@starci/eslint-canon-fe 8.3.0 → 8.4.0

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -60,26 +60,62 @@ function connectionProblems(side, value) {
 /** Whether a declared list is present but not a list of distinct entries that all satisfy `valid`. */
 const isBadUniqueList = (list, valid) => list !== undefined && (!Array.isArray(list) || !list.every((entry) => valid(entry)) || new Set(list).size !== list.length);
 
+const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+
+function validExtraPackage(entry) {
+  return isPlainObject(entry) && Object.keys(entry).every(key => key === 'name' || key === 'reason')
+    && typeof entry.name === 'string' && entry.name.length <= 214 && PACKAGE_NAME.test(entry.name)
+    && typeof entry.reason === 'string' && entry.reason.trim().length > 0;
+}
+
+function extraPackageProblems(side, entries) {
+  if (entries === undefined) return [];
+  if (side !== 'fe') return ['extraPackages belong to the fe side'];
+  if (!Array.isArray(entries) || !entries.every(validExtraPackage)) return ['sides.fe.extraPackages must be a list of {name, reason} with a package name and a nonempty reason'];
+  return [];
+}
+
 function declarationSideProblems(side, value, names) {
   const bad = [];
   const at = `sides.${side}`;
   if (!isPlainObject(value)) return [`${at} must be an object`];
-  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+  for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads', 'extraPackages'].includes(key)) bad.push(`${at} has unknown key ${key}`);
   bad.push(...appShapeProblems(value.apps, at, side, names));
   if (isBadUniqueList(value.optionalSlots, (slot) => SLOT_ID.test(String(slot)))) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
   bad.push(...patternShapeProblems(value, at, NAME), ...kindShapeProblems(value, at, NAME));
   if (isBadUniqueList(value.reads, (read) => typeof read === 'string' && read.length > 0)) bad.push(`${at}.reads must be a unique list of paths`);
   if (value.connections !== undefined) bad.push(...connectionProblems(side, value));
+  bad.push(...extraPackageProblems(side, value.extraPackages));
+  return bad;
+}
+
+/** Product vocabulary is a declaration, never a switch for a rule. */
+function lexiconBlockProblems(lexicon) {
+  if (lexicon === undefined) return [];
+  if (!isPlainObject(lexicon)) return ['lexicon must be an object'];
+  const bad = [];
+  for (const key of Object.keys(lexicon)) if (key !== 'removed') bad.push(`lexicon has unknown key ${key}`);
+  if (isBadUniqueList(lexicon.removed, (word) => typeof word === 'string' && word.trim().length > 0)) bad.push('lexicon.removed must be a unique list of nonempty words');
+  return bad;
+}
+
+/** Front-end error reporting remains optional in both editions. */
+function observeBlockProblems(observe) {
+  if (observe === undefined) return [];
+  if (!isPlainObject(observe)) return ['observe must be an object'];
+  const bad = [];
+  for (const key of Object.keys(observe)) if (key !== 'reporter') bad.push(`observe has unknown key ${key}`);
+  if (observe.reporter !== undefined && (typeof observe.reporter !== 'string' || !observe.reporter.trim())) bad.push('observe.reporter must name the optional error reporter');
   return bad;
 }
 
-const DECLARATION_KEYS = new Set(['hfs', 'kind', 'project', 'edition', 'supabase', 'sides', 'browser']);
+const DECLARATION_KEYS = new Set(['hfs', 'kind', 'project', 'edition', 'supabase', 'sides', 'browser', 'lexicon', 'observe']);
 const RUNTIME_DECLARATION_KEYS = new Set(['hfs', 'kind', 'project']);
 
 function productDeclarationProblems(declaration, profiles) {
   const bad = [];
   for (const key of Object.keys(declaration)) if (!DECLARATION_KEYS.has(key)) bad.push(`unknown key ${key}`);
-  bad.push(...supabaseBlockProblems(declaration.supabase));
+  bad.push(...supabaseBlockProblems(declaration.supabase), ...lexiconBlockProblems(declaration.lexicon), ...observeBlockProblems(declaration.observe));
   if (declaration.browser !== undefined && declaration.browser !== true) bad.push('browser is `true` when the app has a browser journey (slot app.browser), and is left out otherwise');
   if (declaration.kind !== APP_KIND) bad.push(`kind must be ${APP_KIND} (a product is one app repository with a be and an fe side) or ${RUNTIME_KIND} (the StarCi runtime repository)`);
   if (!isPlainObject(declaration.sides) || Object.keys(declaration.sides).sort(byCodeUnit).join() !== profiles.join()) { bad.push('sides must declare exactly be and fe'); return bad; }

package/runtime/scripts/hfs/edition-slots.mjs

@@ -1,7 +1,7 @@
 // edition.mjs - the one edition filter shared by the HFS slot resolver, declaration validation, rule catalog and
 // edition-specific rule parameters. Full is the default; lite changes data views, never the checks that consume them.
-// Lite is the full architecture deployed without self-hosted infrastructure (owner ruling 2026-10-12): its overlays swap
-// adapters and remove the infra and e2e world, and every slot keeps its own `tests`.
+// Lite uses provider adapters and declares Docker Swarm production infrastructure (owner:lite-production-swarm, ruling:R212/case-4).
+// Its overlays exclude the e2e world, and every slot keeps its own `tests`.
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { EDITIONS } from './manifest-shape.mjs';
 

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -4,7 +4,7 @@
 // (sides, app kinds) and refuses a manifest whole on any problem (HFS_MANIFEST_INVALID). Pure: every function takes a
 // parsed manifest or slot and returns a list of problems in the words of modules/schemas/hfs-slots.schema.yaml.
 import { isPlainObject } from '../../engine/plain-object.mjs';
-import { stringList, byCodeUnit } from '../lib/list.mjs';
+import { stringList, byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
 
 export const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
 export const NAME = /^[a-z][a-z0-9-]*$/;
@@ -86,7 +86,7 @@ export const MANIFEST_KINDS = [APP_KIND, RUNTIME_KIND];
 export const manifestKind = (m) => (isPlainObject(m) && m.kind !== undefined ? m.kind : APP_KIND);
 const strList = (v) => stringList(v);
 
