@starci/hfs 4.0.9 → 4.0.10

package/runtime/engine/db/provider-reservations.mjs

@@ -0,0 +1,101 @@
+// Provider receipt SQL participates in the machine writer's existing fenced transactions.
+
+export function providerReservationMethods({ need, parse, toJson, hex }) {
+  // Provider/account slots are shared by all five agent roles. A clock timeout is not exit evidence.
+  const providerReservationRow = (row) => row ? { id: row.id, fence: row.fence, attemptId: row.attempt_id,
+    provider: row.provider, account: row.account, model: row.model, role: row.role, state: row.state,
+    slots: row.slots, amountUnit: 'concurrent-launch', maxParallel: row.max_parallel,
+    handle: row.handle, pid: row.pid, launchIdentity: row.launch_identity, hostRequestId: row.host_request_id, createdAt: row.created_at, updatedAt: row.updated_at,
+    scope: parse(row.scope_json), estimate: parse(row.estimate_json), quota: parse(row.quota_json),
+    override: parse(row.override_json), releasedAt: row.released_at, proof: parse(row.proof_json) } : null;
+  function providerReservations(m, { provider = null, account = null, activeOnly = false } = {}) {
+    const where = [], args = [];
+    if (provider !== null) { where.push('provider=?'); args.push(provider); }
+    if (account !== null) { where.push('account=?'); args.push(account); }
+    if (activeOnly) where.push("state<>'released'");
+    return m.db.prepare(`SELECT * FROM provider_reservations${where.length ? ` WHERE ${where.join(' AND ')}` : ''} ORDER BY fence`).all(...args).map(providerReservationRow);
+  }
+  function providerReservationUsage(m, { provider, account = 'default' } = {}) {
+    const reservations = providerReservations(m, { provider, account, activeOnly: true });
+    return { running: reservations.length, reservations, observed: true };
+  }
+  /** Atomic last-slot admission. Replays preserve the original receipt; changed attempt meaning refuses. */
+  function reserveProvider(m, { provider, account = 'default', attemptId, role, model, maxParallel, scope = null, quota = null, estimate = null, override = null } = {}) {
+    need([provider, account, attemptId, model].every((value) => typeof value === 'string' && value.trim()), 'provider reservation needs provider, account, attemptId and concrete model');
+    need(typeof role === 'string' && role.trim(), 'provider reservation needs one agent role'); // The DDL owns the allowed role domain.
+    need(Number.isInteger(maxParallel) && maxParallel >= 0, 'provider reservation needs nonnegative integer maxParallel');
+    return m.transaction((db) => {
+      const existing = db.prepare('SELECT * FROM provider_reservations WHERE attempt_id=?').get(attemptId);
+      if (existing) {
+        if (existing.provider !== provider || existing.account !== account || existing.model !== model || existing.role !== role || existing.scope_json !== toJson(scope))
+          return { ok: false, reason: 'attempt-conflict', reservation: providerReservationRow(existing) };
+        return { ok: existing.state !== 'released', reason: existing.state === 'released' ? 'attempt-released' : 'reserved', reused: true, reservation: providerReservationRow(existing) };
+      }
+      const running = Number(db.prepare("SELECT count(*) n FROM provider_reservations WHERE provider=? AND account=? AND state<>'released'").get(provider, account).n);
+      if (running >= maxParallel) return { ok: false, reason: 'capacity', running, maxParallel };
+      const id = hex(16), at = m.now();
+      const result = db.prepare("INSERT INTO provider_reservations(id,attempt_id,provider,account,model,role,scope_json,state,max_parallel,quota_json,estimate_json,override_json,created_at,updated_at) VALUES(?,?,?,?,?,?,?,'reserved',?,?,?,?,?,?)")
+        .run(id, attemptId, provider, account, model, role, toJson(scope), maxParallel, toJson(quota), toJson(estimate), toJson(override), at, at);
+      db.prepare("INSERT INTO provider_reservation_events(reservation_id,at,from_state,to_state) VALUES(?,?,NULL,'reserved')").run(id, at);
+      return { ok: true, reason: 'reserved', reused: false, reservation: providerReservationRow(db.prepare('SELECT * FROM provider_reservations WHERE fence=?').get(result.lastInsertRowid)) };
+    });
+  }
+  const fencedProviderRow = (db, { id, fence, attemptId } = {}) => {
+    const row = db.prepare('SELECT * FROM provider_reservations WHERE id=? AND fence=?').get(id ?? '', fence ?? -1);
+    return row && (attemptId === undefined || row.attempt_id === attemptId) ? row : null;
+  };
+  /** Observe launch progress under its original fence; unknown still occupies its slot. */
+  function markProviderReservation(m, { id, fence, attemptId, provider, account, model, role, state, launchIdentity = null, hostRequestId = null, handle = null, pid = null } = {}) {
+    need(['launching', 'live', 'unknown'].includes(state), 'provider reservation observation needs launching, live or unknown');
+    return m.transaction((db) => {
+      const row = fencedProviderRow(db, { id, fence, attemptId });
+      if (!row) return { ok: false, reason: 'fenced' };
