@starci/hfs 4.0.10 → 4.2.0

package/runtime/knowledge/hfs/rules.yaml

@@ -1,4 +1,4 @@
-# knowledge/hfs/rules.yaml - the machine-readable catalog of the HFS rules (the ids run R01 up; an id with no rule is listed under `retired` with its reason, never reused; count the rules, never type the count).
+# knowledge/hfs/rules.yaml - the machine-readable catalog of the HFS rules (count the rules, never type the count).
 #
 # One entry per rule: its id, its finding code, the law in one line, how a violation is fixed
 # (`kinds`), the gates it runs at, the failure codes it reports, and every enforcer that judges it. The prose of each
@@ -21,7 +21,7 @@ version: 2.0.0
 gates:
   pre-commit: the managed .husky/pre-commit at the app root - starci app hygiene (staged .starciwork and .starcistacks paths, secrets guard), typecheck, ESLint per side and stylelint on the staged files, prettier --check, the unit specs the staged files touch
   pre-push: typecheck, lint (starci app lint), format:check and the unit specs affected since origin/main; runs every pre-commit rule again
-  settle: the op gate scripts/gates/gate.mjs over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
+  settle: the op gate `starci gate run` over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
   land: the workflow's finish, the only time main is touched - gate.mjs over the whole workflow branch against its merge-base with main, the merge guard, review.verify of the exact head that lands, the branch rebased onto main, then main fast-forwarded and pushed
   ci: GitHub Actions runs the same pinned starci app lint, format:check, typecheck, unit with the per-file coverage threshold, build:be and build:fe, then the Sonar scan and gate
   sonar: Sonar quality gate (knowledge/sonar-gate.yaml) - the imported lint findings, duplication, cognitive complexity and the coverage of the logic of be/src/modules at 100
@@ -101,14 +101,6 @@ rules:
     failureCodes: ["HFS_AGENT_DATA_TRACKED"]
     enforcers:
       - {kind: work-validate, id: agent-data-tracked, at: scripts/work/validate/check-example-work.mjs}
-  - id: R08
-    code: "HFS_WORK_NODE_RETIRED"
-    law: "Only flat family records, never `work/node`."
-    kinds: [check, codemod]
-    gates: [settle, land, ci]
-    failureCodes: ["HFS_WORK_NODE_RETIRED"]
-    enforcers:
-      - {kind: work-validate, id: work-node-retired, at: scripts/work/validate/check-example-work.mjs}
   - id: R09
     code: "HFS_IDENTITY_CUSTODY"
     law: "An identity points its secret at `secrets/identity-<slug>.enc`; UAT chooses by role."
@@ -483,7 +475,7 @@ rules:
     editions: [full]
     enforcers:
       - {kind: hfs, id: test-topology, at: scripts/hfs/rules/test-topology.mjs}
-      - {kind: machine, id: test-kind-retired, at: scripts/hfs/architecture/hfs.mjs}
+      - {kind: machine, id: test-kind-unsupported, at: scripts/hfs/architecture/hfs.mjs}
       - {kind: eslint-be, id: test-world-files}
       - {kind: machine, id: contract-fixture-guard, at: scripts/hfs/architecture/contract-fixture-guard.mjs}
       - {kind: eslint-be, id: unit-test-colocated}
@@ -1232,15 +1224,6 @@ rules:
     failureCodes: ["RT_SOURCE_NAME"]
     enforcers:
       - {kind: runtime, id: source-name, at: scripts/hfs/runtime-rules/source-name.mjs}
-  - id: R120
-    code: "RT_RETIRED_PRESENT"
-    law: "No path of retired[] and no `from` of moved[] in modules/kernel/retired-paths.yaml is tracked again, and no symbol of its retiredSymbols[] is declared in runtime production code."
-    scope: runtime
-    kinds: [check]
-    gates: [land, runtime]
-    failureCodes: ["RT_RETIRED_PRESENT"]
-    enforcers:
-      - {kind: runtime, id: retired-present, at: scripts/hfs/runtime-rules/retired.mjs}
   - id: R121
     code: "RT_GENERATED_DRIFT"
     law: "A generated root of ruleParams.runtime.generated is git-ignored output of its declared generatedBy: the repo's check regenerates every root, the runtime copies (packages/hfs/runtime, packages/eslint/be/runtime, packages/eslint/fe/runtime) are judged equal to what scripts/hfs/sync-runtime.mjs writes from the single source, and no git-tracked path lies under a generated root."
@@ -1253,7 +1236,7 @@ rules:
       - {kind: runtime, id: generated-untracked, at: scripts/hfs/runtime-rules/generated-untracked.mjs}
   - id: R122
     code: "RT_CITED_PATH_MISSING"
-    law: "A runtime path cited by live prose or contracts (modules, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; a retired or moved path is cited only by history."
+    law: "A runtime path cited by live prose or contracts (modules, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; history (a changelog, a benchmark file) is not read."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1262,13 +1245,13 @@ rules:
       - {kind: runtime, id: cited-path, at: scripts/checks/check-contract-cites.mjs}
   - id: R124
     code: "RT_PINNED_PATH_MOVED"
-    law: "A pinned path of ruleParams.runtime.pinned (persisted outside git) exists, or moved through a modules/kernel/retired-paths.yaml moved[] entry marked quiesced: true, landed with the workers stopped."