-const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome'];
+const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'editionWhy', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'templateNa', 'exemplifiedBy'];
 /** The fields a slot's `lite` overlay may hold: the same keys it would carry in the slot body, resolved under edition lite. */
 const LITE_OVERLAY_KEYS = ['path', 'requires', 'allows', 'forbids', 'minInstances', 'requiredInstances', 'why'];
 /** A runtime slot has no app kind, side composition, layer or managed template; it may name the generator of a generated copy. */
@@ -184,6 +184,9 @@ function slotListProblems(slot, at) {
 
 function slotAppOptionProblems(slot, at) {
   const bad = [];
+  bad.push(...slotEditionWhyProblems(slot, at), ...slotCoverageEvidenceProblems(slot, at));
+  // Legacy coverage status derives only from an explicit `since`; a slot that omits it is refused, so a new slot can never be taken for an old one.
+  if (slot.since === undefined) bad.push(`${at}: since is required (the manifest version that added the slot)`);
   if (slot.editions !== undefined && !(Array.isArray(slot.editions) && slot.editions.length && slot.editions.every((e) => EDITIONS.includes(e)) && new Set(slot.editions).size === slot.editions.length)) bad.push(`${at}: editions must be a non-empty subset of ${EDITIONS.join(', ')}`);
   if (slot.litePresence !== undefined && !(PRESENCE.includes(slot.litePresence) || (isPlainObject(slot.litePresence) && Object.keys(slot.litePresence).length && Object.entries(slot.litePresence).every(([side, value]) => ['be', 'fe'].includes(side) && PRESENCE.includes(value))))) bad.push(`${at}: litePresence must be a presence value or map sides to presence values`);
   if (slot.provider !== undefined) {
@@ -193,6 +196,38 @@ function slotAppOptionProblems(slot, at) {
   return bad;
 }
 
+function slotEditionWhyProblems(slot, at) {
+  if (slot.editionWhy === undefined) return [];
+  return typeof slot.editionWhy === 'string' && slot.editionWhy.trim()
+    ? [] : [`${at}: editionWhy must be non-empty text`];
+}
+
+const slotEvidencePathValid = (value) => relPath(value) && /^[^\s]+$/.test(value);
+
+function slotEvidenceRefValid(ref) {
+  if (typeof ref === 'string') return slotEvidencePathValid(ref);
+  if (!isPlainObject(ref) || !slotEvidencePathValid(ref.path)) return false;
+  if (!Object.keys(ref).every((key) => ['path', 'edition', 'editions'].includes(key))) return false;
+  if (ref.edition !== undefined && !EDITIONS.includes(ref.edition)) return false;
+  if (ref.editions !== undefined && !nonemptyUniqueList(ref.editions, (edition) => EDITIONS.includes(edition))) return false;
+  return ref.edition === undefined || ref.editions === undefined;
+}
+
+const slotEvidenceRefKey = (ref) => typeof ref === 'string' ? ref
+  : JSON.stringify([ref.path, ref.edition, ref.editions]);
+
+function slotCoverageEvidenceProblems(slot, at) {
+  const bad = [];
+  if (slot.templateNa !== undefined && !(typeof slot.templateNa === 'string' && slot.templateNa.trim()))
+    bad.push(`${at}: templateNa must be non-empty text`);
+  if (slot.exemplifiedBy === undefined) return bad;
+  const refs = slot.exemplifiedBy;
+  const valid = Array.isArray(refs) && refs.length > 0 && refs.every(slotEvidenceRefValid)
+    && new Set(refs.map(slotEvidenceRefKey)).size === refs.length;
+  if (!valid) bad.push(`${at}: exemplifiedBy must be unique repository-relative paths or {path, edition? | editions?} references`);
+  return bad;
+}
+
 function slotLiteOverlayProblems(slot, at) {
   if (slot.lite === undefined) return [];
   const ok = isPlainObject(slot.lite) && Object.keys(slot.lite).length && Object.keys(slot.lite).every((key) => LITE_OVERLAY_KEYS.includes(key))
@@ -209,7 +244,7 @@ function slotEntryProblems(slot, at) {
   if (slot.entries !== undefined) {
     const listed = strList(slot.entries) && slot.entries.length > 0 && new Set(slot.entries).size === slot.entries.length && slot.entries.every(relPath);
     if (!listed) bad.push(`${at}: entries must be a non-empty list of unique relative file paths`);
-    else if (typeof slot.path !== 'string' || !slot.path.endsWith('/') || slot.owner === true) bad.push(`${at}: entries belong to a directory slot that is not an owner (they name extra public entries of the owner that holds it)`);
+    else if (typeof slot.path !== 'string' || !slot.path.endsWith('/')) bad.push(`${at}: entries belong to a directory slot (they name its explicit public API files)`);
     else if (Array.isArray(slot.allows) && slot.entries.some((entry) => !slot.allows.includes(entry))) bad.push(`${at}: every entry must be one of the names the slot allows`);
   }
   if (slot.outcomeHome !== undefined && !(slot.outcomeHome === true && typeof slot.path === 'string' && slot.path && !slot.path.endsWith('/'))) bad.push(`${at}: outcomeHome is true and belongs to a file slot (the one file that declares the repository's Outcome union)`);
@@ -328,6 +363,21 @@ const kindPairValid = pair => isPlainObject(pair) && Object.keys(pair).sort(byCo
   && ['from', 'to'].every(side => folderKindsValid(pair[side]));
 const kindRestrictionValid = kinds => isPlainObject(kinds) && Object.keys(kinds).length > 0
   && Object.entries(kinds).every(([target, pair]) => NAME.test(target) && kindPairValid(pair));
+const slotIdsValid = list => strList(list) && list.length > 0 && new Set(list).size === list.length
+  && list.every(id => SLOT_ID.test(id) || RUNTIME_SLOT_ID.test(id));
+const slotRestrictionPairValid = pair => isPlainObject(pair) && Object.keys(pair).join() === 'from' && slotIdsValid(pair.from);
+const slotRestrictionValid = slots => isPlainObject(slots) && Object.keys(slots).length > 0
+  && Object.entries(slots).every(([target, pair]) => NAME.test(target) && slotRestrictionPairValid(pair));
+
+function tierDefinitionProblems(profile, tier, def) {
+  const bad = [];
+  const at = `tiers.${profile}.${tier}`;
+  if (!isPlainObject(def) || !Array.isArray(def.mayImport) || !def.mayImport.every((t) => NAME.test(String(t)))) bad.push(`${at}.mayImport must be a list of tier names`);
+  if (def?.mayImportKinds !== undefined && !kindRestrictionValid(def.mayImportKinds)) bad.push(`${at}.mayImportKinds must map tier names to {from, to} non-empty lists of unique folder kinds`);
+  if (def?.mayImportSlots !== undefined && !slotRestrictionValid(def.mayImportSlots)) bad.push(`${at}.mayImportSlots must map tier names to {from} non-empty lists of unique slot ids`);
+  for (const key of Object.keys(def ?? {})) if (!['mayImport', 'mayImportKinds', 'mayImportSlots', 'acyclic', 'lowerLayerOnly'].includes(key)) bad.push(`${at}.${key} is not a tier field`);
+  return bad;
+}
 
