the members of its tier of that provider are removed before the pick, and a tier with no other provider's member refuses the critique with
+  # CRITIC_NO_INDEPENDENT_MEMBER (the drawer never judges itself). The images a drawer asks of the imagegen call
+  # (starci work imagegen) do not make the call's model the drawer. The drawer is the op's provider, bound to its
+  # terminal (scripts/guards/op-context.mjs) or named by draw-loop.mjs round --drawer; a round with no independent critic has no beauty. directionPrerequisite: interface.draw needs an ACCEPTED brand.direction
   # archetype for its ui record's ui.archetype - brand.mjs checkDirection evidence.ready, the owner's receipt
   # (scripts/kernel/prerequisites.mjs direction-unaccepted; the Kernel enqueues brand.decide --param
   # directionArchetype=<archetype> first). false switches the gate off.
@@ -262,9 +289,7 @@ allocation:
     accentBudget: 0.10
     bandsPerCardMax: 3
     badgesPerEntityMax: 2
-    critic: {provider: codex, model: gpt-6.1-sol, effort: high, timeoutMs: 900000}
-    criticWhenDrawer:
-      codex: {provider: claude, model: claude-opus-5-5, effort: high, timeoutMs: 900000}
+    criticTimeoutMs: 900000
     directionPrerequisite: true
     # How long the workflow that claimed foundation `shell` (the layout chain an interface.draw draws) may hold it before a
     # waiting draw opens a Supervisor Decision Item (scripts/kernel/shell-foundation.mjs; owner ruling 2026-09-29 draw-from-todo).
@@ -303,8 +328,8 @@ allocation:
   # reportWindowMs.
   workerJobs: {leaseTtlMs: 604800000, reportWindowMs: 604800000}
   # draft (scripts/kernel/clear-draft.mjs): the beat between one Ctrl+U and the re-read that judges
-  # the input box's answer - a TUI repaints a beat later. clearDraft and probeDraft default to it and
-  # the wake-delivery draft probe caps its own interval at it.
+  # the input box's answer - a TUI repaints a beat later. clearDraft defaults to it and
+  # wake-delivery caps its runtime-owned draft clear interval at it.
   draft: {intervalMs: 300}
   # housekeeping (scripts/housekeeping/housekeeping.mjs): every retention window and root the host
   # cleanup reads - no literal may live in the script. tmp: top-level %TEMP% entries whose name starts

package/runtime/modules/models/tiers.yaml

@@ -28,6 +28,7 @@ seats:
   kernelManager: frontier
   kernel: high
   worker: high
+  critic: frontier
 # The kernel's own model calls (selection.yaml kernelFunctionKinds) take the tier of their seat.
 kindSeats:
   model.assessGoal: planner

package/runtime/scripts/hfs/architecture/index.mjs

@@ -14,7 +14,7 @@ import { buildHfsGraph } from './hfs-graph.mjs';
 import { checkTiers, TIER_RULE_IDS } from './tiers.mjs';
 import { checkReachability, REACHABILITY_RULE_IDS } from './reachability.mjs';
 import { checkDeadExports, DEAD_EXPORT_RULE_IDS } from './dead-exports.mjs';
-import { checkRequiredFiles, REQUIRED_FILE_RULE_IDS } from './required-files.mjs';
+import { checkRequiredFiles, REQUIRED_FILE_RULE_IDS, withTreeCache } from './required-files.mjs';
 import { checkClones, CLONE_RULE_IDS } from './clones.mjs';
 import { checkSymbols, SYMBOL_RULE_IDS } from './symbols.mjs';
 import { checkConnectionMap, CONNECTION_RULE_IDS } from './connection-map.mjs';
@@ -321,7 +321,11 @@ function scopeFindings({ config, context, violations, paths, surface }) {
  * Check a target repository. injectedTypeScript exists only for hermetic rule fixtures. `fast` leaves out the checks
  * that read the whole repository to answer (clones, dead exports, repository-wide symbols); the pre-push check of the changed owners uses it.
  */
-export function checkArchitecture({ repositoryRoot, injectedTypeScript, paths = [], base, fast = false, hfs: openedHfs, surface = 'all' } = {}) {
+export function checkArchitecture(options = {}) {
+  return withTreeCache(() => checkArchitectureOnce(options));
+}
+
+function checkArchitectureOnce({ repositoryRoot, injectedTypeScript, paths = [], base, fast = false, hfs: openedHfs, surface = 'all' }) {
   if (!['all', 'lint', 'check'].includes(surface)) throw new Error(`unknown surface ${surface}`);
   let config;
   try {

