@starci/hfs 4.0.8 → 4.0.9

package/runtime/knowledge/hfs/rules.yaml

@@ -0,0 +1,2059 @@
+# knowledge/hfs/rules.yaml - the machine-readable catalog of the HFS rules (the ids run R01 up; an id with no rule is listed under `retired` with its reason, never reused; count the rules, never type the count).
+#
+# One entry per rule: its id, its finding code, the law in one line, how a violation is fixed
+# (`kinds`), the gates it runs at, the failure codes it reports, and every enforcer that judges it. The prose of each
+# rule is knowledge/hfs/README.md (section 12 lists the same ids and codes); this file is the data behind it. Read it only
+# through scripts/hfs/slots.mjs (loadRuleCatalog, rules); its shape is modules/schemas/hfs-rules.schema.yaml.
+#
+# An enforcer is a check that exists or one still owed. `status: planned` marks one owed: the architecture machine, the
+# hfs CLI, stylelint and Sonar lanes fill them, and the entry's `status` is removed the day the check ships (the check
+# refuses a planned enforcer that already exists). An existing eslint enforcer is a rule id of the plugin
+# `@starci/eslint-canon-be` or `@starci/eslint-canon-fe`; an existing machine, hfs or work-validate enforcer names the file
+# (`at`) that emits one of the rule's codes. scripts/checks/check-hfs-rules.mjs holds all of this to the packages, the
+# scripts and modules/kernel/failure-codes.yaml.
+#
+# Every rule is an error from 2.0. There is no baseline, allowlist or suppression file for a product. The runtime gate
+# (the StarCi runtime repository judged by knowledge/hfs/runtime-slots.yaml) has exactly one, the shrink-only sections of
+# modules/kernel/allowlist.yaml, held by RT_ALLOWLIST_SPRAWL. Codes are quoted: the failure-code
+# scanner reads this file as an emitter of every code it names.
+schema: starci/hfs-rules@2
+version: 2.0.0
+gates:
+  pre-commit: the managed .husky/pre-commit at the app root - starci app hygiene (staged .starciwork and .starcistacks paths, secrets guard), typecheck, ESLint per side and stylelint on the staged files, prettier --check, the unit specs the staged files touch
+  pre-push: typecheck, lint (starci app lint), format:check and the unit specs affected since origin/main; runs every pre-commit rule again
+  settle: the op gate scripts/gates/gate.mjs over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
+  land: the workflow's finish, the only time main is touched - gate.mjs over the whole workflow branch against its merge-base with main, the merge guard, review.verify of the exact head that lands, the branch rebased onto main, then main fast-forwarded and pushed
+  ci: GitHub Actions runs the same pinned starci app lint, format:check, typecheck, unit with the per-file coverage threshold, build:be and build:fe, then the Sonar scan and gate
+  sonar: Sonar quality gate (knowledge/sonar-gate.yaml) - the imported lint findings, duplication, cognitive complexity and the coverage of the logic of be/src/modules at 100
+  runtime: "`starci runtime check` (npm run check) of the StarCi runtime repository itself: scripts/checks/check-runtime.mjs runs node --check, scripts/hfs/runtime-check.mjs with knowledge/hfs/runtime-slots.yaml, and the retained self-checks"
+enforcerKinds:
+  eslint-be: a rule of the plugin @starci/eslint-canon-be (id without the plugin prefix)
+  eslint-fe: a rule of the plugin @starci/eslint-canon-fe (id without the plugin prefix)
+  stylelint: a rule of the @starci/stylelint-canon package
+  machine: a check of the architecture machine (scripts/hfs/architecture), which reads the import graph
+  hfs: a check of the hfs CLI that reads the repository tree, configuration, contracts or catalogs
+  work-validate: a check of scripts/work/validate/work-validate.mjs over a .starciwork tree
+  sonar: a condition of the Sonar quality gate
+  runtime: a rule module of the runtime check (scripts/hfs/runtime-check.mjs, scripts/hfs/runtime-rules/*) or an emitter whose findings it judges, over the runtime repository
+rules:
+  - id: R01
+    code: "HFS_SLOT_UNDECLARED"
+    law: "Every tracked path matches exactly one slot."
+    kinds: [check, lint]
+    gates: [pre-push, settle, land, ci, runtime]
+    failureCodes: ["HFS_SLOT_UNDECLARED", "HFS_SLOT_AMBIGUOUS", "HFS_SLOT_NOT_ENABLED", "HFS_FORBIDDEN_PRESENT", "HFS_TRACKED_MUST_BE_IGNORED", "HFS_ROOT_ENTRY_FORBIDDEN", "HFS_ROOT_MARKDOWN_FORBIDDEN", "HFS_ROOT_SRC_FORBIDDEN_FE", "HFS_SRC_LAYOUT_INVALID", "HFS_MODULE_TIER_INVALID", "HFS_WORK_IN_FE", "HFS_STACKS_IN_SIDE"]
+    enforcers:
+      - {kind: hfs, id: slot-undeclared, at: scripts/hfs/check.mjs}
+      - {kind: eslint-be, id: slot-undeclared}
+      - {kind: eslint-fe, id: slot-undeclared}
+      - {kind: machine, id: repository-tree-layout, at: scripts/hfs/architecture/hfs.mjs}
+      - {kind: runtime, id: runtime-tree, at: scripts/hfs/runtime-check.mjs}
+  - id: R02
+    code: "HFS_SLOT_REQUIRED_MISSING"
+    law: "A slot is missing a required file (feature `index.ts`, app `main.ts`, FE `global-error.tsx`), or the root README breaks its standard shape (title, description, standard sections in order, Work pointer, live badges only, no private URL)."
+    kinds: [check, codemod]
+    gates: [settle, land, ci, runtime]
+    failureCodes: ["HFS_SLOT_REQUIRED_MISSING", "HFS_MIN_INSTANCES", "HFS_REQUIRED_FILE_MISSING", "HFS_ROOT_ENTRY_MISSING", "HFS_APPS_REQUIRED", "HFS_APP_LAYOUT_INVALID", "HFS_README_TITLE_INVALID", "HFS_README_DESCRIPTION_INVALID", "HFS_README_SECTION_MISSING", "HFS_README_SECTION_ORDER", "HFS_README_DEVELOPMENT_INCOMPLETE", "HFS_README_WORK_POINTER_MISSING", "HFS_README_PRIVATE_URL", "HFS_README_BADGE_NOT_LIVE"]
+    enforcers:
+      - {kind: hfs, id: slot-required-missing, at: scripts/hfs/check.mjs}
+      - {kind: machine, id: required-files, at: scripts/hfs/architecture/required-files.mjs}
+      - {kind: machine, id: repository-tree-required, at: scripts/hfs/architecture/hfs.mjs}
+      - {kind: runtime, id: runtime-required, at: scripts/hfs/runtime-check.mjs}
+  - id: R03
+    code: "HFS_UNTRACKED_ROOT_ENTRY"
+    law: "No untracked or ignored entry outside an `ignored` slot."
+    kinds: [check, codemod]
+    gates: [pre-push, land, ci, runtime]
+    failureCodes: ["HFS_UNTRACKED_ROOT_ENTRY", "HFS_EMPTY_DIR", "HFS_GHOST_TREE"]
+    enforcers:
+      - {kind: hfs, id: untracked-root-entry, at: scripts/hfs/check.mjs}
+      - {kind: runtime, id: runtime-untracked, at: scripts/hfs/runtime-check.mjs}
+  - id: R04
+    code: "HFS_GITIGNORE_BLOCK_DRIFT"
+    law: "The managed `.gitignore` block equals its render."
+    kinds: [check, codemod]
+    gates: [pre-push, land, ci]
+    failureCodes: ["HFS_GITIGNORE_BLOCK_DRIFT"]
+    enforcers:
+      - {kind: hfs, id: gitignore-block-drift, at: packages/hfs/sync/managed.mjs}
+  - id: R05
+    code: "HFS_MANAGED_FILE_DRIFT"
+    law: "A managed file equals its template render."
+    kinds: [check, codemod]
+    gates: [pre-push, land, ci]
+    failureCodes: ["HFS_MANAGED_FILE_DRIFT"]
+    enforcers:
+      - {kind: hfs, id: managed-file-drift, at: packages/hfs/sync/managed.mjs}
+  - id: R06
+    code: "HFS_PLAINTEXT_SECRET"
+    law: "Secrets exist only as `.starcistacks/<env>/secrets/<slug>.enc`."
+    kinds: [check, design]
+    gates: [pre-commit, pre-push, land, ci]
+    failureCodes: ["HFS_PLAINTEXT_SECRET"]
+    enforcers:
+      - {kind: hfs, id: plaintext-secret, at: scripts/hfs/rules/secrets.mjs}
+      - {kind: hfs, id: plaintext-secret-staged, at: packages/hfs/sync/hygiene.mjs}
+  - id: R07
+    code: "HFS_AGENT_DATA_TRACKED"
+    law: "`.starciwork` holds product records only."
+    kinds: [check, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["HFS_AGENT_DATA_TRACKED"]
+    enforcers:
+      - {kind: work-validate, id: agent-data-tracked, at: scripts/work/validate/check-example-work.mjs}
+  - id: R08
+    code: "HFS_WORK_NODE_RETIRED"
+    law: "Only flat family records, never `work/node`."
+    kinds: [check, codemod]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_WORK_NODE_RETIRED"]
+    enforcers:
+      - {kind: work-validate, id: work-node-retired, at: scripts/work/validate/check-example-work.mjs}
+  - id: R09
+    code: "HFS_IDENTITY_CUSTODY"
+    law: "An identity points its secret at `secrets/identity-<slug>.enc`; UAT chooses by role."
+    kinds: [check, codemod]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_IDENTITY_CUSTODY", "SEALED_CUSTODY_LOCATION", "SEALED_FILE_IN_WORK"]
+    enforcers:
+      - {kind: work-validate, id: sealed-custody-location, at: scripts/work/validate/check-work-artifacts.mjs}
+      - {kind: work-validate, id: identity-custody-role, at: scripts/work/validate/check-example-work.mjs}
+  - id: R10
+    code: "HFS_STACKS_SHAPE"
+    law: "`.starcistacks` has the standard shape and the host Sonar owner."
+    kinds: [check, codemod]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_STACKS_SHAPE"]
+    enforcers:
+      - {kind: hfs, id: stacks-shape, at: scripts/hfs/rules/stacks.mjs}
+  - id: R11
+    code: "HFS_SONAR_CONFIG"
+    law: "Sonar config is generated, with no host URL, importing the be lcov with the logic of be/src/modules (the coverage scope derived from the slot manifest) as the only coverage scope."
+    kinds: [check, codemod]
+    gates: [land, ci]
+    failureCodes: ["HFS_SONAR_CONFIG"]
+    enforcers:
+      - {kind: hfs, id: sonar-config, at: packages/hfs/sync/managed.mjs}
+  - id: R12
+    code: "HFS_E2E_IN_AUTOMATIC_GATE"
+    law: "e2e never joins husky, coverage or automatic CI."
+    kinds: [check]
+    gates: [pre-push, land, ci]
+    failureCodes: ["HFS_E2E_IN_AUTOMATIC_GATE"]
+    enforcers:
+      - {kind: machine, id: e2e-in-automatic-gate, at: scripts/hfs/architecture/hfs.mjs}
+  - id: R13
+    code: "HFS_CI_MISSING_CANON"
+    law: "CI runs the pinned `starci app lint` (`npm run lint`), and a clone never redirects `core.hooksPath` away from husky."
+    kinds: [check, codemod]
+    gates: [pre-push, land, ci]
+    failureCodes: ["HFS_CI_MISSING_CANON", "HFS_HOOKS_PATH_REDIRECTED"]
+    enforcers:
+      - {kind: machine, id: hooks-path-not-redirected, at: scripts/hfs/architecture/hfs.mjs}
+      - {kind: hfs, id: ci-missing-canon, at: scripts/hfs/rules/pipeline.mjs}
+  - id: R14
+    code: "HFS_DEP_VERSION_SKEW"
+    law: "One version per dependency in the workspace, a root `overrides` pin included, and npm is the only package manager."
+    kinds: [check, codemod]
+    gates: [pre-push, land, ci]
+    failureCodes: ["HFS_DEP_VERSION_SKEW", "HFS_PACKAGE_MANAGER_MIXED"]
+    enforcers:
+      - {kind: hfs, id: dep-version-skew, at: scripts/hfs/rules/deps.mjs}
+      - {kind: machine, id: package-manager, at: scripts/hfs/architecture/hfs.mjs}
+  - id: R15
+    code: "HFS_CANON_PIN_DRIFT"
+    law: "Canon packages and frameworks match `canon-pins.yaml`."
+    kinds: [check, codemod]
+    gates: [pre-push, land, ci]
+    failureCodes: ["HFS_CANON_PIN_DRIFT"]
+    enforcers:
+      - {kind: hfs, id: canon-pin-drift, at: scripts/hfs/check.mjs}
+  - id: R16
+    code: "HFS_TOOL_CONFIG_LOCAL"
+    law: "Configs only call the factories; no local rules."
+    kinds: [check, codemod]
+    gates: [land, ci]
+    failureCodes: ["HFS_TOOL_CONFIG_LOCAL"]
+    enforcers:
+      - {kind: hfs, id: tool-config-local, at: packages/hfs/sync/managed.mjs}
+      - {kind: hfs, id: tool-config-forbidden, at: scripts/hfs/check.mjs}
+  - id: R17
+    code: "HFS_RULE_OFF_WITHOUT_REPLACEMENT"
+    law: "The ESLint configuration (and a front end's stylelint configuration) is the rendered one-liner, so no rule is off, warned or redefined in a repository."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_RULE_OFF_WITHOUT_REPLACEMENT"]
+    enforcers:
+      - {kind: hfs, id: rule-off-without-replacement, at: packages/hfs/sync/managed.mjs}
+  - id: R18
+    code: "HFS_INLINE_SUPPRESSION"
+    law: "No inline suppression of any kind."
+    kinds: [lint, design]
+    gates: [pre-commit, pre-push, land, ci]
+    failureCodes: ["HFS_INLINE_SUPPRESSION"]
+    enforcers:
+      - {kind: eslint-be, id: no-inline-suppression}
+      - {kind: eslint-fe, id: no-inline-lint-config}
+      - {kind: stylelint, id: no-inline-lint-config}
+  - id: R19
+    code: "HFS_FORMAT"
+    law: "Prettier is the only formatter."
+    kinds: [codemod]
+    gates: [pre-commit, pre-push, land, ci]
+    failureCodes: ["HFS_FORMAT"]
+    enforcers:
+      - {kind: hfs, id: format, at: packages/hfs/sync/format.mjs}
+  - id: R20
+    code: "HFS_SIZE_GROWTH"
+    law: "Over-budget files do not grow; new files are inside budget."
+    kinds: [lint, design]
+    gates: [land, ci, sonar, runtime]
+    failureCodes: ["HFS_SIZE_GROWTH", "HFS_SIZE_SOFT_BACKLOG"]
+    enforcers:
+      - {kind: eslint-be, id: file-size-growth}
+      - {kind: eslint-fe, id: file-size-growth}
+      - {kind: sonar, id: cognitive-complexity, at: knowledge/sonar-gate.yaml}
+      - {kind: runtime, id: runtime-size, at: scripts/hfs/runtime-rules/size.mjs}
+  - id: R21
+    code: "HFS_DUPLICATE_CODE"
+    law: "No duplicated blocks or twice-defined helpers."
+    kinds: [lint, design]
+    gates: [land, ci, sonar]
+    failureCodes: ["HFS_DUPLICATE_CODE", "HFS_DUPLICATE_SYMBOL", "FE_CROSS_APP_DUPLICATE"]
+    enforcers:
+      - {kind: eslint-be, id: duplicate-code}
+      - {kind: eslint-fe, id: duplicate-code}
+      - {kind: eslint-be, id: duplicate-symbol}
+      - {kind: eslint-fe, id: duplicate-symbol}
+      - {kind: eslint-fe, id: cross-app-duplicate}
+      - {kind: sonar, id: duplicated-lines-density, at: knowledge/sonar-gate.yaml}
+  - id: R22
+    code: "HFS_TS_STRICT"
+    law: "tsconfig extends `@starci/tsconfig` and lowers no flag; no assertion, `!` or `any` in product source."
+    kinds: [codemod, design, lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["HFS_TS_STRICT", "FE_TYPE_ESCAPE"]
+    enforcers:
+      - {kind: eslint-fe, id: no-type-assertion}
+      - {kind: eslint-fe, id: no-non-null-assertion}
+      - {kind: eslint-fe, id: no-explicit-any}
+      - {kind: hfs, id: ts-strict, at: packages/hfs/sync/ts-strict.mjs}
+      - {kind: eslint-fe, id: no-double-cast}
+  - id: R23
+    code: "HFS_CONTRACT_SNAPSHOT_DRIFT"
+    law: "The be side commits its contract snapshot and it equals the emit; the fe side reads it in place (be/contracts/)."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_CONTRACT_SNAPSHOT_DRIFT"]
+    enforcers:
+      - {kind: hfs, id: contract-snapshot-drift, at: scripts/hfs/rules/contract.mjs}
+  - id: R24
+    code: "HFS_ARCH_CONFIG_UNREAD"
+    law: "The machine reads `hfs.json`; zero files analysed is red."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_ARCH_CONFIG_UNREAD"]
+    enforcers:
+      - {kind: machine, id: arch-config-unread, at: scripts/hfs/architecture/config-unread.mjs}
+  - id: R25
+    code: "HFS_UNUSED_EXPORT"
+    law: "No public export without a consumer; no source file nothing reaches."