 /** Shape problems of the tier map of one profile. */
 export function tierMapProblems(profile, tiers) {
@@ -335,9 +385,7 @@ export function tierMapProblems(profile, tiers) {
   if (!isPlainObject(tiers) || !Object.keys(tiers).length) return [`tiers.${profile} must be a non-empty map`];
   for (const [tier, def] of Object.entries(tiers)) {
     if (!NAME.test(tier)) bad.push(`tiers.${profile}.${tier} is not a tier name`);
-    if (!isPlainObject(def) || !Array.isArray(def.mayImport) || !def.mayImport.every((t) => NAME.test(String(t)))) bad.push(`tiers.${profile}.${tier}.mayImport must be a list of tier names`);
-    if (def?.mayImportKinds !== undefined && !kindRestrictionValid(def.mayImportKinds)) bad.push(`tiers.${profile}.${tier}.mayImportKinds must map tier names to {from, to} non-empty lists of unique folder kinds`);
-    for (const key of Object.keys(def ?? {})) if (!['mayImport', 'mayImportKinds', 'acyclic', 'lowerLayerOnly'].includes(key)) bad.push(`tiers.${profile}.${tier}.${key} is not a tier field`);
+    bad.push(...tierDefinitionProblems(profile, tier, def));
   }
   return bad;
 }
@@ -347,10 +395,22 @@ function tierFolderKindProblems(manifest, profile, tier, kinds, at) {
   return kinds.filter(kind => !known.has(kind)).map(kind => `${at} names ${kind}, which is not a folder kind of the ${tier} tier`);
 }
 
-/** Kind restrictions narrow an allowed tier edge and name kinds that its source and target slots actually declare. */
+function tierSlotRestrictionProblems(manifest, profile, tier, def) {
+  const bad = [];
+  const known = new Set(manifest.slots.filter(slot => slot.profiles.includes(profile) && slot.tier === tier).map(slot => slot.id));
+  for (const [target, restriction] of Object.entries(def.mayImportSlots ?? {})) {
+    const at = `tiers.${profile}.${tier}.mayImportSlots.${target}`;
+    if (!def.mayImport.includes(target)) bad.push(`${at} restricts a tier that mayImport does not allow`);
+    for (const id of restriction.from) if (!known.has(id)) bad.push(`${at}.from names ${id}, which is not a slot of the ${profile} ${tier} tier`);
+  }
+  return bad;
+}
+
+/** Kind and slot restrictions narrow allowed tier edges and name declared source and target roles. */
 export function tierKindProblems(manifest, profile) {
   const bad = [];
   for (const [tier, def] of Object.entries(manifest.tiers[profile])) {
+    bad.push(...tierSlotRestrictionProblems(manifest, profile, tier, def));
     for (const [target, kinds] of Object.entries(def.mayImportKinds ?? {})) {
       const at = `tiers.${profile}.${tier}.mayImportKinds.${target}`;
       if (!def.mayImport.includes(target)) bad.push(`${at} restricts a tier that mayImport does not allow`);

package/runtime/scripts/hfs/project-rule.mjs

@@ -3,6 +3,8 @@
 // A project rule judges nothing itself: the graph (the architecture machine's module graph and slot manifest, built once per
 // process) holds the findings of its codes, and the rule reports those of the file it is visiting, on the line the machine named.
 // `settings.starci.injectedTypeScript` is a fixtures-only seam, a function returning the compiler (RuleTester freezes settings, and a frozen compiler cannot run).
+// `settings.starci.injectedRuntimeRoot` is the second fixtures-only seam: a directory holding knowledge/hfs/slots.yaml that stands in for the shipped runtime, so a hermetic
+// fixture can hand the registered rule a manifest with a gap (two slots of equal specificity) that the shipped manifest, guarded by its specs, never has.
 // Both lint canons ship a byte copy of this file in runtime/ and build their rules with it.
 import path from 'node:path';
 import { projectGraph } from './project-graph.mjs';
@@ -22,7 +24,7 @@ export const projectRule = ({ enforcer, runtimeRoot, hfsOf }) => {
       const hfs = hfsOf(context);
       const rel = posixPath(path.relative(hfs.repoRoot, context.filename));
       if (rel.startsWith('..')) return {};
-      const { byFile } = projectGraph({ repoRoot: hfs.repoRoot, runtimeRoot, injectedTypeScript: context.settings?.starci?.injectedTypeScript?.() });
+      const { byFile } = projectGraph({ repoRoot: hfs.repoRoot, runtimeRoot: context.settings?.starci?.injectedRuntimeRoot ?? runtimeRoot, injectedTypeScript: context.settings?.starci?.injectedTypeScript?.() });
       const mine = (byFile.get(rel) ?? []).filter((finding) => belongsTo(enforcer, finding));
       return {
         Program(node) {