package/runtime/scripts/hfs/architecture/required-files.mjs

@@ -49,8 +49,20 @@ function diskFiles(root, relative = '') {
   return out;
 }
 
-/** The repository tree as file and directory sets over posix relatives. */
-export function treeOf(root) {
+let runTrees = null;
+
+/** Runs `run` with one tree read per root: every checker of one machine run shares the repository listing instead of spawning git again. */
+export function withTreeCache(run) {
+  const outer = runTrees;
+  runTrees = outer ?? new Map();
+  try {
+    return run();
+  } finally {
+    runTrees = outer;
+  }
+}
+
+function readTree(root) {
   const list = gitFiles(root) ?? diskFiles(root);
   const files = new Set(list);
   const directories = new Set();
@@ -61,6 +73,13 @@ export function treeOf(root) {
   return { files, directories };
 }
 
+/** The repository tree as file and directory sets over posix relatives. */
+export function treeOf(root) {
+  if (!runTrees) return readTree(root);
+  if (!runTrees.has(root)) runTrees.set(root, readTree(root));
+  return runTrees.get(root);
+}
+
 /**
  * The prelude every tree-walking architecture checker shares: the input's config/graph/context, the compiler,
  * the slot resolver and the tracked repository tree.

package/runtime/scripts/hfs/repo-identity.mjs

@@ -14,14 +14,28 @@ const real = (p) => { try { return fs.realpathSync(p); } catch { return path.res
 const GIT_SUFFIX_SOURCE = String.raw`\.git$`;
 const GIT_SUFFIX = new RegExp(GIT_SUFFIX_SOURCE, 'iu');
 
+// The identity of a folder that has its own .git entry holds while that entry is the same file system object (same inode, same modification time), so a
+// process asks Git once per such folder state instead of at every check. A folder with no .git entry of its own is asked every time.
+const known = new Map();
+const stateOf = (root) => { try { const stat = fs.statSync(path.join(root, '.git')); return `${real(root)}|${stat.ino}|${stat.mtimeMs}`; } catch { return null; } };
+
 /** { repositoryRoot, inWorkTree, home } for `root`: home is the main checkout folder when root is a repository top level. */
 function identityOf(root) {
+  const state = stateOf(root);
+  if (state === null) return askGit(root);
+  if (!known.has(state)) known.set(state, askGit(root));
+  return known.get(state);
+}
+
+function askGit(root) {
   let inWorkTree = false, repositoryRoot = false, home = null;
   try {
     // Identity comes from Git only when root IS a repository (or worktree) top level, never a folder inside one.
-    repositoryRoot = real(git(revParseQuery, root, ['--show-toplevel'])) === real(root);
+    // One git call answers both questions: the top level on the first line, the common git dir on the second.
+    const [top, commonDir] = git(revParseQuery, root, ['--show-toplevel', '--git-common-dir']).split(String.fromCodePoint(10)).map((line) => line.trim());
+    repositoryRoot = real(top) === real(root);
     inWorkTree = true;
-    const common = path.resolve(root, git(revParseQuery, root, ['--git-common-dir']));
+    const common = path.resolve(root, commonDir);
     if (repositoryRoot && path.basename(common) === '.git') home = path.dirname(common);
   } catch { /* Not a Git work tree; the caller falls back to the folder and package name. */ }
   return { inWorkTree, repositoryRoot, home };