+    law: "A pinned path of ruleParams.runtime.pinned (persisted outside git) exists."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
     failureCodes: ["RT_PINNED_PATH_MOVED"]
     enforcers:
-      - {kind: runtime, id: pinned-path, at: scripts/hfs/runtime-rules/retired.mjs}
+      - {kind: runtime, id: pinned-path, at: scripts/hfs/runtime-rules/pinned.mjs}
   - id: R125
     code: "RT_NODE_MODULES_LINK"
     law: "No runtime source creates a junction or a symlink for a node_modules folder, through node:fs (symlink, symlinkSync, directly or through a local wrapper) or a spawned link command (mklink /J or /D, New-Item -ItemType Junction or SymbolicLink, ln -s): every checkout installs its own dependencies with a real npm ci from the cache."
@@ -1736,11 +1719,11 @@ rules:
       - {kind: runtime, id: facts, at: scripts/hfs/runtime-rules/facts.mjs}
   - id: R193
     code: "RT_RULE_ID_UNKNOWN"
-    law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and the ids run from R01 to the last rule with no undeclared gap: an id with no rule is listed under `retired` with its reason (RT_RULE_ID_GAP), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). A retired id is a history name that only changelogs may still spell; specs and generated copies are not read."
+    law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and rule ids are unique and well-formed (a gap between two ids is fine), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). History paths (changelogs, benchmark findings, .starciwork records), specs and generated copies are not read."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
-    failureCodes: ["RT_RULE_ID_UNKNOWN", "RT_RULE_ID_GAP", "RT_RULE_UNCITED"]
+    failureCodes: ["RT_RULE_ID_UNKNOWN", "RT_RULE_UNCITED"]
     enforcers:
       - {kind: runtime, id: rule-ids, at: scripts/hfs/runtime-rules/rule-ids.mjs}
   - id: R194
@@ -1754,7 +1737,7 @@ rules:
       - {kind: runtime, id: generated-block, at: scripts/hfs/runtime-rules/generated-block.mjs}
   - id: R195
     code: "RT_PROSE_PATH_NO_SLOT"
-    law: "Every product path the knowledge, the docs and the READMEs name (a be/ or fe/ path, whole or with placeholders, globs and braces) is owned by a slot of knowledge/hfs/slots.yaml or is a folder above one; a path no slot owns is prose that invented a place or kept one a slot no longer has. App names are free: a literal app name is one the examples or the starter declare, a placeholder stands for any; a ** glob and a topic file of the knowledge are not paths."
+    law: "Every product path the knowledge, the docs and the READMEs name (a be/ or fe/ path, whole or with placeholders, globs and braces) is owned by a slot of knowledge/hfs/slots.yaml or is a folder above one; a path no slot owns is prose that invented a place or kept one a slot no longer has. App names are free: a literal app name is one a shipped examples/*/hfs.json declares, a placeholder stands for any; a ** glob and a topic file of the knowledge are not paths."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1770,15 +1753,6 @@ rules:
     failureCodes: ["RT_PROSE_RESTATES_SLOTS"]
     enforcers:
       - {kind: runtime, id: prose-restates, at: scripts/hfs/runtime-rules/prose-restates.mjs}
-  - id: R197
-    code: "RT_RETIRED_CLI_CALL"
-    law: "No tracked file invokes a command the unified CLI removed: the retired kernel, hfs, test-stack and top-level runtime spellings listed in the `removed` fields of the catalog and in the dispatcher table; those fields and changelogs are exempt."
-    scope: runtime
-    kinds: [check]
-    gates: [land, runtime]
-    failureCodes: ["RT_RETIRED_CLI_CALL"]
-    enforcers:
-      - {kind: runtime, id: retired-cli, at: scripts/checks/check-retired-cli.mjs}
   - id: R198
     code: "RT_CLI_CATALOG_DRIFT"
     law: "Every generated output of the unified CLI catalog (packages/cli/src/catalog.generated.mjs, docs/cli.md, packages/cli/completions/*) equals what scripts/cli/gen-catalog.mjs writes from modules/cli/commands."
@@ -1799,7 +1773,7 @@ rules:
       - {kind: runtime, id: cli-parity, at: scripts/checks/check-cli-parity.mjs}
   - id: R200
     code: "RT_CLI_APP_ONLY_TEMPLATES"
-    law: "Managed app templates and their generated runtime copies invoke product actions only through `starci app <verb>`; retired hfs and test-stack commands, and any other starci group, are forbidden there."
+    law: "Managed app templates and their generated runtime copies invoke product actions only through `starci app <verb>`; any other starci group is forbidden there."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1858,15 +1832,6 @@ rules:
     failureCodes: ["RT_EXAMPLE_COUPLING", "RT_PRODUCT_NAME_IN_SOURCE", "RT_HOST_PATH_IN_TEMPLATE"]
     enforcers:
       - {kind: runtime, id: example-coupling, at: scripts/checks/check-example-coupling.mjs}
-  - id: R207
-    code: "RT_RETIRED_NAME_LIVE"
-    law: "A name the retired registry declares dead never appears in a live tracked file — not in prose, a comment, a string literal or a path: every retired[].path and moved[].from of modules/kernel/retired-paths.yaml, and every retiredNames[] naming that is not a path (a deleted app, a layer naming, a verb prefix). History (a changelog, a benchmark finding, a .starciwork record), the registry itself and the files of the check may name what was deleted; a slot manifest's forbids value or forbidden-presence tombstone declares a refusal, not a use."
