@starci/hfs 4.0.7 → 4.0.9

package/runtime/scripts/{lib/hfs-check.mjs → hfs/check.mjs}

@@ -1,6 +1,6 @@
-// hfs-check.mjs - the HFS app check, behind `hfs check | explain` (packages/hfs) and reusable by any
+// hfs-check.mjs - the HFS app check, behind `starci app check | explain` (packages/hfs) and reusable by any
 // runtime check. It reads three things and nothing else: the app's hfs.json, the slot manifest
-// (knowledge/hfs/slots.yaml through scripts/lib/hfs-slots.mjs) and the pins (knowledge/hfs/canon-pins.yaml). It never
+// (knowledge/hfs/slots.yaml through scripts/hfs/slots.mjs) and the pins (knowledge/hfs/canon-pins.yaml). It never
 // writes to the repository it inspects.
 //
 // checkRepo() answers, for the tracked paths of one app (git ls-files), per scope (the app root and each side folder):
@@ -15,21 +15,29 @@
 //                                 and passed in as `extraFindings` (this module does not read the templates)
 //   HFS_SLOT_REQUIRED_MISSING     a file or directory a required slot (or an instance of one) must contain
 //   HFS_MIN_INSTANCES             fewer instances of a slot than minInstances
-//   HFS_PLAINTEXT_SECRET          (R06, hfs-rules/secrets.mjs) a plaintext secret file or value in a tracked file; a `.enc` that is no sops envelope
-//   HFS_STACKS_SHAPE              (R10, hfs-rules/stacks.mjs) a `.starcistacks` path outside the standard shape, or a Sonar owner that is not the host
-//   HFS_CI_MISSING_CANON          (R13, hfs-rules/pipeline.mjs) CI without the pinned `hfs check`, pre-push without typecheck or lint
-//   HFS_DEP_VERSION_SKEW          (R14, hfs-rules/deps.mjs) a dependency at two versions in the workspace, or a nested copy in the lockfile
-//   HFS_CONTRACT_SNAPSHOT_DRIFT   (R23, hfs-rules/contract.mjs) an uncommitted back-end snapshot, or a front-end copy that differs from it
-//   BE_TEST_TOPOLOGY              (R47, hfs-rules/test-topology.mjs) a `.test` file, a testing/ folder, a second jest configuration
-//   FE_NO_TESTS                   (R97, hfs-rules/fe-no-tests.mjs) a front end holds a spec, e2e or test-tool file, a test script or a test dependency; no exception
-//   BE_SPEC_PLACEMENT             (R102, hfs-rules/spec-placement.mjs) a spec or test file outside the four test layers, scripts/ and tools/ included
-//   HFS_REPO_LOCAL_CHECK          (R103, hfs-rules/repo-local-checks.mjs) a local eslint rule or plugin, a `check-*` script, a relative import in eslint.config
-//   HFS_LINT_SUPPRESSION_FILE     (R104, hfs-rules/lint-suppression.mjs) an eslint suppressions file, script or option
-//   HFS_PROOF_COMMAND_FILE_MISSING (R105, hfs-rules/proof-commands.mjs) a .starciwork proof command that runs a file the repository does not hold
-//   HFS_PEER_INTEGRATION_MISSING  (R111, hfs-rules/peer-integrations.mjs) the app root package.json lacks the runtime peer a driver integration needs
-//   BE_INTEGRATION_SPEC_MISSING   (R112, hfs-rules/integration-specs.mjs) an integration with no integration spec that registers its module, maps its refusals and drives an outage
-//   FE_WIRE_GENERATED, FE_I18N_PLACEMENT, FE_I18N_CATALOG   (R52, R59, R60, hfs-rules/frontend.mjs) the front-end tree of each app
-//   HFS_GITIGNORE_BLOCK_DRIFT, HFS_SONAR_CONFIG   (R04, R11) produced by packages/hfs/sync/managed.mjs, which renders the templates
+//   HFS_PLAINTEXT_SECRET          (R06, rules/secrets.mjs) a plaintext secret file or value in a tracked file; a `.enc` that is no sops envelope
+//   HFS_STACKS_SHAPE              (R10, rules/stacks.mjs) a `.starcistacks` path outside the standard shape, or a Sonar owner that is not the host
+//   HFS_CI_MISSING_CANON          (R13, rules/pipeline.mjs) CI without the pinned `starci app check`, pre-push without typecheck or lint
+//   HFS_DEP_VERSION_SKEW          (R14, rules/deps.mjs) a dependency at two versions in the workspace, or a nested copy in the lockfile
+//   HFS_CONTRACT_SNAPSHOT_DRIFT   (R23, rules/contract.mjs) an uncommitted back-end snapshot, or a front-end copy that differs from it
+//   BE_TEST_TOPOLOGY              (R47, rules/test-topology.mjs) a `.test` file, a testing/ folder, a second jest configuration
+//   FE_NO_TESTS                   (R97, rules/fe-no-tests.mjs) a front end holds a spec, e2e or test-tool file, a test script or a test dependency; no exception
+//   HFS_LITE_SECRET_CUSTODY       (R220, rules/supabase-secrets.mjs) under edition lite: secret material or a forbidden custody path; the R06 scan itself runs for every edition
+//   HFS_EDITION_FORBIDDEN_PRESENT (R212, rules/edition.mjs) under edition lite: a test script, dependency or tool config in a
+//                                 package.json or the tree, or a declared worker app, event pattern or trigger kind lite does not have
+//   DB_MIGRATION_SHAPE ... DB_TYPES_DRIFT (R213-R216, rules/database.mjs, async: passed in as extraFindings) the Supabase migrations, policies, definer functions, buckets, config.toml and generated types
+//   BE_SPEC_PLACEMENT             (R102, rules/spec-placement.mjs) a spec or test file outside the four test layers, scripts/ and tools/ included
+//   HFS_REPO_LOCAL_CHECK          (R103, rules/repo-local-checks.mjs) a local eslint rule or plugin, a `check-*` script, a relative import in eslint.config
+//   HFS_LINT_SUPPRESSION_FILE     (R104, rules/lint-suppression.mjs) an eslint suppressions file, script or option
+//   HFS_PROOF_COMMAND_FILE_MISSING (R105, rules/proof-commands.mjs) a .starciwork proof command that runs a file the repository does not hold