package/runtime/scripts/hfs/rule-catalog.mjs

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
-import { parseYaml } from '../../engine/yaml.mjs';
+import { parseYamlCached } from '../lib/yaml-cached.mjs';
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { SEMVER } from './manifest-shape.mjs';
 import { enforcerJudgedInEdition, judgedInEdition, ruleEditionProblems } from './edition-slots.mjs';
@@ -153,7 +153,7 @@ const deepFreeze = (value) => { if (value && typeof value === 'object') { Object
  */
 export function loadRuleCatalog({ root = skillRoot, file = path.join(root, HFS_RULES_FILE), text, manifest } = {}) {
   let doc;
-  try { doc = parseYaml(text ?? fs.readFileSync(file, 'utf8')); } catch (error) { fail('HFS_RULES_INVALID', `the rule catalog cannot be read (${String(error?.message ?? error).split('\n')[0]})`, { file }); }
+  try { doc = parseYamlCached(text ?? fs.readFileSync(file, 'utf8')); } catch (error) { fail('HFS_RULES_INVALID', `the rule catalog cannot be read (${String(error?.message ?? error).split('\n')[0]})`, { file }); }
   const problems = ruleCatalogProblems(doc);
   if (problems.length) { fail('HFS_RULES_INVALID', `the rule catalog breaks its schema: ${problems.slice(0, 5).join('; ')}${problems.length > 5 ? '; and ' + (problems.length - 5) + ' more' : ''}`, { file, problems }); }
   const [major, minor, patch] = doc.version.split('.').map(Number);

package/runtime/scripts/hfs/slots.mjs

@@ -21,7 +21,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
-import { parseYaml } from '../../engine/yaml.mjs';
+import { parseYamlCached } from '../lib/yaml-cached.mjs';
 import { braceVariants } from '../lib/glob.mjs';
 import { APP_KIND, RUNTIME_KIND, manifestKind } from './manifest-shape.mjs';
 import { APP_SCOPE, manifestShapeProblems, PROFILES } from './slot-manifest-shape.mjs';
@@ -73,7 +73,7 @@ export function appRelativeMessages(side, sideRoot) {
  */
 export function loadSlotManifest({ root = skillRoot, file = path.join(root, HFS_MANIFEST_FILE), text } = {}) {
   let doc;
-  try { doc = parseYaml(text ?? fs.readFileSync(file, 'utf8')); } catch (error) { fail('HFS_MANIFEST_INVALID', `the slot manifest cannot be read (${String(error?.message ?? error).split('\n')[0]})`, { file }); }
+  try { doc = parseYamlCached(text ?? fs.readFileSync(file, 'utf8')); } catch (error) { fail('HFS_MANIFEST_INVALID', `the slot manifest cannot be read (${String(error?.message ?? error).split('\n')[0]})`, { file }); }
   const problems = manifestShapeProblems(doc);
   if (!problems.length) problems.push(...manifestSemanticProblems(doc, { varsOf, braceVariants, compileVariant }));
   if (problems.length) fail('HFS_MANIFEST_INVALID', `the slot manifest breaks its schema: ${problems.slice(0, 5).join('; ')}${problems.length > 5 ? '; and ' + (problems.length - 5) + ' more' : ''}`, { file, problems });

package/runtime/scripts/lib/yaml-cached.mjs

@@ -0,0 +1,14 @@
+// yaml-cached.mjs - parse a YAML text once per distinct text in a process.
+//
+// The HFS slot manifest and rule catalog are large documents that one process asks for again at every check, every render and every fixture. Their
+// bytes do not change between those asks, so the parse (the dominant cost of a load) is keyed by the text itself; each caller gets its own copy of the
+// parsed document, so nothing a caller does to it reaches the next one. A changed file is a different text and parses again.
+import { parseYaml } from '../../engine/yaml.mjs';
+
+const parsed = new Map();
+
+/** The parsed document of `text`: parsed on the first ask for this text, a structured copy afterwards. Throws what parseYaml throws, every time. */
+export function parseYamlCached(text) {
+  if (!parsed.has(text)) parsed.set(text, parseYaml(text));
+  return structuredClone(parsed.get(text));
+}