+      if (Object.entries({ provider, account, model, role }).some(([key, value]) => value !== undefined && row[key] !== value)) return { ok: false, reason: 'identity-conflict' };
+      if (row.state === 'released') return { ok: false, reason: 'released' };
+      if (state === 'launching' && (typeof launchIdentity !== 'string' || !launchIdentity.trim())) return { ok: false, reason: 'launch-identity-required' };
+      if (launchIdentity !== null && row.launch_identity && row.launch_identity !== launchIdentity) return { ok: false, reason: 'launch-identity-conflict', reservation: providerReservationRow(row) };
+      if (hostRequestId !== null && row.host_request_id && row.host_request_id !== hostRequestId) return { ok: false, reason: 'host-request-conflict', reservation: providerReservationRow(row) };
+      if (state === 'launching' && row.state !== 'reserved' && row.state !== 'launching') return { ok: false, reason: 'state-regression' };
+      if ((row.handle && handle && row.handle !== handle) || (row.pid && pid && row.pid !== pid)) return { ok: false, reason: 'identity-conflict' };
+      const at = m.now();
+      db.prepare('UPDATE provider_reservations SET state=?,launch_identity=coalesce(launch_identity,?),host_request_id=coalesce(host_request_id,?),handle=coalesce(handle,?),pid=coalesce(pid,?),updated_at=? WHERE id=? AND fence=?')
+        .run(state, launchIdentity, hostRequestId, handle, pid, at, id, fence);
+      if (row.state !== state) db.prepare('INSERT INTO provider_reservation_events(reservation_id,at,from_state,to_state) VALUES(?,?,?,?)').run(id, at, row.state, state);
+      return { ok: true, reservation: providerReservationRow(db.prepare('SELECT * FROM provider_reservations WHERE id=?').get(id)) };
+    });
+  }
+  /** Only the launcher/reconciler's definitive matching exit/no-effect receipt releases capacity. */
+  function releaseProviderReservation(m, { id, fence, attemptId, proof } = {}) {
+    return m.transaction((db) => {
+      const row = fencedProviderRow(db, { id, fence, attemptId });
+      if (!row) return { ok: false, reason: 'fenced' };
+      if (row.state === 'released') return { ok: true, reused: true, reservation: providerReservationRow(row) };
+      const affirmation = proof?.hostAffirmation;
+      const reply = affirmation?.receipt, result = reply?.result;
+      const residual = result?.residualResources ?? result?.worker?.residualResources;
+      const identities = [result, result?.worker, result?.terminal].filter((value) => value && typeof value === 'object');
+      const hostNoEffect = reply && typeof reply === 'object' && !['unknown', 'outcome_unknown'].includes(result?.state)
+        && !['unknown', 'outcome_unknown'].includes(result?.worker?.state)
+        && !(residual && typeof residual === 'object' && Object.keys(residual).length > 0)
+        && !identities.some((value) => ['agentTerminalHandle', 'terminalHandle', 'handle', 'pid', 'processId', 'dispatchId'].some((key) => value[key] !== undefined && value[key] !== null && value[key] !== ''))
+        && (result?.failedStage !== undefined || result?.stage !== undefined || typeof reply.error?.code === 'string' && reply.error.code.trim());
+      const resolvedUnknown = row.state === 'unknown' && row.launch_identity && proof?.launchIdentity === row.launch_identity
+        && row.host_request_id && affirmation?.requestId === row.host_request_id && affirmation.kind === 'worker-start-replay'
+        && affirmation.replayed === true && affirmation.outcome === 'failed' && affirmation.effectState === 'none'
+        && hostNoEffect;
+      const noEffect = proof?.kind === 'failed-before-launch' && proof.confirmed === true && !row.handle && !row.pid
+        && (['reserved', 'launching'].includes(row.state) || resolvedUnknown);
+      const terminalEnded = row.handle && proof?.kind === 'closed' && proof.handle === row.handle
+        && ['gone', 'disconnected'].includes(proof.terminalProof) && ['none', 'stopped'].includes(proof.processVerdict);
+      const processEnded = !row.handle && row.pid && proof?.kind === 'process-exited' && proof.pid === row.pid;
+      const ended = proof?.confirmed === true && (terminalEnded || processEnded)
+        && (!row.pid || proof.pid == null || proof.pid === row.pid);
+      if (!noEffect && !ended) return { ok: false, reason: 'exit-unproven', reservation: providerReservationRow(row) };
+      const at = m.now();
+      db.prepare("UPDATE provider_reservations SET state='released',released_at=?,updated_at=?,proof_json=? WHERE id=? AND fence=?").run(at, at, toJson(proof), id, fence);
+      db.prepare("INSERT INTO provider_reservation_events(reservation_id,at,from_state,to_state,proof_json) VALUES(?,?,?,'released',?)").run(id, at, row.state, toJson(proof));
+      return { ok: true, reused: false, reservation: providerReservationRow(db.prepare('SELECT * FROM provider_reservations WHERE id=?').get(id)) };
+    });
+  }
+  return { reserveProvider, providerReservations, providerReservationUsage, markProviderReservation, releaseProviderReservation };
+}