+//   HFS_PEER_INTEGRATION_MISSING  (R111, rules/peer-integrations.mjs) the app root package.json lacks the runtime peer a driver integration needs
+//   BE_INTEGRATION_SPEC_MISSING   (R112, rules/integration-specs.mjs) an integration with no integration spec that registers its module, maps its refusals and drives an outage
+//   FE_GRAPHQL_CONTRACT           (R113, rules/fe-contract-documents.mjs) a front-end GraphQL document the back end's contract snapshot does not serve
+//   HFS_MONO_* (R143-R146, rules/monorepo.mjs) the monorepo shape; BE_CLI_REQUIRED (R147, rules/cli.mjs) the one cli app
+//   HFS_SERVICE_PLACEMENT, HFS_IMAGE_UNPINNED, HFS_SERVICE_STACK_DECLARATION, HFS_EVENT_CONTRACT, BE_ASYNC_SPEC_MISSING   (R163-R167, rules/services.mjs) the microservice policy of a product with more than one service
+//   BE_EVENT_CLASS_CONTRACT, BE_PATTERN_SPEC_MISSING, BE_KIND_DECLARATION, BE_KIND_EMPTY   (rules/app-root.mjs: event-bus.mjs and kinds.mjs) a typed event class the vendored contract does not list, a declared pattern whose proof scenarios have no test, and the trigger kinds of the features (declared, whole, never empty)
+//   FE_WIRE_GENERATED, FE_I18N_PLACEMENT, FE_I18N_CATALOG   (R52, R59, R60, rules/frontend.mjs) the front-end tree of each app
+//   HFS_GITIGNORE_BLOCK_DRIFT, HFS_SONAR_CONFIG, HFS_COVERAGE_SCOPE_DRIFT   (R04, R11, R204) produced by packages/hfs/sync/managed.mjs, which renders the templates
 //   HFS_FORMAT                    (R19) produced by packages/hfs/sync/format.mjs, which runs the repository's own prettier
 //                                 both are passed in as `extraFindings`: this module reads no template and starts no tool
 //   HFS_CANON_PIN_DRIFT           a dependency whose declared version is not the pinned one
@@ -38,47 +46,51 @@
 //   HFS_EMPTY_DIR                 a directory with no file below it (git never tracks one), outside .git, node_modules and ignored slots
 //   HFS_GHOST_TREE                an empty directory beside a sibling within two edits of its name (business / bussiness)
 //   HFS_UNTRACKED_ROOT_ENTRY      an entry git neither tracks nor ignores, outside an `ignored` slot (R03)
-// checkRepository() is the whole `hfs check`: checkRepo() plus the architecture machine (scripts/checks/architecture.mjs, one
+// A runtime repository (hfs.json kind runtime, judged with knowledge/hfs/runtime-slots.yaml) gets the per-path slot findings,
+// the required files and minimum instances and the tree findings only; scripts/hfs/runtime-check.mjs adds the runtime rules.
+// checkRepository() is the whole `starci app check`: checkRepo() plus the architecture machine (scripts/hfs/architecture.mjs, one
 // implementation; the published bundle carries a byte copy), its violations and errors reported as findings under their own
 // codes; `fast` limits both to the owners changed since the merge-base. Every finding carries its code and the Vietnamese why text of modules/kernel/failure-codes.yaml. Only `error`
 // findings fail the check.
 import fs from 'node:fs';
 import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
-import { ARCHITECTURE_RULE_IDS, checkArchitecture } from '../checks/architecture/index.mjs';
+import { ARCHITECTURE_RULE_IDS, checkArchitecture } from './architecture/index.mjs';
 import { parseYaml } from '../../engine/yaml.mjs';
-import { APP_SCOPE, HFS_DECLARATION_FILE, appRelativeMessages, HfsSlotsError, SIDES, createSlotResolver, loadSlotManifest, readRepoDeclaration, resolveRepoDeclaration } from './hfs-slots.mjs';
-import { allowsFile } from './hfs-allows.mjs';
-import { gitOutput } from '../api/git/lib.mjs';
-import { posixPath } from './path-key.mjs';
-import { readTree, treeFacts, untrackedEntries } from './hfs-tree.mjs';
-import { contractFindings } from './hfs-rules/contract.mjs';
-import { depFindings } from './hfs-rules/deps.mjs';
-import { appFrontendFindings, frontendFindings } from './hfs-rules/frontend.mjs';
-import { integrationSpecFindings } from './hfs-rules/integration-specs.mjs';
-import { lintSuppressionFindings } from './hfs-rules/lint-suppression.mjs';
-import { peerIntegrationFindings } from './hfs-rules/peer-integrations.mjs';
-import { pipelineFindings } from './hfs-rules/pipeline.mjs';
-import { proofCommandFindings } from './hfs-rules/proof-commands.mjs';
-import { repoLocalCheckFindings } from './hfs-rules/repo-local-checks.mjs';
-import { readJson } from './hfs-rules/read.mjs';
-import { secretFindings } from './hfs-rules/secrets.mjs';
-import { pathFindings } from './hfs-path-findings.mjs';
-import { onLintSurface } from '../checks/architecture/surface.mjs';
-import { checkAppRoot, trackedTreeView } from '../checks/architecture/hfs.mjs';
-import { stacksFindings } from './hfs-rules/stacks.mjs';
-import { testTopologyFindings } from './hfs-rules/test-topology.mjs';
-import { feNoTestsFindings, isFeTestPath } from './hfs-rules/fe-no-tests.mjs';
-
-export const CANON_PINS_FILE = 'knowledge/hfs/canon-pins.yaml';
+import { APP_SCOPE, HFS_DECLARATION_FILE, appRelativeMessages, HfsSlotsError, SIDES, createSlotResolver, loadRuleCatalog, loadSlotManifest, readRepoDeclaration, resolveRepoDeclaration } from './slots.mjs';
+import { allowsFile } from './allows.mjs';
+import { RUNTIME_KIND } from './manifest-shape.mjs';
+import { lsFiles } from '../api/git/ls-files.mjs';
+import { diff as gitDiff } from '../api/git/diff.mjs';
+import { mergeBase } from '../api/git/merge-base.mjs';