package/runtime/scripts/hfs/rule-catalog.mjs

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
 import { parseYamlCached } from '../lib/yaml-cached.mjs';
+import { jsonClone } from '../lib/json-clone.mjs';
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { SEMVER } from './manifest-shape.mjs';
 import { enforcerJudgedInEdition, judgedInEdition, ruleEditionProblems } from './edition-slots.mjs';
@@ -15,10 +16,129 @@ const RULE_KINDS = Object.freeze(['codemod', 'lint', 'check', 'design']);
 const FINDING_CODE = /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/;
 const ENFORCER_ID = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const FILE_ENFORCERS = new Set(['machine', 'hfs', 'work-validate', 'sonar', 'runtime']);
-const RULE_KEYS = new Set(['id', 'code', 'law', 'scope', 'kinds', 'gates', 'failureCodes', 'editions', 'enforcers', 'cases']);
-const CASE_KEYS = new Set(['id', 'date', 'source', 'ruling', 'quote']);
+const RULE_KEYS = new Set(['id', 'code', 'law', 'scope', 'kinds', 'gates', 'failureCodes', 'editions', 'codeEditions', 'enforcers', 'cases', 'docs', 'exemplifiedBy', 'proves', 'witness', 'editionWhy', 'amendedBy', 'templateNa']);
+const CASE_KEYS = new Set(['id', 'date', 'source', 'ruling', 'quote', 'supersedes', 'status', 'staleWhen', 'amendedBy']);
 const CASE_DATE = /^\d{4}-\d{2}-\d{2}$/;
-const ENFORCER_KEYS = new Set(['kind', 'id', 'status', 'at', 'editions']);
+const ENFORCER_KEYS = new Set(['kind', 'id', 'status', 'at', 'editions', 'editionWhy']);
+const CASE_REFERENCE = /^(?:case-[1-9][0-9]*|(?:ruling:)?R[0-9]{2,3}(?:\/case-[1-9][0-9]*)?|owner:[a-z][a-z0-9]*(?:-[a-z0-9]+)*)$/;
+const EVIDENCE_KEYS = new Set(['path', 'edition', 'editions']);
+const PROOF_KEYS = new Set([...EVIDENCE_KEYS, 'codes', 'fixtures']);
+const WITNESS_KEYS = new Set(['edition', 'base', 'mutate', 'expect']);
+const MUTATION_KEYS = new Set(['op', 'path', 'content']);
+
+function textProblem(value, label, bad) {
+  if (typeof value !== 'string' || !value.trim()) bad.push(`${label} must be non-empty text`);
+}
+
+function dateProblem(value, label, bad) {
+  const date = typeof value === 'string' && CASE_DATE.test(value) ? new Date(`${value}T00:00:00Z`) : null;
+  if (!date || !Number.isFinite(date.getTime()) || date.toISOString() !== `${value}T00:00:00.000Z`) bad.push(`${label} must be a valid YYYY-MM-DD date`);
+}
+
+function relativePathProblem(value, label, bad, anchor = false) {
+  const parts = typeof value === 'string' ? value.split('#') : [];
+  const file = parts[0];
+  const valid = typeof value === 'string' && value.trim() === value && value.length > 0
+    && !/[\r\n\u0000\\]/.test(value) && !/^(?:\/|[a-z][a-z0-9+.-]*:)/i.test(value) && !file.includes(':')
+    && !file.split('/').some((part) => ['', '.', '..'].includes(part))
+    && (parts.length === 1 || (anchor && parts.length === 2 && /^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(parts[1])));
+  if (!valid) bad.push(`${label} must be a repository-relative path${anchor ? ' with an optional #anchor' : ''}`);
+}
+
+function unknownKeys(item, allowed, label, bad) {
+  for (const key of Object.keys(item)) if (!allowed.has(key)) bad.push(`${label} has unknown key ${key}`);
+}
+
+function nonEmptyList(value, label, bad) {
+  if (!Array.isArray(value) || !value.length) { bad.push(`${label} must be a non-empty list`); return false; }
+  const normalized = value.map((value) => JSON.stringify(value, (_key, item) => isPlainObject(item) ? Object.fromEntries(Object.keys(item).sort().map((key) => [key, item[key]])) : item));
+  if (new Set(normalized).size !== value.length) bad.push(`${label} repeats a value`);
+  return true;
+}
+
+function optionalText(item, key, label, bad) {
+  if (item[key] !== undefined) textProblem(item[key], `${label}.${key}`, bad);
+}
+
+function evidenceEditionProblems(item, label, bad) {
+  if (item.edition !== undefined && !['full', 'lite'].includes(item.edition)) bad.push(`${label}.edition must be full or lite`);
+  bad.push(...ruleEditionProblems(item, label));
+  if (item.edition !== undefined && item.editions !== undefined) bad.push(`${label} names edition or editions, not both`);
+}
+