-    scope: runtime
-    kinds: [check]
-    gates: [land, runtime]
-    failureCodes: ["RT_RETIRED_NAME_LIVE"]
-    enforcers:
-      - {kind: runtime, id: retired-names, at: scripts/checks/check-retired-names.mjs}
   - id: R208
     code: "RT_PORT_RESTATED"
     law: "Every port literal of the runtime is spelled once, by its owner, and every other file references the owner: the harness UI ports live in modules/models/runtimes.yaml statusApp.port/devPort read through ui/ports.mjs, the local SonarQube host in scripts/gates/sonar-local.mjs DEFAULT_HOST. No in-scope file that is not the owner spells an owned literal in a port position (a scheme://host:NNNN or host:NNNN authority, a *port*/PORT assignment, a listen(NNNN) call), and an unowned literal in a port position of two or more runtime source files gets one owning exported constant the rest reference. Specs, tests, node_modules, the generated runtime copies, changelogs, .starciwork and the product stack declarations (.starcistacks, starcistacks-services - a product owns the ports of the services it runs) are out of scope."
@@ -1979,7 +1944,7 @@ rules:
       - {kind: hfs, id: lite-secret-custody, at: scripts/hfs/rules/supabase-secrets.mjs}
   - id: R221
     code: "CI_TRIGGERS_RELEASE_ONLY"
-    law: "The only workflow triggers are a push of release tags and a person dispatching it: every tracked workflow of the runtime, its examples and the hfs app templates (so every scaffolded app inherits it) declares an `on` that holds only `push` filtered to `tags: ['v*']` (no branches, paths or ignore filter beside it) and `workflow_dispatch`. A branch push, a pull_request, a schedule, a workflow_call or any other event refuses the workflow: CI runs once per release, on its tag, and Codecov and Sonar upload only from that run."
+    law: "The only workflow triggers are a push of release tags, a person dispatching it and, in the runtime's own workflows (`.github/workflows/` at the root), a push to `main`: every tracked workflow declares an `on` that holds only `push` filtered to `tags: ['v*']` (and, in the runtime's own workflows, `branches: [main]`; no paths or ignore filter beside them) and `workflow_dispatch`. The examples and the hfs app templates (so every scaffolded app inherits it) take the tag and the dispatch only: an app's CI runs once per release, on its tag. A push to any other branch, a pull_request, a schedule, a workflow_call or any other event refuses the workflow."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -2015,7 +1980,7 @@ rules:
       - {kind: runtime, id: protected-zone, at: scripts/hfs/runtime-rules/rights-policy.mjs}
   - id: R225
     code: "RT_HOOK_SHAPE"
-    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags) and runs no npm test, jest, typecheck or lint."
+    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags; the runtime's own hook is scripts/guards/release-push-gate.mjs, which judges main and v* tags against the release definition and lets every other ref through) and runs no npm test, jest, typecheck or lint."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -2024,7 +1989,7 @@ rules:
       - {kind: runtime, id: hook-shape, at: scripts/hfs/runtime-rules/hook-shape.mjs}
   - id: R226
     code: "RT_SPEC_OVER_BUDGET"
-    law: "Every recorded spec duration should stay within the shared per-file land budget in modules/kernel/spec-durations.yaml: for alpha.4 an over-budget spec is an advisory info finding ranked by its excess (it does not fail the check stage; the budget turns blocking in alpha.5), and every recorded spec path must still exist. An over-budget spec is repaired without removing tests or assertions: share a per-process fixture, remove per-test install or boot, inject the clock and never lengthen a timeout; stale rows are refreshed from the current land record."
+    law: "Every recorded spec duration should stay within the shared per-file land budget in modules/kernel/spec-durations.yaml: an over-budget spec is an advisory info finding ranked by its excess (it does not fail the check stage), and every recorded spec path must still exist. An over-budget spec is repaired without removing tests or assertions: share a per-process fixture, remove per-test install or boot, inject the clock and never lengthen a timeout; stale rows are refreshed from the current land record."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -2040,20 +2005,151 @@ rules:
     failureCodes: ["RT_SYNTAX_INVALID"]
     enforcers:
       - {kind: runtime, id: syntax, at: scripts/hfs/runtime-rules/syntax.mjs}
-retired:
-  - {id: R66, reason: "FE_E2E_SHAPE retired with eslint-canon-fe 7.0.0: a front end has no tests by standard"}
-  - {id: R67, reason: "FE_SPEC_QUALITY retired with eslint-canon-fe 7.0.0: a front end has no tests by standard"}
-  - {id: R123, reason: "RT_PENDING_STALE retired with the pending list itself: ruleParams.runtime.pending and its pending-ratchet enforcer are gone; nothing ratchets a tolerated-finding list"}
-  - {id: R128, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R129, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R130, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R131, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R132, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R133, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R134, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R135, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R136, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R137, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R138, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R139, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R140, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - id: R228
+    code: "RT_IDENTIFIER_UNDECLARED"
+    law: "Every identifier a runtime ES module (scripts/, engine/ without the vendored yaml bundle, ui/api/, packages/cli/bin and src) reads or writes resolves, by scope analysis over its TypeScript syntax tree, to a declaration, import, parameter or Node global of an enclosing scope. A re-export (export {x} from './y.mjs') binds x in no local scope; require, module, exports and __dirname are not globals of a module; browser globals resolve only inside a function that a module hands to page.evaluate, here or through an import. A name a refactor left behind is refused before the line that reads it runs."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_IDENTIFIER_UNDECLARED"]