+import { gitOutputOf } from '../lib/git.mjs';
+import { posixPath } from '../lib/path-key.mjs';
+import { readTree, treeFacts, untrackedEntries } from './tree.mjs';
+import { contractFindings } from './rules/contract.mjs';
+import { appRootFindings } from './rules/app-root.mjs';
+import { frontendFindings } from './rules/frontend-tree.mjs';
+import { lintSuppressionFindings } from './rules/lint-suppression.mjs';
+import { repoLocalCheckFindings } from './rules/repo-local-checks.mjs';
+import { readJson } from './rules/read.mjs';
+import { supabaseSecretFindings } from './rules/supabase-secrets.mjs';
+import { pathFindings } from './path-findings.mjs';
+import { onLintSurface } from './architecture/surface.mjs';
+import { checkAppRoot, trackedTreeView } from './architecture/hfs.mjs';
+import { testTopologyFindings } from './rules/test-topology.mjs';
+import { feNoTestsFindings, isFeTestPath } from './rules/fe-no-tests.mjs';
+import { editionFindings } from './rules/edition.mjs';
+// The database rules (R213-R216) read SQL through a WASM parser, so they are async: `starci app check` calls them beside the other emitters and passes the findings in as `extraFindings`.
+export { checkDatabase } from './rules/database.mjs';
+
+const CANON_PINS_FILE = 'knowledge/hfs/canon-pins.yaml';
 export const FAILURE_CODES_FILE = 'modules/kernel/failure-codes.yaml';
 /**
- * The codes `hfs check` reports when it cannot judge (an unreadable repository, a refused declaration or manifest, a missing
+ * The codes `starci app check` reports when it cannot judge (an unreadable repository, a refused declaration or manifest, a missing
  * formatter): infrastructure refusals, never obligations, so no rule of knowledge/hfs/rules.yaml owns them.
  */
 export const REFUSAL_CODES = Object.freeze([
   'HFS_REPO_UNREADABLE',
-  'HFS_DECLARATION_INVALID', 'HFS_MANIFEST_MAJOR_MISMATCH', 'HFS_MANIFEST_INVALID', 'HFS_FORMAT_TOOL_MISSING',
+  'HFS_DECLARATION_INVALID', 'HFS_MANIFEST_MAJOR_MISMATCH', 'HFS_MANIFEST_INVALID', 'HFS_FORMAT_TOOL_MISSING', 'HFS_EDITION_INVALID',
 ]);
 /** The codes this module emits that are not the slot loader's own: the why bundle of packages/hfs ships exactly these plus the loader's. */
 export const CHECK_CODES = Object.freeze([
@@ -86,12 +98,14 @@ export const CHECK_CODES = Object.freeze([
   'HFS_SLOT_REQUIRED_MISSING', 'HFS_MIN_INSTANCES', 'HFS_CANON_PIN_DRIFT', 'HFS_SIZE_SOFT_BACKLOG', 'BE_SOURCE_FORM',
   'HFS_MANAGED_FILE_DRIFT', 'HFS_TOOL_CONFIG_LOCAL', 'HFS_RULE_OFF_WITHOUT_REPLACEMENT', 'HFS_TS_STRICT',
   'HFS_PLAINTEXT_SECRET', 'HFS_STACKS_SHAPE', 'HFS_CI_MISSING_CANON', 'HFS_DEP_VERSION_SKEW', 'HFS_CONTRACT_SNAPSHOT_DRIFT',
-  'BE_TEST_TOPOLOGY', 'BE_SPEC_PLACEMENT', 'HFS_REPO_LOCAL_CHECK', 'HFS_LINT_SUPPRESSION_FILE', 'HFS_PROOF_COMMAND_FILE_MISSING', 'HFS_PEER_INTEGRATION_MISSING', 'BE_INTEGRATION_SPEC_MISSING', 'FE_NO_TESTS', 'FE_WIRE_GENERATED', 'FE_I18N_PLACEMENT', 'FE_I18N_CATALOG',
-  'HFS_GITIGNORE_BLOCK_DRIFT', 'HFS_SONAR_CONFIG', 'HFS_FORMAT',
+  'BE_TEST_TOPOLOGY', 'BE_SPEC_PLACEMENT', 'HFS_REPO_LOCAL_CHECK', 'HFS_LINT_SUPPRESSION_FILE', 'HFS_PROOF_COMMAND_FILE_MISSING', 'HFS_PEER_INTEGRATION_MISSING', 'BE_INTEGRATION_SPEC_MISSING', 'FE_GRAPHQL_CONTRACT', 'FE_NO_TESTS', 'HFS_MONO_WORKSPACES', 'HFS_MONO_FE_WORKSPACE', 'HFS_MONO_NEST_PROJECTS', 'HFS_MONO_WORKSPACE_DEP', 'BE_CLI_REQUIRED', 'FE_WIRE_GENERATED', 'FE_I18N_PLACEMENT', 'FE_I18N_CATALOG', 'HFS_SERVICE_PLACEMENT', 'HFS_IMAGE_UNPINNED', 'HFS_SERVICE_STACK_DECLARATION', 'HFS_EVENT_CONTRACT', 'BE_ASYNC_SPEC_MISSING', 'BE_SAGA_STEP_COMPENSATION', 'BE_SAGA_STATE_VERSIONED', 'BE_SAGA_EVENT_CONTRACT', 'BE_SAGA_CONSUMER_DEDUPE', 'BE_EVENT_CLASS_CONTRACT', 'BE_PATTERN_SPEC_MISSING', 'BE_CONTRACT_BREAKING', 'BE_KIND_DECLARATION', 'BE_KIND_EMPTY', 'HFS_DOCKER_BUILD_CONTEXT', 'HFS_DOCKER_STAGES', 'HFS_DOCKER_ENTRY', 'HFS_DOCKER_BASE_PIN', 'HFS_DOCKER_SECRETS', 'BE_SAGA_E2E_MISSING',
+  'HFS_EDITION_FORBIDDEN_PRESENT', 'HFS_LITE_SECRET_CUSTODY',
+  'DB_MIGRATION_SHAPE', 'DB_RLS_REQUIRED', 'DB_DYNAMIC_DDL', 'DB_POLICY_SHAPE', 'DB_DEFINER_SAFE', 'DB_STORAGE_POLICY', 'DB_CONFIG_POLICY', 'DB_TYPES_DRIFT',
+  'HFS_GITIGNORE_BLOCK_DRIFT', 'HFS_SONAR_CONFIG', 'HFS_COVERAGE_SCOPE_DRIFT', 'HFS_FORMAT',
   'HFS_EMPTY_DIR', 'HFS_GHOST_TREE', 'HFS_UNTRACKED_ROOT_ENTRY',
   ...REFUSAL_CODES,
 ]);
-/** Every code `hfs check` can report: its own and every code the architecture machine can emit (derived from the machine's rule id lists). */
+/** Every code `starci app check` can report: its own and every code the architecture machine can emit (derived from the machine's rule id lists). */
 export const ALL_CHECK_CODES = Object.freeze([...new Set([...CHECK_CODES, ...ARCHITECTURE_RULE_IDS])].sort());
 const SOURCE_EXT = /\.(?:[cm]?[jt]sx?)$/;
 const VAR = /<([a-z][a-z0-9-]*)>/g;
@@ -115,7 +129,7 @@ export function readWhy(root = skillRoot, codes = CHECK_CODES) {
 export function trackedFiles(repoRoot) {
   let out;
   try {
-    out = gitOutput(['ls-files', '-z', '--cached', '--exclude-standard'], { dir: repoRoot, maxBuffer: 256 * 1024 * 1024 });
+    out = gitOutputOf(lsFiles(['-z', '--cached', '--exclude-standard'], { dir: repoRoot, maxBuffer: 256 * 1024 * 1024 }), 'git ls-files');
   } catch (error) {
     refuse('HFS_REPO_UNREADABLE', `${repoRoot} is not a readable Git work tree (${String(error?.stderr ?? error?.message ?? error).trim().split('\n')[0]})`, { repoRoot });
   }
@@ -124,12 +138,6 @@ export function trackedFiles(repoRoot) {
 