+function codeListProblems(codes, label, bad) {
+  if (!nonEmptyList(codes, label, bad)) return;
+  for (const code of codes) if (typeof code !== 'string' || !FINDING_CODE.test(code)) bad.push(`${label} must contain UPPER_SNAKE finding codes`);
+}
+
+function evidenceMapProblems(item, key, label, bad) {
+  unknownKeys(item, key === 'docs' ? EVIDENCE_KEYS : PROOF_KEYS, label, bad);
+  relativePathProblem(item.path, `${label}.path`, bad, key === 'docs');
+  evidenceEditionProblems(item, label, bad);
+  if (item.codes !== undefined) codeListProblems(item.codes, `${label}.codes`, bad);
+  if (item.fixtures !== undefined && nonEmptyList(item.fixtures, `${label}.fixtures`, bad)) item.fixtures.forEach((value) => textProblem(value, `${label}.fixtures`, bad));
+}
+
+function evidenceProblems(rule, key, label, bad) {
+  if (rule[key] === undefined || !nonEmptyList(rule[key], `${label}.${key}`, bad)) return;
+  rule[key].forEach((item, index) => {
+    const at = `${label}.${key}[${index}]`;
+    if (typeof item === 'string') { relativePathProblem(item, at, bad, key === 'docs'); return; }
+    if (!isPlainObject(item)) { bad.push(`${at} must be a path or a map`); return; }
+    evidenceMapProblems(item, key, at, bad);
+  });
+}
+
+function mutationProblems(item, label, bad) {
+  if (!isPlainObject(item)) { bad.push(`${label} must be a map`); return; }
+  unknownKeys(item, MUTATION_KEYS, label, bad);
+  if (!['add', 'edit', 'delete'].includes(item.op)) bad.push(`${label}.op must be add, edit or delete`);
+  relativePathProblem(item.path, `${label}.path`, bad);
+  if (['add', 'edit'].includes(item.op) && typeof item.content !== 'string') bad.push(`${label}.content must be text for add or edit`);
+  if (item.op === 'delete' && item.content !== undefined) bad.push(`${label}.content is absent for delete`);
+}
+
+function witnessEntryProblems(item, label, bad) {
+  if (!isPlainObject(item)) { bad.push(`${label} must be a map`); return; }
+  if (Object.hasOwn(item, 'path')) { evidenceMapProblems(item, 'proves', label, bad); return; }
+  unknownKeys(item, WITNESS_KEYS, label, bad);
+  if (!['full', 'lite'].includes(item.edition)) bad.push(`${label}.edition must be full or lite`);
+  relativePathProblem(item.base, `${label}.base`, bad);
+  codeListProblems(item.expect, `${label}.expect`, bad);
+  if (nonEmptyList(item.mutate, `${label}.mutate`, bad)) item.mutate.forEach((mutation, index) => mutationProblems(mutation, `${label}.mutate[${index}]`, bad));
+}
+
+function witnessProblems(rule, label, bad) {
+  const value = rule.witness;
+  if (value === undefined) return;
+  const at = `${label}.witness`;
+  if (isPlainObject(value)) {
+    unknownKeys(value, new Set(['status', 'reason', 'date']), at, bad);
+    if (value.status !== 'unreachable') bad.push(`${at}.status must be unreachable`);
+    textProblem(value.reason, `${at}.reason`, bad);
+    dateProblem(value.date, `${at}.date`, bad);
+    return;
+  }
+  if (!nonEmptyList(value, at, bad)) return;
+  value.forEach((item, index) => witnessEntryProblems(item, `${at}[${index}]`, bad));
+}
+
+function caseReferenceProblems(value, label, bad) {
+  const values = Array.isArray(value) ? value : [value];
+  if (!nonEmptyList(values, label, bad)) return;
+  for (const ref of values) if (typeof ref !== 'string' || !CASE_REFERENCE.test(ref)) bad.push(`${label} must name case-N, R<id>[/case-N], ruling:R<id>[/case-N] or owner:<id>`);
+}
+
+function caseTransitionProblems(item, label, bad) {
+  if (item.status !== undefined && !['live', 'superseded', 'amended'].includes(item.status)) bad.push(`${label}.status must be live, superseded or amended`);
+  for (const key of ['supersedes', 'amendedBy']) if (item[key] !== undefined) caseReferenceProblems(item[key], `${label}.${key}`, bad);
+  if (item.staleWhen !== undefined && nonEmptyList(item.staleWhen, `${label}.staleWhen`, bad)) {
+    for (const pattern of item.staleWhen) {
+      if (typeof pattern !== 'string' || !pattern.trim()) { bad.push(`${label}.staleWhen must contain non-empty regex strings`); continue; }
+      try { new RegExp(pattern, 'i'); } catch { bad.push(`${label}.staleWhen has an invalid regex ${JSON.stringify(pattern)}`); }
+    }
+  }
+}
 