package/runtime/engine/digest.mjs

@@ -0,0 +1,16 @@
+// digest.mjs — the one SHA-256 the runtime hashes with. A leaf: every file's integrity digest,
+// every ledger input ref and every stamped asset is this function, so a byte stream and a file
+// never disagree about what their digest is.
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+
+/** The lowercase hex SHA-256 of `value` (string, Buffer or TypedArray). */
+export const sha256 = (value) => createHash('sha256').update(value).digest('hex');
+/** The SHA-256 of the file's exact bytes; throws when the file cannot be read. */
+export function sha256File(file){
+  // A numeric descriptor belongs to the caller; positional reads preserve its offset.
+  const owned=typeof file!=='number',fd=owned?fs.openSync(file,'r'):file;
+  const hash=createHash('sha256'),buffer=Buffer.alloc(1024*1024);
+  try{let at=0,n;while((n=fs.readSync(fd,buffer,0,buffer.length,at))>0){hash.update(buffer.subarray(0,n));at+=n;}return hash.digest('hex');}
+  finally{if(owned)fs.closeSync(fd);}
+}

package/runtime/engine/refuse.mjs

@@ -0,0 +1,11 @@
+// refuse.mjs — the refusal Error every verb raises: a message plus a stable `code` (and any extra fields the
+// caller attaches). `refuse` builds it, `fail` throws it, `need` throws it when a required condition is false.
+
+/** An Error carrying `code` and `extra` fields; callers `throw` it or hand it to a result row. */
+export const refuse = (message, code, extra = {}) => Object.assign(new Error(message), { code, ...extra });
+
+/** Throws the refusal `refuse` builds — the spelling used where refusing is the whole statement. */
+export const fail = (message, code, extra = {}) => { throw refuse(message, code, extra); };
+
+/** Throws `refuse(message, code)` when `ok` is falsy — the assertion spelling of a refusal. */
+export const need = (ok, message, code) => { if (!ok) throw refuse(message, code); };

package/runtime/engine/secrets.mjs

@@ -0,0 +1,130 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+/** The host-local credential filename, resolved only against a verified runtime main root. */
+export const SECRET_ENV_FILE='secret.env';
+/** The configured credential variable grammar shared by validation and secret resolution. */
+export const ENV_NAME=/^[A-Z_][A-Z0-9_]{0,63}$/;
+export const CREDENTIAL_FILE_MAX_BYTES=1024*1024;
+const resolvedValues = new Set();
+const remember = value => {
+  if (typeof value === 'string' && value.length >= 6) resolvedValues.add(value);
+  return value;
+};
+
+/** Filter credentials resolved by this process; the values never leave their resolution owner. */
+export function redactResolvedSecrets(text) {
+  let clean = text;
+  for (const value of resolvedValues) if (clean.includes(value)) clean = clean.split(value).join('[redacted:resolved-secret]');
+  return clean;
+}
+
+/** Check lexical availability only; blank and conventional template markers never prove provider validity. */
+export function credentialPresent(value){
+  if(typeof value!=='string'||!value.trim())return false;
+  return !/^(?:CHANGE_ME|REPLACE_ME|PLACEHOLDER|TODO|<[^>]*>|YOUR_[A-Z0-9_]+)$/i.test(value.trim());
+}
+
+/** Read one configured credential file with a finite byte budget; no effects beyond the read. */
+export function readSecretBytes(file){
+  const before=fs.lstatSync(file);
+  if(!before.isFile()||before.isSymbolicLink())throw new Error('credential file must be a regular file');
+  if(before.size>CREDENTIAL_FILE_MAX_BYTES)throw new Error('credential file exceeds the byte budget');
+  const fd=fs.openSync(file,fs.constants.O_RDONLY|(fs.constants.O_NOFOLLOW??0));
+  let bytes;
+  try{
+    const stat=fs.fstatSync(fd);
+    if(!stat.isFile()||stat.dev!==before.dev||stat.ino!==before.ino)throw new Error('credential file changed during resolution');
+    bytes=Buffer.alloc(CREDENTIAL_FILE_MAX_BYTES+1);
+    let count=0;
+    while(count<bytes.length){const n=fs.readSync(fd,bytes,count,bytes.length-count,null);if(n===0)break;count+=n;}
+    if(count>CREDENTIAL_FILE_MAX_BYTES)throw new Error('credential file exceeds the byte budget');
+    return bytes.subarray(0,count);
+  }catch(error){bytes?.fill(0);throw error;}finally{fs.closeSync(fd);}
+}
+
+const readCredentialFile = file => { const bytes=readSecretBytes(file); try{return bytes.toString('utf8');}finally{bytes.fill(0);} };
+
+/** Parse a dotenv file (KEY=VALUE lines, # comments, optional export/quotes). An absent file is {}. */
+export function readDotenv(file){
+  let text='';try{text=readCredentialFile(file);}catch(error){if(error?.code==='ENOENT')return {};throw error;}
+  const out={};
+  for(const line of text.split(/\r?\n/)){
+    const m=line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*?)\s*$/);
+    if(!m)continue;
+    let value=m[2];