+    enforcers:
+      - {kind: runtime, id: undeclared-identifiers, at: scripts/checks/check-undeclared-identifiers.mjs}
+  - id: R229
+    code: "RT_REMOVED_VOCABULARY"
+    law: "No text an agent or the owner reads teaches a spelling the runtime refuses. The refused names - config keys, routing-bias fields, verbs, flags, codes and vocabulary - are the one list modules/kernel/removed-vocabulary.yaml, each with its replacement and the release that removed it; the config and routing-bias refusals read the same list. Every tracked file of skills/, docs/, README.md, CONTEXT.md, CONTRIBUTING.md, modules/ and knowledge/ (Markdown and yaml) is scanned line by line, and a line that spells a listed name is a finding naming file:line, the name and its replacement, (and every tests/**/*.spec.mjs, where a name is allowed only on a line or under a test title that says refuse, reject, removed, throws or unknown) unless the file is the list, CHANGELOG.md, or the line or block carries the [removed-list] marker (a marker alone on a comment line covers the lines up to the next blank one). Removing or renaming a key, flag, verb, field or code adds its entry to the list in the same commit."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_REMOVED_VOCABULARY"]
+    enforcers:
+      - {kind: runtime, id: removed-vocabulary, at: scripts/checks/check-removed-vocabulary.mjs}
+  - id: R230
+    code: "RT_PROSE_COMMAND_UNKNOWN"
+    law: "A command an instruction shows exists as written. Every `starci <group> <verb>` in a backticked span, fenced code line or yaml example item of skills/, docs/, README.md, CONTEXT.md, CONTRIBUTING.md and modules/ names a verb of the CLI catalog (modules/cli/commands) in a catalogued group, and every --flag on it is a flag of that verb or a global flag; the text after a lone -- belongs to another program and a [removed-list] marked line is exempt. The catalog is generated into the valid set, never typed twice."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_PROSE_COMMAND_UNKNOWN"]
+    enforcers:
+      - {kind: runtime, id: prose-commands, at: scripts/checks/check-prose-commands.mjs}
+  - id: R231
+    code: "RT_DOCUMENTED_DEFAULT_DRIFT"
+    law: "A default a document states equals the value the code reads. A document states a default by citing its key - default <value> = `<key>` - where the key is a config.yaml path (resolved through the validator's settings reader, so an absent block yields its code default) or <yaml file under modules/>:<dotted path>; the check resolves the key and compares, and a key that resolves to nothing is a finding. docs/, README.md, CONTEXT.md, config.example.yaml and modules/ prose and yaml are scanned; a bare number stated as a default without its key is not judged, so the owner of a default is cited, never retyped."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_DOCUMENTED_DEFAULT_DRIFT"]
+    enforcers:
+      - {kind: runtime, id: documented-defaults, at: scripts/checks/check-documented-defaults.mjs}
+  - id: R232
+    code: "RT_ROLES_CONTRACT_DRIFT"
+    law: "A role is described once. modules/kernel/roles.yaml holds, per role, its scope, what it does, what it must clean up, what it never does, whom it reports to and who oversees it; a Markdown surface of the role carries the block generated from it, a yaml or script surface cites modules/kernel/roles.yaml#<role>, and no surface teaches a spelling the role's contradicts list names."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_ROLES_CONTRACT_DRIFT"]
+    enforcers:
+      - {kind: runtime, id: roles-contract, at: scripts/checks/check-roles-contract.mjs}
+  - id: R233
+    code: "RT_EDGE_CASE_REGISTRY"
+    law: "Every edge case met is a declared entry of modules/reconciler/edge-cases.yaml with its family, its real occurrence and a status of covered or open; a covered entry names the rule that handles it and the spec that reproduces it, and both exist, and an open entry says why."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_EDGE_CASE_REGISTRY"]
+    enforcers:
+      - {kind: runtime, id: edge-case-registry, at: scripts/checks/check-edge-case-registry.mjs}
+  - id: R234
+    code: "RT_SECRET_TRACKED"
+    law: "The runtime repository is public and tracks no secret material, not even ciphertext: no tracked *.enc member and no tracked secret.env or .env file, except the paths ruleParams.runtime.heldSecrets names with their reason (a list that only shrinks). Every secret the host needs lives in the one untracked .claude/secret.env, read only through engine/secrets.mjs, its names listed in the tracked secret.env.example; a product repository keeps its own custody in its own repository. Two Sonar servers, no overlap: SonarCloud serves everything that lives in the runtime repository (the runtime and the example apps, token SONAR_TOKEN), the self-hosted ext/sonar serves product repositories only."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_SECRET_TRACKED"]
+    enforcers:
+      - {kind: runtime, id: secret-tracked, at: scripts/hfs/runtime-rules/secret-tracked.mjs}
+  - id: R235
+    code: "SCAN_SMELL"
+    law: "Code carries none of the smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (S9382; an endless loop is spared), no `charCodeAt`/`fromCharCode` (S7758), no string that only escapes backslashes (S7780; a Next `matcher` is spared, it is read statically), no nested conditional expression (S3358), no `void` on anything but a call (S3735), no unused import (S1128), no import that is only handed on instead of `export ... from` (S7763), no prop of a component's props type the component never reads (S6767, front end), and, through typescript-eslint with type information, no deprecated API (S1874), no object turned into text (S6551) and no `async` function that never awaits and returns no promise (S7503). The files a unit or an end-to-end spec names are outside the scan, so outside these rules."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["SCAN_SMELL"]