 function vocabularyProblems(catalog, key, names, bad) {
   if (!isPlainObject(catalog[key])) { bad.push(`${key} must be a map`); return; }
@@ -75,13 +195,15 @@ function checkRuleCases(rule, label, bad) {
     if (typeof item.date !== 'string' || !CASE_DATE.test(item.date)) bad.push(`${at}.date must be YYYY-MM-DD`);
     if (item.source !== 'owner') bad.push(`${at}.source must be owner`);
     for (const key of ['ruling', ...(item.quote === undefined ? [] : ['quote'])]) if (typeof item[key] !== 'string' || !item[key].trim()) bad.push(`${at}.${key} must be text`);
+    caseTransitionProblems(item, at, bad);
   });
 }
 
-function checkRuleGates(label, gates, bad) {
+function checkRuleGates(rule, label, gates, bad) {
   if (!gates.length) return;
-  if (!gates.includes('land')) bad.push(`${label} must run at the land gate (every rule does)`);
-  if (gates.includes('pre-commit') && !gates.includes('pre-push')) bad.push(`${label} runs at pre-commit, so it also runs at pre-push`);
+  const releaseGate = gates.includes('land') || gates.includes('ci');
+  const runtimeGate = rule.scope === 'runtime' && gates.includes('runtime');
+  if (!releaseGate && !runtimeGate) bad.push(`${label} must run at land or ci or, for runtime scope, the runtime gate`);
 }
 
 function checkRuleFailureCodes(rule, label, codeOwner, bad) {
@@ -97,6 +219,19 @@ function checkRuleFailureCodes(rule, label, codeOwner, bad) {
   }
 }
 
+function checkCodeEditions(rule, label, bad) {
+  const value = rule.codeEditions;
+  if (value === undefined) return;
+  if (!isPlainObject(value) || !Object.keys(value).length) { bad.push(`${label}.codeEditions must be a non-empty map`); return; }
+  const editions = Array.isArray(rule.editions) ? rule.editions : ['full', 'lite'];
+  for (const [code, selected] of Object.entries(value)) {
+    const at = `${label}.codeEditions.${code}`;
+    if (!Array.isArray(rule.failureCodes) || !rule.failureCodes.includes(code)) bad.push(`${at} must name a code owned by this rule`);
+    enumListProblems({ editions: selected }, at, 'editions', ['full', 'lite'], bad);
+    if (Array.isArray(selected) && selected.some((edition) => !editions.includes(edition))) bad.push(`${at} must be a subset of the rule's editions`);
+  }
+}
+
 function checkEnforcerIdentity(enforcer, label, seen, bad) {
   if (!ENFORCER_FAMILIES.includes(enforcer.kind)) bad.push(`${label}.kind must be one of ${ENFORCER_FAMILIES.join(', ')}`);
   if (!ENFORCER_ID.test(String(enforcer.id))) bad.push(`${label}.id must be kebab-case`);
@@ -119,6 +254,7 @@ function checkEnforcer(enforcer, index, ruleLabel, seen, bad) {
     if (!ENFORCER_KEYS.has(key)) bad.push(`${label} has unknown key ${key}`);
   }
   bad.push(...ruleEditionProblems(enforcer, label));
+  optionalText(enforcer, 'editionWhy', label, bad);
   checkEnforcerIdentity(enforcer, label, seen, bad);
   if (enforcer.status !== undefined && enforcer.status !== 'planned') bad.push(`${label}.status is either absent or planned`);
   checkEnforcerLocation(enforcer, label, bad);
@@ -140,11 +276,17 @@ function checkRule(rule, index, catalog, codeOwner, bad) {
   checkRuleIdentity(rule, index, catalog, at, label, bad);
   checkRuleText(rule, label, bad);
   checkRuleCases(rule, label, bad);
+  if (rule.amendedBy !== undefined) caseReferenceProblems(rule.amendedBy, `${label}.amendedBy`, bad);
+  optionalText(rule, 'editionWhy', label, bad);
+  optionalText(rule, 'templateNa', label, bad);
+  for (const key of ['docs', 'exemplifiedBy', 'proves']) evidenceProblems(rule, key, label, bad);
+  witnessProblems(rule, label, bad);
   enumListProblems(rule, label, 'kinds', RULE_KINDS, bad);
   bad.push(...ruleEditionProblems(rule, label));
   const gates = enumListProblems(rule, label, 'gates', RULE_GATES, bad);
-  checkRuleGates(label, gates, bad);
+  checkRuleGates(rule, label, gates, bad);
   checkRuleFailureCodes(rule, label, codeOwner, bad);
+  checkCodeEditions(rule, label, bad);
   checkRuleEnforcers(rule, label, bad);
   if (Array.isArray(rule.gates)) {
     const hasSonar = rule.enforcers.some((enforcer) => isPlainObject(enforcer) && enforcer.kind === 'sonar');
@@ -183,15 +325,18 @@ export function loadRuleCatalog({ root = skillRoot, file = path.join(root, HFS_R
   const byCode = new Map(list.flatMap((rule) => rule.failureCodes.map((code) => [code, rule])));
   return Object.freeze({
     version: doc.version, major, minor, patch,
-    gates: deepFreeze(structuredClone(doc.gates)),
-    enforcerKinds: deepFreeze(structuredClone(doc.enforcerKinds)),
+    gates: deepFreeze(jsonClone(doc.gates)),
+    enforcerKinds: deepFreeze(jsonClone(doc.enforcerKinds)),
     rules: list,
     /** The rule with this id (R01..), or null. */
     rule: (id) => byId.get(id) ?? null,
     /** The rule that owns this failure code (its own or a sub-check code), or null. */
     byCode: (code) => byCode.get(code) ?? null,
-    /** Whether a finding code is judged under `edition`: a code of a rule that names `editions` without it is not (a code outside the catalog always is). */
-    judgedIn: (code, edition = 'full') => judgedInEdition(byCode.get(code), edition),
+    /** Whether a finding code is judged under `edition`: codeEditions narrows its owner's editions; uncatalogued codes remain judged. */
+    judgedIn: (code, edition = 'full') => {
+      const owner = byCode.get(code);
+      return judgedInEdition(owner, edition) && (!owner?.codeEditions?.[code] || owner.codeEditions[code].includes(edition));
+    },
     enforcerJudgedIn: (kind, id, edition = 'full') => enforcerJudgedInEdition(list, kind, id, edition),
     /** The rules that run at a gate. */
     forGate: (gate) => list.filter((rule) => rule.gates.includes(gate)),