+    kinds: [lint, codemod]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["HFS_UNUSED_EXPORT", "HFS_UNUSED_FILE"]
+    enforcers:
+      - {kind: eslint-be, id: dead-exports}
+      - {kind: eslint-fe, id: dead-exports}
+  - id: R26
+    code: "BE_TIER_DIRECTION"
+    law: "The tier direction matrix; a shared package never imports an app."
+    kinds: [lint, design]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["BE_TIER_DIRECTION", "FE_TIER_DIRECTION", "ARCH_PACKAGE_IMPORTS_APP"]
+    enforcers:
+      - {kind: eslint-be, id: tier-direction}
+      - {kind: eslint-fe, id: tier-direction}
+      - {kind: eslint-be, id: package-imports-app}
+      - {kind: eslint-fe, id: package-imports-app}
+  - id: R27
+    code: "ARCH_OWNER_CYCLE"
+    law: "No owner cycles, type-only included."
+    kinds: [lint, design]
+    gates: [pre-push, settle, land, ci, runtime]
+    failureCodes: ["ARCH_OWNER_CYCLE"]
+    enforcers:
+      - {kind: eslint-be, id: owner-cycle}
+      - {kind: eslint-fe, id: owner-cycle}
+      - {kind: runtime, id: runtime-cycles, at: scripts/hfs/runtime-rules/tier-direction.mjs}
+  - id: R28
+    code: "BE_FEATURE_IMPORTS_FEATURE"
+    law: "A feature never imports a feature."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_FEATURE_IMPORTS_FEATURE"]
+    enforcers:
+      - {kind: eslint-be, id: feature-imports-feature}
+  - id: R29
+    code: "BE_FEATURE_SHAPE"
+    law: "Feature root is `index.ts`, module, `application/`, `transport/<protocol>/`; `application/` never imports `transport/` or a protocol framework."
+    kinds: [check, codemod, design, lint]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_FEATURE_SHAPE", "BE_FEATURE_LAYOUT_INVALID", "BE_APPLICATION_IMPORTS_TRANSPORT", "BE_APPLICATION_TRANSPORT_FRAMEWORK"]
+    enforcers:
+      - {kind: machine, id: feature-shape, at: scripts/hfs/architecture/feature-shape.mjs}
+      - {kind: eslint-be, id: feature-layout}
+      - {kind: eslint-be, id: application-never-imports-transport}
+  - id: R30
+    code: "BE_PUBLIC_SURFACE"
+    law: "Every owner has one `index.ts`; cross-owner imports use it, same-owner imports are relative and never go through it; it holds only named `export { }` lines, no `export *`, no alias re-export (`export { X as Y }`, `export const Y = X`, `export type Y = X`, `export interface Y extends X {}`: one declaration has one name), at most 60 exports; cross-package imports use the package name and a declared export."
+    kinds: [lint, codemod]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["BE_PUBLIC_SURFACE", "ARCH_OWNER_EXPORT_BYPASS", "ARCH_OWNER_EXPORT_STAR", "HFS_ALIAS_REEXPORT", "ARCH_PACKAGE_EXPORT_BYPASS"]
+    enforcers:
+      - {kind: eslint-be, id: import-owner-entry}
+      - {kind: eslint-be, id: no-folder-reexport}
+      - {kind: eslint-be, id: owner-export-bypass}
+      - {kind: eslint-fe, id: owner-export-bypass}
+      - {kind: eslint-be, id: alias-reexport}
+      - {kind: eslint-fe, id: alias-reexport}
+      - {kind: eslint-be, id: no-relative-capability-escape}
+      - {kind: eslint-be, id: no-self-module-alias}
+      - {kind: eslint-be, id: package-export-bypass}
+      - {kind: eslint-fe, id: package-export-bypass}
+  - id: R31
+    code: "BE_FEATURE_NOT_COMPOSED"
+    law: "Every feature, transport module and capability module is composed by an app."
+    kinds: [lint, design]
+    gates: [land, ci]
+    failureCodes: ["BE_FEATURE_NOT_COMPOSED"]
+    enforcers:
+      - {kind: eslint-be, id: feature-not-composed}
+  - id: R32
+    code: "BE_APP_COMPOSITION_ONLY"
+    law: "Apps compose only; an app is proven by the e2e world (`useTestWorld({ apps })`), never by a unit spec."
+    kinds: [lint, codemod]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_APP_COMPOSITION_ONLY", "BE_APP_BUSINESS_ROLE"]
+    enforcers:
+      - {kind: eslint-be, id: app-composition-only}
+  - id: R33
+    code: "BE_ENTRYPOINT_ONLY_IN_APPS"
+    law: "Entrypoints only in `be/apps/*/src`."
+    kinds: [lint, codemod]
+    gates: [land, ci]
+    failureCodes: ["BE_ENTRYPOINT_ONLY_IN_APPS"]
+    enforcers:
+      - {kind: eslint-be, id: entrypoint-only-in-apps}
+  - id: R34
+    code: "BE_SCHEMA_AUTHORITY"
+    law: "Migrations are the only schema authority, run only by the cli migrate command and the test world; `synchronize` is `false`."
+    kinds: [lint, codemod, design]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_SCHEMA_AUTHORITY"]
+    enforcers:
+      - {kind: eslint-be, id: no-runtime-schema}
+  - id: R35
+    code: "BE_SCHEMA_OWNER"
+    law: "Entities and migrations live in the owning capability's `persistence/`; its `<c>Entities` and `<c>Migrations` are registered under exactly one declared connection, which every `Inject<Conn>EntityManager` of the capability names (no `CONNECTION` alias); only a platform capability the manifest lists as `perConnection` (the event-bus outbox, the job table) registers on several."
+    kinds: [lint, codemod, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_SCHEMA_OWNER"]
+    enforcers:
+      - {kind: eslint-be, id: schema-owner}
+  - id: R36
+    code: "BE_SQL_OUTSIDE_PERSISTENCE"
+    law: "Raw SQL is `sql`-tagged `SqlText` in `persistence/<name>.sql.ts` of the owning capability; `.query()` takes only `SqlText`; no QueryBuilder."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_SQL_OUTSIDE_PERSISTENCE"]
+    enforcers:
+      - {kind: eslint-be, id: sql-text-only}
+      - {kind: eslint-be, id: no-query-builder}
+  - id: R37
+    code: "BE_ENTITY_IN_CONTRACT"
+    law: "No ORM entity in a contract or transport type."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_ENTITY_IN_CONTRACT"]
+    enforcers:
+      - {kind: eslint-be, id: no-entity-in-contract}
+  - id: R38
+    code: "BE_ERROR_HOME"
+    law: "Errors live in the owning capability's `errors/` and extend `DomainError`."
+    kinds: [lint, codemod]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_ERROR_HOME"]
+    enforcers:
+      - {kind: eslint-be, id: error-home}
+      - {kind: eslint-be, id: throw-domain-error}
+      - {kind: eslint-be, id: error-family-shape}
+      - {kind: eslint-be, id: error-code-unique}
+  - id: R39
+    code: "BE_ERROR_MASKED"
+    law: "One filter per app; undeclared errors are masked."
+    kinds: [lint, codemod]
+    gates: [land, ci]
+    failureCodes: ["BE_ERROR_MASKED"]
+    enforcers:
+      - {kind: eslint-be, id: error-masked}
+  - id: R40
+    code: "BE_LOGGER_REQUIRED"
+    law: "`platform/logging` exists and its `Logger` port is the only logger; every `catch` logs, rethrows or returns a reasoned outcome, and a log call names its event with a member of an owner's `<owner>.log-events.ts` enum."
+    kinds: [lint, design]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_LOGGER_REQUIRED"]
+    enforcers:
+      - {kind: eslint-be, id: catch-must-account}
+      - {kind: eslint-be, id: no-error-wording-as-log-identity}
+      - {kind: eslint-be, id: no-interpolated-log-message}
+      - {kind: eslint-be, id: no-framework-logger}
+  - id: R41
+    code: "BE_DEFAULT_DENY"
+    law: "APP_GUARD plus `@Public({ reason: PublicReason.X })`; no `@UseGuards`; typed bodies; `timingSafeEqual`."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_DEFAULT_DENY"]
+    enforcers:
+      - {kind: eslint-be, id: no-untyped-body}
+      - {kind: eslint-be, id: public-needs-reason}
+      - {kind: eslint-be, id: secret-compare-timing-safe}
+      - {kind: eslint-be, id: no-auth-use-guards}
+      - {kind: eslint-be, id: default-deny-app-guard}
+  - id: R42
+    code: "BE_INPUT_BOUNDED"
+    law: "Bounded input, cursor-only pagination, depth limits, rate limits; every property of an input class carries the `class-validator` decorators its type calls for; a door opened for `PublicReason.AuthHandshake` or `PublicReason.SignedWebhook` carries `RateTier.Strict` of `platform/http-security`."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_INPUT_BOUNDED"]
+    enforcers:
+      - {kind: eslint-be, id: input-bounded}
+      - {kind: eslint-be, id: no-offset-pagination}
+      - {kind: eslint-be, id: auth-door-strict-rate-tier}
+  - id: R43
+    code: "BE_CONFIG_OWNER"
+    law: "Only `platform/config` reads `process.env`; config per capability."
+    kinds: [lint, design]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_CONFIG_OWNER"]
+    enforcers:
+      - {kind: eslint-be, id: no-direct-env-read}
+      - {kind: eslint-be, id: config-parsed-in-main}
+  - id: R44
+    code: "BE_SECRET_DEFAULT"
+    law: "No default for a secret key or infrastructure URL."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, land, ci]
+    failureCodes: ["BE_SECRET_DEFAULT"]
+    enforcers:
+      - {kind: eslint-be, id: no-secret-default}
+  - id: R45
+    code: "BE_MODULE_SHAPE"
+    law: "`@Global` nowhere and `isGlobal: true` only at app roots; no cross-owner module imports; typed options; one module per transport; every handler and provider registered exactly once."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_MODULE_SHAPE", "BE_MODULE_HANDLER_REGISTRATION", "BE_MODULE_PROVIDER_REREGISTRATION"]
+    enforcers:
+      - {kind: eslint-be, id: no-global-decorator}
+      - {kind: eslint-be, id: is-global-only-in-app}
+      - {kind: eslint-be, id: no-cross-owner-module-import}
+      - {kind: eslint-be, id: capability-module-shape}
+      - {kind: eslint-be, id: typed-module-definition}
+      - {kind: eslint-be, id: static-module-register}
+      - {kind: eslint-be, id: no-new-injectable}
+      - {kind: eslint-be, id: no-module-let}
+      - {kind: eslint-be, id: one-module-per-file}
+      - {kind: eslint-be, id: register-once}
+      - {kind: eslint-be, id: module-per-transport}
+      - {kind: eslint-be, id: module-registration}
+  - id: R46
+    code: "BE_BACKGROUND_UNOWNED"
+    law: "Every sweep, outbox or retry has a job or consumer composed by an app: the service that owns it (an api app) or a worker app scaled apart."
+    kinds: [lint, design]
+    gates: [land, ci]
+    failureCodes: ["BE_BACKGROUND_UNOWNED"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: background-unowned}
+  - id: R47
+    code: "BE_TEST_TOPOLOGY"
+    law: "One jest config, projects `unit`, `integration`, `e2e` and `contract`, live by folder, `diagnostics: false`; unit specs are `<name>.<role>.spec.ts` beside the file they test: required for the roles of `ruleParams.be.unitRoles` (`<name>.service.spec.ts` beside a `<name>.service.ts`, `<name>.cli.spec.ts` beside a cli command `<name>.cli.ts` of `src/features/cli`), optional for any other logic role (`ruleParams.be.logicRoles`) inside a slot whose `coverage` is required, and nowhere else but beside a webhook or realtime door that has no service of its own (`<provider>.webhook.spec.ts`, `<channel>.gateway.spec.ts`, `<x>.subscription.spec.ts`) (every unit-tested subject has exactly one; any other `*.spec.ts` outside `be/src/tests/{world,integration,e2e,contract}` is a finding, including specs in apps), and the unit project collects coverage from the logic roles of the measured roots only (the scope derived from the slot manifest, R204) with a per-file threshold of 100 on lines, branches, functions and statements (`test` runs `--coverage`; `importHelpers` and `tslib`); `be/src/tests/world/` is the ONLY test infrastructure: `global-setup.ts` starts the app's own stack (`.starcistacks/<env>`, named by `stack` in `test-world.config.ts`, the declaration of the test-world library in its one named form `export const { useTestWorld, useSandbox } = defineTestWorld({...})` (a default export is not read): every service it declares runs REAL, behind toxiproxy, images and versions read from the stack at run time, never spelled in test source) or attaches to a warm one that answers, and runs the migrations once over the cli app's connections (the runner of the cli migrate command); `global-teardown.ts` stops only what its setup started; `use-test-world.ts` exports `useTestWorld({ apps } | { modules })` (`world.apps.<name>.api`, `world.db.<connection>`, `world.infra.<service>` with `latency(ms)`, `cut()` and `restore()` on the real service, `world.fake.<provider>`, `world.waitFor`) and `fakes/<provider>/` holds the network-edge fakes (`failNext`, `replayWebhook`, `delay`, payload fixtures) of external SaaS the team does not operate ONLY: a fake of a service the stack declares is refused, except stateless compute that needs special hardware or an external model (GPU inference, a self-hosted embedding model), whose `stacks` entry in `test-world.config.ts` declares `{ fakedBy: <fake>, reason }` with a non-empty `reason` (a stateful service, or one with a persistent volume, is never accepted); it alone owns containers, DataSource, migrations and `process.env`; nothing under `be/src/tests` overrides a provider or DI token; `be/src/tests/integration/<capability>/*.integration-spec.ts` (`{ modules }`, with the real peer apps its client calls beside them as `apps`; real infrastructure, no HTTP door of ours), `be/src/tests/e2e/<area>/*.e2e-spec.ts` (`{ apps }`) and `be/src/tests/contract/<provider>/*.contract-spec.ts` (provider sandboxes, skipped without sandbox config, run only by `test:contract`, never by `test` or `test:e2e`) agree folder with suffix; an integration or e2e spec passes `useTestWorld` one object literal with plain keys (no variable, spread or computed key) and calls it; the contract layer skips only through the test-world library's `useSandbox(...)` when the sandbox config is absent (`sandbox.describe(...)`), and every `fakes/<provider>/` that serves payload fixtures (`payloads/*.json`) has a `contract/<provider>/*.contract-spec.ts` that references those fixtures and asserts `shapeOf(real)` equals `shapeOf(fixture)` (the helper `shapeOf` is named by `ruleParams.be.contractShape` of the slot manifest; fakes the test-world library provides are guarded by the library); no `.test.ts`, `int-spec` or `harness-spec`, no `live/` and no `be/src/tests/e2e/world`."