+    enforcers:
+      - {kind: eslint-be, id: no-await-in-loop}
+      - {kind: eslint-be, id: prefer-code-point}
+      - {kind: eslint-be, id: prefer-string-raw}
+      - {kind: eslint-be, id: no-nested-conditional}
+      - {kind: eslint-be, id: no-void-operator}
+      - {kind: eslint-be, id: no-unused-import}
+      - {kind: eslint-be, id: prefer-export-from}
+      - {kind: eslint-fe, id: no-await-in-loop}
+      - {kind: eslint-fe, id: prefer-code-point}
+      - {kind: eslint-fe, id: prefer-string-raw}
+      - {kind: eslint-fe, id: no-nested-conditional}
+      - {kind: eslint-fe, id: no-void-operator}
+      - {kind: eslint-fe, id: no-unused-import}
+      - {kind: eslint-fe, id: prefer-export-from}
+      - {kind: eslint-fe, id: no-unused-prop-types}
+  - id: R236
+    code: "RT_GATE_LOOSENING"
+    law: "A change that loosens a gate or check is owner-class: a check removed from a gate file's list, a floor lowered or a ceiling raised there, an allowlist entry added, a spec deleted or weakened or skipped together with product code (modules/kernel/gate-loosening.yaml). It lands, and passes the check, only when the tree it is judged against already holds the owner's approval of exactly that loosening, an owner-rulings entry gate-loosening-<fingerprint>."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_GATE_LOOSENING"]
+    enforcers:
+      - {kind: runtime, id: gate-loosening, at: scripts/checks/check-gate-loosening.mjs}
+  - id: R237
+    code: "RT_REVISION_SCOPE"
+    law: "What a change of the runtime tree asks of each role is declared once, in modules/kernel/revision-scope.yaml: every tracked path matches a row, the engine-loaded files are derived from the import graph of the engine's entries and never hand-listed, the files each seat's launch prompt is built from are the files its generator reads, and a wording-only declaration holds only for an edit that keeps the file's structure."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_REVISION_SCOPE"]
+    enforcers:
+      - {kind: runtime, id: revision-scope, at: scripts/checks/check-revision-scope.mjs}
+  - id: R238
+    code: "RT_EVENT_SPILL_BYPASS"
+    law: "A ledger event payload that grows with its input (a file list, a manifest, a digest, a report, a critique, a menu) goes to the blob store through the one path of appendEvent: engine/db/event-compact.mjs eventPayloadRecord keeps a bounded inline view of at most 16 KiB and the whole payload behind events.payload_sha, and readers resolve it through engine/db/event-payload.mjs. No runtime source file other than engine/db/ledger.mjs and engine/db/event-compact.mjs passes a payloadSha to a write, catches the payload-too-large refusal to spill by hand, or inserts into the events table directly. Specs, tests, node_modules, the generated runtime copies and packages are out of scope."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_EVENT_SPILL_BYPASS"]
+    enforcers:
+      - {kind: runtime, id: event-spill, at: scripts/checks/check-event-spill.mjs}
+  - id: R239
+    code: "RT_STORAGE_UNDECLARED"
+    law: "Content lives as a file in the content-addressed blob store under the runtime state dir (<runtime root>/.runtime/artifacts, engine/db/blob.mjs) and a database row holds only the reference (the sha) plus the small scalars it is queried by (owner ruling 2026-10-09). Always content, whatever its size: a report, a critique or verdict, a prompt or dispatch contract, a read manifest, a list of files, a log or command output, a menu or digest snapshot, an image or render, a diff. What may stay inline: ids, states, timestamps, counts, short codes and one-line reasons up to 256 bytes; any other free text up to 1024 bytes; a payload of any size is class spill (appendEvent and supEvent keep the whole payload behind the sha and a small inline form). Every text column of the product ledger and of machine.sqlite is declared in modules/schemas/storage-convention.yaml with its class (scalar, bounded, reference, spill, migrate), so a new table or column cannot appear without one; a column that holds content inline today is class migrate with its measured size, and the migration to a reference is a proposed runtime step, idempotent and journalled, never a hand rewrite of a live store."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_STORAGE_UNDECLARED"]
+    enforcers:
+      - {kind: runtime, id: storage-convention, at: scripts/checks/check-storage-convention.mjs}
+  - id: R240
+    code: "RT_ROOT_ADHOC"
+    law: "Which directory a component reads or writes is decided in one module, scripts/lib/roots.mjs: the runtime tree, its state directory, the temp root, the invocation directory, the Work directory name, the order in which two trees that can hold the same record are tried (the tree the work happens in first, then the product's main checkout: workDirHolding, workRecordPath) and the order a tool is looked up (the tree the work happens in, then the project, the runtime's own install last: toolSearchDirs). A runtime source file does not resolve a root by itself: it neither spells process.cwd() nor the Work directory name as a literal outside that module more often than the tree the check landed on held it: a file keeps the count it had and only loses it as it is converted, and a new file starts at none. Four times in two days a component read or wrote the wrong tree because it resolved the directory itself."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_ROOT_ADHOC"]
+    enforcers:
+      - {kind: runtime, id: root-adhoc, at: scripts/checks/check-root-adhoc.mjs}
+  - id: R241
+    code: "RT_HELD_UNSURFACED"