 const fill = (text, bindings) => String(text).replace(VAR, (whole, name) => bindings[name] ?? whole);
 
-/** hfs.json of `repoRoot` resolved against the manifest, or the single refusal finding when it is absent or invalid. */
-export function openRepo({ repoRoot, root = skillRoot, manifest = loadSlotManifest({ root }) }) {
-  const repo = readRepoDeclaration(manifest, repoRoot);
-  return { manifest, repo, resolver: createSlotResolver(manifest, repo) };
-}
-
 const pinnedSpec = (spec, pin) => (spec === pin.version ? null : `declared ${spec}, pinned ${pin.version}`);
 
 /** The pin map of knowledge/hfs/canon-pins.yaml under `root`. */
@@ -197,6 +205,16 @@ function summarize(findings) {
   };
 }
 
+/**
+ * THE edition filter of findings: a finding whose code belongs, through the rule catalog, to a rule the app's edition does not
+ * judge (rules.yaml `editions`) is dropped. Codes outside the catalog (refusals, machine codes without a rule) stay. This is the
+ * only place the edition touches a finding; no check below it knows the edition.
+ */
+function judgedFindings(findings, edition, root) {
+  const catalog = loadRuleCatalog({ root });
+  return findings.filter((finding) => catalog.judgedIn(finding.code, edition));
+}
+
 /** The tree findings of R03: empty directories, ghost siblings, untracked entries outside an ignored slot. */
 function treeFindings({ repoRoot, resolver }) {
   const inIgnoredSlot = (rel) => resolver.classifyPath(`${rel}/.probe`).tracking === 'ignored';
@@ -225,7 +243,7 @@ const onSide = (side, p) => (p ? path.posix.normalize(`${side}/${p}`) : p);
  * relative to it, exactly as the standalone repository root was). `files` are the scope's tracked paths; `all` (root only) every
  * tracked path of the app, for the rules that read across it (dependency skew, proof commands).
  */
-function scopeFindings({ repoRoot, root, repo, resolver, files, all = files, scoped }) {
+function scopeFindings({ repoRoot, root, repo, resolver, files, all = files, scoped, manifest, editionDeclaration = true }) {
   const inScope = (file) => !scoped || scoped.has(file);
   // A required directory of the root (be/, fe/) is present through the files below it, which are the sides' own.
   const trackedSet = new Set(all);
@@ -253,31 +271,27 @@ function scopeFindings({ repoRoot, root, repo, resolver, files, all = files, sco
     const count = instances.filter((i) => i.slot === slot).length;
     if (count < min) findings.push({ code: 'HFS_MIN_INSTANCES', level: 'error', path: resolver.slot(slot).path, slot, min, count, message: `${slot} needs at least ${min} instance${min === 1 ? '' : 's'} (${resolver.slot(slot).path}), found ${count}` });
   }
+  // The runtime repository (kind runtime) is judged here by its tree law only; its own rules run in scripts/hfs/runtime-check.mjs.
+  if (repo.kind === RUNTIME_KIND) return findings;
 
   const pins = readPins(root);
   findings.push(...pinFindings({ repoRoot, files, profile: repo.profile, pins, only: scoped }));
 