+    kinds: [check, codemod, lint]
+    gates: [land, ci]
+    failureCodes: ["BE_TEST_TOPOLOGY", "BE_CONTRACT_UNGUARDED"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: test-topology, at: scripts/hfs/rules/test-topology.mjs}
+      - {kind: machine, id: test-kind-retired, at: scripts/hfs/architecture/hfs.mjs}
+      - {kind: eslint-be, id: test-world-files}
+      - {kind: machine, id: contract-fixture-guard, at: scripts/hfs/architecture/contract-fixture-guard.mjs}
+      - {kind: eslint-be, id: unit-test-colocated}
+      - {kind: eslint-be, id: tests-infra-only-in-world}
+      - {kind: eslint-be, id: tests-no-override}
+      - {kind: eslint-be, id: test-world-shape}
+  - id: R48
+    code: "BE_SPEC_QUALITY"
+    law: "No source-reading specs; a spec asserts results or state, not only calls; no `as` and no `x!` in a spec (the borrowed rules of R72), no return-only generic (`<T>(value: unknown): T`), `unknown` handed back as a concrete type, `JSON.parse(JSON.stringify(x))` or `Object.assign(new X(), y)` returned as another type in a spec or a test fixture, and no `Date.now()`, argless `new Date()` or `process.env` (R79, R43); a unit spec (`<name>.service.spec.ts`) builds its subject with `Test.createTestingModule({ providers: [...] }).compile()` and `moduleRef.get(Subject)`: no `new` of the service, no `imports` key, no `override*` call, and no `jest.mock`, `jest.doMock`, `jest.unstable_mockModule` or `jest.requireMock` of an own module or a third-party library; it provides each infrastructure token from its `@starci/jest-preset` double (`mockEntityManager(...)` for an EntityManager token, `new FakeClock(...)`, `recordingEventBus()`, `recordingQueueOutbox()`, `fakeCache(...)`, `fakeLock(...)`, `fakeIds()`, `builder(...)(...)` or a plain literal of real values for an options token, `mock<T>()` for everything else; the token table is `ruleParams.be.specDoubles` of the slot manifest) and takes its EntityManager only from the kit's `mockEntityManager()` or `fakeTransaction()`, never an ad-hoc `jest.fn` object, and asserts exact values: ids from `fakeIds()` and dates from `FakeClock` are compared as themselves, never `expect.any(String)`, `expect.any(Number)` or `expect.any(Date)`; an e2e enters through transport, waits with `waitFor`, boots through `useTestWorld`, reads persisted state back and reaches no model provider. Test data is arranged by builders, which R98 to R101 hold. No spec of any layer skips, focuses or marks a test todo (`skip`, `skipIf`, `runIf`, `todo`, `only`, `xit`, `xdescribe`, `xtest`) and none selects its runner conditionally, and no file of the test tree (world, fixtures, kit) writes one either; the only skip is the test-world library's `useSandbox(...)` (`@starci/test-world`), which skips a contract spec when the sandbox config is absent."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_SPEC_QUALITY"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: spec-no-source-read}
+      - {kind: eslint-be, id: e2e-uses-production-transport}
+      - {kind: eslint-be, id: no-branch-in-flow-step}
+      - {kind: eslint-be, id: no-sleep-in-flow}
+      - {kind: eslint-be, id: no-wiring-in-flow-spec}
+      - {kind: eslint-be, id: e2e-asserts-persisted-state}
+      - {kind: eslint-be, id: no-api-shaped-e2e-filename}
+      - {kind: eslint-be, id: no-call-only-spec}
+      - {kind: eslint-be, id: no-marker-model-stub}
+      - {kind: eslint-be, id: no-model-call-in-e2e}
+      - {kind: eslint-be, id: spec-typed-entity-manager}
+      - {kind: eslint-be, id: spec-builds-with-testing-module}
+      - {kind: eslint-be, id: spec-no-new-subject}
+      - {kind: eslint-be, id: spec-module-definition-only-providers}
+      - {kind: eslint-be, id: spec-no-module-mock}
+      - {kind: eslint-be, id: no-return-only-generic}
+      - {kind: eslint-be, id: spec-infra-double-from-kit}
+      - {kind: eslint-be, id: spec-exact-values}
+      - {kind: eslint-be, id: spec-no-skip}
+      - {kind: eslint-be, id: unit-spec-providers}
+  - id: R49
+    code: "FE_ENV_OWNER"
+    law: "Only `modules/config` reads the environment; no localhost fallback."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_ENV_OWNER"]
+    enforcers:
+      - {kind: eslint-fe, id: no-env-outside-config}
+      - {kind: eslint-fe, id: no-hardcoded-endpoint-fallback}
+  - id: R50
+    code: "FE_TRANSPORT_OWNER"
+    law: "One `fetch` per front end, in the transport client: `fe/apps/<app>/src/modules/api/client.ts` of a one-app front end or `fe/packages/<family>-api/src/client.ts` shared by every app; timeout and abort; a client read is SWR whose key carries the identity of its result, and a mutation is tied to its resource."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_TRANSPORT_OWNER", "FE_EFFECT_FETCH", "FE_SWR_KEY_IDENTITY", "FE_SWR_MUTATION_RESOURCE_IDENTITY"]
+    enforcers:
+      - {kind: eslint-fe, id: fetch-only-in-api-client}
+      - {kind: eslint-fe, id: client-fetch-has-signal}
+      - {kind: eslint-fe, id: no-shared-transport-state}
+      - {kind: eslint-fe, id: no-data-fetch-in-effect}
+      - {kind: eslint-fe, id: transport-owner}
+      - {kind: eslint-fe, id: api-client-attaches-the-locale}
+      - {kind: eslint-fe, id: locale-header-belongs-to-the-link}
+      - {kind: eslint-fe, id: swr-data-lifecycle}
+  - id: R51
+    code: "FE_HTTP_STATUS_COLLAPSE"
+    law: "One `Outcome<T>` union per front end (the api slot's `outcome.ts`); 401 and 403 become `refused`."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_HTTP_STATUS_COLLAPSE", "FE_OUTCOME_KIND_UNHANDLED"]
+    enforcers:
+      - {kind: eslint-fe, id: client-maps-auth-to-refused}
+      - {kind: eslint-fe, id: no-failure-collapse}
+      - {kind: eslint-fe, id: outcome-kinds-exhaustive}
+      - {kind: eslint-fe, id: one-outcome-union}
+  - id: R52
+    code: "FE_WIRE_GENERATED"
+    law: "Wire types generated from the be contract snapshots the fe side reads."
+    kinds: [lint, check, design]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_WIRE_GENERATED"]
+    enforcers:
+      - {kind: eslint-fe, id: no-hand-typed-wire}
+      - {kind: hfs, id: wire-generated, at: scripts/hfs/rules/frontend-tree.mjs}
+  - id: R53
+    code: "FE_ERROR_BOUNDARY_MISSING"
+    law: "Global, locale error, not-found and loading boundaries exist."
+    kinds: [check, codemod, lint]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_ERROR_BOUNDARY_MISSING", "FE_SUSPENSE_NULL_FALLBACK"]
+    enforcers:
+      - {kind: eslint-fe, id: no-null-suspense-fallback}
+      - {kind: machine, id: error-boundary-missing, at: scripts/hfs/architecture/required-files.mjs}
+  - id: R54
+    code: "FE_ROUTE_FILES_THIN"
+    law: "Route files mount one owner; Next conventions (`proxy.ts`, metadata)."
+    kinds: [lint]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_ROUTE_FILES_THIN", "FE_NEXT_CONVENTIONS", "FE_PAGE_METADATA_MISSING", "FE_ROUTE_ONE_PAGE", "FE_ROUTE_DRAWING_DECISION", "FE_ROUTE_CLIENT_BOUNDARY", "FE_ROUTE_CLIENT_HOOK", "FE_ROUTE_DEFAULT_EXPORT"]
+    enforcers:
+      - {kind: eslint-fe, id: no-middleware-file}
+      - {kind: eslint-fe, id: page-exports-metadata}
+      - {kind: eslint-fe, id: route-files-thin}
+      - {kind: eslint-fe, id: route-adapter}
+  - id: R55
+    code: "FE_CLIENT_BOUNDARY"
+    law: "Server first; `\"use client\"` only where allowed."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_CLIENT_BOUNDARY", "FE_CLIENT_SERVER_IMPORT", "FE_CLIENT_REACHES_SERVER", "FE_SERVER_ONLY_MARK", "FE_STORAGE_OUTSIDE_MODULES", "FE_DANGEROUS_HTML"]
+    enforcers:
+      - {kind: eslint-fe, id: use-client-only-at-boundary}
+      - {kind: eslint-fe, id: client-no-server-import}
+      - {kind: eslint-fe, id: server-module-marks-server-only}
+      - {kind: eslint-fe, id: web-storage-only-in-modules}
+      - {kind: eslint-fe, id: no-dangerous-html}
+      - {kind: eslint-fe, id: client-reaches-server}
+  - id: R56
+    code: "FE_HOOKS_ARE_HOOKS"
+    law: "`hooks/` hold hooks and one shared file per domain; a product hook is defined only there and imported through its index."
+    kinds: [lint, codemod]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_HOOKS_ARE_HOOKS", "FE_CUSTOM_HOOK_LOCATION", "FE_BLOCK_PRODUCT_HOOK_DEFINITION", "FE_COMPONENT_DEEP_HOOK_IMPORT"]
+    enforcers:
+      - {kind: eslint-fe, id: hooks-folder-holds-hooks-only}
+      - {kind: eslint-fe, id: hooks-are-hooks}
+      - {kind: eslint-fe, id: hook-location}
+  - id: R57
+    code: "FE_OWNER_REACHABLE"
+    law: "Every owner is mounted; every href resolves to a route."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_OWNER_REACHABLE", "FE_ROUTE_HARDCODED", "FE_HREF_RESOLVES"]
+    enforcers:
+      - {kind: eslint-fe, id: no-hardcoded-route}
+      - {kind: eslint-fe, id: owner-reachable}
+  - id: R58
+    code: "FE_I18N_LITERAL"
+    law: "No display text at any tier, no escape comment."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_I18N_LITERAL"]
+    enforcers:
+      - {kind: eslint-fe, id: no-hardcoded-copy}
+      - {kind: eslint-fe, id: html-lang-from-locale}
+      - {kind: eslint-fe, id: no-copy-resolution-below-block}
+  - id: R59
+    code: "FE_I18N_PLACEMENT"
+    law: "`next-intl` with `[locale]`; the next-intl stack is written once per front end: `fe/packages/<family>-i18n` (`createAppI18n`) called by each app's `modules/i18n/index.ts`, or the only app's `modules/i18n/`."
+    kinds: [check, codemod, lint]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_I18N_PLACEMENT", "FE_I18N_NAVIGATION", "FE_I18N_FORMATTER"]
+    enforcers:
+      - {kind: eslint-fe, id: locale-segment-is-locale}
+      - {kind: eslint-fe, id: no-second-i18n-stack}
+      - {kind: eslint-fe, id: i18n-stack-in-one-module}
+      - {kind: eslint-fe, id: navigation-from-intl}
+      - {kind: eslint-fe, id: no-native-anchor}
+      - {kind: eslint-fe, id: use-intl-formatter}
+      - {kind: hfs, id: i18n-placement, at: scripts/hfs/rules/frontend-tree.mjs}
+  - id: R60
+    code: "FE_I18N_CATALOG"
+    law: "Same keys in every catalog, `pick` for clients."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["FE_I18N_CATALOG"]
+    enforcers:
+      - {kind: hfs, id: i18n-catalog, at: scripts/hfs/rules/frontend-tree.mjs}
+  - id: R61
+    code: "FE_STYLE_TOKEN_ONLY"
+    law: "Token-only CSS; colour only in `brand.css`; every `@source` resolves (sub-check `FE_STYLE_SOURCE_UNRESOLVED`). Status colours follow HeroUI soft pairs: every status tone has `--<tone>-soft` and `--<tone>-soft-foreground` in light and dark, the soft foreground reaches 3:1 on its tint and on `--background`, body text 4.5:1, a solid tone is never text below 4.5:1, and text and icons take the soft foreground, never the solid tone."
+    kinds: [lint, design]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_STYLE_TOKEN_ONLY", "FE_STYLE_SOURCE_UNRESOLVED"]
+    enforcers:
+      - {kind: stylelint, id: token-only}
+      - {kind: stylelint, id: raw-brand-value}
+      - {kind: stylelint, id: no-apply-raw}
+      - {kind: stylelint, id: no-important}
+      - {kind: stylelint, id: globals-shape}
+      - {kind: stylelint, id: globals-import-order}
+      - {kind: stylelint, id: no-token-redefinition}
+      - {kind: stylelint, id: brand-layer-shape}
+      - {kind: stylelint, id: status-contrast}
+      - {kind: stylelint, id: no-css-module}
+      - {kind: stylelint, id: no-class-selector}
+      - {kind: stylelint, id: breakpoint-scale}
+      - {kind: stylelint, id: source-resolves}
+      - {kind: eslint-fe, id: no-raw-brand-value}
+      - {kind: eslint-fe, id: no-fractional-step}
+      - {kind: eslint-fe, id: no-arbitrary-value}
+      - {kind: eslint-fe, id: no-hand-rolled-heading}
+      - {kind: eslint-fe, id: no-unresolved-token-class}
+      - {kind: eslint-fe, id: no-heading-tag-outside-heading-component}
+      - {kind: eslint-fe, id: status-text-uses-soft-foreground}
+  - id: R62
+    code: "FE_NATIVE_FORM_CONTROL"
+    law: "No raw form controls, native images or raw structural tags in product tiers; the grammar renders them."
+    kinds: [lint, design]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_NATIVE_FORM_CONTROL", "FE_NATIVE_IMAGE"]
+    enforcers:
+      - {kind: eslint-fe, id: no-native-form-control}
+      - {kind: eslint-fe, id: no-native-img}
+      - {kind: eslint-fe, id: no-raw-structural-element}
+      - {kind: eslint-fe, id: image-has-size}
+  - id: R63
+    code: "FE_PACKAGE_SHAPE"
+    law: "Packages build to `dist` with explicit exports and no dead unit."
+    kinds: [check, design]
+    gates: [land, ci]
+    failureCodes: ["FE_PACKAGE_SHAPE"]
+    enforcers:
+      - {kind: machine, id: package-shape, at: scripts/hfs/architecture/package-shape.mjs}
+  - id: R64
+    code: "FE_APP_ISOLATION"
+    law: "Apps never import apps; ui-screen declares `app`."
+    kinds: [lint, codemod]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_APP_ISOLATION"]
+    enforcers:
+      - {kind: eslint-fe, id: app-isolation}
+  - id: R65
+    code: "FE_SIZE_AND_STATE_BUDGET"
+    law: "Hook and state budgets; no hand-written poll loop; keyed lists; everything an effect starts is released by its cleanup; no swallowed error or console."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_SIZE_AND_STATE_BUDGET", "FE_LIST_KEY", "FE_EFFECT_CLEANUP", "FE_SWALLOWED_ERROR", "FE_CONSOLE_CALL"]
+    enforcers:
+      - {kind: eslint-fe, id: component-line-budget}
+      - {kind: eslint-fe, id: unit-hook-budget}
+      - {kind: eslint-fe, id: no-hand-rolled-polling}
+      - {kind: eslint-fe, id: list-item-has-key}
+      - {kind: eslint-fe, id: no-index-key}
+      - {kind: eslint-fe, id: no-inline-literal-prop-in-list}
+      - {kind: eslint-fe, id: effect-subscription-needs-cleanup}
+      - {kind: eslint-fe, id: no-empty-catch}
+      - {kind: eslint-fe, id: no-console}
+  - id: R68
+    code: "BE_SQL_INTERPOLATED"
+    law: "SQL text carries no runtime substitution; values are numbered parameters."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_SQL_INTERPOLATED"]
+    enforcers:
+      - {kind: eslint-be, id: no-interpolated-sql}
+  - id: R69
+    code: "BE_QUERY_UNBOUNDED"
+    law: "A read that can return many rows states `take`, `limit` or `LIMIT`, or pages by cursor."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_QUERY_UNBOUNDED"]
+    enforcers:
+      - {kind: eslint-be, id: query-needs-limit}
+  - id: R70
+    code: "BE_HTTP_TIMEOUT"
+    law: "Every outbound `fetch`, axios or HttpService call states a timeout or an abort signal."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_HTTP_TIMEOUT"]
+    enforcers:
+      - {kind: eslint-be, id: http-needs-timeout}
+  - id: R71
+    code: "BE_LOG_SECRET"
+    law: "A `Logger` call carries no `Secret` or `Pii` value and no credential or personal identifier by name; log an id or a masked form. A constructed error carries no `Secret` value and no text value named like a credential."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_LOG_SECRET"]
+    enforcers:
+      - {kind: eslint-be, id: no-secret-in-log}
+      - {kind: eslint-be, id: no-secret-in-error}
+  - id: R72
+    code: "BE_TYPE_ESCAPE"
+    law: "No type escape in any file, specs included: no `as X` (only `as const`), `<X>y`, `x!` or `any` (the factory turns on the typescript-eslint rules `consistent-type-assertions` with `never`, `no-non-null-assertion` and `no-explicit-any`), no `Function` type, no `eval`."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_TYPE_ESCAPE"]
+    enforcers:
+      - {kind: eslint-be, id: no-function-or-eval}
+  - id: R73
+    code: "BE_ASYNC_NO_AWAIT"
+    law: "An `async` function contains an `await`; otherwise it is not `async`."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_ASYNC_NO_AWAIT"]
+    enforcers:
+      - {kind: eslint-be, id: async-needs-await}
+  - id: R74
+    code: "BE_MIGRATION_REVERSIBLE"
+    law: "Every migration declares a `down()` that reverses its `up()`; never empty, never a bare throw."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_MIGRATION_REVERSIBLE"]
+    enforcers:
+      - {kind: eslint-be, id: migration-down-reversible}
+  - id: R75
+    code: "BE_RETURN_TYPE"
+    law: "Handlers and public methods of an Injectable, Resolver or Controller declare their return type."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_RETURN_TYPE"]
+    enforcers:
+      - {kind: eslint-be, id: explicit-handler-return-type}
+  - id: R76
+    code: "BE_JSON_PARSE_UNGUARDED"
+    law: "`JSON.parse` sits inside a `try` in its own function and fails as a typed outcome."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_JSON_PARSE_UNGUARDED"]
+    enforcers:
+      - {kind: eslint-be, id: json-parse-needs-guard}
+  - id: R77
+    code: "BE_QUERY_IN_LOOP"
+    law: "A read through the shared EntityManager does not run once per element of a loop; read once before the loop by key list."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_QUERY_IN_LOOP"]
+    enforcers:
+      - {kind: eslint-be, id: no-query-in-loop}
+  - id: R78
+    code: "BE_USER_COPY_LITERAL"
+    law: "A literal exception message, notification text or response copy comes from the per-capability messages catalog through the typed `MessageCatalog` port, not from source."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_USER_COPY_LITERAL"]
+    enforcers:
+      - {kind: eslint-be, id: user-copy-through-catalog}
+  - id: R79
+    code: "BE_AMBIENT_CLOCK"
+    law: "`Date.now`, a bare `new Date()`, `performance.now`, `process.hrtime` and `Temporal.Now` are referenced only inside `platform/clock`, specs included; code asks the injected `Clock` port and specs use `FakeClock`."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_AMBIENT_CLOCK"]
+    enforcers:
+      - {kind: eslint-be, id: no-ambient-clock}
+  - id: R80
+    code: "BE_INBOX_DEDUPE_MISSING"
+    law: "Every service method that takes a delivery (a public method of a `*.service.ts` whose first parameter has an `eventId`) makes `claim(source, eventId)` on the `Inbox` port its first awaited expression and returns early when the claim answers `false`; consumers and `SignedWebhook` controllers stay thin doors (R88) and dispatch to the handler whose service claims."