+    law: "A failure code the catalogue gives to the Supervisor or the owner as a runtime fault is a state that role must be able to learn of; a stop that nobody is told of stands for hours until someone reads source. Each such entry of modules/kernel/failure-codes.yaml names the house mechanism that reaches its owner (surfacedBy: decision-item, sla-clock, incident, digest, notifier, caller or open) with surfacedAs (the item kind, clock code, incident kind, digest problem line or urgent class) and surfacedAt (the file that does it), and the check proves the mechanism exists and is wired in that file: the kind is a Decision Item kind and the file opens items naming it, the code is an SLA code with an owner and the file sets its clock, the problem line is a departure of the operating standard, a caller is a verb the owning role ran itself and never a reconciler file (a loop is no owner). An entry nothing reaches is surfacedBy open and names an open edge-case registry entry with the exact reason; it is never exempted silently."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_HELD_UNSURFACED"]
+    enforcers:
+      - {kind: runtime, id: held-surfacing, at: scripts/checks/check-held-surfacing.mjs}
+  - id: R242
+    code: "RT_OP_JUDGE_UNDECLARED"
+    law: "Every op declares who judges its product (principle P2: the maker never judges its own work). The contract of each op (modules/ops/ops/<op>.yaml) carries the required field `judge`, a list of at least one entry, each with a one-line why: machine (independent measures the runtime owns or re-runs at settle, named from modules/kernel/op-judges.yaml, and the contract proofs they rely on; a test file the same attempt wrote is never one by itself), critic (the independent Critic and its rubric, declared exactly for the op kinds that modules/kernel/critic.yaml coverage marks covered), owner (only where modules/kernel/op-judges.yaml ownerGates holds an owner gate) and next-leg (a registered reviewing leg whose contract is to review this product). Nobody cannot be declared. The registry and the contracts are checked against the runtime's own tables (op-gate and sonar-gate enforcedOps, opProofs, proof media, the Critic coverage), so the declarations and what the runtime does cannot drift apart. Surfaced in the full status text of a leg and in the op prompt."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_OP_JUDGE_UNDECLARED"]
+    enforcers:
+      - {kind: runtime, id: op-judge, at: scripts/checks/check-op-judge.mjs}

package/runtime/knowledge/hfs/slots.yaml

@@ -1,7 +1,7 @@
 # HFS slot manifest (owner-approved 2026-09-29, decisions 1-10 in the owner decisions record).
 # The one place that says what may exist in a StarCi product repository and where. A product is ONE app repository
 # (hfs 4, manifest major 2): the app root holds the one package.json, lockfile and node_modules, the hfs.json of kind app,
-# the CI, the hooks and .starciwork (slots of profile `app`); `be/` and `fe/` are its two sides, each laid out as the old
+# the CI, the hooks and .starciwork (slots of profile `app`); `be/` and `fe/` are its two sides, each laid out as a
 # standalone repository root (slots of profile be or fe, paths relative to the side folder). Every tracked path of every
 # repository must match exactly one slot. Checks, lint factories, the architecture machine, templates and the why
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
@@ -20,9 +20,6 @@ versioning:
     change or remove an existing slot, make an optional slot required, promote a rule warn to error, change the
     direction matrix. Needs owner approval and a migration lane per repo. There is no compatibility window: the old
     MAJOR is refused the day the new one lands (owner ruling: no backward compatibility).
-  retire: >-
-    a slot is never edited in place; it gets retiredIn (a major) and a successor slot id. After that major a
-    path matching a retired slot is HFS_SLOT_RETIRED (error).
   pins: knowledge/hfs/canon-pins.yaml carries the exact versions of every @starci/* package and framework this MAJOR supports.
 # 2.1.0 is such a minor: it ADDS the edition mechanism (the `editions` list, the per-slot `editions`, `litePresence`, `lite`
 # overlays and `provider`, and `sides.<side>.reads` of an app-root tree) and the lite slots; an app without `edition` in its
@@ -83,7 +80,7 @@ versioning:
 #               requiredInstances), each shaped as the same field in the slot body; every other field is the edition's.
 #               Under lite `tests` is none on every slot: a lite app has no test world.
 #   provider    the hfs.json connections[].provider that enables this opt-in slot (supabase); never an app kind.
-#   since / retiredIn / successor   lifecycle.
+#   since       the manifest version that introduced the slot.
 presenceValues: [required, optional, opt-in, forbidden]
 trackedValues: [tracked, ignored, external]
 testValues: [unit-beside, e2e, none]
@@ -177,7 +174,7 @@ ruleParams:
       http: [platform/http]
       https: [platform/http]
       cache-manager: [integrations/cache, integrations/redis]
-      "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability (retired local rule must-use-cache-service)
+      "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability
       redis: [integrations/cache, integrations/redis]
       ioredis: [integrations/cache, integrations/redis]
       bullmq: [platform/queue]               # pattern queue: BullMQ jobs and job schedulers (the relay of the outbox into queues)
@@ -389,7 +386,7 @@ slots:
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL]
   - id: app.tool-config-optional
     profiles: [app]
-    path: .npmrc
+    path: "{.npmrc,.npmignore}"     # .npmignore: npm reads the nearest ignore file instead of the root files negations, so an app that ships inside another package keeps its sealed credentials out of the tarball here
     presence: optional
     tracked: tracked
     tier: none
@@ -530,12 +527,12 @@ slots:
              "features/<feature>/<family>/<name>/index.yaml", "features/<feature>/br/<rule>/ac/<name>/index.yaml",
              "features/<feature>/ui/<name>/assets/<approved-file>", "features/<feature>/uat/<name>/{index,accounts,fixtures}.yaml",
              "features/<feature>/uat/<name>/{seed,cleanup}.sql", "_resources/{identities,environments,fixtures}/<slug>/resource.yaml"]
-    forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/, "work/node records"]
+    forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/]
     # Lite keeps the product catalog, feature overviews, grammar and brand drawing records; UAT records belong to the forbidden slot below.