-  // The tree checks of the rules that read file content or configuration (hfs-rules/*): whole-scope, cheap, no tool run.
+  // The tree checks of the rules that read file content or configuration (rules/*): whole-scope, cheap, no tool run.
   findings.push(
-    ...secretFindings({ repoRoot, files: files.filter(inScope), resolver }),
+    ...supabaseSecretFindings({ repoRoot, files: files.filter(inScope), resolver, repo }),
+    ...editionFindings({ repoRoot, files: files.filter(inScope), repo, resolver, withDeclaration: editionDeclaration }),
     ...repoLocalCheckFindings({ repoRoot, files }),
     ...lintSuppressionFindings({ repoRoot, files }),
   );
   if (isRoot) {
     findings.push(
-      ...depFindings({ repoRoot, files: all }),
-      ...peerIntegrationFindings({ repoRoot, files: all }),
-      ...integrationSpecFindings({ repoRoot, files: all }),
-      ...pipelineFindings({ repoRoot, files, pins }),
-      ...testTopologyFindings({ repoRoot, files }),
-      ...proofCommandFindings({ repoRoot, files: all, resolver, sides: Object.keys(repo.sides ?? {}) }),
-      ...appFrontendFindings({ repoRoot, files: all, repo }),
-      ...stacksFindings({ repoRoot, files, resolver }),
+      ...appRootFindings({ repoRoot, files, all, repo, resolver, pins }),
       // The tree check of the app root the machine runs per side for a side folder: README, root entries, automatic gates, hooks path.
       ...checkAppRoot({ root: repoRoot, resolver, tree: trackedTreeView(all) }).violations.map((item) => ({ code: item.ruleId, level: 'error', path: item.path, line: item.line, column: item.column, source: 'machine', message: `${item.path}: ${item.message}` })),
     );
   } else if (repo.profile === 'be') {
-    findings.push(...contractFindings({ files, repo, resolver }), ...testTopologyFindings({ repoRoot, files }));
+    findings.push(...contractFindings({ repoRoot, files, repo, resolver }), ...testTopologyFindings({ repoRoot, files }));
   } else {
     findings.push(...frontendFindings({ repoRoot, files, repo }), ...feNoTestsFindings({ repoRoot, files: files.filter(inScope) }));
   }
@@ -311,7 +325,7 @@ export function checkRepo({ repoRoot, root = skillRoot, declaration, files, only
   try {
     repo = declaration === undefined ? readRepoDeclaration(manifest, repoRoot) : resolveRepoDeclaration(manifest, declaration);
   } catch (error) {
-    if (!(error instanceof HfsSlotsError) || !['HFS_DECLARATION_INVALID', 'HFS_MANIFEST_MAJOR_MISMATCH'].includes(error.code)) throw error;
+    if (!(error instanceof HfsSlotsError) || !['HFS_DECLARATION_INVALID', 'HFS_MANIFEST_MAJOR_MISMATCH', 'HFS_EDITION_INVALID'].includes(error.code)) throw error;
     const findings = withWhy([{ code: error.code, level: 'error', path: HFS_DECLARATION_FILE, message: error.message.replace(/^[A-Z_]+: /, ''), problems: error.details.problems }], why);
     return { ok: false, repoRoot, manifest: manifest.version, profile: null, apps: [], tracked: 0, findings, counts: summarize(findings) };
   }
@@ -319,28 +333,29 @@ export function checkRepo({ repoRoot, root = skillRoot, declaration, files, only
   const tracked = files ?? trackedFiles(repoRoot);
   const scoped = only ? new Set(only) : null;
   const findings = [];
-  // `hfs check` leaves to the lint canon the per-path findings that sit on an existing TypeScript file (hfs-path-findings.mjs).
+  // `starci app check` leaves to the lint canon the per-path findings that sit on an existing TypeScript file (hfs-path-findings.mjs).
   const keep = (list, scopeRoot) => (surface === 'check' ? list.filter((finding) => !(finding.origin === 'repo' && onLintSurface(scopeRoot, finding))) : list);
   if (repo.profile === APP_SCOPE) {
     const own = tracked.filter((file) => resolver.sideOf(file) === null);
-    findings.push(...keep(scopeFindings({ repoRoot, root, repo, resolver, files: own, all: tracked, scoped }), repoRoot));
+    findings.push(...keep(scopeFindings({ repoRoot, root, repo, resolver, files: own, all: tracked, scoped, manifest }), repoRoot));
     for (const side of SIDES) {
       const prefix = `${side}/`;
       const sideRoot = path.join(repoRoot, side);
       const sideFiles = tracked.filter((file) => file.startsWith(prefix)).map((file) => file.slice(prefix.length));
       const sideScoped = scoped ? new Set([...scoped].filter((file) => file.startsWith(prefix)).map((file) => file.slice(prefix.length))) : null;
-      const sideFindings = scopeFindings({ repoRoot: sideRoot, root, repo: repo.sides[side], resolver: resolver.sides[side], files: sideFiles, scoped: sideScoped });
+      const sideFindings = scopeFindings({ repoRoot: sideRoot, root, repo: repo.sides[side], resolver: resolver.sides[side], files: sideFiles, scoped: sideScoped, manifest, editionDeclaration: false });
       const message = appRelativeMessages(side, sideRoot);
       findings.push(...keep(sideFindings, sideRoot).map((finding) => ({ ...finding, side, path: onSide(side, finding.path), message: message(finding.message) })));
     }
   } else {
-    findings.push(...keep(scopeFindings({ repoRoot, root, repo, resolver, files: tracked, scoped }), repoRoot));
+    findings.push(...keep(scopeFindings({ repoRoot, root, repo, resolver, files: tracked, scoped, manifest }), repoRoot));
   }
   findings.push(...extraFindings);
   if (tree) findings.push(...treeFindings({ repoRoot, resolver }));
 
   // The app-root tree check reports machine codes: their why is read with the check's own.
-  const finished = withWhy(findings, { ...why, ...readWhy(root, [...new Set(findings.map((f) => f.code).filter((code) => !why[code]))]) });
+  const judged = judgedFindings(findings, repo.edition ?? 'full', root);
+  const finished = withWhy(judged, { ...why, ...readWhy(root, [...new Set(judged.map((f) => f.code).filter((code) => !why[code]))]) });
   const counts = summarize(finished);
   const apps = repo.profile === APP_SCOPE ? SIDES.flatMap((side) => repo.sides[side].apps.map((app) => ({ ...app, side }))) : repo.apps;
   return { ok: counts.error === 0, repoRoot, manifest: manifest.version, profile: repo.profile, apps, tracked: tracked.length, findings: finished, counts };
@@ -348,28 +363,24 @@ export function checkRepo({ repoRoot, root = skillRoot, declaration, files, only
 
 // ------------------------------------------------------------------------------------------ the whole check
 
-const gitOut = (repoRoot, args) => gitOutput(args, { dir: repoRoot, maxBuffer: 256 * 1024 * 1024 });
-
 /** The merge-base of HEAD with `base`, else with origin/main, else with main; null when none resolves. */
 function mergeBaseOf(repoRoot, base) {
   for (const ref of base ? [base] : ['origin/main', 'main']) {
-    try {
-      const sha = gitOut(repoRoot, ['merge-base', 'HEAD', ref]).trim();
-      if (sha) return sha;
-    } catch { /* this ref has no merge-base with HEAD; try the next */ }
+    const sha = mergeBase(repoRoot, 'HEAD', ref); // null: this ref has no merge-base with HEAD; try the next
+    if (sha) return sha;
   }
   return null;
 }
 
 /** Tracked paths that differ from the merge-base (commits, staged and unstaged edits; deletions are not paths to judge). */
-export function changedSince(repoRoot, base) {
+function changedSince(repoRoot, base) {
   const sha = mergeBaseOf(repoRoot, base);
   if (!sha) {
     throw new Error(base
       ? `--base ${base} has no merge-base with HEAD; pass a ref this branch descends from`
       : '--fast needs a merge-base with origin/main or main and found none; run `git fetch origin main` or pass --base <ref>');
   }
-  const files = gitOut(repoRoot, ['diff', '--name-only', '--diff-filter=ACMRT', '-z', sha]).split('\0').filter(Boolean).map(posixPath);
+  const files = gitOutputOf(gitDiff(['--name-only', '--diff-filter=ACMRT', '-z', sha], { dir: repoRoot, maxBuffer: 256 * 1024 * 1024 }), 'git diff').split('\0').filter(Boolean).map(posixPath);
   return { base: sha, files };
 }
 