+    kinds: [lint, design]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_INBOX_DEDUPE_MISSING"]
+    enforcers:
+      - {kind: eslint-be, id: inbox-dedupe-required}
+  - id: R81
+    code: "BE_HAND_ROLLED_RETRY"
+    law: "A loop that catches an error and waits before trying again goes through the shared `platform/retry` helper, never a hand-written loop."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_HAND_ROLLED_RETRY"]
+    enforcers:
+      - {kind: eslint-be, id: no-hand-rolled-retry}
+  - id: R82
+    code: "BE_TRANSACTION_EXTERNAL_CALL"
+    law: "No transaction spans an external call; commit first and call out after, or write an outbox message inside the transaction."
+    kinds: [lint, design]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_TRANSACTION_EXTERNAL_CALL"]
+    enforcers:
+      - {kind: eslint-be, id: no-external-call-in-transaction}
+  - id: R83
+    code: "BE_UNNAMED_DATA_ACCESS"
+    law: "The database is reached through the shared EntityManager, injected as a constructor parameter by the `Inject<Conn>EntityManager()` of a declared connection and called directly; no bare `@InjectEntityManager()`, `getRepository`, repository, QueryBuilder or property injection; a `DataSource` or `QueryRunner` only in `platform/database`, the cli (`be/apps/cli`, `be/src/features/cli`) and the test world `be/src/tests/world`, whose `world.db.<connection>` EntityManager the specs use. No class outside an application handler, a domain service or a platform persistence capability takes, holds or returns an `EntityManager`, `Repository`, `DataSource` or `QueryRunner` (a repository under any name, a store, dao, gateway or persistence wrapper included), no exported function whose first parameter is an `EntityManager` (a statement module), and no wrapper return type, awaited value or `provide:` token hands out a connection object."
+    kinds: [lint, design]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_UNNAMED_DATA_ACCESS"]
+    enforcers:
+      - {kind: eslint-be, id: named-entity-manager-only}
+      - {kind: eslint-be, id: no-injected-repository}
+      - {kind: eslint-be, id: must-inject-entity-manager}
+      - {kind: eslint-be, id: no-repository-class}
+      - {kind: eslint-be, id: no-eager-relation}
+      - {kind: eslint-be, id: no-outer-manager-in-transaction}
+      - {kind: eslint-be, id: require-entity-table-name}
+  - id: R84
+    code: "BE_CONNECTION_DUPLICATE"
+    law: "One physical database is one connection and one `Inject<Conn>EntityManager()` injector declared once in `platform/database`; `hfs.json` connections, connection files, injectors and module registrations correspond one to one."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_CONNECTION_DUPLICATE"]
+    enforcers:
+      - {kind: eslint-be, id: one-connection-per-database}
+      - {kind: eslint-be, id: connection-map}
+  - id: R85
+    code: "BE_RAW_INJECT"
+    law: "Every injected infrastructure dependency arrives through a zero-argument `Inject<Thing>()` from its owner's `<owner>.decorators.ts` over a `unique symbol` token; raw `@Inject(` exists only there, and every such token is exported so a spec can provide it; a constructor parameter of a provider is typed by a class or carries an `Inject<Thing>()`, never a bare primitive, `Map`, union or interface; the parameter that injects a port of the table `ruleParams.be.paramNames` of `slots.yaml` (`Clock`, `Logger`, `Cache`, `CommandBus`, `QueryBus`, `EntityManager`, an `*Options`) carries the name that table gives it."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_RAW_INJECT"]
+    enforcers:
+      - {kind: eslint-be, id: injector-only}
+      - {kind: eslint-be, id: injector-shape}
+      - {kind: eslint-be, id: injector-type-match}
+      - {kind: eslint-be, id: infra-needs-injector}
+      - {kind: eslint-be, id: provider-param-token}
+      - {kind: eslint-be, id: injected-param-name}
+      - {kind: eslint-be, id: no-module-ref}
+      - {kind: eslint-be, id: no-forward-ref}
+      - {kind: eslint-be, id: no-string-token}
+      - {kind: eslint-be, id: injection-token-exported}
+  - id: R86
+    code: "BE_SQL_TABLE_OWNER"
+    law: "SQL writes only the tables of its own capability's entities, reads only tables of its own context (its own capability's, or a same-context capability it may import; a cross-context JOIN is refused), and every multi-row SELECT is bounded."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_SQL_TABLE_OWNER"]
+    enforcers:
+      - {kind: eslint-be, id: sql-owner}
+  - id: R87
+    code: "BE_CQRS_SHAPE"
+    law: "The application layer is CQRS: typed `Command<R>`/`Query<R>` messages carrying one `params`, handlers extending `ICQRSHandler` that override `process`, where `process` is one `return this.<service>.<method>(...)` and the handler injects only `*Service` classes and the Logger (no EntityManager, no branch, no loop, no second call); no use-case classes, forwarder services or in-process events (`EventBus`, `EventEmitter`, an RxJS `Subject`, a stored listener list); a message and an injected dependency are `readonly`."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_CQRS_SHAPE", "BE_READONLY_BOUNDARY"]
+    enforcers:
+      - {kind: eslint-be, id: handler-overrides-process}
+      - {kind: eslint-be, id: handler-is-thin}
+      - {kind: eslint-be, id: message-carries-params-only}
+      - {kind: eslint-be, id: message-typed-result}
+      - {kind: eslint-be, id: no-use-case}
+      - {kind: eslint-be, id: no-event-bus}
+      - {kind: eslint-be, id: execute-params-shape}
+      - {kind: eslint-be, id: readonly-boundary}
+  - id: R88
+    code: "BE_TRANSPORT_SHAPE"
+    law: "A transport handler (a controller, resolver, gateway, consumer or job; a cli command is an action runner, R149) maps its input, dispatches exactly one command or query through the injected bus and maps the result; it injects nothing else (no EntityManager, no Inbox), holds no branch, loop or other call besides pure mapper functions and `unwrapOutcome` of `platform/primitives`, returns no envelope and takes no `GraphQLJSON`."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_TRANSPORT_SHAPE"]
+    enforcers:
+      - {kind: eslint-be, id: door-lives-in-features}
+      - {kind: eslint-be, id: no-capability-imports-features}
+      - {kind: eslint-be, id: rest-door-needs-a-reason, editions: [full]}
+      - {kind: eslint-be, id: transport-is-thin}
+      - {kind: eslint-be, id: no-response-envelope}
+      - {kind: eslint-be, id: no-graphql-json}
+      - {kind: eslint-be, id: em-injection-slots}
+  - id: R89
+    code: "BE_SOURCE_FORM"
+    law: "Files use the closed role-suffix vocabulary of the slot manifest, `ruleParams.be.suffixes`; named exports only; every export has English JSDoc (its public members: R109); no emoji, and no Vietnamese in identifiers, string literals, comments or test titles outside message catalogs and the i18n fixtures slot; a public input or output is a named contract, never an inline object type; no `Mock*`, `Fake*` or `Stub*` class, function or constant in production source."
+    kinds: [lint, check, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_SOURCE_FORM", "BE_PUBLIC_CONTRACT_FORM"]
+    enforcers:
+      - {kind: eslint-be, id: require-export-jsdoc}
+      - {kind: eslint-be, id: require-enum-member-jsdoc}
+      - {kind: eslint-be, id: no-non-ascii-source}
+      - {kind: eslint-be, id: no-restated-name-jsdoc}
+      - {kind: eslint-be, id: no-bare-verb-export}
+      - {kind: eslint-be, id: no-vendor-module-factory-name}
+      - {kind: eslint-be, id: no-version-in-name}
+      - {kind: eslint-be, id: no-const-enum}
+      - {kind: eslint-be, id: no-inline-object-type}
+      - {kind: eslint-be, id: no-inline-param-type}
+      - {kind: eslint-be, id: no-test-double-in-source}
+      - {kind: eslint-be, id: no-default-export}
+      - {kind: hfs, id: source-suffix, at: scripts/hfs/check.mjs}
+      - {kind: eslint-be, id: source-suffix}
+      - {kind: eslint-be, id: source-names}
+      - {kind: eslint-be, id: public-contract-form}
+  - id: R90
+    code: "BE_INFRA_OWNER"
+    law: "Each raw infrastructure library (HTTP, cache, queue, scheduler, logger, date, config, events) is imported or referenced only by its one owning platform or integration capability, and the `HttpClient` port of `platform/http` is called only by an `integrations` capability."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_INFRA_OWNER"]
+    enforcers:
+      - {kind: eslint-be, id: infra-import-owner}
+      - {kind: eslint-be, id: http-client-only-in-integrations}
+  - id: R91
+    code: "FE_SOURCE_FORM"
+    law: "Front-end files sit in their tier folder with the fixed names, export arrow functions named after the folder, carry English JSDoc, no emoji, and no Vietnamese in identifiers, string literals, comments or test titles outside the i18n catalogs and the i18n e2e fixtures slot."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_SOURCE_FORM", "FE_SOURCE_LAYOUT_INVALID"]
+    enforcers:
+      - {kind: eslint-fe, id: require-export-jsdoc}
+      - {kind: eslint-fe, id: no-emoji-in-source}
+      - {kind: eslint-fe, id: no-vietnamese-in-source}
+      - {kind: eslint-fe, id: no-shell-tier}
+      - {kind: eslint-fe, id: source-tier-marker-matches-folder}
+      - {kind: eslint-fe, id: surface-folder-two-files-only}
+      - {kind: eslint-fe, id: route-tree-holds-routes-only}
+      - {kind: eslint-fe, id: route-slot-fixed-name}
+      - {kind: eslint-fe, id: no-helper-folder-in-components}
+      - {kind: eslint-fe, id: export-matches-folder}
+      - {kind: eslint-fe, id: no-runtime-namespace}
+      - {kind: eslint-fe, id: monorepo-tier-belongs-to-its-side}
+      - {kind: eslint-fe, id: prefer-arrow-export}
+      - {kind: eslint-fe, id: handler-on-prefix}
+      - {kind: eslint-fe, id: no-second-language-in-path}
+      - {kind: eslint-fe, id: no-direct-const-alias}
+      - {kind: eslint-fe, id: frontend-source-layout}
+  - id: R92
+    code: "FE_COMPONENT_API"
+    law: "A component exposes the canon surface: typed named props and slots, a presentational twin for every connected block, status through the slot view, no className or CSS doors, no resting twin or placeholder prop, class names in the colocated file; a pure component reaches no hook, router, locale or API."
+    kinds: [lint, design]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_COMPONENT_API", "FE_COMPONENT_WORLD_OWNERSHIP", "FE_WORLD_OWNER_RENDER_BOUNDARY", "FE_CONNECTED_BLOCK_RENDER_PAIR", "FE_PURE_REACHES_DATA", "FE_PURE_WORLD_HOOK", "FE_PURE_WORLD_IMPORT"]
+    enforcers:
+      - {kind: eslint-fe, id: no-inline-parameter-type}
+      - {kind: eslint-fe, id: public-component-signature}
+      - {kind: eslint-fe, id: no-per-part-classname-prop}
+      - {kind: eslint-fe, id: no-public-classname-prop}
+      - {kind: eslint-fe, id: no-public-frame-css-props}
+      - {kind: eslint-fe, id: no-css-door-type-laundering}
+      - {kind: eslint-fe, id: base-props-atom}
+      - {kind: eslint-fe, id: base-import-pair}
+      - {kind: eslint-fe, id: no-data-status-shape}
+      - {kind: eslint-fe, id: slot-status-through-slotview}
+      - {kind: eslint-fe, id: presentational-purity}
+      - {kind: eslint-fe, id: connected-block-has-presentational-twin}
+      - {kind: eslint-fe, id: no-resting-twin-component}
+      - {kind: eslint-fe, id: no-placeholder-prop}
+      - {kind: eslint-fe, id: no-resting-branch-at-call-site}
+      - {kind: eslint-fe, id: no-inline-class-name}
+      - {kind: eslint-fe, id: class-names-in-colocated-file}
+      - {kind: eslint-fe, id: cn-arguments-are-single-tokens}
+      - {kind: eslint-fe, id: component-purity}
+  - id: R93
+    code: "FE_VENDOR_BOUNDARY"
+    law: "Vendor primitives and icons reach components only through their named owner: heroicons through the icon leaf at the glyph scale, every vendor primitive behind a named owner; the Grammar package is imported only through its selected code and style entry and keeps its declared contract."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_VENDOR_BOUNDARY", "ARCH_GRAMMAR_CONTRACT_INVALID", "ARCH_GRAMMAR_EXPORT_BYPASS"]
+    enforcers:
+      - {kind: eslint-fe, id: no-vendor-icon-outside-icon-leaf}
+      - {kind: eslint-fe, id: heroicons-is-the-glyph-vendor}
+      - {kind: eslint-fe, id: no-off-scale-glyph-size}
+      - {kind: eslint-fe, id: no-decorative-icon-in-metric-cell}
+      - {kind: eslint-fe, id: vendor-primitive-has-named-owner}
+      - {kind: eslint-fe, id: grammar-entry}
+  - id: R94
+    code: "FE_SLOT_FILE_ROLE"
+    law: "A front-end file is owned by a slot and named by it: a slot that owns a directory (route, feature, components, hooks, api module) holds only the files its `allows` list names, and holds them inside a folder of its own."
+    kinds: [check, design]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_SLOT_FILE_ROLE"]
+    enforcers:
+      - {kind: machine, id: fe-slot-allows, at: scripts/hfs/architecture/fe-slot-allows.mjs}
+  - id: R95
+    code: "BE_OPERATION_CONTRACT"
+    law: "A versioned operation is declared once in the app's typed operation table (`OperationContract<Input, Output, RefusalCode>` registered by `defineOperations`): its input and output are closed types (never `any`, `unknown` or `Record<string, unknown>`), its refusal codes a closed union of string literals, and the route that serves the table takes `OperationRequest<Table>` and answers `Promise<OperationReply<Table>>` of that one table."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_OPERATION_CONTRACT"]
+    enforcers:
+      - {kind: eslint-be, id: operation-contract-decidable}
+      - {kind: eslint-be, id: operation-route-driven-by-table}
+  - id: R96
+    code: "HFS_DOC_NOT_ENGLISH"
+    law: "Every Markdown and YAML document under a side's docs/, src/ and apps/ (be/, fe/) and under the runtime's knowledge/ and docs/ is English, code fences included; only YAML data in a message-catalog or i18n-fixtures slot may hold another language."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_DOC_NOT_ENGLISH"]
+    enforcers:
+      - {kind: machine, id: doc-language, at: scripts/hfs/architecture/doc-language.mjs}
+  - id: R97
+    code: "FE_NO_TESTS"
+    law: "The front end (`fe/`) has no tests by standard: no `*.spec.*`, `*.test.*` or `*-spec.*` file, no `e2e/`, `__tests__/`, `__mocks__/` or `test-support/` directory, no vitest, Playwright, jest or Cypress configuration or setup file, no test script, and no test-runner, test-environment, testing-library or axe dependency in any `package.json`; there is no exception, `scripts/` included."
+    kinds: [check]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["FE_NO_TESTS"]
+    enforcers:
+      - {kind: hfs, id: fe-no-tests, at: scripts/hfs/rules/fe-no-tests.mjs}
+  - id: R98
+    code: "BE_TEST_BUILDER_HOME"
+    law: "A test data builder lives only in `be/src/tests/fixtures/builders/<area>.builder.ts` (slot `be.tests.fixtures.builders`, its SQL text in `<area>.sql.ts` beside it): a `*.repository.ts`, `*.factory.ts` or `*.fixture.ts` under `be/src/tests` and a `*.builder.ts` elsewhere are BE_SOURCE_FORM findings, and any other module of the test tree that exports a function creating persisted rows through an EntityManager, DataSource or QueryRunner is a builder in the wrong place."
+    kinds: [lint]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["BE_TEST_BUILDER_HOME"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: persisting-builder-in-builders-slot}
+  - id: R99
+    code: "BE_TEST_ROW_BY_BUILDER"
+    law: "A unit, integration or e2e spec never hand-builds rows: no raw INSERT/UPDATE/DELETE text, no `save`, `insert`, `upsert`, `update`, `delete` or `remove` on an EntityManager, DataSource or QueryRunner, and no persistence entity built as an object literal more than once in the spec; rows come from the area's builder."
+    kinds: [lint]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["BE_TEST_ROW_BY_BUILDER"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: spec-no-raw-insert}
+      - {kind: eslint-be, id: spec-no-repeated-row-literal}
+  - id: R100
+    code: "BE_TEST_CONSTRAINTS_ON"
+    law: "Nothing under `be/src/tests` disables or drops a database constraint: no `session_replication_role`, `SET CONSTRAINTS ... DEFERRED`, `DEFERRABLE INITIALLY DEFERRED`, `ALTER TABLE ... DISABLE`, `DISABLE TRIGGER`, `DROP CONSTRAINT`, and no `dropForeignKey(s)`, `dropCheckConstraint(s)` or `dropUniqueConstraint(s)` on a QueryRunner; a builder creates the parent chain instead."
+    kinds: [lint]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["BE_TEST_CONSTRAINTS_ON"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: tests-keep-constraints}
+  - id: R101
+    code: "BE_TEST_BUILDER_ARRANGES"
+    law: "A test data builder arranges data only: it imports no assertion or test-framework global (`expect`, `@jest/globals` or the Jest namespace) and its defaults are deterministic (no `Date.now()`, argless `new Date()`, `Math.random()`, `randomUUID()` or `crypto.random*`)."
+    kinds: [lint]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["BE_TEST_BUILDER_ARRANGES"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: builder-arranges-only}
+  - id: R102
+    code: "BE_SPEC_PLACEMENT"
+    law: "A back-end spec or test file lives in one of the four test layers and nowhere else: a unit spec of a unit-tested role (`ruleParams.be.unitRoles`: `<name>.service.spec.ts` beside its service, `<name>.cli.spec.ts` beside its cli command), or an integration, e2e or contract spec under `be/src/tests/{integration,e2e,contract}`; a `*.spec.*`, `*.test.*` or `*-spec.*` file anywhere else, `scripts/` and `tools/` included, is a finding."
+    kinds: [check, lint]
+    gates: [land, ci]
+    failureCodes: ["BE_SPEC_PLACEMENT"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: spec-placement, at: scripts/hfs/rules/spec-placement.mjs}
+      - {kind: eslint-be, id: spec-placement}
+  - id: R103
+    code: "HFS_REPO_LOCAL_CHECK"
+    law: "A repository keeps no check, lint rule or lint plugin of its own: no `check-*` file in `scripts/` or `tools/`, no `eslint-local-rules*` or local eslint plugin, no script that runs one; every check lives in the `.claude` runtime and the canons."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_REPO_LOCAL_CHECK"]
+    enforcers:
+      - {kind: hfs, id: repo-local-check, at: scripts/hfs/rules/repo-local-checks.mjs}
+  - id: R104
+    code: "HFS_LINT_SUPPRESSION_FILE"
+    law: "A repository keeps no lint-suppression file, script or option: no `eslint.suppressions*`, no `lint:suppressions` script, no eslint `--suppress-all` or `--suppressions-location` flag and no suppressions configuration passed to eslint; a finding is fixed in the code."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_LINT_SUPPRESSION_FILE"]
+    enforcers:
+      - {kind: hfs, id: lint-suppression, at: scripts/hfs/rules/lint-suppression.mjs}
+  - id: R105
+    code: "HFS_PROOF_COMMAND_FILE_MISSING"
+    law: "A proof command of a `.starciwork` record (`requiresProof.<kind>.command`) is runnable as written: every repository file it names exists."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_PROOF_COMMAND_FILE_MISSING"]
+    enforcers:
+      - {kind: hfs, id: proof-command-files, at: scripts/hfs/rules/proof-commands.mjs}
+  - id: R106
+    code: "FE_I18N_KEYS"
+    law: "The catalogs of a front-end app and its source agree both ways: a literal key read through `next-intl` (`useTranslations`, `getTranslations`, `t`, `t.rich`, `t.raw`, `t.markup`) exists in every locale, and a catalog key that no string of the app's or the shared packages' source can be reading is deleted."
+    kinds: [lint]
+    gates: [land, ci]
+    failureCodes: ["FE_I18N_KEYS"]
+    enforcers:
+      - {kind: eslint-fe, id: i18n-keys}
+  - id: R107
+    code: "FE_COOKIE_ATTRIBUTES"
+    law: "A cookie the front end writes through Next's response cookies (`response.cookies.set`, `cookies().set`) states `httpOnly` as a literal (`true` for a session, `false` only for a preference page script reads), carries `secure` and has `sameSite` `lax` or `strict`."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_COOKIE_ATTRIBUTES"]
+    enforcers:
+      - {kind: eslint-fe, id: response-cookie-attributes}
+  - id: R108
+    code: "BE_ERROR_CAUSE_DROPPED"
+    law: "A `throw` that escapes a `catch` (or a promise `.catch` handler) rethrows the caught value or carries it: the replacement capability error takes the exact caught value as `cause`; a `catch` with no binding throws nothing new."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_ERROR_CAUSE_DROPPED"]
+    enforcers:
+      - {kind: eslint-be, id: replacement-throw-carries-cause}
+  - id: R109
+    code: "BE_MEMBER_DOC_MISSING"
+    law: "Every public member of an exported class, interface or object type alias in product source opens with English JSDoc: methods, accessors, fields and signatures; a private, protected or `#` member, the constructor, an index signature and a property set to a literal or a named constant are not judged, and overloads of one name share one doc."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_MEMBER_DOC_MISSING"]
+    enforcers:
+      - {kind: eslint-be, id: require-public-member-jsdoc}
+  - id: R110
+    code: "FE_PROPS_MUTABLE"
+    law: "The props type of an exported rendering function in front-end product source is readonly all the way down: every field and index signature is `readonly`, and every collection it holds, directly or in a nested object, is `readonly T[]`, `readonly [A, B]` or `ReadonlyArray<T>`."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["FE_PROPS_MUTABLE"]
+    enforcers:
+      - {kind: eslint-fe, id: props-fields-readonly}
+  - id: R111
+    code: "HFS_PEER_INTEGRATION_MISSING"
+    law: "An app declares the runtime peer every driver integration it uses needs: when the app root package.json depends on every package of a pair of knowledge/hfs/peer-integrations.yaml (at the named major), it declares the pair's `requires` in its dependencies (`@nestjs/apollo` on `@nestjs/platform-express` 11, Express 5, needs `@as-integrations/express5`)."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_PEER_INTEGRATION_MISSING"]
+    enforcers:
+      - {kind: hfs, id: peer-integrations, at: scripts/hfs/rules/peer-integrations.mjs}
+  - id: R112
+    code: "BE_INTEGRATION_SPEC_MISSING"
+    law: "Every integration of a back end (`src/modules/integrations/<provider>/` holding `<provider>.config.ts`) has at least one `src/tests/integration/<provider>/*.integration-spec.ts` that, read as a syntax tree, calls `useTestWorld({ modules })` with a factory registering the integration's own module (`<Provider>Module.register`, imported from the integration folder; an inline array, a local const or an exported const of another file), references the ErrorCode enum the integration exports, and drives an outage through the world (`world.infra.<service>.cut|latency|during|connection`, `world.fake.<name>.failNext`, `world.apps.<peer>.during`, `world.interruptDatabase`); the finding sits on the integration folder."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["BE_INTEGRATION_SPEC_MISSING"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: integration-specs, at: scripts/hfs/rules/integration-specs.mjs}
+  - id: R113
+    code: "FE_GRAPHQL_CONTRACT"
+    law: "Every GraphQL operation a front end keeps in a `.graphql` file under `fe/` is one its back end serves: it is judged against the contract snapshot (`be/contracts/<service>/schema.graphql`) whose root type declares its first root field, and every selected field, argument and input field must be declared there, every required argument and required input field given, every variable passed with the argument's named type, every leaf selected without and every object with a selection, and every declared variable used; a root field no contract declares is a finding too."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["FE_GRAPHQL_CONTRACT"]
+    enforcers:
+      - {kind: hfs, id: fe-contract-documents, at: scripts/hfs/rules/fe-contract-documents.mjs}
+  - id: R114
+    code: "RT_EXTERNAL_OWNER"
+    law: "In the runtime repository a process, the network, SQLite or an external binary is reached only by its owner in ruleParams.runtime.infraOwners of knowledge/hfs/runtime-slots.yaml: an owned module specifier, global or spawned program word is used only by the files of scripts/api/<system> or engine/db that the map names."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_EXTERNAL_OWNER"]
+    enforcers:
+      - {kind: runtime, id: external-owner, at: scripts/hfs/runtime-rules/external-owner.mjs}
+  - id: R115
+    code: "RT_TIER_DIRECTION"
+    law: "Every relative import between two runtime owners goes from a tier to a tier its mayImport lists in tiers.runtime of knowledge/hfs/runtime-slots.yaml; owner cycles are ARCH_OWNER_CYCLE."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_TIER_DIRECTION"]
+    enforcers:
+      - {kind: runtime, id: runtime-tiers, at: scripts/hfs/runtime-rules/tier-direction.mjs}
+  - id: R116
+    code: "RT_BASE_IMPURE"
+    law: "The runtime base tier (the engine foundation and scripts/lib) never writes the filesystem and reads process.env only in a declared seam of ruleParams.runtime.baseEnvSeams."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_BASE_IMPURE"]
+    enforcers:
+      - {kind: runtime, id: base-pure, at: scripts/hfs/runtime-rules/base-pure.mjs}
+  - id: R117
+    code: "RT_API_SHAPE"
+    law: "A call file of scripts/api/<system>/ exports exactly one function named in camelCase after the file; only the files of its own system import its lib.mjs; no api system imports another; a system with a calls contract has a call file only for a call id the contract declares."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_API_SHAPE"]
+    enforcers:
+      - {kind: runtime, id: api-shape, at: scripts/hfs/runtime-rules/api-shape.mjs}
+  - id: R118
+    code: "RT_SPEC_PLACEMENT"
+    law: "A runtime spec is tests/<area>/<module>[.<topic>].spec.mjs, shared spec code is tests/helpers/<name>.mjs, preloads tests/setup/<name>.mjs and data tests/fixtures/**; a package spec sits beside its source as <name>.spec.*; no file uses the .test. suffix."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_SPEC_PLACEMENT"]
+    enforcers:
+      - {kind: runtime, id: spec-placement, at: scripts/hfs/runtime-rules/test-layout.mjs}
+  - id: R119
+    code: "RT_SOURCE_NAME"
+    law: "A runtime source file is named <kebab-name>.mjs, never a one-off of ruleParams.runtime.oneOffNames (_*, tmp-*, fix-*, *-backfill, migrate-*, *-old, *.bak*), and its basename is unique inside its tier except lib.mjs and index.mjs."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_SOURCE_NAME"]
+    enforcers:
+      - {kind: runtime, id: source-name, at: scripts/hfs/runtime-rules/source-name.mjs}
+  - id: R120
+    code: "RT_RETIRED_PRESENT"
+    law: "No path of retired[] and no `from` of moved[] in modules/kernel/retired-paths.yaml is tracked again, and no symbol of its retiredSymbols[] is declared in runtime production code."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_RETIRED_PRESENT"]
+    enforcers:
+      - {kind: runtime, id: retired-present, at: scripts/hfs/runtime-rules/retired.mjs}
+  - id: R121
+    code: "RT_GENERATED_DRIFT"
+    law: "A generated root of ruleParams.runtime.generated is git-ignored output of its declared generatedBy: the repo's check regenerates every root, the runtime copies (packages/hfs/runtime, packages/eslint/be/runtime, packages/eslint/fe/runtime) are judged equal to what scripts/hfs/sync-runtime.mjs writes from the single source, and no git-tracked path lies under a generated root."
+    scope: runtime
+    kinds: [check, codemod]
+    gates: [land, runtime]
+    failureCodes: ["RT_GENERATED_DRIFT", "GENERATED_UNTRACKED"]
+    enforcers:
+      - {kind: runtime, id: generated-drift, at: scripts/hfs/sync-runtime.mjs}
+      - {kind: runtime, id: generated-untracked, at: scripts/hfs/runtime-rules/generated-untracked.mjs}
+  - id: R122
+    code: "RT_CITED_PATH_MISSING"
+    law: "A runtime path cited by live prose or contracts (modules outside the contract history, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; a retired or moved path is cited only by history."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_CITED_PATH_MISSING"]
+    enforcers:
+      - {kind: runtime, id: cited-path, at: scripts/checks/check-contract-cites.mjs}
+  - id: R124
+    code: "RT_PINNED_PATH_MOVED"
+    law: "A pinned path of ruleParams.runtime.pinned (persisted outside git) exists, or moved through a modules/kernel/retired-paths.yaml moved[] entry marked quiesced: true, landed with the workers stopped."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_PINNED_PATH_MOVED"]
+    enforcers:
+      - {kind: runtime, id: pinned-path, at: scripts/hfs/runtime-rules/retired.mjs}
+  - id: R125
+    code: "RT_NODE_MODULES_LINK"
+    law: "No runtime source creates a junction or a symlink for a node_modules folder, through node:fs (symlink, symlinkSync, directly or through a local wrapper) or a spawned link command (mklink /J or /D, New-Item -ItemType Junction or SymbolicLink, ln -s): every checkout installs its own dependencies with a real npm ci from the cache."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_NODE_MODULES_LINK"]
+    enforcers:
+      - {kind: runtime, id: node-modules-link, at: scripts/hfs/runtime-rules/node-modules-link.mjs}
+  - id: R126
+    code: "RT_CONTROL_CHARACTER"
+    law: "Tracked text source of the runtime (*.mjs, *.cjs, *.js, *.ts, *.tsx, *.yaml, *.yml, *.md, *.json outside the generated copies) holds no raw control character (U+0000 to U+001F except tab, LF and CR, and U+007F); the character is written as its escape."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_CONTROL_CHARACTER"]
+    enforcers:
+      - {kind: runtime, id: control-characters, at: scripts/hfs/runtime-rules/control-chars.mjs}
+  - id: R127
+    code: "RT_ABSOLUTE_PATH"
+    law: "No tracked file of the runtime holds a hard-coded absolute host path: a drive-letter path, a user-profile path (/Users/<name>/, /home/<name>/) or an expanded AppData path. Paths resolve from the runtime root, os.tmpdir(), the config or a state-root helper, and a spec builds every path and prompt fixture from its temp dir; %LOCALAPPDATA% as an unexpanded name is clean. In source the rule reads string and template literals and comments through the syntax tree (a URL and a generic drive-pattern regular expression are not paths); in yaml, json and md it reads line text."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_ABSOLUTE_PATH"]
+    enforcers:
+      - {kind: runtime, id: absolute-path, at: scripts/hfs/runtime-rules/absolute-path.mjs}
+  - id: R141
+    code: "BE_COOKIE_ATTRIBUTES"
+    law: "A cookie a back-end door writes through the response of Express or Fastify (`cookie`, `setCookie`) states `httpOnly: true`, `secure: true` and `sameSite` `lax` or `strict` in options typed with those literals, and `Set-Cookie` is never written as a header (`setHeader`, `append`, `header`); the call is recognised by where its signature is declared, never by the receiver's name."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_COOKIE_ATTRIBUTES"]
+    enforcers:
+      - {kind: eslint-be, id: response-cookie-attributes}
+  - id: R142
+    code: "BE_AMBIENT_ID"
+    law: "`randomUUID` of Node's crypto (named, namespace or global), the `v1`, `v4`, `v6` and `v7` generators of `uuid`, `nanoid` and `ulid` are used only inside `platform/ids`, specs included; code asks the injected `Ids` port (`ids.next()`) and specs use `fakeIds()`."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_AMBIENT_ID"]
+    enforcers:
+      - {kind: eslint-be, id: no-ambient-id}
+  - id: R143
+    code: "HFS_MONO_WORKSPACES"
+    law: "Every app is a monorepo, even with one service: the app root package.json declares `workspaces` exactly `[\"fe/apps/*\", \"fe/packages/*\"]`, `packageManager` as `npm@<exact version>` and `turbo` in its devDependencies (at the canon pin), the app root holds the one `package-lock.json` and the managed `turbo.json` (app.task-graph: build, dev, lint and typecheck, build depending on `^build` with cached `.next` and `dist` outputs)."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_MONO_WORKSPACES"]
+    enforcers:
+      - {kind: hfs, id: monorepo, at: scripts/hfs/rules/monorepo.mjs}
+  - id: R144
+    code: "HFS_MONO_FE_WORKSPACE"
+    law: "Every fe app `fe/apps/<app>` is an npm workspace: its `package.json` is named `@<project>/<app>`, is private, declares its own runtime dependencies and has exactly the scripts `build: next build`, `dev: next dev`, `lint: starci app lint --workspace .`, `start: next start` and `typecheck: tsc --noEmit`; every fe package `fe/packages/<pkg>` is private with `build`, `typecheck` and the same workspace `lint` script."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_MONO_FE_WORKSPACE"]
+    enforcers:
+      - {kind: hfs, id: monorepo, at: scripts/hfs/rules/monorepo.mjs}
+  - id: R145
+    code: "HFS_MONO_NEST_PROJECTS"
+    law: "The back end is a Nest monorepo of `be/apps/<app>`, even with one service: `be/nest-cli.json` is `\"monorepo\": true`, its default project (`root`, `sourceRoot`) is an api app, and its `projects` are exactly the be apps hfs.json declares, each `{\"type\": \"application\", \"root\": \"apps/<app>\", \"sourceRoot\": \"apps/<app>/src\"}`."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_MONO_NEST_PROJECTS"]
+    enforcers:
+      - {kind: hfs, id: monorepo, at: scripts/hfs/rules/monorepo.mjs}
+  - id: R146
+    code: "HFS_MONO_WORKSPACE_DEP"
+    law: "An fe workspace declares every package its files import (read with TypeScript's import pre-processor, its tsconfig path aliases excluded) in its own `package.json`, a sibling workspace package at `\"*\"`; the app root `package.json` never declares a workspace package."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_MONO_WORKSPACE_DEP"]
+    enforcers:
+      - {kind: hfs, id: monorepo, at: scripts/hfs/rules/monorepo.mjs}
+  - id: R147
+    code: "BE_CLI_REQUIRED"
+    law: "Every one-off action of a back end lives in ONE app, `be/apps/cli` (kind cli, named cli): a back end that declares a connection (its migrations run as `cli migrate run`) or tracks a command under `src/features/cli/` declares exactly that app, and tracks its image `be/apps/cli/Dockerfile` (one image, run as `cli <group> <command>`)."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_CLI_REQUIRED"]
+    enforcers:
+      - {kind: hfs, id: cli, at: scripts/hfs/rules/cli.mjs}
+  - id: R148
+    code: "BE_CLI_BOOTSTRAP"
+    law: "The cli app boots in its `main.ts` with `CommandFactory.run(...)` of nest-commander and never serves: `NestFactory.create*` of `@nestjs/core`, a `.listen()`, a microservice connection, an `@nestjs/platform-*` adapter or `@nestjs/microservices` in the cli app is refused (by the import that binds each name)."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_CLI_BOOTSTRAP"]
+    enforcers:
+      - {kind: eslint-be, id: cli-bootstrap}
+  - id: R149
+    code: "BE_CLI_COMMAND_SHAPE"
+    law: "A nest-commander command (`@Command` or `@SubCommand`, by the import that binds the decorator) is declared only in the cli feature root `src/features/cli/`: a group `@Command` in `<group>/<group>.cli.ts`, a `@SubCommand` extending `CommandRunner` in `<group>/subs/<name>.cli.ts`, one command per file, and every sub-command has its unit spec `<name>.cli.spec.ts` beside it (a command is an action runner, not a thin transport: R88 does not apply to it). `.cli.ts`, because `.command.ts` is the CQRS message."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_CLI_COMMAND_SHAPE"]
+    enforcers:
+      - {kind: eslint-be, id: cli-command-shape}
+      - {kind: eslint-be, id: unit-test-colocated}
+  - id: R150
+    code: "BE_CLI_OWNER"
+    law: "`nest-commander` is imported only by the cli app and the cli feature root, and no back-end source parses command-line arguments itself: `process.argv` and the parsers commander, yargs and minimist are refused everywhere; a one-off action anywhere but a cli command is a door the rule closes."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_CLI_OWNER"]
+    enforcers:
+      - {kind: eslint-be, id: cli-owner}
+  - id: R151
+    code: "BE_EVENT_CLASS_CONTRACT"
+    law: "Every typed event class `be/src/modules/events/<service>/<event>.event.ts` (one class with literal `static readonly eventName` and `version`, in a file named after its event: dots become dashes) equals an entry of the vendored contract `be/contracts/<service>/events.json` at the same name and version, and every entry of a vendored contract has its class; a class the contract does not list, a version mismatch, a contract entry with no class or a misnamed file is a finding (pattern event-bus)."
+    kinds: [check, codemod]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_EVENT_CLASS_CONTRACT"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: event-class-contract, at: scripts/hfs/rules/event-bus.mjs}
+  - id: R152
+    code: "BE_OUTBOX_WRITE_TX"
+    law: "The outbox is written only by a domain service, with the manager of its own transaction: `eventBus.publish(event, tx)` and a queue producer's `enqueueX(payload, tx)` are called only in a file of `modules/domain` (the test world, e2e and fixtures aside), and `tx` is the `manager` parameter of a `.transaction(async (manager) => ...)` callback or a function parameter typed `EntityManager`; the injected shared manager, an alias, an outer manager or a missing argument is a finding. The call is found by the receiver's TYPE (the `EventBus` port of platform/event-bus) or by the resolved signature's declaring tier (queues), never by a name."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_OUTBOX_WRITE_TX"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: outbox-write-tx}
+  - id: R153
+    code: "BE_EVENT_CONSUMER_SHAPE"
+    law: "A class that implements the `EventConsumer` port of platform/event-bus (by type origin) is `transport/message/<event>.consumer.ts` (slot be.transport.message), its file stem is the kebab form of its event class's literal `eventName` (dots become dashes), and its `handle` reads `delivery.eventId` so the dispatched command carries the id the domain service claims in platform/inbox; a `.consumer.ts` that implements no `EventConsumer` is a finding."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_EVENT_CONSUMER_SHAPE"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: event-consumer-shape}
+  - id: R154
+    code: "BE_QUEUE_PRODUCER_SHAPE"
+    law: "In `modules/queues/<queue>/<queue>.queue.ts` every exported function or class method that writes the `QueueOutbox` port of platform/queue declares a `tx` parameter typed `EntityManager` and passes that parameter as the first argument of the write; a write with another manager, an outer manager or none is a finding (pattern queue)."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_QUEUE_PRODUCER_SHAPE"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: queue-producer-shape}
+  - id: R155
+    code: "BE_PATTERN_SPEC_MISSING"
+    law: "Every pattern a back end declares (hfs.json sides.be.patterns) is proven on the test world: each scenario id of ruleParams.be.patternScenarios.<pattern> has a test titled `<pattern>/<scenario>: ...` (the first argument of `it(` or `test(`) in an e2e or integration spec under be/src/tests; a declared pattern with a missing scenario is a finding."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["BE_PATTERN_SPEC_MISSING"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: pattern-spec-missing, at: scripts/hfs/rules/event-bus.mjs}
+  - id: R156
+    code: "BE_KIND_ISOLATION"
+    law: "No trigger kind imports another: a feature whose owner slot names one `trigger` (api, webhooks, realtime, saga, reactors, jobs, cli) never imports (static, dynamic, re-export or type-only) a feature of another kind; each kind imports only `modules/*` and only be/apps/* compose features. The kinds meet through the event bus: a domain service publishes `eventBus.publish(event, tx)` and the other kind consumes it. The importing and imported owners are read from the slot view (slot field `trigger`), never from a folder name; the finding replaces BE_FEATURE_IMPORTS_FEATURE when both features name different kinds."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_KIND_ISOLATION"]
+    enforcers:
+      - {kind: eslint-be, id: kind-isolation}
+      - {kind: machine, id: tiers, at: scripts/hfs/architecture/tiers.mjs}
+  - id: R157
+    code: "BE_JOB_WRITE_OUTSIDE_OWNER"
+    law: "The job entity (the class `platform/jobs` declares in its persistence) is written only by `platform/jobs`: an `update`, `increment`, `decrement`, `save`, `insert`, `upsert`, `delete`, `remove`, `softDelete` or a query-builder write on it in any other file (the test world, e2e and fixtures aside) is a finding. The entity is found by the type origin of the call's arguments or builder chain, never by a name; raw SQL is judged by BE_SQL_TABLE_OWNER (pattern fenced-job)."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_JOB_WRITE_OUTSIDE_OWNER"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: job-write-owner}
+  - id: R158
+    code: "BE_JOB_FENCE_REQUIRED"
+    law: "Every `JobClaims` method that takes a job (a parameter type with `jobId`) declares a required, non-nullable `expectedFencingToken: number`; no call on `JobClaims` outside `platform/jobs` casts around it (`as`, a type assertion or `!` in an argument); and a `catch` around a `JobClaims` write rethrows, so a `JobFencedOut` stops the zombie with no further effect (pattern fenced-job)."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_JOB_FENCE_REQUIRED"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: job-fence-required}
+  - id: R159
+    code: "BE_JOB_RUN_KEY"
+    law: "In a job step (slot be.feature.jobs.steps) every call on a receiver typed by an `integrations` owner passes an argument of the `RunKey` type of `platform/jobs`, produced by `JobClaims.runKey(job, step)` (it includes the fencing token), never built with a cast; a read belongs in the application layer, not in a step (pattern fenced-job)."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_JOB_RUN_KEY"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: job-run-key}
+  - id: R160
+    code: "BE_JOB_SHAPE"
+    law: "A `<job>.processor.ts` exists only in `features/jobs/<job>/transport/queue/`, is named after its job and declares a class extending the `FencedProcessor` of `platform/jobs`; a `steps/<step>.step.ts` exists only in `features/jobs/<job>/steps/` and declares a class implementing `JobStep`; a class implementing `JobStep` exists nowhere else (pattern fenced-job)."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_JOB_SHAPE"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: job-shape}
+  - id: R161
+    code: "BE_PROJECTION_WRITE_OWNER"
+    law: "A projection's entity (a class of `<name>.projection-entity.ts` in `modules/projections/<name>/`) is written only by the `<name>.projection.ts` of the same folder (the test world, e2e and fixtures aside): a write on it from a domain service, a handler, another projection or another file of the folder is a finding. The entity is found by the type origin of the write's arguments or builder chain (pattern projection)."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_PROJECTION_WRITE_OWNER"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: projection-write-owner}
+  - id: R162
+    code: "BE_PROJECTION_SHAPE"
+    law: "Every public method of a `<name>.projection.ts` class is `recompute*` (idempotent write from the source facts) or `get*` (read); the `index.ts` of a projection exports nothing from a `.projection-entity` file; and a feature whose kind is api calls no `recompute*` method of a projection (it reads through `get*`). The kind is read from the owner slot's `trigger` (pattern projection)."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_PROJECTION_SHAPE"]
+    editions: [full]
+    enforcers:
+      - {kind: eslint-be, id: projection-shape}
+  - id: R163
+    code: "HFS_SERVICE_PLACEMENT"
+    law: "A back-end service lives only at `be/apps/<service>/`: a folder with a `Dockerfile` of its own, or with a `package.json` other than the app root's and those of the fe workspaces (`fe/apps/<app>`, `fe/packages/<pkg>`), outside `be/apps/<service>/` (and outside a front end's `fe/apps/<app>/Dockerfile`) is a second service root and a finding; a service is a Nest app of the one repository that shares the `be/src` libraries and the one package.json, and its image is built from its own Dockerfile."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_SERVICE_PLACEMENT"]
+    enforcers:
+      - {kind: hfs, id: services-placement, at: scripts/hfs/rules/services.mjs}
+  - id: R164
+    code: "HFS_IMAGE_UNPINNED"
+    law: "In a product with more than one service (two or more be apps of kind api or worker) every component `image` of `.starcistacks/application-stacks.yaml` is pinned: a digest (`@sha256:<64 hex>`) or an exact version tag (`x.y.z`, optionally with a suffix); no tag, `latest`, a branch word or a major or minor-only tag is a finding. An own service image is `<repo>/<service>:<x.y.z>`, built from `be/apps/<service>/Dockerfile`; a service the product does not own stays a pinned third-party image."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_IMAGE_UNPINNED"]
+    enforcers:
+      - {kind: hfs, id: services-image-pins, at: scripts/hfs/rules/services.mjs}
+  - id: R165
+    code: "HFS_SERVICE_STACK_DECLARATION"
+    law: "Every api or worker app `be/apps/<service>` of a product with more than one service is a component of the same name with `role: service` in `.starcistacks/application-stacks.yaml`."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["HFS_SERVICE_STACK_DECLARATION"]
+    enforcers:
+      - {kind: hfs, id: services-stack-declaration, at: scripts/hfs/rules/services.mjs}
+  - id: R166
+    code: "HFS_EVENT_CONTRACT"
+    law: "The async contract between services is vendored under `be/contracts/<service>/events.json` (`starci/event-contract@1`, emitted by `starci app emit` from the literal `EVENTS` table of `be/apps/<service>/src/events.ts`, never written by hand) and equals that table; an event that undoes the step of another declares `compensates: \"<event>\"` and the named event must exist in a contract; a consumer declares what it reads in the literal `CONSUMES` table of `be/apps/<app>/src/consumes.ts` (service, event, version), every entry must exist in the provider's vendored snapshot at the same version, and a missing or stale snapshot, an unknown event or a version mismatch is a finding."
+    kinds: [check, codemod]
+    gates: [land, ci]
+    failureCodes: ["HFS_EVENT_CONTRACT"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: services-event-contract, at: scripts/hfs/rules/services.mjs}
+  - id: R167
+    code: "BE_ASYNC_SPEC_MISSING"
+    law: "Every event an app consumes (an entry of its `consumes.ts`) is named by an e2e spec, a file `be/src/tests/e2e/<area>/*.e2e-spec.ts` that boots the apps through `useTestWorld` (it publishes the event, reads the effect back and redelivers it); when the contract of the event declares `compensates: \"<event>\"` it is a saga step, and a spec naming it also names the compensated event, so the spec drives the whole flow: the step, the failure, then the compensated state."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["BE_ASYNC_SPEC_MISSING"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: services-async-specs, at: scripts/hfs/rules/services.mjs}
+  - id: R168
+    code: "BE_SERVICE_ISOLATION"
+    law: "A service app (`be/apps/<service>/`) imports no file of a sibling service app: the app that owns the importing file and the app that owns the file a specifier resolves to (a relative path or an alias of the program's own `compilerOptions.paths`) are read from the HFS slot view, and two different apps is a finding; services share only the `be/src` libraries and meet through the wire (a client of the sibling's API, or the events of its vendored contract under `be/contracts/<service>/`)."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_SERVICE_ISOLATION"]
+    enforcers:
+      - {kind: eslint-be, id: service-isolation}
+  - id: R169
+    code: "BE_SAGA_STEP_COMPENSATION"
+    law: "In a product that declares the `saga` pattern (`patterns: [\"saga\"]` in hfs.json sides.be) a saga is the folder `be/src/features/saga/<saga>/` (`<saga>.saga.ts` the orchestrator, `steps/<step>.step.ts`, `compensations/<step>.compensation.ts`): every step has a compensation of the same name and every compensation a step, the orchestrator imports every step and every compensation of its folder, and a folder of steps or compensations has an orchestrator; the folders themselves are slots enabled only by the declared pattern, so an undeclared saga is `HFS_SLOT_NOT_ENABLED`."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["BE_SAGA_STEP_COMPENSATION"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: saga-step-compensation, at: scripts/hfs/rules/saga.mjs}
+  - id: R170
+    code: "BE_SAGA_STATE_VERSIONED"
+    law: "Every saga orchestrator has `<saga>.saga-state.ts` beside it, whose exported state type declares `status` and `version: number`, and imports the fenced store of `platform/saga`: the persisted state of a run moves only through the store, every transition naming the version it read, so a zombie delivery cannot move a run twice."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["BE_SAGA_STATE_VERSIONED"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: saga-state-versioned, at: scripts/hfs/rules/saga.mjs}
+  - id: R171
+    code: "BE_SAGA_EVENT_CONTRACT"
+    law: "A saga step and a saga compensation each name their event (`readonly event = \"<name>\"`), both events are declared in a vendored contract (`be/contracts/<service>/events.json`), and the contract of the compensation's event declares `compensates: \"<event of the step of the same name>\"`."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["BE_SAGA_EVENT_CONTRACT"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: saga-event-contract, at: scripts/hfs/rules/saga.mjs}
+  - id: R172
+    code: "BE_SAGA_CONSUMER_DEDUPE"
+    law: "A consumer of a saga (`be/src/features/saga/<saga>/transport/message/<event>.consumer.ts`) passes the id of the delivery on (`message.eventId`) to the command it dispatches: the saga takes every event through the inbox (R80), so the consumer must hand it the dedupe key."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["BE_SAGA_CONSUMER_DEDUPE"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: saga-consumer-dedupe, at: scripts/hfs/rules/saga.mjs}
+  - id: R173
+    code: "BE_SAGA_E2E_MISSING"
+    law: "Every compensation path of a saga has an e2e spec (`be/src/tests/e2e/<area>/*.e2e-spec.ts` through `useTestWorld`) that names the event of the compensation and injects a failure through the world (an outage of an infra service or an app with `during`, `cut` or `latency`, a fake's `failNext`, `interruptDatabase`): the compensation is proven under a fault, not only on the happy flow."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["BE_SAGA_E2E_MISSING"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: saga-e2e, at: scripts/hfs/rules/saga.mjs}
+  - id: R174
+    code: "BE_CONTEXT_OWNER"
+    law: "A connection of hfs.json is a bounded context owned by one api or worker app (`owner`, `isolation` database or schema): an app composes only the connections and capabilities of the contexts it owns, and the migrate and cli apps compose every declared connection (migrations run only through them, once per connection)."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_CONTEXT_OWNER"]
+    enforcers:
+      - {kind: eslint-be, id: context-owner}
+  - id: R175
+    code: "BE_CONTEXT_COUPLING"
+    law: "Contexts are coupled only by events: no entity relation, no migration foreign key and no import (entities, services or SQL) of a domain or projection capability reaches a capability of another context."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_CONTEXT_COUPLING"]
+    enforcers:
+      - {kind: eslint-be, id: context-coupling}
+  - id: R176
+    code: "BE_CONTEXT_TRANSACTION"
+    law: "One transaction touches one context's connection: inside `transaction(async (manager) => ...)` of a connection's entity manager no entity manager of another connection is used and no capability of another context is called; work across contexts is a saga."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_CONTEXT_TRANSACTION"]
+    enforcers:
+      - {kind: eslint-be, id: context-transaction}
+  - id: R177
+    code: "BE_CONTRACT_BREAKING"
+    law: "An event contract evolves only additively: `be/contracts/<service>/events.json` against its pinned previous copy `events.pin.json` keeps every event, stream, version, payload field and type, adds only optional fields, and a breaking change is a new `<event>.v2` key."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_CONTRACT_BREAKING"]
+    editions: [full]
+    enforcers:
+      - {kind: hfs, id: contract-compat, at: scripts/hfs/rules/contract-compat.mjs}
+  - id: R178
+    code: "BE_CONTEXT_PLATFORM_TABLES"
+    law: "A platform capability the manifest lists as `perConnection` (the event-bus outbox, the job table) has its entities and migrations registered on every connection whose entity manager is passed to it."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_CONTEXT_PLATFORM_TABLES"]
+    enforcers:
+      - {kind: eslint-be, id: context-platform-tables}
+  - id: R179
+    code: "BE_KIND_DECLARATION"
+    law: "`hfs.json` `sides.be.kinds` lists exactly the trigger kinds (api, webhooks, realtime, saga, reactors, jobs, cli) the back end uses: a kind in use that is not declared, a declared kind with no feature, a declared kind whose patterns (`ruleParams.be.kindPatterns`, e.g. jobs needs fenced-job and queue) are missing from `sides.be.patterns`, and a declared kind whose platform capabilities (the tier-platform slots naming those patterns) are not tracked are each a finding. A kind is declared only when it is used; `starci app add <noun> <name>` creates the first member, the platform capabilities it needs and the registration."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_KIND_DECLARATION"]
+    enforcers:
+      - {kind: hfs, id: kind-declaration, at: scripts/hfs/rules/kinds.mjs}
+  - id: R180
+    code: "BE_KIND_EMPTY"
+    law: "A kind folder `be/src/features/<kind>/` holds only instance folders `<kind>/<name>/`, and each instance holds TypeScript source: a file directly in the kind folder (a feature named like a kind, a `.gitkeep`) and an instance with no TypeScript file are findings; an empty kind folder is never kept."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_KIND_EMPTY"]
+    enforcers:
+      - {kind: hfs, id: kind-empty, at: scripts/hfs/rules/kinds.mjs}
+  - id: R181
+    code: "BE_SQL_RETURNING_SHAPE"
+    law: "A `sql` constant that UPDATEs or DELETEs with RETURNING is wrapped as `WITH changed AS (UPDATE ... RETURNING ...) SELECT ... FROM changed`, because EntityManager.query returns a bare UPDATE or DELETE with RETURNING as `[rows, affectedCount]`, not as rows."
+    kinds: [lint, design]
+    gates: [settle, land, ci]
+    failureCodes: ["BE_SQL_RETURNING_SHAPE"]
+    enforcers:
+      - {kind: eslint-be, id: sql-returning}
+  - id: R182
+    code: "BE_WEBHOOK_SHAPE"
+    law: "A provider webhook door (`src/features/webhooks/<provider>/transport/http/<provider>.webhook.ts`) is one `@Controller` with one `@Post` handler declared `@Public({ reason: PublicReason.SignedWebhook })`; it injects only the `WebhookSignatureService` of `platform/http-security` and services of `modules/domain`, and its handler holds no branch, loop or `try`, calls only `verify` on the signature service and exactly one method of a domain service (the intake that records the delivery and publishes the event in its own transaction), and returns nothing."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_WEBHOOK_SHAPE"]
+    enforcers:
+      - {kind: eslint-be, id: webhook-shape}
+  - id: R183
+    code: "BE_WEBHOOK_UNVERIFIED"
+    law: "The first statement of a webhook handler is the unconditional `verify` call of the `WebhookSignatureService` (signature and replay window): a delivery that fails the proof throws before any other code runs, so no path reaches the domain intake unproven."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_WEBHOOK_UNVERIFIED"]
+    enforcers:
+      - {kind: eslint-be, id: webhook-verify-first}
+  - id: R184
+    code: "BE_REALTIME_SHAPE"
+    law: "A realtime file is the one door its role names: `<channel>.gateway.ts` holds one `@WebSocketGateway` class with `@SubscribeMessage` handlers and `<x>.subscription.ts` holds one `@Resolver` class with `@Subscription` operations, and neither carries a query, a mutation, a field resolver, a REST route or the other protocol."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_REALTIME_SHAPE"]
+    enforcers:
+      - {kind: eslint-be, id: realtime-shape}
+  - id: R185
+    code: "BE_REALTIME_WRITES"
+    law: "A realtime door reads and pushes only: the one value injected into it is the `RealtimeHub` of `platform/realtime`; no `EntityManager`, bus, queue, event bus or domain service reaches it."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_REALTIME_WRITES"]
+    enforcers:
+      - {kind: eslint-be, id: realtime-read-only}
+  - id: R186
+    code: "BE_REALTIME_TOPIC_SCOPE"
+    law: "The topic a realtime handler passes to `RealtimeHub.subscribe` is built from the handler's `@CurrentPrincipal()` parameter of `domain/identity`, so a client can only listen to channels its principal owns."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_REALTIME_TOPIC_SCOPE"]
+    enforcers:
+      - {kind: eslint-be, id: realtime-topic-scope}
+  - id: R187
+    code: "HFS_DOCKER_BUILD_CONTEXT"
+    law: "Every app image is built from the app root: the header comment of an app's Dockerfile states `starci docker build <app>` for its own path, and no COPY or ADD source leaves the build context (a `..` segment or an absolute path)."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_DOCKER_BUILD_CONTEXT"]
+    enforcers:
+      - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+  - id: R188
+    code: "HFS_DOCKER_STAGES"
+    law: "An app Dockerfile is multi-stage: a stage named `build` and a last stage named `runtime`; the runtime stage ends as `USER node` and runs no build (`npm run build*`, tsc, next, turbo, nest); every install is `npm ci`, never `npm install`; a back-end runtime runs `npm ci --omit=dev --ignore-scripts` and a front-end runtime installs nothing."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_DOCKER_STAGES"]
+    enforcers:
+      - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+  - id: R189
+    code: "HFS_DOCKER_ENTRY"
+    law: "The runtime stage starts the app's own built entry in exec form (be `node be/dist/apps/<app>/src/main.js`, fe `node` on the standalone `server.js` of the app); an api or Next app sets `ENV PORT` and EXPOSEs the same port and carries a HEALTHCHECK, a worker carries a process HEALTHCHECK and exposes nothing, a cli app says `HEALTHCHECK NONE` and exposes nothing; a Next app's build stage runs `turbo run build --filter=@<project>/<app>` and its `next.config.ts` sets `output: \"standalone\"`."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_DOCKER_ENTRY"]
+    enforcers:
+      - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+  - id: R190
+    code: "HFS_DOCKER_BASE_PIN"
+    law: "Every FROM of an app Dockerfile is a prior stage, the one node base image of the canon (an exact node version on an exact alpine release, `NODE_IMAGE` in scripts/hfs/rules/docker.mjs), or an image pinned by `@sha256` digest; never a moving tag, never an unresolved build argument."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_DOCKER_BASE_PIN"]
+    enforcers:
+      - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+  - id: R191
+    code: "HFS_DOCKER_SECRETS"
+    law: "No secret enters an image: no COPY or ADD of an `.env*` file (except `.env.example`) or of a path under `.starcistacks`, `.secrets`, `.volume`, a key, certificate or kubeconfig; no ADD of a URL; no ARG or ENV whose name is a credential (PASSWORD, SECRET, TOKEN, KEY, CREDENTIAL, PRIVATE), `NEXT_PUBLIC_*` excepted because it is published by design."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_DOCKER_SECRETS"]
+    enforcers:
+      - {kind: hfs, id: docker, at: scripts/hfs/rules/docker.mjs}
+  - id: R192
+    code: "RT_FACT_FALSE"
+    law: "Every claim of knowledge/hfs/facts.yaml holds against knowledge/hfs/slots.yaml (the one source of the product shape), and no prose of knowledge/**, docs/** or a README states the opposite of a fact (for example that an fe app lacks its own package.json, which fe.app.next requires); prose quotes a fact id or a slot id and never restates the claim."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_FACT_FALSE"]
+    enforcers:
+      - {kind: runtime, id: facts, at: scripts/hfs/runtime-rules/facts.mjs}
+  - id: R193
+    code: "RT_RULE_ID_UNKNOWN"
+    law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and the ids run from R01 to the last rule with no undeclared gap: an id with no rule is listed under `retired` with its reason (RT_RULE_ID_GAP), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). A retired id is a history name that only the contract changes and the changelogs may still spell; specs and generated copies are not read."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_RULE_ID_UNKNOWN", "RT_RULE_ID_GAP", "RT_RULE_UNCITED"]
+    enforcers:
+      - {kind: runtime, id: rule-ids, at: scripts/hfs/runtime-rules/rule-ids.mjs}
+  - id: R194
+    code: "RT_GENERATED_BLOCK_STALE"
+    law: "The app map (section 4), the back-end source tree (5.1), the tier matrix (5.2), the front-end source tree (6.1) and the rule catalog (12) of knowledge/hfs/README.md are generated blocks, rendered by scripts/hfs/readme-blocks.mjs from knowledge/hfs/slots.yaml and rules.yaml between hfs:generated markers and equal to the render byte for byte; the README never restates them by hand. Likewise the `verification.automated` list of a pattern rule is the failure codes of the rules its `hfsRules` names, the `slot` of a `files:` entry is the slot that owns its path, and the `code` of a why-map entry is the code of the catalog rule that lists the lint rule: scripts/hfs/derived-fields.mjs writes them and they equal the derivation byte for byte."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_GENERATED_BLOCK_STALE"]
+    enforcers:
+      - {kind: runtime, id: generated-block, at: scripts/hfs/runtime-rules/generated-block.mjs}
+  - id: R195
+    code: "RT_PROSE_PATH_NO_SLOT"
+    law: "Every product path the knowledge, the docs and the READMEs name (a be/ or fe/ path, whole or with placeholders, globs and braces) is owned by a slot of knowledge/hfs/slots.yaml or is a folder above one; a path no slot owns is prose that invented a place or kept one a slot no longer has. App names are free: a literal app name is one the examples or the starter declare, a placeholder stands for any; a ** glob and a topic file of the knowledge are not paths."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_PROSE_PATH_NO_SLOT"]
+    enforcers:
+      - {kind: runtime, id: prose-path, at: scripts/hfs/runtime-rules/prose-path.mjs}
+  - id: R196
+    code: "RT_PROSE_RESTATES_SLOTS"
+    law: "Knowledge, docs and READMEs never restate knowledge/hfs/slots.yaml: no fenced block or line names three or more product paths a slot owns, and no sentence lists three or more of the root or side file names the slots declare; a slot is referenced by its id, and the only allowed copy is a generated block between hfs:generated markers. The slot and rule catalogs, the example READMEs and the templates are sources or snapshots, not prose."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_PROSE_RESTATES_SLOTS"]
+    enforcers:
+      - {kind: runtime, id: prose-restates, at: scripts/hfs/runtime-rules/prose-restates.mjs}
+  - id: R197
+    code: "RT_RETIRED_CLI_CALL"
+    law: "No tracked file invokes a command the unified CLI removed: the retired kernel, hfs, test-stack and top-level runtime spellings listed in the `removed` fields of the catalog and in the dispatcher table; those fields, changelogs and contract-change history are exempt."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_RETIRED_CLI_CALL"]
+    enforcers:
+      - {kind: runtime, id: retired-cli, at: scripts/checks/check-retired-cli.mjs}
+  - id: R198
+    code: "RT_CLI_CATALOG_DRIFT"
+    law: "Every generated output of the unified CLI catalog (packages/cli/src/catalog.generated.mjs, docs/cli.md, packages/cli/completions/*) equals what scripts/cli/gen-catalog.mjs writes from modules/cli/commands."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_CLI_CATALOG_DRIFT"]
+    enforcers:
+      - {kind: runtime, id: cli-catalog-drift, at: scripts/cli/gen-catalog.mjs}
+  - id: R199
+    code: "RT_CLI_VERB_PARITY"
+    law: "The CLI catalog of modules/cli/commands and the implementation agree: every catalog verb has a handler and a doc, every kernel verb module and cli.mjs dispatch case has a catalog file, and every --flag a verb module names (usage, required, api-boolean-flags.txt) is a catalog flag."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_CLI_VERB_PARITY"]
+    enforcers:
+      - {kind: runtime, id: cli-parity, at: scripts/checks/check-cli-parity.mjs}
+  - id: R200
+    code: "RT_CLI_APP_ONLY_TEMPLATES"
+    law: "Managed app templates and their generated runtime copies invoke product actions only through `starci app <verb>`; retired hfs and test-stack commands, and any other starci group, are forbidden there."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_CLI_APP_ONLY_TEMPLATES"]
+    enforcers:
+      - {kind: runtime, id: cli-app-only-templates, at: scripts/hfs/runtime-rules/app-cli-templates.mjs}
+  - id: R201
+    code: "CLI_ONLY_ENTRY"
+    law: "Every action enters runtime code through `starci <group> <verb>`: tracked prompts, docs, skills, knowledge files, configs, CI files, hooks and scheduled-task registrations do not bypass the catalog through direct runtime scripts or package-script wrappers; the dispatcher and the specs' own spawn helpers are the declared exceptions."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["CLI_ONLY_ENTRY"]
+    enforcers:
+      - {kind: runtime, id: cli-only-entry, at: scripts/checks/check-cli-only-entry.mjs}
+  - id: R202
+    code: "CI_UPLOAD_NOT_SILENT"
+    law: "A coverage upload of a CI workflow never skips or fails silently: every step that uses codecov/codecov-action, in a root workflow, an example workflow or a template workflow of packages/hfs, authenticates by OIDC (`use_oidc: true`, with `permissions: id-token: write` on the job or the workflow), sets `fail_ci_if_error: true`, has no `continue-on-error`, and has no `if` that reads a secret or CODECOV_TOKEN, so a missing token can never turn the upload into a skipped step."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["CI_UPLOAD_NOT_SILENT"]
+    enforcers:
+      - {kind: runtime, id: ci-upload, at: scripts/hfs/runtime-rules/ci-upload.mjs}
+  - id: R203
+    code: "BE_FEATURE_THIN"
+    law: "A feature file (a role of ruleParams.be.thinRoles inside a slot of tier feature: handler, resolver, controller, consumer, processor, step, saga, saga-step, compensation, webhook, gateway, subscription, cli, mapper, the saga orchestrator service) maps its parameters and makes ONE delegating call into modules/ (a service, the command or query bus, the event bus, a queue producer): no branch, loop, ternary, try or throw and no computation. Business logic lives in modules/**, where every logic file owes 100 per file; orchestration (step order, compensation, claim, fencing, retry) lives in platform/*; the feature layer is proven by integration and e2e. The gate calls a kind requires are not delegation: a webhook's `verify` and a job step's `JobClaims` fence (`advance`, `runKey`); a logger call, a pure mapper function and a modules function in argument position are free too; a mapper may map a collection item by item (`map`) and write a date as text (`toISOString`), and a cli group command shows its help."
+    kinds: [lint]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["BE_FEATURE_THIN"]
+    enforcers:
+      - {kind: eslint-be, id: feature-thin}
+  - id: R204
+    code: "HFS_COVERAGE_SCOPE_DRIFT"
+    law: "What a back end measures at 100 per file is derived once from the slot manifest (the `coverage: required|none` field of every be slot and ruleParams.be.logicRoles, scripts/hfs/coverage-scope.mjs), and the three files that state it are its render: be/jest.config.js (thresholds), the `sonar.coverage.exclusions` line of sonar-project.properties, and codecov.yml (paths and one component per service app plus platform, each at 100). A difference is drift; the scope is never edited by hand."
+    kinds: [check, codemod]
+    gates: [pre-push, land, ci]
+    failureCodes: ["HFS_COVERAGE_SCOPE_DRIFT"]
+    enforcers:
+      - {kind: hfs, id: coverage-scope-drift, at: packages/hfs/sync/managed.mjs}
+  - id: R205
+    code: "RT_DOC_NO_OWNER"
+    law: "Every tracked docs/*.md declares exactly one ownership header on its first line — \"Owner: <knowledge/ or modules/ path that exists>\" when the document explains a machine-owned source, \"Task: <one task>\" for a how-to — no two documents carry the same task, and two documents whose titles share two or more topic words while at least 30% of the shorter one's sentences appear in the other are one document merged, not two."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_DOC_NO_OWNER"]
+    enforcers:
+      - {kind: runtime, id: doc-owner, at: scripts/checks/check-doc-owner.mjs}
+  - id: R206
+    code: "RT_EXAMPLE_COUPLING"
+    law: "Runtime source never couples to a product or its example: no tracked file under scripts/, engine/, packages/, ui/src or ui/api - and no managed template under packages/hfs/templates/ - spells a literal examples/<name>, one of the product names this runtime shipped against (the closed PRODUCT_NAMES list of scripts/lib/example-refs.mjs), an inc-<hash> a product name prefixes, or a host drive path. Specs, tests, the generated runtime copies, contract-change history, changelogs and .starciwork records are out of scope; a read the runtime genuinely makes at run time is declared once in scripts/lib/example-refs.mjs and every consumer names that constant."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_EXAMPLE_COUPLING", "RT_PRODUCT_NAME_IN_SOURCE", "RT_HOST_PATH_IN_TEMPLATE"]
+    enforcers:
+      - {kind: runtime, id: example-coupling, at: scripts/checks/check-example-coupling.mjs}
+  - id: R207
+    code: "RT_RETIRED_NAME_LIVE"
+    law: "A name the retired registry declares dead never appears in a live tracked file — not in prose, a comment, a string literal or a path: every retired[].path and moved[].from of modules/kernel/retired-paths.yaml, and every retiredNames[] naming that is not a path (a deleted app, a layer naming, a verb prefix). History (the contract changes, a changelog, a benchmark finding, a .starciwork record), the registry itself and the files of the check may name what was deleted; a slot manifest's forbids value or forbidden-presence tombstone declares a refusal, not a use."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_RETIRED_NAME_LIVE"]
+    enforcers:
+      - {kind: runtime, id: retired-names, at: scripts/checks/check-retired-names.mjs}
+  - id: R208
+    code: "RT_PORT_RESTATED"
+    law: "Every port literal of the runtime is spelled once, by its owner, and every other file references the owner: the harness UI ports live in modules/models/runtimes.yaml statusApp.port/devPort read through ui/ports.mjs, the local SonarQube host in scripts/gates/sonar-local.mjs DEFAULT_HOST. No in-scope file that is not the owner spells an owned literal in a port position (a scheme://host:NNNN or host:NNNN authority, a *port*/PORT assignment, a listen(NNNN) call), and an unowned literal in a port position of two or more runtime source files gets one owning exported constant the rest reference. Specs, tests, node_modules, the generated runtime copies, contract-change history, changelogs, .starciwork and the product stack declarations (.starcistacks, starcistacks-services - a product owns the ports of the services it runs) are out of scope."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_PORT_RESTATED"]
+    enforcers:
+      - {kind: runtime, id: port-once, at: scripts/checks/check-port-once.mjs}
+  - id: R209
+    code: "RT_CONFIG_DEFAULT_TWICE"
+    law: "Every documented configuration default is stated once, by its owner, and read through it: a camelCase leaf or lowercase key of config.example.yaml, or a value an owner declares - scripts/machine/home.mjs DEFAULTS (supervisor workers, the land gate, frozenMinutes, pollIntervalMs), engine/config.mjs (connector, ask, UAT, spec and allocation defaults, and DEFAULT_OWNER_LANGUAGE which scripts/machine/home.mjs re-exports), engine/orca-config.mjs (worker depth), scripts/reconciler/state.mjs (the controller mode) - is never restated as a literal fallback (?? or ||, a parameter default, or a language ternary) in any other runtime source file; the reader calls the owner accessor (supervisorSettings(), configuredMode(), ownerLanguage(), ...). Specs, tests, the generated runtime copies, stories and the HFS templates are out of scope, and a bare identifier or a computed value is a read, not a restatement."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_CONFIG_DEFAULT_TWICE"]
+    enforcers:
+      - {kind: runtime, id: default-once, at: scripts/checks/check-default-once.mjs}
+  - id: R210
+    code: "RT_VERSION_RESTATED"
+    law: "knowledge/hfs/canon-pins.yaml spells the version of every @starci package and every canon-pinned dependency once; a package.json is the declared install site and a lockfile its resolution. Anywhere else a semver literal equal to a pin - or a name@x.y.z specifier naming one - restates it, except on the declared binding keys a refresher owns and rewrites in place (canon.version of the code-pattern bindings held by check-canon-pins.mjs, provenance.version and identity.version of the grammar snapshots rewritten by scripts/work/ui/grammar-knowledge.mjs). Package manifests, lockfiles, changelogs, contract-change history, specs, tests, the generated runtime copies and .starciwork are out of scope; a restatement is fixed by naming the pin, never the literal."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_VERSION_RESTATED"]
+    enforcers:
+      - {kind: runtime, id: version-pin-once, at: scripts/checks/check-version-pin-once.mjs}
+  - id: R211
+    code: "RT_SLOT_ID_SHAPE"
+    law: "A slot id follows the grammar its manifest declares, read from the manifest not from a list: dot-separated lowercase kebab segments, a first segment of naming.prefixes in knowledge/hfs/slots.yaml (profiles in knowledge/hfs/runtime-slots.yaml), <side>.app.<kind> naming a kind of appKinds.<side>, and every deeper id extending a declared id - an explicit parent field, or a family at least two slots share; a lone deep orphan invents a family. The role-suffix vocabulary holds no synonym pairs: a profile's suffixes never share a word with bannedSuffixes, no naming.refusedPairs pair is live in suffixes on both sides, and naming.sameConceptPairs is the one declared exception (step + saga-step), live on both sides or dropped; naming.glossary binds the five incoming-thing names (consumer, subscription, webhook, processor, handler) to their distinct kinds."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_SLOT_ID_SHAPE"]
+    enforcers:
+      - {kind: runtime, id: slot-id-shape, at: scripts/checks/check-slot-id-shape.mjs}
+  - id: R212
+    code: "HFS_EDITION_INVALID"
+    law: "hfs.json names an edition the manifest knows (full, or lite; absent means full), and a lite app holds none of what lite does not have: no spec or test file, test script, test dependency or test-tool config, no UAT record, no supabase/functions, no worker app, no event, queue, job, projection or saga pattern, no saga, reactors, jobs or realtime kind."
+    kinds: [check]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["HFS_EDITION_INVALID", "HFS_EDITION_FORBIDDEN_PRESENT"]
+    enforcers:
+      - {kind: hfs, id: edition, at: scripts/hfs/rules/edition.mjs}
+  - id: R213
+    code: "DB_MIGRATION_SHAPE"
+    law: "A migration is `supabase/migrations/<ts14>_<kebab>.sql`; the stamp is a valid UTC instant not in the future, new migrations sort strictly after every migration on the base branch, and a migration already on the base is immutable (a diff or a removal is a finding); a file that does not parse as PostgreSQL is a shape failure."
+    kinds: [check]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["DB_MIGRATION_SHAPE"]
+    enforcers:
+      - {kind: hfs, id: db-migration-shape, at: scripts/hfs/rules/database.mjs}
+  - id: R214
+    code: "DB_RLS_REQUIRED"
+    law: "Row level security is code a parser can read: every `create table` (or `create table as`) in an exposed schema (`public` plus the config.toml `[api] schemas`) is followed, in the same migration, by `alter table <t> enable row level security` (and `force` for a table hfs.json `supabase.forceRls` declares); no `DO` block or function runs dynamic SQL that builds DDL or grants; a write or `for all` policy never uses `(true)`, `to anon`/`to public` is legal only on a `for select` policy named `*_public_read`, every policy is named `<table>_<role>_<action>`, and `service_role` is never granted."
+    kinds: [check, codemod]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["DB_RLS_REQUIRED", "DB_DYNAMIC_DDL", "DB_POLICY_SHAPE"]
+    enforcers:
+      - {kind: hfs, id: db-rls, at: scripts/hfs/rules/database.mjs}
+  - id: R215
+    code: "DB_DEFINER_SAFE"
+    law: "Privileged database objects are declared safely: a `security definer` function pins `search_path` (never `from current`), lives outside the exposed schemas or is `revoke execute ... from public` in the same migration, declares a return type and interpolates parameters into dynamic SQL only through `format('%I/%L')`; a bucket inserted into `storage.buckets` declares `public = false` (true only for an id ending `_public`), `file_size_limit` and `allowed_mime_types`, and has a `storage.objects` policy naming its `bucket_id` in the same migration."
+    kinds: [check]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["DB_DEFINER_SAFE", "DB_STORAGE_POLICY"]
+    enforcers:
+      - {kind: hfs, id: db-privileged-objects, at: scripts/hfs/rules/database.mjs}
+  - id: R216
+    code: "DB_CONFIG_POLICY"
+    law: "The database configuration and its types are checked facts: `supabase/config.toml` carries no literal value under a credential key (the value is `env(NAME)`), `auth.jwt_expiry` is at most 3600, and signup, site url and redirect urls equal the Supabase block of hfs.json where it declares them; `supabase/types/database.types.ts` is committed and equals the text `contract:emit` regenerates from the migrations."
+    kinds: [check]
+    gates: [land, ci]
+    failureCodes: ["DB_CONFIG_POLICY", "DB_TYPES_DRIFT"]
+    enforcers:
+      - {kind: hfs, id: db-config-types, at: scripts/hfs/rules/database.mjs}
+  - id: R217
+    code: "FE_SUPABASE_CLIENT_OWNER"
+    law: "The database has one door per side: `@supabase/ssr` and `@supabase/supabase-js` are imported and called only by the fe db owner (`fe.modules.db`, `fe.package.db`) and, on the back end, by `be.integrations.supabase`, and every client carries the committed `Database` type; the front end has no route handler beyond health/live and the auth callback slot, and holds no credential: `fe/` names no service-role or `*_SECRET`, `*_PRIVATE`, `*_TOKEN`, `*_PASSWORD` value (public configuration is read once by `modules/config`)."
+    kinds: [check, design]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["FE_SUPABASE_CLIENT_OWNER", "BE_SUPABASE_CLIENT_OWNER", "FE_ROUTE_HANDLER_FORBIDDEN", "FE_SERVICE_ROLE_FORBIDDEN"]
+    enforcers:
+      - {kind: machine, id: supabase-client-owner, at: scripts/hfs/architecture/supabase.mjs}
+      - {kind: machine, id: supabase-service-role, at: scripts/hfs/architecture/supabase.mjs}
+  - id: R218
+    code: "FE_DB_RESULT_TYPED"
+    law: "A Supabase result is typed by `Database` inference and never swallowed: no explicit generic on `single`/`maybeSingle`/`returns`, no cast or non-null assertion on a result, every list read carries `.limit()` or a keyset bound, every awaited call reads `error` or hands the whole result to `toOutcome`, and a failure never becomes empty data."
+    kinds: [check, design]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["FE_DB_RESULT_TYPED", "FE_DB_ERROR_HANDLED"]
+    enforcers:
+      - {kind: machine, id: supabase-result, at: scripts/hfs/architecture/supabase.mjs}
+  - id: R219
+    code: "FE_AUTH_SESSION_TRUST"
+    law: "The principal is verified, never trusted: server code never calls `auth.getSession()` (`getClaims()` through `getPrincipal()`, `auth.getUser()` for money, account security and role changes); a `write-*.ts` Server Action awaits `getPrincipal()` first, refuses an anonymous principal (the sign-in action is the one exception) and parses its input by a schema before any use; a back-end principal comes only from a Supabase access token verified against the project JWKS (signature, issuer, audience, expiry, pinned algorithm), never decoded unverified and never from the request body."
+    kinds: [check, design]
+    gates: [pre-push, settle, land, ci]
+    failureCodes: ["FE_AUTH_SESSION_TRUST", "FE_DB_WRITE_SHAPE", "BE_SUPABASE_JWT_VERIFIED"]
+    enforcers:
+      - {kind: machine, id: supabase-principal, at: scripts/hfs/architecture/supabase.mjs}
+  - id: R220
+    code: "HFS_LITE_SECRET_CUSTODY"
+    editions: [lite]
+    law: "A lite app holds no secret material in the tree: root `.env*`, `secrets.env`, `.secrets/` and an `.enc` file outside `.starcistacks/<env>/secrets` are forbidden, and `fe/` and `supabase/` hold no Supabase token, JWT or connection string with a password; the one custody is the sealed `.starcistacks/<env>/secrets/<slug>.enc`."
+    kinds: [check]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["HFS_LITE_SECRET_CUSTODY"]
+    enforcers:
+      - {kind: hfs, id: lite-secret-custody, at: scripts/hfs/rules/supabase-secrets.mjs}
+  - id: R221
+    code: "CI_TRIGGERS_RELEASE_ONLY"
+    law: "The only workflow triggers are a push of release tags and a person dispatching it: every tracked workflow of the runtime, its examples and the hfs app templates (so every scaffolded app inherits it) declares an `on` that holds only `push` filtered to `tags: ['v*']` (no branches, paths or ignore filter beside it) and `workflow_dispatch`. A branch push, a pull_request, a schedule, a workflow_call or any other event refuses the workflow: CI runs once per release, on its tag, and Codecov and Sonar upload only from that run."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["CI_TRIGGERS_RELEASE_ONLY"]
+    enforcers:
+      - {kind: runtime, id: git-triggers, at: scripts/hfs/runtime-rules/git-triggers.mjs}
+  - id: R222
+    code: "RELEASE_NOTES"
+    law: "A release tag `v<version>` on HEAD has its CHANGELOG.md section `## [<version>]` with no TODO, PENDING or TBD left in it and no `in preparation` mark: the tag message and the GitHub Release are that section, so a tag is never cut over an unfinished or missing section."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RELEASE_NOTES"]
+    enforcers:
+      - {kind: runtime, id: release-notes, at: scripts/hfs/runtime-rules/release-notes.mjs}
+  - id: R223
+    code: "RIGHTS_ROLE_DENIED"
+    law: "By the caller's role, the command guard refuses git push, git tag, raw git commit/add/rm/mv, raw git synchronization writes, npm publish, a whole-suite run outside the release cut and unit.verify/e2e.verify, npm ci without the host lock, a release cut, and raw side-effecting tools; modules/kernel/command-policy.yaml is the one rule table read by both the PreToolUse guard and the PATH shim."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RIGHTS_ROLE_DENIED", "RIGHTS_GIT_PUSH", "RIGHTS_GIT_TAG", "RIGHTS_GIT_COMMIT", "RIGHTS_GIT_SYNC", "RIGHTS_NPM_PUBLISH", "RIGHTS_NPM_CI_UNLOCKED", "RIGHTS_SUITE_RUN", "RIGHTS_RELEASE_CUT", "RIGHTS_RAW_TOOL"]
+    enforcers:
+      - {kind: runtime, id: role-rights, at: scripts/hfs/runtime-rules/rights-policy.mjs}
+  - id: R224
+    code: "RIGHTS_PROTECTED_ZONE"
+    law: "The protected zone declared once in modules/kernel/protected-zone.yaml is edited only by the owner path; a supervisor self-upgrade files an owner proposal, and an op never writes the .claude runtime checkout."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RIGHTS_PROTECTED_ZONE", "RIGHTS_OP_RUNTIME_WRITE"]
+    enforcers:
+      - {kind: runtime, id: protected-zone, at: scripts/hfs/runtime-rules/rights-policy.mjs}
+  - id: R225
+    code: "RT_HOOK_SHAPE"
+    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags) and runs no npm test, jest, typecheck or lint."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_HOOK_SHAPE", "RIGHTS_PUSH_NOT_RELEASE"]
+    enforcers:
+      - {kind: runtime, id: hook-shape, at: scripts/hfs/runtime-rules/hook-shape.mjs}
+  - id: R226
+    code: "RT_SPEC_OVER_BUDGET"
+    law: "Every recorded spec duration should stay within the shared per-file land budget in modules/kernel/spec-durations.yaml: for alpha.4 an over-budget spec is an advisory info finding ranked by its excess (it does not fail the check stage; the budget turns blocking in alpha.5), and every recorded spec path must still exist. An over-budget spec is repaired without removing tests or assertions: share a per-process fixture, remove per-test install or boot, inject the clock and never lengthen a timeout; stale rows are refreshed from the current land record."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_SPEC_OVER_BUDGET", "RT_SPEC_BUDGET_STALE"]
+    enforcers:
+      - {kind: runtime, id: spec-budget, at: scripts/checks/check-spec-budget.mjs}
+  - id: R227
+    code: "RT_SYNTAX_INVALID"
+    law: "Every git-tracked .mjs, .cjs and .js file parses as JavaScript, including tests and package sources; node_modules, generated roots of ruleParams.runtime.generated and vendored build output are outside the authored-source scope. The runtime folder's Node-exact syntax pass remains in place, while this batched in-process pass extends coverage to the whole tracked repository and reports every parser diagnostic at its file and line."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_SYNTAX_INVALID"]
+    enforcers:
+      - {kind: runtime, id: syntax, at: scripts/hfs/runtime-rules/syntax.mjs}
+retired:
+  - {id: R66, reason: "FE_E2E_SHAPE retired with eslint-canon-fe 7.0.0: a front end has no tests by standard"}
+  - {id: R67, reason: "FE_SPEC_QUALITY retired with eslint-canon-fe 7.0.0: a front end has no tests by standard"}
+  - {id: R123, reason: "RT_PENDING_STALE retired with the pending list itself: ruleParams.runtime.pending and its pending-ratchet enforcer are gone; nothing ratchets a tolerated-finding list"}
+  - {id: R128, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R129, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R130, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R131, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R132, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R133, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R134, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R135, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R136, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R137, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R138, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R139, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - {id: R140, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}