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -4,22 +4,33 @@
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { paramNamesOk } from './param-names.mjs';
 import { kindParamProblems, scenarioProblem } from './declaration-slots.mjs';
-import { roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
-import { byCodeUnit } from '../lib/list.mjs';
+import { NAME, roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
+import { byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
 
 const PROFILES = ['be', 'fe'];
 const BE_OWN = ['infraOwners', 'eventBus', 'specDoubles', 'paramNames', 'suffixes', 'bannedSuffixes', 'contractShape', 'unitRoles', 'logicRoles', 'thinRoles', 'patternScenarios', 'kindPatterns', 'addKinds'];
 const FORM_NAMES = new Set(['call', 'new', 'curried', 'object', 'primitive', 'array']);
 const blockOk = (v) => isPlainObject(v) && Number.isInteger(v.lines) && v.lines >= 2 && Number.isInteger(v.tokens) && v.tokens >= 1 && Object.keys(v).length === 2;
 const fileLinesOk = (v) => isPlainObject(v) && Number.isInteger(v.soft) && v.soft >= 1 && typeof v.hardGrowth === 'boolean' && Object.keys(v).length === 2;
-const sharedParam = (key, v) => (key === 'fileLines' ? fileLinesOk(v) : blockOk(v));
-const sideOk = (side, own, extra = []) => own.every((k) => side[k] !== undefined) && Object.entries(side).every(([k, v]) => own.includes(k) || extra.includes(k) || (['fileLines', 'duplicateBlock'].includes(k) && sharedParam(k, v)));
-const liteOk = (lite, keys) => lite === undefined || (isPlainObject(lite) && Object.keys(lite).length > 0 && Object.keys(lite).every((k) => k !== 'lite' && keys.includes(k)));
+const SHARED_PARAMS = {
+  fileLines: fileLinesOk,
+  duplicateBlock: blockOk,
+  functionLines: v => Number.isInteger(v) && v >= 1,
+  featureFiles: v => Number.isInteger(v) && v >= 1,
+};
+const SHARED_KEYS = Object.keys(SHARED_PARAMS);
+const sharedParam = (key, v) => Object.hasOwn(SHARED_PARAMS, key) && SHARED_PARAMS[key](v);
+const sideOk = (side, own, extra = []) => own.every((k) => side[k] !== undefined) && Object.entries(side).every(([k, v]) => own.includes(k) || extra.includes(k) || sharedParam(k, v));
+const liteKeyOk = (lite, key, keys) => key !== 'lite' && keys.includes(key)
+  && (!['functionLines', 'featureFiles'].includes(key) || sharedParam(key, lite[key]));
+const liteOk = (lite, keys) => lite === undefined || (isPlainObject(lite) && Object.keys(lite).length > 0 && Object.keys(lite).every((k) => liteKeyOk(lite, k, keys)));
 const memberMap = (v, allowEmpty) => isPlainObject(v) && Object.keys(v).length > 0 && Object.values(v).every((list) => Array.isArray(list) && (allowEmpty || list.length > 0) && list.every((x) => /^[A-Z][A-Za-z0-9]*$/.test(String(x))) && new Set(list).size === list.length);
-const roleList = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => /^[a-z][a-z0-9-]*$/.test(String(x))) && new Set(v).size === v.length;
+const roleList = (v) => nonemptyUniqueList(v, (role) => NAME.test(String(role)));
 const formsOk = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => FORM_NAMES.has(x)) && new Set(v).size === v.length;
 const doubleOk = (v) => isPlainObject(v) && /^[A-Za-z][A-Za-z0-9]*$/.test(String(v.double)) && formsOk(v.forms);
 const regexOk = (v) => { try { return typeof v === 'string' && v.length > 0 && Boolean(new RegExp(v)); } catch { return false; } };
+const dbExtensionsOk = (value) => Array.isArray(value) && value.every((name) => typeof name === 'string' && name.length > 0) && new Set(value).size === value.length;
+const dbParamsOk = (db) => db === undefined || (isPlainObject(db) && Object.entries(db).every(([key, value]) => key === 'extensions' && dbExtensionsOk(value)));
 
 function beSpecificProblems(be, manifest) {
   const bad = [];
@@ -43,14 +54,15 @@ function beSpecificProblems(be, manifest) {
 export function ruleParamsProblems(m) {
   const bad = [];
   const rp = m.ruleParams;
-  if (!isPlainObject(rp) || Object.keys(rp).some((k) => ![...PROFILES, 'common'].includes(k)) || !isPlainObject(rp.common) || !isPlainObject(rp.be) || (rp.fe !== undefined && !isPlainObject(rp.fe))) return ['ruleParams must be a map with common, be and optionally fe'];
+  if (!isPlainObject(rp) || Object.keys(rp).some((k) => ![...PROFILES, 'common', 'db'].includes(k)) || !isPlainObject(rp.common) || !isPlainObject(rp.be) || (rp.fe !== undefined && !isPlainObject(rp.fe))) return ['ruleParams must be a map with common, be and optionally fe and db'];
   else {
     // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
     // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
-    if (Object.keys(rp.common).length !== 2 || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs exactly fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}');
-    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, 'fileLines', 'duplicateBlock', 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns and addKinds (fileLines and duplicateBlock live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
+    if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
+    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns and addKinds (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
     bad.push(...beSpecificProblems(rp.be, m));
-    if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, ['fileLines', 'duplicateBlock']))) bad.push('ruleParams.fe may only restate fileLines and duplicateBlock of ruleParams.common, and carry a lite override of them');
+    if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS))) bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
+    if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions: a list of unique non-empty extension names');
   }
   return bad;
 }

package/runtime/scripts/hfs/rules/secrets.mjs

@@ -66,3 +66,16 @@ export function secretFindings({ repoRoot, files, resolver }) {
   }
   return findings;
 }
+
+// The age identity stays on the host: `.claude/secret.env` (SOPS_AGE_KEY) or the sops config dir's `keys.txt`,
+// both host-local files. A tracked `secret.env`, `keys.txt` or `*.agekey` is the identity committed.
+const AGE_KEY_FILE = /^\.claude\/secret\.env$|(?:^|\/)keys\.txt$|\.agekey$/i;
+export function ageKeyCustodyFindings({ files, inScope }) {
+  const findings = [];
+  for (const file of files.filter((f) => !inScope || inScope(f))) {
+    if (!AGE_KEY_FILE.test(file)) continue;
+    findings.push(found('HFS_AGE_KEY_CUSTODY', file,
+      `${file} is a tracked sops/age identity file; the age key lives only in the host-local .claude/secret.env or the sops keys.txt - never commit the identity`));
+  }
+  return findings;
+}

package/runtime/scripts/hfs/slot-imports.mjs

@@ -2,9 +2,14 @@
 // owner units, the layer order and the public entry of an owner. Cycles are a graph property of the architecture check, not of one edge.
 import { RUNTIME_KIND } from './manifest-shape.mjs';
 import { classifyIn, ownerIn, tierIn } from './slot-classify.mjs';
+import { braceVariants, globExpression } from '../lib/glob.mjs';
 
 const isEntryFile = (name) => name === 'index.ts' || name === 'index.tsx';
 
+function declaredEntry(slot, relative) {
+  return (slot.entries ?? []).some(entry => braceVariants(entry).some(pattern => globExpression(pattern).test(relative)));
+}
+
 function unownedPathProblem(from, to) {
   for (const side of [from, to]) {
     if (side.status === 'no-slot') return { allowed: false, reason: 'unowned', code: side.code, path: side.path, nearest: side.nearest };
@@ -39,12 +44,22 @@ function privateEntryProblem({ repo, byId }, to, toOwner) {
   if (toOwner && repo.kind !== RUNTIME_KIND) {
     const relative = to.path === toOwner.root ? '' : to.path.slice(toOwner.root.length + 1);
     const ownerSlot = byId.get(toOwner.slot);
-    const entry = isEntryFile(relative) || (byId.get(to.slot).entries ?? []).includes(to.path.slice(to.root.length + 1)) || (ownerSlot.tier === 'package' && relative === 'src/index.ts') || (ownerSlot.tier === 'app' && relative === 'app.module.ts');
+    const entry = isEntryFile(relative) || declaredEntry(byId.get(to.slot), to.path.slice(to.root.length + 1)) || (ownerSlot.tier === 'package' && relative === 'src/index.ts') || (ownerSlot.tier === 'app' && relative === 'app.module.ts');
     if (!entry) return { allowed: false, reason: 'notPublicEntry', owner: toOwner.root, path: to.path };
   }
   return null;
 }
 
+function tierImportProblem(scope, from, to, fromTier, toTier) {
+  const { mayImport, mayImportKinds, mayImportSlots } = scope.manifest.tiers[scope.profile][fromTier] ?? {};
+  if (!mayImport?.includes(toTier)) return { allowed: false, reason: 'tierDirection', fromTier, toTier, mayImport: mayImport ?? [] };
+  const kindRestriction = mayImportKinds?.[toTier];
+  if (kindRestriction && (!kindRestriction.from.includes(from.kind) || !kindRestriction.to.includes(to.kind))) return { allowed: false, reason: 'tierDirection', fromTier, toTier, mayImport, kindRestriction, fromKind: from.kind ?? null, toKind: to.kind ?? null };
+  const slotRestriction = mayImportSlots?.[toTier];
+  if (slotRestriction && !slotRestriction.from.includes(from.slot)) return { allowed: false, reason: 'tierDirection', fromTier, toTier, mayImport, slotRestriction, fromSlot: from.slot };
+  return null;
+}
+
 /**
  * Whether `fromPath` may import `toPath`: {allowed, reason, ...}. Reasons: sameOwner, untiered, crossApp,
  * tierDirection, layerOrder, notPublicEntry, allowed, slotForbidden, slotNotEnabled, slotAmbiguous, and unowned (HFS_SLOT_UNDECLARED for the path no slot owns).
@@ -65,10 +80,8 @@ export function importAllowedIn(scope, fromPath, toPath) {
   const fromOwner = ownerIn(scope, from.path);
   const toOwner = ownerIn(scope, to.path);
   if (sameOwnerUnit(from, fromOwner) === sameOwnerUnit(to, toOwner)) return { allowed: true, reason: 'sameOwner' };
-  const { mayImport, mayImportKinds } = scope.manifest.tiers[scope.profile][fromTier] ?? {};
-  if (!mayImport?.includes(toTier)) return { allowed: false, reason: 'tierDirection', fromTier, toTier, mayImport: mayImport ?? [] };
-  const kindRestriction = mayImportKinds?.[toTier];
-  if (kindRestriction && (!kindRestriction.from.includes(from.kind) || !kindRestriction.to.includes(to.kind))) return { allowed: false, reason: 'tierDirection', fromTier, toTier, mayImport, kindRestriction, fromKind: from.kind ?? null, toKind: to.kind ?? null };
+  const tierProblem = tierImportProblem(scope, from, to, fromTier, toTier);
+  if (tierProblem) return tierProblem;
   const layerProblem = lowerLayerProblem(scope, from, to, fromTier, toTier, fromOwner, toOwner);
   if (layerProblem) return layerProblem;
   // A runtime owner is imported file by file (crossOwner of knowledge/hfs/runtime-slots.yaml): no public entry.

package/runtime/scripts/hfs/slots.mjs

@@ -119,6 +119,7 @@ function sideDeclaration(manifest, declaration, name, edition, providers) {
     connections: Object.freeze((s.connections ?? []).map(connectionView)),
     providers,
     reads: Object.freeze([...(s.reads ?? [])]),
+    ...(s.extraPackages === undefined ? {} : { extraPackages: Object.freeze(s.extraPackages.map(entry => Object.freeze({ ...entry }))) }),
     manifestVersion: manifest.version,
   });
 }