@@ -380,7 +391,7 @@ function machineFindings(report) {
 }
 
 /**
- * The whole `hfs check` of one app: checkRepo() (the root and both sides: slots, pins, size, tree) and then the architecture machine
+ * The whole `starci app check` of one app: checkRepo() (the root and both sides: slots, pins, size, tree) and then the architecture machine
  * over each side folder (the side as the repository root it judges), its violations and errors merged in as findings with the
  * Vietnamese why of their codes and the side prefixed onto their paths. `fast` judges only what changed since the merge-base (`base`
  * names another ref): the per-path slot and pin checks on the changed paths, the machine on the owners of the changed source files
@@ -404,7 +415,7 @@ export function checkRepository({ repoRoot, root = skillRoot, fast = false, base
     found.push(...run.findings);
   }
   const why = readWhy(root, [...new Set(found.map((f) => f.code))]);
-  const findings = [...slotResult.findings, ...withWhy(found, why)];
+  const findings = [...slotResult.findings, ...withWhy(judgedFindings(found, repo.edition ?? 'full', root), why)];
   const counts = summarize(findings);
   const ran = runs.filter((info) => info.status === 'ran');
   return {
@@ -443,7 +454,7 @@ function machineOver({ scope, manifest, machine, changed }) {
 // --------------------------------------------------------------------------------------------------- explain
 
 const TEST_KIND = {
-  'unit-beside': 'a <name>.service.spec.ts beside each <name>.service.ts in this slot (only services are unit-tested)',
+  'unit-beside': 'a <name>.service.spec.ts beside each <name>.service.ts in this slot (only services are unit-tested; a webhook or realtime door has its own spec beside it)',
   e2e: 'an integration, e2e or contract spec covering the flow; no unit spec is required',
   none: 'no test is required for files in this slot',
 };

package/runtime/scripts/hfs/coverage-scope.mjs

@@ -0,0 +1,162 @@
+// coverage-scope.mjs - THE derivation of what a back end measures (R204 HFS_COVERAGE_SCOPE_DRIFT).
+//
+// One input: the slot manifest. Every tracked slot of the be profile declares `coverage: required | none`, and
+// `ruleParams.be.logicRoles` names the roles that carry logic. A file `<name>.<role>.ts` of a logic role inside a required slot is
+// measured at 100 per file; every other file of the back end is not. Three consumers read this module and nothing else:
+//   - the jest preset: `jestCoverage` (roots x roles, and the none subtrees inside a root) becomes the per-file thresholds and
+//     collectCoverageFrom of the rendered be/jest.config.js;
+//   - Sonar: `sonarCoverageExclusions` are the complement (SonarQube has no inclusions and no negation), rendered into
+//     sonar.coverage.exclusions;
+//   - Codecov: `codecovPaths` are the measured roots, and `coverageComponents` one component per service app plus platform,
+//     each 100% and red below it, rendered into codecov.yml.
+// starci app sync renders the three for an app, scripts/checks/check-examples-ci.mjs for the example apps of the runtime repository,
+// and `starci app check` compares the files with this derivation. Nothing here lists a path of a product: it all comes from slots.yaml.
+import { braceVariants, globExpression } from '../lib/glob.mjs';
+import { logicRolesOf } from './manifest-shape.mjs';
+
+/** The component that holds the shared infrastructure: the platform tier and every capability more than one service app composes. */
+export const PLATFORM_COMPONENT = 'platform';
+const SERVICE_APP_KINDS = new Set(['api', 'worker']);
+const star = (text) => String(text).replace(/<[^>]+>/g, '*');
+const segments = (dir) => dir.replace(/\/+$/, '').split('/').filter(Boolean);
+const isDir = (path) => path.endsWith('/');
+
+/** True when directory pattern `inner` lies inside `outer` (an outer `*` segment matches any one inner segment) or is the same. */
+function nested(inner, outer) {
+  const a = segments(inner);
+  const b = segments(outer);
+  return a.length >= b.length && b.every((segment, index) => segment === '*' ? true : segment === a[index]);
+}
+
+/** The directory patterns (be-relative, placeholders as `*`, trailing slash) of a slot's path variants; a file pattern keeps its name. */
+const variantsOf = (slot) => braceVariants(slot.path).map(star);
+
+/**
+ * The tracked slots of the be profile, in manifest order. A slot gated by a connection provider (be.integrations.supabase) holds files only in an
+ * app whose connection declares that provider (`providers`), so it takes no part in the scope of any other app.
+ */
+const beSlots = (manifest, providers) => manifest.slots.filter((slot) => slot.profiles.includes('be') && slot.tracked === 'tracked' && (slot.provider === undefined || providers.includes(slot.provider)));
+
+/** The directory a path pattern lives in (itself when it is one). */
+const dirOf = (path) => (isDir(path) ? path : path.slice(0, path.lastIndexOf('/') + 1));
+
+/** The unique directory patterns not nested inside another one. */
+const minimal = (patterns) => {
+  const unique = [...new Set(patterns)];
+  return unique.filter((pattern) => !unique.some((other) => other !== pattern && nested(pattern, other)));
+};
+
+/**
+ * The scope of an app's back end, derived from the manifest: { roles, roots, excludes, none, sonar, codecovPaths }.
+ *   roles     ruleParams.be.logicRoles;
+ *   roots     the minimal required directories (be-relative, `*` for a placeholder, trailing slash), sorted;
+ *   excludes  the none directories inside a root (never measured though their root is);
+ *   none      the minimal none paths of the whole back end (a directory ends in a slash), sorted;
+ *   sonar     sonar.coverage.exclusions, repository-relative from the app root, sorted;
+ *   codecovPaths  the measured roots as `be/<root>**`.
+ */
+export function coverageScope(manifest, providers = []) {
+  const roles = [...logicRolesOf(manifest)];
+  const slots = beSlots(manifest, providers);
+  const required = slots.filter((slot) => slot.coverage === 'required');
+  const none = slots.filter((slot) => slot.coverage === 'none');
+  const requiredDirs = required.flatMap((slot) => variantsOf(slot).map((dir) => {
+    if (!isDir(dir)) throw new Error(`slot ${slot.id} is coverage: required but its path ${slot.path} is not a directory`);
+    return dir;
+  }));
+  const roots = minimal(requiredDirs).sort();
+  const nonePaths = none.flatMap((slot) => variantsOf(slot));
+  for (const dir of nonePaths.filter(isDir)) if (requiredDirs.some((other) => nested(other, dir))) throw new Error(`a coverage: none directory ${dir} contains a coverage: required slot`);
+  const noneUnique = [...new Set(nonePaths)];
+  const noneMinimal = noneUnique.filter((path) => !noneUnique.some((other) => other !== path && isDir(other) && nested(dirOf(path), other)));
+  const excludes = noneMinimal.filter((path) => isDir(path) && roots.some((root) => nested(path, root))).sort();
+  const suffixes = manifest.ruleParams.be.suffixes;
+  const isRole = new RegExp(`\\.(?:${suffixes.map((s) => s.replace(/-/g, '\\-')).join('|')})\\.ts$`);
+  const sonar = new Set(noneMinimal.map((path) => `be/${path}${isDir(path) ? '**' : ''}`));
+  for (const role of suffixes.filter((suffix) => !roles.includes(suffix))) sonar.add(`be/**/*.${role}.ts`);
+  for (const slot of required) {
+    for (const entry of [...(slot.requires ?? []), ...(slot.allows ?? [])]) {
+      if (!/\.ts$/.test(entry) || entry.includes('<role>')) continue;
+      for (const name of braceVariants(entry)) {
+        if (isRole.test(star(name).replace(/\*/g, 'x'))) continue;
+        for (const dir of variantsOf(slot)) sonar.add(`be/${dir}${star(name)}`.replace(/\/\/+/g, '/'));
+      }
+    }
+  }
+  sonar.add('fe/**');
+  return { roles, roots, excludes, none: noneMinimal.sort(), sonar: [...sonar].sort(), codecovPaths: roots.map((root) => `be/${root}**`) };
+}
+
+/** The glob a root measures: every file of a logic role below it (`src/modules/domain/*\/**\/*.{service,policy}.ts`). */
+export const rootGlob = (root, roles) => `${root}**/*.${roles.length === 1 ? roles[0] : `{${roles.join(',')}}`}.ts`;
+
+/** The jest coverage options of the rendered be/jest.config.js: { roots, roles, excludes }. */
+export function jestCoverage(manifest, providers = []) {
+  const { roots, roles, excludes } = coverageScope(manifest, providers);
+  return { roots, roles, excludes: excludes.map((dir) => `${dir}**`) };
+}
+
+/** Sonar's sonar.coverage.exclusions of an app: the complement of the measured files, repository-relative from the app root. */
+export const sonarCoverageExclusions = (manifest, providers = []) => coverageScope(manifest, providers).sonar;
+
+/** The Codecov paths of an app: the measured roots, repository-relative from the app root. */
+export const codecovPaths = (manifest, providers = []) => coverageScope(manifest, providers).codecovPaths;
+
+/**
+ * The capability a be-relative file belongs to inside a root, or null: the folder the root's last `*` stands for
+ * (`src/modules/domain/*\/` and `src/modules/domain/order/order.service.ts` give `order`).
+ */
+function capabilityOf(root, file) {
+  const parts = segments(root);
+  const at = parts.length - 1;
+  if (parts[at] !== '*') return null;
+  const own = file.split('/');
+  return parts.slice(0, at).every((part, index) => part === own[index]) && own.length > at + 1 ? own[at] : null;
+}
+
+/**
+ * The Codecov components of an app, [{ id, name, paths }] (paths repository-relative from the app root): one per service app (api or worker)
+ * that composes the capabilities nothing else composes, then `platform`. A capability of a root whose last segment is a placeholder
+ * (`src/modules/domain/<capability>/`, projections, integrations) belongs to the one service app whose composition root
+ * (`apps/<app>/`) imports `@modules/<tier>/<capability>`; when several import it, the service app named like the capability (the
+ * `identity` service and the `identity` capability) owns it; one that nothing singles out belongs to platform, as does the whole platform tier. The measured roots of the tier `platform` are never split.
+ *
+ * @param {object} manifest the slot manifest
+ * @param {{ files: string[], read: (file: string) => string, apps: Array<{name: string, kind: string}> }} source be-relative source files, a reader, the declared be apps
+ */
+export function coverageComponents(manifest, { files, read, apps, providers = [] }) {
+  const { roots } = coverageScope(manifest, providers);
+  const services = apps.filter((app) => SERVICE_APP_KINDS.has(app.kind));
+  const imports = new Map(services.map((app) => [app.name, files.filter((file) => file.startsWith(`apps/${app.name}/`) && /\.[cm]?ts$/.test(file)).map((file) => read(file)).join('\n')]));
+  const platformPaths = [];
+  const ownedBy = new Map(services.map((app) => [app.name, []]));
+  for (const root of roots) {
+    const module = /^src\/modules\/(.+)\/\*\/$/.exec(root)?.[1] ?? null;
+    const capabilities = [...new Set(files.map((file) => capabilityOf(root, file)).filter(Boolean))].sort();
+    const base = root.slice(0, -2);
+    if (module === null || module === 'platform' || !capabilities.length) {
+      platformPaths.push(`be/${root}**`);
+      continue;
+    }
+    for (const capability of capabilities) {
+      const spec = new RegExp(`from\\s+["']@modules/${module.replace(/[/.]/g, '\\$&')}/${capability.replace(/[/.]/g, '\\$&')}["']`);
+      const importers = services.filter((app) => spec.test(imports.get(app.name)));
+      const owners = importers.length === 1 ? importers : importers.filter((app) => app.name === capability);
+      if (owners.length === 1) ownedBy.get(owners[0].name).push(`be/${base}${capability}/**`);
+      else platformPaths.push(`be/${base}${capability}/**`);
+    }
+  }
+  return [
+    ...services.filter((app) => ownedBy.get(app.name).length).map((app) => ({ id: app.name, name: app.name, paths: ownedBy.get(app.name).sort() })),
+    ...(platformPaths.length ? [{ id: PLATFORM_COMPONENT, name: PLATFORM_COMPONENT, paths: platformPaths.sort() }] : []),
+  ];
+}
+
+/** True when the be-relative `file` is measured: it is `<name>.<role>.ts` of a logic role below a measured root and inside no none directory of it. */
+export function isMeasured(manifest, file) {
+  const { roots, roles, excludes } = coverageScope(manifest);
+  const role = /\.([a-z][a-z0-9-]*)\.ts$/.exec(file)?.[1];
+  if (!role || !roles.includes(role)) return false;
+  const inside = (dir) => globExpression(`${dir}**`).test(file);
+  return roots.some(inside) && !excludes.some(inside);
+}

package/runtime/scripts/hfs/declaration-shape.mjs

@@ -0,0 +1,62 @@
+// declaration-shape.mjs - the dependency-free hfs.json shape validation used by the HFS slot loader. Semantic checks
+// against a loaded manifest remain in slots.mjs; this module mirrors modules/schemas/hfs-repo.schema.yaml only.
+import { isPlainObject } from '../../engine/plain-object.mjs';
+import { APP_KIND, connectionShapeProblems, NAME, RUNTIME_KIND, SLOT_ID } from './manifest-shape.mjs';
+import { kindShapeProblems, patternShapeProblems } from './declaration-slots.mjs';
+
+/** Shape problems of the optional hfs.json `supabase` block whose auth posture DB_CONFIG_POLICY checks. */
+function supabaseBlockProblems(block) {
+  if (block === undefined) return [];
+  if (!isPlainObject(block)) return ['supabase must be an object'];
+  const bad = [];
+  for (const key of Object.keys(block)) if (!['enableSignup', 'jwtExpiry', 'siteUrl', 'redirectUrls', 'forceRls'].includes(key)) bad.push(`supabase has unknown key ${key}`);
+  if (block.enableSignup !== undefined && typeof block.enableSignup !== 'boolean') bad.push('supabase.enableSignup must be true or false');
+  if (block.jwtExpiry !== undefined && !(Number.isInteger(block.jwtExpiry) && block.jwtExpiry > 0 && block.jwtExpiry <= 3600)) bad.push('supabase.jwtExpiry must be an integer of seconds, 3600 at most');
+  if (block.siteUrl !== undefined && (typeof block.siteUrl !== 'string' || !block.siteUrl.trim())) bad.push('supabase.siteUrl must be a URL string');
+  for (const key of ['redirectUrls', 'forceRls']) if (block[key] !== undefined && !(Array.isArray(block[key]) && block[key].every((value) => typeof value === 'string' && value.trim()))) bad.push(`supabase.${key} must be a list of strings`);
+  return bad;
+}
+
+/** Shape problems of a parsed hfs.json, in the words of modules/schemas/hfs-repo.schema.yaml. */
+export function declarationShapeProblems(declaration, profiles) {
+  const bad = [];
+  if (!isPlainObject(declaration)) return ['hfs.json is not an object'];
+  if (!(Number.isInteger(declaration.hfs) && declaration.hfs >= 1)) bad.push('hfs must be the pinned manifest major (an integer, 1 or more)');
+  if (!NAME.test(String(declaration.project))) bad.push('project must be a project name');
+  if (declaration.kind === RUNTIME_KIND) {
+    for (const key of Object.keys(declaration)) if (!['hfs', 'kind', 'project'].includes(key)) bad.push(`unknown key ${key} (a runtime declaration is {hfs, kind, project})`);
+    return bad;
+  }
+  for (const key of Object.keys(declaration)) if (!['hfs', 'kind', 'project', 'edition', 'supabase', 'sides', 'browser'].includes(key)) bad.push(`unknown key ${key}`);
+  bad.push(...supabaseBlockProblems(declaration.supabase));
+  if (declaration.browser !== undefined && declaration.browser !== true) bad.push('browser is `true` when the app has a browser journey (slot app.browser), and is left out otherwise');
+  if (declaration.kind !== APP_KIND) bad.push(`kind must be ${APP_KIND} (a product is one app repository with a be and an fe side) or ${RUNTIME_KIND} (the StarCi runtime repository)`);
+  if (!isPlainObject(declaration.sides) || Object.keys(declaration.sides).sort().join() !== profiles.join()) { bad.push('sides must declare exactly be and fe'); return bad; }
+  const names = new Map();
+  for (const side of profiles) {
+    const value = declaration.sides[side];
+    const at = `sides.${side}`;
+    if (!isPlainObject(value)) { bad.push(`${at} must be an object`); continue; }
+    for (const key of Object.keys(value)) if (!['apps', 'optionalSlots', 'patterns', 'kinds', 'connections', 'reads'].includes(key)) bad.push(`${at} has unknown key ${key}`);
+    if (!Array.isArray(value.apps) || !value.apps.length) bad.push(`${at}.apps must list every ${side}/apps/<name> with its kind`);
+    else value.apps.forEach((app, index) => {
+      if (!isPlainObject(app) || !NAME.test(String(app.name)) || !NAME.test(String(app.kind)) || Object.keys(app).some((key) => key !== 'name' && key !== 'kind')) bad.push(`${at}.apps[${index}] must be {name, kind}`);
+      else if (names.has(app.name)) bad.push(`app ${app.name} is declared twice (${names.get(app.name)} and ${side})`);
+      else names.set(app.name, side);
+    });
+    if (value.optionalSlots !== undefined && (!Array.isArray(value.optionalSlots) || !value.optionalSlots.every((slot) => SLOT_ID.test(String(slot))) || new Set(value.optionalSlots).size !== value.optionalSlots.length)) bad.push(`${at}.optionalSlots must be a unique list of slot ids`);
+    bad.push(...patternShapeProblems(value, at, NAME), ...kindShapeProblems(value, at, NAME));
+    if (value.reads !== undefined && (!Array.isArray(value.reads) || !value.reads.every((read) => typeof read === 'string' && read.length > 0) || new Set(value.reads).size !== value.reads.length)) bad.push(`${at}.reads must be a unique list of paths`);
+    if (value.connections !== undefined) {
+      if (side !== 'be') { bad.push('connections belong to the be side'); continue; }
+      const list = Array.isArray(value.connections) ? value.connections : null;
+      const shape = connectionShapeProblems(list, value.apps);
+      if (shape.length) bad.push(...shape);
+      else {
+        if (new Set(list.map((connection) => connection.name)).size !== list.length) bad.push('connections names must be unique');
+        for (const a of list) for (const b of list) if (a !== b && `${b.envPrefix}_`.startsWith(`${a.envPrefix}_`)) bad.push(`connections ${a.name} and ${b.name} share env keys (${a.envPrefix}_ covers ${b.envPrefix}_)`);
+      }
+    }
+  }
+  return bad;
+}