     lite:
       requires: [.gitignore, workspace.yaml, index.yaml]
       allows: [workspace.yaml, index.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml", "features/<feature>/ui/<name>/index.yaml", "features/<feature>/ui/<name>/assets/<approved-file>"]
-    rules: [HFS_AGENT_DATA_TRACKED, HFS_WORK_NODE_RETIRED, HFS_IDENTITY_CUSTODY]
+    rules: [HFS_AGENT_DATA_TRACKED, HFS_IDENTITY_CUSTODY]
   - id: app.starciwork.uat
     profiles: [app]
     # The UAT records of the full edition: a lite app has no UAT (no tests, no record of one), so the trees are forbidden paths
@@ -699,7 +696,7 @@ slots:
     goesTo: "a be feature: webhooks/<provider> for a third-party callback, api for an endpoint, a cli command on a schedule (pg_cron / pg_net)"
     since: 2.1.0
 
-  # ----- side root (both sides): what the old standalone repository root held, less the app-root files ----------
+  # ----- side root (both sides): what a standalone repository root holds, less the app-root files ----------
   - id: repo.side-root-forbidden
     profiles: [be, fe]
     path: "{package.json,package-lock.json,hfs.json,README.md,.gitignore,.gitattributes,.husky/,.github/,.starciwork/,.starcistacks/,supabase/,.sops.yaml,sonar-project.properties,codecov.yml,.prettierrc,.prettierignore,scripts/}"
@@ -1640,7 +1637,7 @@ slots:
     coverage: none
     why: provider sandbox contracts, skipped without sandbox config; run only by test:contract, never part of test or test:e2e
     rules: [BE_TEST_TOPOLOGY]
-  - id: be.tests.e2e-world-retired
+  - id: be.tests.e2e-world-dir
     profiles: [be]
     path: "src/tests/e2e/world/"
     presence: forbidden
@@ -1694,15 +1691,15 @@ slots:
     tier: route
     roles: {proxy: proxy.ts, instrumentation: instrumentation.ts, instrumentation-client: instrumentation-client.ts}
     tests: none
-    rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16 (fe.source-root-retired)
-  - id: fe.source-root-retired
+    rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16 (fe.source-root-middleware)
+  - id: fe.source-root-middleware
     profiles: [fe]
     path: "apps/<app>/src/{middleware.ts,middleware.js}"
     presence: forbidden
     tracked: external
     tier: none
     tests: none
-    goesTo: "apps/<app>/src/proxy.ts: Next >= 16 renamed middleware to proxy and refuses the old name"
+    goesTo: "apps/<app>/src/proxy.ts: Next >= 16 reads proxy.ts and refuses middleware.ts"
     rules: [FE_NEXT_CONVENTIONS]
   - id: fe.route.callback
     profiles: [fe]

package/runtime/knowledge/patterns/be/api.yaml

@@ -94,32 +94,15 @@ rules:
       `@CommandHandler(X)` or `@QueryHandler(X)` on a class that `extends ICQRSHandler<X, XResult>` and implements
       `protected override async process(message)`; it never overrides `execute`. `ICQRSHandler.execute` is load-bearing: it
       logs `OperationFailed` with the operation name and the error and rethrows, and counts refused outcomes. `<Action>Result`
-      is a plain projection type or an `Outcome<Value, Code>` and the return type of `process` is declared. The handler opens
-      the transaction (`this.entityManager.transaction(async (manager) => ...)`), stamps `this.clock.now()` once and passes
-      it down. The handler is thin (R203 `BE_FEATURE_THIN`): its `process` maps the message, makes one delegating call to an
-      injected `*.service` and returns the result, so it has no unit spec; the decisions (persisted state, the `where` that
-      holds ownership, nothing written on a refusal) live in the service and its `<name>.service.spec.ts` asserts them.
+      is a plain projection type or an `Outcome<Value, Code>` and the return type of `process` is declared. The handler is
+      thin (R203 `BE_FEATURE_THIN`): its `process` maps the message, makes one delegating call to an injected `*.service`
+      and returns the result, so it has no unit spec. The service owns the work: it opens the one transaction
+      (`this.entityManager.transaction(async (manager) => ...)`), stamps `this.clock.now()` once and passes it down, and it
+      holds the decisions (persisted state, the `where` that holds ownership, nothing written on a refusal), which its
+      `<name>.service.spec.ts` asserts under the per-file coverage law of BE-TEST-13.
     rationale: |-
       A single template gives every operation the same failure log and metric, and the service spec pins the decision the
       handler delegates.