+    if(value.length>=2&&(value[0]==='"'||value[0]==="'")&&value.at(-1)===value[0])value=value.slice(1,-1);
+    out[m[1]]=value;
+  }
+  return out;
+}
+
+/**
+ * Resolve a configured variable or its supported NAME_FILE custody pointer. An explicitly supplied
+ * blank variable disables the value; it must not resurrect a file value. Never print the result.
+ */
+export function connectorSecret(name,env=process.env){
+  if(typeof name!=='string'||!ENV_NAME.test(name))return null;
+  if(Object.hasOwn(env,name))return typeof env[name]==='string'?remember(env[name].trim()||null):null;
+  const pointer=typeof env[`${name}_FILE`]==='string'?env[`${name}_FILE`].trim():'';
+  if(!pointer)return null;
+  try{const value=readCredentialFile(pointer).trim();return remember(value||null);}catch{return null;}
+}
+
+/**
+ * Load the verified runtime main's local credentials below the actual environment without mutating
+ * either input. The caller owns repository identity; this base-tier reader never infers a root from cwd.
+ * Absence is allowed so the action-specific gate can name only the credentials that action requires.
+ */
+export function secretEnv(verifiedRuntimeRoot,env=process.env){
+  if(typeof verifiedRuntimeRoot!=='string'||!path.isAbsolute(verifiedRuntimeRoot))
+    throw new TypeError('secretEnv requires an absolute verified runtime root');
+  if(env===null||typeof env!=='object'||Array.isArray(env))throw new TypeError('secretEnv requires an environment mapping');
+  const root=fs.lstatSync(verifiedRuntimeRoot);
+  if(!root.isDirectory()||root.isSymbolicLink())throw new Error('secretEnv runtime root must be a regular directory');
+  const file=path.join(verifiedRuntimeRoot,SECRET_ENV_FILE);
+  let stat;
+  try{stat=fs.lstatSync(file);}catch(error){if(error?.code==='ENOENT')return {...env};throw error;}
+  if(!stat.isFile()||stat.isSymbolicLink())throw new Error('secret.env must be a regular file');
+  const local = readDotenv(file);
+  const resolved = {...local,...env};
+  for (const name of Object.keys(local)) if (typeof resolved[name] === 'string') remember(resolved[name]);
+  return resolved;
+}
+
+/** Select a supplied age identity without inventing custody or running a key tool. Inline execution awaits its owned isolation capability. */
+export function sopsIdentityEnv(env,{identity=null,required=false,platform=process.platform}={}){
+  const refuse=(reason,message)=>{
+    const error=new Error(`SOPS identity [${reason}]: ${message}`);
+    error.name='SopsIdentityRefusal';error.identityRefusal=reason;
+    return {mode:'refused',env:null,error};
+  };
+  if(!env||typeof env!=='object'||Array.isArray(env))return refuse('invalid-environment','an environment mapping is required');
+  const names=name=>Object.keys(env).filter(key=>platform==='win32'?key.toUpperCase()===name:key===name);
+  const inline=names('SOPS_AGE_KEY'),files=names('SOPS_AGE_KEY_FILE');
+  if(inline.length>1||files.length>1)return refuse('ambiguous-environment','multiple Windows aliases select an age identity');
+  if(inline.length){
+    const name=inline[0];
+    if(!credentialPresent(env[name]))return refuse('disabled-inline','SOPS_AGE_KEY is explicitly empty or invalid');
+    remember(env[name].trim());
+    return {...refuse('inline-context-unqualified','the supplied SOPS_AGE_KEY awaits an owned selected-identity isolation capability; no SOPS process was launched'),inlineName:name};
+  }
+  let file=identity;
+  if(files.length){
+    const value=env[files[0]];
+    if(!credentialPresent(value))return refuse('disabled-file','SOPS_AGE_KEY_FILE is explicitly empty or invalid');
+    if(identity!==null&&identity!==undefined&&identity!==value)return refuse('conflicting-files','two different original identity files were explicitly selected');
+    file=value;
+  }
+  if(file!==null&&file!==undefined){
+    if(!credentialPresent(file))return refuse('invalid-file','the original identity file selection is empty or invalid');
+    if(!path.isAbsolute(file))return refuse('identity-file-location-unqualified','select the original identity by its absolute path; caller and SOPS working directories may differ');
+    try{
+      const stat=fs.lstatSync(file);
+      if(!stat.isFile()||stat.isSymbolicLink())return refuse('identity-file-unavailable','the explicitly selected original identity must be a regular non-symlink file');
+    }catch{return refuse('identity-file-unavailable','the explicitly selected original identity file is unavailable');}
+    return {mode:'file',env:{...env,SOPS_AGE_KEY_FILE:file},error:null};
+  }
+  if(required)return refuse('identity-not-supplied','supply SOPS_AGE_KEY locally or select the original SOPS_AGE_KEY_FILE; no home default was inferred');
+  return {mode:'public-recipient',env:{...env},error:null};
+}

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -22,68 +22,68 @@ pins:
     source: packages/heroicons/package.json
     why: 'StarCi custom Heroicons-compatible cuts; eslint-canon-fe (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/grammar':
-    version: 0.8.2
+    version: 0.8.3
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: the product front ends pinned older versions (0.4.11, 0.5.0, 0.5.1); the runtime source is 0.8.0 and wins for a @starci package (the brand layer sets `--font-sans` and `--font-mono`; the grammar reads them; 0.7.2 added the Input tel kind and IconButton disclosure props).
   '@starci/eslint-canon-be':
-    version: 3.0.9
+    version: 3.0.10
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: '3.0.3: its bundled canon-pins copy pins stylelint-canon 2.0.2 and hfs 4.0.3; no rule changed. 3.0.2: its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root (app.starcistacks, app.sops) and pin hfs 4.0.2. 3.0.1: its bundled canon-pins copy pins hfs 4.0.1. 3.0.0: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side; the project graph is built per side. 2.0.0 (C0 release): starciBeConfig({ hfs: loadHfs(import.meta.url) }) typed factory and the BE-CONVENTION laws.'
   '@starci/eslint-canon-fe':
-    version: 8.0.9
+    version: 8.0.10
     group: starci
     install: registry
     side: fe
     source: packages/eslint/fe/package.json
     why: '8.0.3: its bundled canon-pins copy pins stylelint-canon 2.0.2 and hfs 4.0.3; no rule changed. 8.0.2: its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root (app.starcistacks, app.sops) and pin hfs 4.0.2. 8.0.1: its bundled canon-pins copy pins hfs 4.0.1. 8.0.0: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side; the project graph is built per side. 7.0.0: the front end has no tests (FE_NO_TESTS R97 in hfs); no-vietnamese-in-source (R91).'
   '@starci/stylelint-canon':
-    version: 2.0.4
+    version: 2.0.5
     group: starci
     install: registry
     side: fe
     source: packages/stylelint/package.json
     why: '2.0.2: no-class-selector refuses a compound class selector (`div.card`), which the 2.0.1 pattern let through. 2.0.1 accepts `--font-sans` and `--font-mono` in the brand layer (the vocabulary follows the grammar 0.8.0). 2.0.0 adds status-contrast (HeroUI soft pairs measured per theme), fixes brand-layer-shape on the shared :root,.light,.dark block and the info soft pair, and derives appTokens with loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.2
+    version: 2.0.3
     group: starci
     install: registry
     side: both
     source: packages/tsconfig/package.json
   '@starci/prettier-config':
-    version: 1.0.2
+    version: 1.0.3
     group: starci
     install: registry
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.2.4
+    version: 2.2.5
     group: starci
     install: registry
     side: be
     source: packages/jest-preset/package.json
     why: '2.2.4: the world runner runs up to min(--maxWorkers, slots) world files at once, each in its own process bound to one data slot of the test world (STARCI_TEST_WORLD_SLOT), and reads test-world state protocol 2 only: pinned together with @starci/test-world 1.1.0, any other state file is JEST_PRESET_WORLD_PAIR_MISMATCH. 2.2.3: republished after the move (no preset change). 2.2.2: the unit run writes the lcov Sonar and Codecov import (services only); 2.2.0: the integration, e2e and contract projects run every spec file in a worker process of its own (world-runner.cjs), so a process-global framework registry (@nestjs/graphql type metadata) never leaks between e2e files; 2.1.0: four projects on the test world, the unit kit (mockEntityManager, fakeTransaction, fakeIds, FakeClock, Outcome matchers) and the recordingOutbox claim side.'
   '@starci/test-world':
-    version: 1.2.0
+    version: 1.2.1
     group: starci
     install: registry
     side: be
     source: packages/test-world/package.json
     why: '1.2.0: Kafka as real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and schema-per-context Postgres (a schema and a login role per context in a shared database); its CLI main is exported at ./cli for starci app stack, and the former starci app stack bin is removed. 1.1.0: per-worker data slots: a run provisions min(jest workers, workers cap, default 2) slots, each its own namespace (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock, so world files run in parallel; state file protocol 2, paired exactly with @starci/jest-preset 2.2.4 (TEST_WORLD_PAIR_MISMATCH otherwise). 1.0.6: republished after the move (no library change). 1.0.5: a modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, and w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client. 1.0.4: world.resolve and scope.resolve take any Nest token (class, string or symbol). 1.0.3: the globalSetup registers the path aliases as TypeScript resolves them (the extends chain, paths from the config that declares them, the effective baseUrl), so a tests tsconfig that only extends the side config loads the declaration. 1.0.2: every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json), where .starcistacks lives, never from the be side. The shared e2e library of every back end (R47, R48): the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock; a devDependency of every back end. 1.0.1: world.keycloak.events/sessions (the user events of the realm and live sessions through the admin API) and world.infra.postgresql.connection(name) (the database of one connection down while the others serve, under the outage lock).'
   '@starci/cli':
-    version: 1.0.0
+    version: 1.0.1
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: '1.0.0: the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.0.9
+    version: 4.0.10
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -346,7 +346,7 @@ rules:
       - {kind: eslint-be, id: entrypoint-only-in-apps}
   - id: R34
     code: "BE_SCHEMA_AUTHORITY"
-    law: "Migrations are the only schema authority, run only by the cli migrate command and the test world; `synchronize` is `false`."
+    law: "Migrations own the application schema and run only through cli migrate or TestWorld; `synchronize` is `false`. TestWorld infrastructure may provision generated write-fault triggers and functions only in its verified private connection, preserving production constraints and existing triggers, holding its operation lock through catalog-confirmed cleanup."
     kinds: [lint, codemod, design]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_SCHEMA_AUTHORITY"]
@@ -1253,7 +1253,7 @@ rules:
       - {kind: runtime, id: generated-untracked, at: scripts/hfs/runtime-rules/generated-untracked.mjs}
   - id: R122
     code: "RT_CITED_PATH_MISSING"
-    law: "A runtime path cited by live prose or contracts (modules outside the contract history, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; a retired or moved path is cited only by history."
+    law: "A runtime path cited by live prose or contracts (modules, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; a retired or moved path is cited only by history."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1736,7 +1736,7 @@ rules:
       - {kind: runtime, id: facts, at: scripts/hfs/runtime-rules/facts.mjs}
   - id: R193
     code: "RT_RULE_ID_UNKNOWN"
-    law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and the ids run from R01 to the last rule with no undeclared gap: an id with no rule is listed under `retired` with its reason (RT_RULE_ID_GAP), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). A retired id is a history name that only the contract changes and the changelogs may still spell; specs and generated copies are not read."
+    law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and the ids run from R01 to the last rule with no undeclared gap: an id with no rule is listed under `retired` with its reason (RT_RULE_ID_GAP), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). A retired id is a history name that only changelogs may still spell; specs and generated copies are not read."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1772,7 +1772,7 @@ rules:
       - {kind: runtime, id: prose-restates, at: scripts/hfs/runtime-rules/prose-restates.mjs}
   - id: R197
     code: "RT_RETIRED_CLI_CALL"
-    law: "No tracked file invokes a command the unified CLI removed: the retired kernel, hfs, test-stack and top-level runtime spellings listed in the `removed` fields of the catalog and in the dispatcher table; those fields, changelogs and contract-change history are exempt."
+    law: "No tracked file invokes a command the unified CLI removed: the retired kernel, hfs, test-stack and top-level runtime spellings listed in the `removed` fields of the catalog and in the dispatcher table; those fields and changelogs are exempt."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1851,7 +1851,7 @@ rules:
       - {kind: runtime, id: doc-owner, at: scripts/checks/check-doc-owner.mjs}
   - id: R206
     code: "RT_EXAMPLE_COUPLING"
-    law: "Runtime source never couples to a product or its example: no tracked file under scripts/, engine/, packages/, ui/src or ui/api - and no managed template under packages/hfs/templates/ - spells a literal examples/<name>, one of the product names this runtime shipped against (the closed PRODUCT_NAMES list of scripts/lib/example-refs.mjs), an inc-<hash> a product name prefixes, or a host drive path. Specs, tests, the generated runtime copies, contract-change history, changelogs and .starciwork records are out of scope; a read the runtime genuinely makes at run time is declared once in scripts/lib/example-refs.mjs and every consumer names that constant."
+    law: "Runtime source never couples to a product or its example: no tracked file under scripts/, engine/, packages/, ui/src or ui/api - and no managed template under packages/hfs/templates/ - spells a literal examples/<name>, one of the product names this runtime shipped against (the closed PRODUCT_NAMES list of scripts/lib/example-refs.mjs), an inc-<hash> a product name prefixes, or a host drive path. Specs, tests, the generated runtime copies, changelogs and .starciwork records are out of scope; a read the runtime genuinely makes at run time is declared once in scripts/lib/example-refs.mjs and every consumer names that constant."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1860,7 +1860,7 @@ rules:
       - {kind: runtime, id: example-coupling, at: scripts/checks/check-example-coupling.mjs}
   - id: R207
     code: "RT_RETIRED_NAME_LIVE"
-    law: "A name the retired registry declares dead never appears in a live tracked file — not in prose, a comment, a string literal or a path: every retired[].path and moved[].from of modules/kernel/retired-paths.yaml, and every retiredNames[] naming that is not a path (a deleted app, a layer naming, a verb prefix). History (the contract changes, a changelog, a benchmark finding, a .starciwork record), the registry itself and the files of the check may name what was deleted; a slot manifest's forbids value or forbidden-presence tombstone declares a refusal, not a use."
+    law: "A name the retired registry declares dead never appears in a live tracked file — not in prose, a comment, a string literal or a path: every retired[].path and moved[].from of modules/kernel/retired-paths.yaml, and every retiredNames[] naming that is not a path (a deleted app, a layer naming, a verb prefix). History (a changelog, a benchmark finding, a .starciwork record), the registry itself and the files of the check may name what was deleted; a slot manifest's forbids value or forbidden-presence tombstone declares a refusal, not a use."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1869,7 +1869,7 @@ rules:
       - {kind: runtime, id: retired-names, at: scripts/checks/check-retired-names.mjs}
   - id: R208
     code: "RT_PORT_RESTATED"
-    law: "Every port literal of the runtime is spelled once, by its owner, and every other file references the owner: the harness UI ports live in modules/models/runtimes.yaml statusApp.port/devPort read through ui/ports.mjs, the local SonarQube host in scripts/gates/sonar-local.mjs DEFAULT_HOST. No in-scope file that is not the owner spells an owned literal in a port position (a scheme://host:NNNN or host:NNNN authority, a *port*/PORT assignment, a listen(NNNN) call), and an unowned literal in a port position of two or more runtime source files gets one owning exported constant the rest reference. Specs, tests, node_modules, the generated runtime copies, contract-change history, changelogs, .starciwork and the product stack declarations (.starcistacks, starcistacks-services - a product owns the ports of the services it runs) are out of scope."
+    law: "Every port literal of the runtime is spelled once, by its owner, and every other file references the owner: the harness UI ports live in modules/models/runtimes.yaml statusApp.port/devPort read through ui/ports.mjs, the local SonarQube host in scripts/gates/sonar-local.mjs DEFAULT_HOST. No in-scope file that is not the owner spells an owned literal in a port position (a scheme://host:NNNN or host:NNNN authority, a *port*/PORT assignment, a listen(NNNN) call), and an unowned literal in a port position of two or more runtime source files gets one owning exported constant the rest reference. Specs, tests, node_modules, the generated runtime copies, changelogs, .starciwork and the product stack declarations (.starcistacks, starcistacks-services - a product owns the ports of the services it runs) are out of scope."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1887,7 +1887,7 @@ rules:
       - {kind: runtime, id: default-once, at: scripts/checks/check-default-once.mjs}
   - id: R210
     code: "RT_VERSION_RESTATED"
-    law: "knowledge/hfs/canon-pins.yaml spells the version of every @starci package and every canon-pinned dependency once; a package.json is the declared install site and a lockfile its resolution. Anywhere else a semver literal equal to a pin - or a name@x.y.z specifier naming one - restates it, except on the declared binding keys a refresher owns and rewrites in place (canon.version of the code-pattern bindings held by check-canon-pins.mjs, provenance.version and identity.version of the grammar snapshots rewritten by scripts/work/ui/grammar-knowledge.mjs). Package manifests, lockfiles, changelogs, contract-change history, specs, tests, the generated runtime copies and .starciwork are out of scope; a restatement is fixed by naming the pin, never the literal."
+    law: "knowledge/hfs/canon-pins.yaml spells the version of every @starci package and every canon-pinned dependency once; a package.json is the declared install site and a lockfile its resolution. Anywhere else a semver literal equal to a pin - or a name@x.y.z specifier naming one - restates it, except on the declared binding keys a refresher owns and rewrites in place (canon.version of the code-pattern bindings held by check-canon-pins.mjs, provenance.version and identity.version of the grammar snapshots rewritten by scripts/work/ui/grammar-knowledge.mjs). Package manifests, lockfiles, changelogs, specs, tests, the generated runtime copies and .starciwork are out of scope; a restatement is fixed by naming the pin, never the literal."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]

package/runtime/modules/kernel/failure-codes.yaml

@@ -1642,6 +1642,46 @@ HFS_LITE_SECRET_CUSTODY:
   owner: owner
   kind: check-finding
 
+kernel-caller-stale:
+  title: "Kernel incarnation does not own this mutation"
+  title_vi: "Phiên Kernel không còn sở hữu thao tác"
+  meaning_vi: "Quyền hiện tại đã đổi trước khi ghi dữ liệu hoặc thực hiện tác động."
+  causes_vi:
+    - "Terminal, Dispatch, thế hệ, lượt khởi động hoặc singleton token đã bị thay thế."
+  nextStep_vi: "Giữ nguyên quyền đang tranh chấp; Supervisor kiểm tra phiên hiện tại trước khi thử lại."
+  owner: supervisor
+  kind: verb-refusal
+
+kernel-caller-unknown:
+  title: "Managed caller custody is unavailable"
+  title_vi: "Không xác minh được quyền của caller"
+  meaning_vi: "Lịch sử hoặc binding của caller không đọc được hoặc mâu thuẫn; không suy ra quyền owner."
+  causes_vi:
+    - "Kho ledger hoặc machine không đọc được; binding sai, cũ hoặc thuộc workflow khác."
+  nextStep_vi: "Khôi phục khả năng đọc và xác minh caller thực tế; không dùng biến môi trường để giả quyền."
+  owner: supervisor
+  kind: verb-refusal
+
+kernel-caller-actor:
+  title: "Actor claim contradicts native caller"
+  title_vi: "Actor khai báo mâu thuẫn với caller"
+  meaning_vi: "Giá trị --by không khớp với quyền caller mà owner hiện có xác minh."
+  causes_vi:
+    - "Caller dùng tên Kernel, Op hoặc Supervisor khác với phiên thực tế."
+  nextStep_vi: "Bỏ khai báo giả và dùng đúng caller; chuỗi actor không cấp quyền."
+  owner: supervisor
+  kind: verb-refusal
+
+kernel-read-unverified:
+  title: "Current Kernel READ attestation is incomplete"
+  title_vi: "READ của Kernel hiện tại chưa đầy đủ"
+  meaning_vi: "Manifest READ không chứng minh toàn bộ bytes cần đọc cho phiên Kernel hiện tại."
+  causes_vi:
+    - "File thiếu, hash sai, bytes dirty, descriptor sai hoặc lượt Kernel đã thay đổi."
+  nextStep_vi: "Lấy --plan, đọc đủ từng file và gửi manifest nguyên vẹn với --read-manifest từ Kernel hiện tại."
+  owner: supervisor
+  kind: verb-refusal
+
 HFS_MANAGED_FILE_DRIFT:
   title: "A managed file equals its template render"
   title_vi: "Tệp do .claude quản lý bị lệch"

package/runtime/modules/models/registry.yaml

@@ -154,9 +154,6 @@ targets:
   # difficulty and whose `defaultModel` covers an unpinned difficulty. A pool target names no model itself.
   codex-agent:
     runtime: codex
-    profiles:
-      working: gpt-6-luna
-      reasoning: gpt-6.1-sol
     orcaLaunch: {agent: codex}   # orca orchestration worker-start --agent codex
   # Launch-only targets: an explicit `--model gpt-6.1-sol` or `--model gpt-6-luna` request reaches that one model
   # on the Codex provider window. They are off every automatic chain; allocation routes the codex-agent pool.
@@ -164,16 +161,10 @@ targets:
   gpt-6.1-sol:
     runtime: codex
     defaultModel: gpt-6.1-sol
-    profiles:
-      working: gpt-6.1-sol
-      reasoning: gpt-6.1-sol
     orcaLaunch: {agent: codex}   # orca orchestration worker-start --agent codex
   gpt-6-luna:
     runtime: codex
     defaultModel: gpt-6-luna
-    profiles:
-      working: gpt-6-luna
-      reasoning: gpt-6-luna
     orcaLaunch: {agent: codex}   # orca orchestration worker-start --agent codex
   # Cursor: Orca agent id `cursor` (binary cursor-agent). A launch-only target like gpt-6.1-sol: off every automatic chain,
   # reached by an explicit `--model auto` (the CLI's default) or any id of the account's `cursor-agent --list-models`.
@@ -183,43 +174,14 @@ targets:
   cursor-agent:
     runtime: cursor
     defaultModel: auto
-    profiles:
-      working: auto
-      reasoning: auto
     orcaLaunch: {agent: cursor}   # orca orchestration worker-start --agent cursor
   claude-agent:
     runtime: claude
-    profiles:
-      working: opus
-      reasoning: opus-reviewer
     orcaLaunch: {agent: claude}   # orca orchestration worker-start --agent claude
   devin-agent:
     runtime: devin
     executionHosts: [orca]
-    profiles:
-      working: devin-worker
-      reasoning: devin-reviewer
     orcaLaunch: {agent: devin}   # orca orchestration worker-start --agent devin
-targetAliases:
-  codex-gpt-6.1-sol: codex-agent
-  codex-gpt-6-luna: codex-agent
-  devin-devin-worker: devin-agent
-  devin-devin-reviewer: devin-agent
-  # Bare model ids that are not targets resolve to the provider-window pool that carries them, so workflow
-  # quota entries land on the right window. gpt-6.1-sol and gpt-6-luna are targets; their `runtime: codex`
-  # names the window.
-  claude-opus: claude-agent
-  claude-opus-5-5: claude-agent
-skills:
-  starci:
-    chains:
-      working:
-        - devin-agent
-        - codex-agent
-        - claude-agent
-      reasoning:
-        - claude-agent
-        - codex-agent
 # An operator whose kind runtimes.yaml roleOfKind marks think work with no declared order carries the
 # think order of runtimes.yaml allocation.preference.think (Opus, then Sol) and nothing else;
 # scripts/route/route-model.mjs refuses any other pool for it. A kind's declared order wins: owner routing
@@ -524,7 +486,7 @@ selection: |-
   operator chain from top to bottom, choosing the first ready runtime/profile. Fall through only
   after an allowed failure with verified no-effect state. This policy never installs an agent,
   authenticates a provider, grants tools or expands the workflow authority. Every pool launches the one
-  way (modules/kernel/contract-changes/launch-through-worker-start.yaml): `orca orchestration worker-start --agent
+  way (modules/kernel/start-workflow.yaml): `orca orchestration worker-start --agent
   <runtime> [--model <id> --effort <level>] --spec <prompt>` (Orca files the Task), the unattended flags from Orca's per-agent
   default args; the launcher takes the agent terminal from the start receipt (else worker-show) and attests the effective agent and model
   (worker-show). Devin takes no model flag (Orca: --model is for Claude, Codex and Cursor) and starts on its CLI default.

package/runtime/modules/models/runtimes.yaml

@@ -275,9 +275,6 @@ allocation:
   # start waits for an Orca that does not answer, and how long after a responding Orca calls a kernel dead
   # it is asked again.
   hostOutage: {waitMs: 90000, deathSettleMs: 10000}
-  # resume: unused since resume-all.mjs was retired (2026-09-28); the logon run waited orcaWaitMs for Orca; the scheduled task
-  # re-runs resume every everyMs (whole minutes: schtasks /MO).
-  resume: {orcaWaitMs: 600000, everyMs: 600000}
   # supervisorTick: the numbers of the retired supervisor tick (2026-09-28) that the reconciler controllers still read
   # (host thresholds, orca probes, statusApp port, owner digest cadence); everyMs is unused. The tick ran every
   # everyMs (whole minutes: schtasks repetition). host: above maxNode node.exe or maxGit git.exe processes the host
@@ -354,9 +351,6 @@ allocation:
     routeAs: implementation.plan
     minDifficulty: hard
     effort: high
-  # restart: unused since restart-all.mjs was retired (2026-09-28); it waited waitMs for every running workflow to show one live
-  # Kernel, polling every pollMs.
-  restart: {waitMs: 480000, pollMs: 20000}
   # selfReload (scripts/machine/self-reload.mjs): a watchdog loop re-execs at most once per minIntervalMs; its
   # replacement takes over the loop's lock within handoverMs or is stopped.
   selfReload: {minIntervalMs: 300000, handoverMs: 30000}

package/runtime/modules/ops/_labels.yaml

@@ -0,0 +1,53 @@
+# _labels.yaml — the human name of every operation, one shared map.
+# The underscore prefix keeps this file out of the op catalog scan, like
+# _common.yaml: scripts/route/build-ops-registry.mjs and route-op.mjs skip
+# modules/ops/*.yaml files whose names start with "_".
+#
+# Owner request 2026-09-27: kernels, workflows and op workers carry names a person understands. The
+# op id (interface.draw) stays the key everywhere — the ledger, the api, job ids, contracts; this map
+# only says what a human reads for it. Every reader goes through scripts/lib/display-names.mjs
+# (opLabel): Orca [Op] worker titles, starci kernel status legs/nextActions `label`, the supervisor digest and
+# progress report, Telegram notices and the harness UI (ui/server.mjs sends the map in the snapshot
+# as `opLabels`, so the UI shows exactly these words). tests/lib/display-names.spec.mjs keeps one entry per
+# modules/ops/ops/*.yaml. `vi` is what the owner reads; `en` is the UI's English rendering of it.
+schema: starci/op-labels@1
+
+labels:
+  request.analyze: { vi: Phân tích yêu cầu, en: Analyze request }
+  task.execute: { vi: Chọn luồng việc, en: Select workflow }
+  scope.define: { vi: Xác định phạm vi, en: Define scope }
+  scope.finish: { vi: Kết thúc phạm vi, en: Finish scope }
+  goal.revise: { vi: Sửa mục tiêu, en: Revise goal }
+  business.decide: { vi: Chốt nghiệp vụ, en: Decide business rules }
+  architecture.decide: { vi: Thiết kế kiến trúc, en: Design architecture }
+  brand.decide: { vi: Chốt thương hiệu, en: Decide brand }
+  decision.prepare: { vi: Chuẩn bị quyết định, en: Prepare decision }
+  provision.ask: { vi: Xin thông tin, en: Request information }
+  work.author: { vi: Chia việc chi tiết, en: Plan work }
+  workspace.manage: { vi: Dựng workspace, en: Manage workspace }
+  knowledge.repair: { vi: Sửa tri thức, en: Repair knowledge }
+  grammar.update: { vi: Bổ sung Grammar, en: Update grammar }
+  interface.draw: { vi: Vẽ giao diện, en: Draw interface }
+  interface.asset: { vi: Làm hình ảnh, en: Make assets }
+  interface.scaffold: { vi: Dựng khung giao diện, en: Scaffold interface }
+  interface.implement: { vi: Code giao diện, en: Implement interface }
+  interface.audit: { vi: Soát giao diện, en: Audit interface }
+  backend.scaffold: { vi: Dựng khung backend, en: Scaffold backend }
+  backend.implement: { vi: Code backend, en: Implement backend }
+  package.scaffold: { vi: Dựng khung package, en: Scaffold package }
+  code.refactor: { vi: Chỉnh sửa mã nguồn, en: Refactor code }
+  content.generate: { vi: Soạn nội dung, en: Generate content }
+  docs.author: { vi: Viết tài liệu, en: Write docs }
+  test.author: { vi: Viết test, en: Write tests }
+  integration.verify: { vi: Kiểm thử tích hợp, en: Integration test }
+  e2e.verify: { vi: Kiểm thử đầu cuối, en: End-to-end test }
+  perf.verify: { vi: Kiểm thử hiệu năng, en: Performance test }
+  unit.verify: { vi: Chạy toàn bộ unit test, en: Full unit test run }
+  security.verify: { vi: Soát bảo mật, en: Security review }
+  uat.verify: { vi: Kiểm thử UAT, en: UAT test }
+  uat.assisted.prepare: { vi: Chuẩn bị UAT có người, en: Prepare assisted UAT }
+  uat.assisted.verify: { vi: Xác minh UAT có người, en: Verify assisted UAT }
+  review.verify: { vi: Review cuối, en: Final review }
+  handover.review: { vi: Bàn giao, en: Handover }
+  release.deliver: { vi: Phát hành, en: Release }
+  runtime.operate: { vi: Vận hành môi trường, en: Operate runtime }