-    cases:
-      - id: case-1
-        when: A handler
-        write: |-
-          @CommandHandler(StartCheckoutCommand)
-          /** Opens a checkout, or refuses with a purchase code. */
-          export class StartCheckoutHandler extends ICQRSHandler<StartCheckoutCommand, StartCheckoutResult> {
-              constructor(
-                  @InjectPrimaryEntityManager() private readonly entityManager: EntityManager,
-                  @InjectClock() private readonly clock: Clock,
-                  private readonly purchaseService: PurchaseService,
-              ) { super() }
-
-              protected override async process(command: StartCheckoutCommand): Promise<StartCheckoutResult> {
-                  const at = this.clock.now()
-                  return this.entityManager.transaction(async (manager) => this.purchaseService.open({ manager, learnerId: command.params.principal.id, offerId: command.params.request.offerId, at }))
-              }
-          }
     verification:
       automated:
         - BE_CQRS_SHAPE
@@ -129,7 +112,7 @@ rules:
         - BE_FEATURE_THIN
       manual:
         - Confirm the service spec the handler calls asserts refusal paths and ownership, not only that a mock was called.
-    relatedExamples: []
+    relatedExamples: [api]
   - id: BE-CQRS-4
     title: The bus is the only way into a handler; nothing forwards
     kind: mandatory

package/runtime/knowledge/patterns/be/cli.yaml

@@ -87,22 +87,13 @@ rules:
       command and its spec are found from the name alone.
     cases:
       - id: case-1
-        when: The migrate group
-        write: |-
-          // be/src/features/cli/migrate/migrate.cli.ts
-          @Command({ name: "migrate", subCommands: [RunCli], description: "Schema migrations of every connection" })
-          /** The migrate group; without a sub-command it shows its help. */
-          export class MigrateCli extends CommandRunner {
-              async run(): Promise<void> { this.command.help() }
-          }
-      - id: case-2
         when: A `@SubCommand` declared in src/modules/platform/database/reindex.cli.ts or in features/api/
         write: 'Refused (BE_CLI_COMMAND_SHAPE, BE_CLI_OWNER): move it to src/features/cli/<group>/subs/reindex.cli.ts and register it in the group module.'
     verification:
       automated:
         - BE_CLI_COMMAND_SHAPE
       manual: []
-    relatedExamples: []
+    relatedExamples: [cli]
   - id: BE-CLI-3
     title: A command is an action runner with its own unit spec
     kind: mandatory
@@ -134,7 +125,7 @@ rules:
         - BE_FEATURE_THIN
       manual:
         - Confirm a command that writes is safe to re-run or refuses a second run explicitly.
-    relatedExamples: []
+    relatedExamples: [cli]
   - id: BE-CLI-4
     title: Only the cli parses the command line
     kind: mandatory
@@ -180,7 +171,7 @@ rules:
         - BE_CLI_REQUIRED
       manual:
         - Confirm the deploy runs `cli migrate run` to completion before the api and worker apps start.
-    relatedExamples: []
+    relatedExamples: [cli]
 files:
   - path: apps/cli/Dockerfile
     slot: repo.app-image

package/runtime/knowledge/patterns/be/realtime.yaml

@@ -78,7 +78,7 @@ rules:
         - BE_CONTRACT_UNGUARDED
         - BE_REALTIME_SHAPE
       manual:
-        - Confirm a query or mutation an old subscription door carried now lives in an api feature.
+        - Confirm no query or mutation lives in a subscription door; it lives in an api feature.
     relatedExamples: [realtime]
   - id: BE-REALTIME-2
     title: A realtime door reads and pushes, it never writes
@@ -95,19 +95,6 @@ rules:
     rationale: |-
       A door that can only touch the hub cannot change business state, so the biggest risk of a long-lived unauthenticated-looking
       connection, a write through it, is removed by type.
-    cases:
-      - id: case-1
-        when: A subscription that pushes order status changes
-        write: |-
-          @Resolver()
-          export class OrderStatusSubscription {
-              constructor(private readonly hub: RealtimeHub) {}
-
-              @Subscription(() => OrderStatusChangedType)
-              orderStatusChanged(@CurrentPrincipal() principal: Principal, @Args("orderId") orderId: string): AsyncIterable<OrderStatusChangedType> {
-                  return this.hub.subscribe(orderStatusTopic(principal.id, orderId))
-              }
-          }
     verification:
       automated:
         - BE_REALTIME_WRITES

package/runtime/knowledge/patterns/be/webhooks.yaml

@@ -92,25 +92,6 @@ rules:
       that skips it, and a door with one call and no decision has nothing left to test except the proof and the hand-over.
     cases:
       - id: case-1
-        when: The door of a payment gateway
-        write: |-
-          @Controller("webhooks/payment-gateway")
-          export class PaymentGatewayWebhook {
-              constructor(
-                  @InjectWebhookSignature() private readonly signature: WebhookSignatureService,
-                  private readonly payments: PaymentService,
-              ) {}
-
-              @Post()
-              @HttpCode(HttpStatus.NO_CONTENT)
-              @Public({ reason: PublicReason.SignedWebhook })
-              @RateLimit(RateTier.Strict)
-              async receive(@Req() request: RawBodyRequest<Request>, @Headers("x-signature") signature: string | undefined, @Headers("x-timestamp") timestamp: string | undefined, @Body() body: PaymentNotificationRequest): Promise<void> {
-                  this.signature.verify({ provider: "payment-gateway", rawBody: request.rawBody, signature, timestamp })
-                  await this.payments.acceptNotification(body)
-              }
-          }
-      - id: case-2
         when: A delivery whose raw body must be hashed
         write: 'enable the raw body for the app (`NestFactory.create(..., { rawBody: true })` in the api app) and read `request.rawBody`; never hash a re-serialized `body`.'
     verification: