@starci/hfs 4.0.9 → 4.1.0

package/runtime/knowledge/hfs/rules.yaml

@@ -1,4 +1,4 @@
-# knowledge/hfs/rules.yaml - the machine-readable catalog of the HFS rules (the ids run R01 up; an id with no rule is listed under `retired` with its reason, never reused; count the rules, never type the count).
+# knowledge/hfs/rules.yaml - the machine-readable catalog of the HFS rules (count the rules, never type the count).
 #
 # One entry per rule: its id, its finding code, the law in one line, how a violation is fixed
 # (`kinds`), the gates it runs at, the failure codes it reports, and every enforcer that judges it. The prose of each
@@ -21,7 +21,7 @@ version: 2.0.0
 gates:
   pre-commit: the managed .husky/pre-commit at the app root - starci app hygiene (staged .starciwork and .starcistacks paths, secrets guard), typecheck, ESLint per side and stylelint on the staged files, prettier --check, the unit specs the staged files touch
   pre-push: typecheck, lint (starci app lint), format:check and the unit specs affected since origin/main; runs every pre-commit rule again
-  settle: the op gate scripts/gates/gate.mjs over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
+  settle: the op gate `starci gate run` over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
   land: the workflow's finish, the only time main is touched - gate.mjs over the whole workflow branch against its merge-base with main, the merge guard, review.verify of the exact head that lands, the branch rebased onto main, then main fast-forwarded and pushed
   ci: GitHub Actions runs the same pinned starci app lint, format:check, typecheck, unit with the per-file coverage threshold, build:be and build:fe, then the Sonar scan and gate
   sonar: Sonar quality gate (knowledge/sonar-gate.yaml) - the imported lint findings, duplication, cognitive complexity and the coverage of the logic of be/src/modules at 100
@@ -101,14 +101,6 @@ rules:
     failureCodes: ["HFS_AGENT_DATA_TRACKED"]
     enforcers:
       - {kind: work-validate, id: agent-data-tracked, at: scripts/work/validate/check-example-work.mjs}
-  - id: R08
-    code: "HFS_WORK_NODE_RETIRED"
-    law: "Only flat family records, never `work/node`."
-    kinds: [check, codemod]
-    gates: [settle, land, ci]
-    failureCodes: ["HFS_WORK_NODE_RETIRED"]
-    enforcers:
-      - {kind: work-validate, id: work-node-retired, at: scripts/work/validate/check-example-work.mjs}
   - id: R09
     code: "HFS_IDENTITY_CUSTODY"
     law: "An identity points its secret at `secrets/identity-<slug>.enc`; UAT chooses by role."
@@ -346,7 +338,7 @@ rules:
       - {kind: eslint-be, id: entrypoint-only-in-apps}
   - id: R34
     code: "BE_SCHEMA_AUTHORITY"
-    law: "Migrations are the only schema authority, run only by the cli migrate command and the test world; `synchronize` is `false`."
+    law: "Migrations own the application schema and run only through cli migrate or TestWorld; `synchronize` is `false`. TestWorld infrastructure may provision generated write-fault triggers and functions only in its verified private connection, preserving production constraints and existing triggers, holding its operation lock through catalog-confirmed cleanup."
     kinds: [lint, codemod, design]
     gates: [pre-commit, pre-push, settle, land, ci]
     failureCodes: ["BE_SCHEMA_AUTHORITY"]
@@ -483,7 +475,7 @@ rules:
     editions: [full]
     enforcers:
       - {kind: hfs, id: test-topology, at: scripts/hfs/rules/test-topology.mjs}
-      - {kind: machine, id: test-kind-retired, at: scripts/hfs/architecture/hfs.mjs}
+      - {kind: machine, id: test-kind-unsupported, at: scripts/hfs/architecture/hfs.mjs}
       - {kind: eslint-be, id: test-world-files}
       - {kind: machine, id: contract-fixture-guard, at: scripts/hfs/architecture/contract-fixture-guard.mjs}
       - {kind: eslint-be, id: unit-test-colocated}
@@ -1232,15 +1224,6 @@ rules:
     failureCodes: ["RT_SOURCE_NAME"]
     enforcers:
       - {kind: runtime, id: source-name, at: scripts/hfs/runtime-rules/source-name.mjs}
-  - id: R120
-    code: "RT_RETIRED_PRESENT"
-    law: "No path of retired[] and no `from` of moved[] in modules/kernel/retired-paths.yaml is tracked again, and no symbol of its retiredSymbols[] is declared in runtime production code."
-    scope: runtime
-    kinds: [check]
-    gates: [land, runtime]
-    failureCodes: ["RT_RETIRED_PRESENT"]
-    enforcers:
-      - {kind: runtime, id: retired-present, at: scripts/hfs/runtime-rules/retired.mjs}
   - id: R121
     code: "RT_GENERATED_DRIFT"
     law: "A generated root of ruleParams.runtime.generated is git-ignored output of its declared generatedBy: the repo's check regenerates every root, the runtime copies (packages/hfs/runtime, packages/eslint/be/runtime, packages/eslint/fe/runtime) are judged equal to what scripts/hfs/sync-runtime.mjs writes from the single source, and no git-tracked path lies under a generated root."
@@ -1253,7 +1236,7 @@ rules:
       - {kind: runtime, id: generated-untracked, at: scripts/hfs/runtime-rules/generated-untracked.mjs}
   - id: R122
     code: "RT_CITED_PATH_MISSING"
-    law: "A runtime path cited by live prose or contracts (modules outside the contract history, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; a retired or moved path is cited only by history."
+    law: "A runtime path cited by live prose or contracts (modules, docs, skills, knowledge, CONTEXT.md, README.md, CONTRIBUTING.md, init, the ui docs) exists; history (a changelog, a benchmark file) is not read."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1262,13 +1245,13 @@ rules:
       - {kind: runtime, id: cited-path, at: scripts/checks/check-contract-cites.mjs}
   - id: R124
     code: "RT_PINNED_PATH_MOVED"
-    law: "A pinned path of ruleParams.runtime.pinned (persisted outside git) exists, or moved through a modules/kernel/retired-paths.yaml moved[] entry marked quiesced: true, landed with the workers stopped."
+    law: "A pinned path of ruleParams.runtime.pinned (persisted outside git) exists."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
     failureCodes: ["RT_PINNED_PATH_MOVED"]
     enforcers:
-      - {kind: runtime, id: pinned-path, at: scripts/hfs/runtime-rules/retired.mjs}
+      - {kind: runtime, id: pinned-path, at: scripts/hfs/runtime-rules/pinned.mjs}
   - id: R125
     code: "RT_NODE_MODULES_LINK"
     law: "No runtime source creates a junction or a symlink for a node_modules folder, through node:fs (symlink, symlinkSync, directly or through a local wrapper) or a spawned link command (mklink /J or /D, New-Item -ItemType Junction or SymbolicLink, ln -s): every checkout installs its own dependencies with a real npm ci from the cache."
@@ -1736,11 +1719,11 @@ rules:
       - {kind: runtime, id: facts, at: scripts/hfs/runtime-rules/facts.mjs}
   - id: R193
     code: "RT_RULE_ID_UNKNOWN"
-    law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and the ids run from R01 to the last rule with no undeclared gap: an id with no rule is listed under `retired` with its reason (RT_RULE_ID_GAP), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). A retired id is a history name that only the contract changes and the changelogs may still spell; specs and generated copies are not read."
+    law: "Every rule id (R<digits>) that tracked knowledge, docs, code or data names is a rule of this catalog, and rule ids are unique and well-formed (a gap between two ids is fine), and every rule of the catalog is named by the `hfsRules:` of at least one knowledge/patterns topic or carries `scope: runtime` (RT_RULE_UNCITED). History paths (changelogs, benchmark findings, .starciwork records), specs and generated copies are not read."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
-    failureCodes: ["RT_RULE_ID_UNKNOWN", "RT_RULE_ID_GAP", "RT_RULE_UNCITED"]
+    failureCodes: ["RT_RULE_ID_UNKNOWN", "RT_RULE_UNCITED"]
     enforcers:
       - {kind: runtime, id: rule-ids, at: scripts/hfs/runtime-rules/rule-ids.mjs}
   - id: R194
@@ -1754,7 +1737,7 @@ rules:
       - {kind: runtime, id: generated-block, at: scripts/hfs/runtime-rules/generated-block.mjs}
   - id: R195
     code: "RT_PROSE_PATH_NO_SLOT"
-    law: "Every product path the knowledge, the docs and the READMEs name (a be/ or fe/ path, whole or with placeholders, globs and braces) is owned by a slot of knowledge/hfs/slots.yaml or is a folder above one; a path no slot owns is prose that invented a place or kept one a slot no longer has. App names are free: a literal app name is one the examples or the starter declare, a placeholder stands for any; a ** glob and a topic file of the knowledge are not paths."
+    law: "Every product path the knowledge, the docs and the READMEs name (a be/ or fe/ path, whole or with placeholders, globs and braces) is owned by a slot of knowledge/hfs/slots.yaml or is a folder above one; a path no slot owns is prose that invented a place or kept one a slot no longer has. App names are free: a literal app name is one a shipped examples/*/hfs.json declares, a placeholder stands for any; a ** glob and a topic file of the knowledge are not paths."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1770,15 +1753,6 @@ rules:
     failureCodes: ["RT_PROSE_RESTATES_SLOTS"]
     enforcers:
       - {kind: runtime, id: prose-restates, at: scripts/hfs/runtime-rules/prose-restates.mjs}
-  - id: R197
-    code: "RT_RETIRED_CLI_CALL"
-    law: "No tracked file invokes a command the unified CLI removed: the retired kernel, hfs, test-stack and top-level runtime spellings listed in the `removed` fields of the catalog and in the dispatcher table; those fields, changelogs and contract-change history are exempt."
-    scope: runtime
-    kinds: [check]
-    gates: [land, runtime]
-    failureCodes: ["RT_RETIRED_CLI_CALL"]
-    enforcers:
-      - {kind: runtime, id: retired-cli, at: scripts/checks/check-retired-cli.mjs}
   - id: R198
     code: "RT_CLI_CATALOG_DRIFT"
     law: "Every generated output of the unified CLI catalog (packages/cli/src/catalog.generated.mjs, docs/cli.md, packages/cli/completions/*) equals what scripts/cli/gen-catalog.mjs writes from modules/cli/commands."
@@ -1799,7 +1773,7 @@ rules:
       - {kind: runtime, id: cli-parity, at: scripts/checks/check-cli-parity.mjs}
   - id: R200
     code: "RT_CLI_APP_ONLY_TEMPLATES"
-    law: "Managed app templates and their generated runtime copies invoke product actions only through `starci app <verb>`; retired hfs and test-stack commands, and any other starci group, are forbidden there."
+    law: "Managed app templates and their generated runtime copies invoke product actions only through `starci app <verb>`; any other starci group is forbidden there."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1851,25 +1825,16 @@ rules:
       - {kind: runtime, id: doc-owner, at: scripts/checks/check-doc-owner.mjs}
   - id: R206
     code: "RT_EXAMPLE_COUPLING"
-    law: "Runtime source never couples to a product or its example: no tracked file under scripts/, engine/, packages/, ui/src or ui/api - and no managed template under packages/hfs/templates/ - spells a literal examples/<name>, one of the product names this runtime shipped against (the closed PRODUCT_NAMES list of scripts/lib/example-refs.mjs), an inc-<hash> a product name prefixes, or a host drive path. Specs, tests, the generated runtime copies, contract-change history, changelogs and .starciwork records are out of scope; a read the runtime genuinely makes at run time is declared once in scripts/lib/example-refs.mjs and every consumer names that constant."
+    law: "Runtime source never couples to a product or its example: no tracked file under scripts/, engine/, packages/, ui/src or ui/api - and no managed template under packages/hfs/templates/ - spells a literal examples/<name>, one of the product names this runtime shipped against (the closed PRODUCT_NAMES list of scripts/lib/example-refs.mjs), an inc-<hash> a product name prefixes, or a host drive path. Specs, tests, the generated runtime copies, changelogs and .starciwork records are out of scope; a read the runtime genuinely makes at run time is declared once in scripts/lib/example-refs.mjs and every consumer names that constant."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
     failureCodes: ["RT_EXAMPLE_COUPLING", "RT_PRODUCT_NAME_IN_SOURCE", "RT_HOST_PATH_IN_TEMPLATE"]
     enforcers:
       - {kind: runtime, id: example-coupling, at: scripts/checks/check-example-coupling.mjs}
-  - id: R207
-    code: "RT_RETIRED_NAME_LIVE"
-    law: "A name the retired registry declares dead never appears in a live tracked file — not in prose, a comment, a string literal or a path: every retired[].path and moved[].from of modules/kernel/retired-paths.yaml, and every retiredNames[] naming that is not a path (a deleted app, a layer naming, a verb prefix). History (the contract changes, a changelog, a benchmark finding, a .starciwork record), the registry itself and the files of the check may name what was deleted; a slot manifest's forbids value or forbidden-presence tombstone declares a refusal, not a use."
-    scope: runtime
-    kinds: [check]
-    gates: [land, runtime]
-    failureCodes: ["RT_RETIRED_NAME_LIVE"]
-    enforcers:
-      - {kind: runtime, id: retired-names, at: scripts/checks/check-retired-names.mjs}
   - id: R208
     code: "RT_PORT_RESTATED"
-    law: "Every port literal of the runtime is spelled once, by its owner, and every other file references the owner: the harness UI ports live in modules/models/runtimes.yaml statusApp.port/devPort read through ui/ports.mjs, the local SonarQube host in scripts/gates/sonar-local.mjs DEFAULT_HOST. No in-scope file that is not the owner spells an owned literal in a port position (a scheme://host:NNNN or host:NNNN authority, a *port*/PORT assignment, a listen(NNNN) call), and an unowned literal in a port position of two or more runtime source files gets one owning exported constant the rest reference. Specs, tests, node_modules, the generated runtime copies, contract-change history, changelogs, .starciwork and the product stack declarations (.starcistacks, starcistacks-services - a product owns the ports of the services it runs) are out of scope."
+    law: "Every port literal of the runtime is spelled once, by its owner, and every other file references the owner: the harness UI ports live in modules/models/runtimes.yaml statusApp.port/devPort read through ui/ports.mjs, the local SonarQube host in scripts/gates/sonar-local.mjs DEFAULT_HOST. No in-scope file that is not the owner spells an owned literal in a port position (a scheme://host:NNNN or host:NNNN authority, a *port*/PORT assignment, a listen(NNNN) call), and an unowned literal in a port position of two or more runtime source files gets one owning exported constant the rest reference. Specs, tests, node_modules, the generated runtime copies, changelogs, .starciwork and the product stack declarations (.starcistacks, starcistacks-services - a product owns the ports of the services it runs) are out of scope."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1887,7 +1852,7 @@ rules:
       - {kind: runtime, id: default-once, at: scripts/checks/check-default-once.mjs}
   - id: R210
     code: "RT_VERSION_RESTATED"
-    law: "knowledge/hfs/canon-pins.yaml spells the version of every @starci package and every canon-pinned dependency once; a package.json is the declared install site and a lockfile its resolution. Anywhere else a semver literal equal to a pin - or a name@x.y.z specifier naming one - restates it, except on the declared binding keys a refresher owns and rewrites in place (canon.version of the code-pattern bindings held by check-canon-pins.mjs, provenance.version and identity.version of the grammar snapshots rewritten by scripts/work/ui/grammar-knowledge.mjs). Package manifests, lockfiles, changelogs, contract-change history, specs, tests, the generated runtime copies and .starciwork are out of scope; a restatement is fixed by naming the pin, never the literal."
+    law: "knowledge/hfs/canon-pins.yaml spells the version of every @starci package and every canon-pinned dependency once; a package.json is the declared install site and a lockfile its resolution. Anywhere else a semver literal equal to a pin - or a name@x.y.z specifier naming one - restates it, except on the declared binding keys a refresher owns and rewrites in place (canon.version of the code-pattern bindings held by check-canon-pins.mjs, provenance.version and identity.version of the grammar snapshots rewritten by scripts/work/ui/grammar-knowledge.mjs). Package manifests, lockfiles, changelogs, specs, tests, the generated runtime copies and .starciwork are out of scope; a restatement is fixed by naming the pin, never the literal."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -1979,7 +1944,7 @@ rules:
       - {kind: hfs, id: lite-secret-custody, at: scripts/hfs/rules/supabase-secrets.mjs}
   - id: R221
     code: "CI_TRIGGERS_RELEASE_ONLY"
-    law: "The only workflow triggers are a push of release tags and a person dispatching it: every tracked workflow of the runtime, its examples and the hfs app templates (so every scaffolded app inherits it) declares an `on` that holds only `push` filtered to `tags: ['v*']` (no branches, paths or ignore filter beside it) and `workflow_dispatch`. A branch push, a pull_request, a schedule, a workflow_call or any other event refuses the workflow: CI runs once per release, on its tag, and Codecov and Sonar upload only from that run."
+    law: "The only workflow triggers are a push of release tags, a person dispatching it and, in the runtime's own workflows (`.github/workflows/` at the root), a push to `main`: every tracked workflow declares an `on` that holds only `push` filtered to `tags: ['v*']` (and, in the runtime's own workflows, `branches: [main]`; no paths or ignore filter beside them) and `workflow_dispatch`. The examples and the hfs app templates (so every scaffolded app inherits it) take the tag and the dispatch only: an app's CI runs once per release, on its tag. A push to any other branch, a pull_request, a schedule, a workflow_call or any other event refuses the workflow."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -2015,7 +1980,7 @@ rules:
       - {kind: runtime, id: protected-zone, at: scripts/hfs/runtime-rules/rights-policy.mjs}
   - id: R225
     code: "RT_HOOK_SHAPE"
-    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags) and runs no npm test, jest, typecheck or lint."
+    law: "The app hook templates keep the gate model: pre-commit is L0 only (no typecheck, no test run); pre-push checks the release gate (the starci-release L4 record, refs/backup/, v[0-9] tags; the runtime's own hook is scripts/guards/release-push-gate.mjs, which judges main and v* tags against the release definition and lets every other ref through) and runs no npm test, jest, typecheck or lint."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -2024,7 +1989,7 @@ rules:
       - {kind: runtime, id: hook-shape, at: scripts/hfs/runtime-rules/hook-shape.mjs}
   - id: R226
     code: "RT_SPEC_OVER_BUDGET"
-    law: "Every recorded spec duration should stay within the shared per-file land budget in modules/kernel/spec-durations.yaml: for alpha.4 an over-budget spec is an advisory info finding ranked by its excess (it does not fail the check stage; the budget turns blocking in alpha.5), and every recorded spec path must still exist. An over-budget spec is repaired without removing tests or assertions: share a per-process fixture, remove per-test install or boot, inject the clock and never lengthen a timeout; stale rows are refreshed from the current land record."
+    law: "Every recorded spec duration should stay within the shared per-file land budget in modules/kernel/spec-durations.yaml: an over-budget spec is an advisory info finding ranked by its excess (it does not fail the check stage), and every recorded spec path must still exist. An over-budget spec is repaired without removing tests or assertions: share a per-process fixture, remove per-test install or boot, inject the clock and never lengthen a timeout; stale rows are refreshed from the current land record."
     scope: runtime
     kinds: [check]
     gates: [land, runtime]
@@ -2040,20 +2005,88 @@ rules:
     failureCodes: ["RT_SYNTAX_INVALID"]
     enforcers:
       - {kind: runtime, id: syntax, at: scripts/hfs/runtime-rules/syntax.mjs}
-retired:
-  - {id: R66, reason: "FE_E2E_SHAPE retired with eslint-canon-fe 7.0.0: a front end has no tests by standard"}
-  - {id: R67, reason: "FE_SPEC_QUALITY retired with eslint-canon-fe 7.0.0: a front end has no tests by standard"}
-  - {id: R123, reason: "RT_PENDING_STALE retired with the pending list itself: ruleParams.runtime.pending and its pending-ratchet enforcer are gone; nothing ratchets a tolerated-finding list"}
-  - {id: R128, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R129, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R130, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R131, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R132, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R133, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R134, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R135, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R136, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R137, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R138, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R139, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
-  - {id: R140, reason: "skipped when the shape block was renumbered past the ids of main (R143 up); never the id of a landed rule"}
+  - id: R228
+    code: "RT_IDENTIFIER_UNDECLARED"
+    law: "Every identifier a runtime ES module (scripts/, engine/ without the vendored yaml bundle, ui/api/, packages/cli/bin and src) reads or writes resolves, by scope analysis over its TypeScript syntax tree, to a declaration, import, parameter or Node global of an enclosing scope. A re-export (export {x} from './y.mjs') binds x in no local scope; require, module, exports and __dirname are not globals of a module; browser globals resolve only inside a function that a module hands to page.evaluate, here or through an import. A name a refactor left behind is refused before the line that reads it runs."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_IDENTIFIER_UNDECLARED"]
+    enforcers:
+      - {kind: runtime, id: undeclared-identifiers, at: scripts/checks/check-undeclared-identifiers.mjs}
+  - id: R229
+    code: "RT_REMOVED_VOCABULARY"
+    law: "No text an agent or the owner reads teaches a spelling the runtime refuses. The refused names - config keys, routing-bias fields, verbs, flags, codes and vocabulary - are the one list modules/kernel/removed-vocabulary.yaml, each with its replacement and the release that removed it; the config and routing-bias refusals read the same list. Every tracked file of skills/, docs/, README.md, CONTEXT.md, CONTRIBUTING.md, modules/ and knowledge/ (Markdown and yaml) is scanned line by line, and a line that spells a listed name is a finding naming file:line, the name and its replacement, (and every tests/**/*.spec.mjs, where a name is allowed only on a line or under a test title that says refuse, reject, removed, throws or unknown) unless the file is the list, CHANGELOG.md, or the line or block carries the [removed-list] marker (a marker alone on a comment line covers the lines up to the next blank one). Removing or renaming a key, flag, verb, field or code adds its entry to the list in the same commit."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_REMOVED_VOCABULARY"]
+    enforcers:
+      - {kind: runtime, id: removed-vocabulary, at: scripts/checks/check-removed-vocabulary.mjs}
+  - id: R230
+    code: "RT_PROSE_COMMAND_UNKNOWN"
+    law: "A command an instruction shows exists as written. Every `starci <group> <verb>` in a backticked span, fenced code line or yaml example item of skills/, docs/, README.md, CONTEXT.md, CONTRIBUTING.md and modules/ names a verb of the CLI catalog (modules/cli/commands) in a catalogued group, and every --flag on it is a flag of that verb or a global flag; the text after a lone -- belongs to another program and a [removed-list] marked line is exempt. The catalog is generated into the valid set, never typed twice."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_PROSE_COMMAND_UNKNOWN"]
+    enforcers:
+      - {kind: runtime, id: prose-commands, at: scripts/checks/check-prose-commands.mjs}
+  - id: R231
+    code: "RT_DOCUMENTED_DEFAULT_DRIFT"
+    law: "A default a document states equals the value the code reads. A document states a default by citing its key - default <value> = `<key>` - where the key is a config.yaml path (resolved through the validator's settings reader, so an absent block yields its code default) or <yaml file under modules/>:<dotted path>; the check resolves the key and compares, and a key that resolves to nothing is a finding. docs/, README.md, CONTEXT.md, config.example.yaml and modules/ prose and yaml are scanned; a bare number stated as a default without its key is not judged, so the owner of a default is cited, never retyped."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_DOCUMENTED_DEFAULT_DRIFT"]
+    enforcers:
+      - {kind: runtime, id: documented-defaults, at: scripts/checks/check-documented-defaults.mjs}
+  - id: R232
+    code: "RT_ROLES_CONTRACT_DRIFT"
+    law: "A role is described once. modules/kernel/roles.yaml holds, per role, its scope, what it does, what it must clean up, what it never does, whom it reports to and who oversees it; a Markdown surface of the role carries the block generated from it, a yaml or script surface cites modules/kernel/roles.yaml#<role>, and no surface teaches a spelling the role's contradicts list names."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_ROLES_CONTRACT_DRIFT"]
+    enforcers:
+      - {kind: runtime, id: roles-contract, at: scripts/checks/check-roles-contract.mjs}
+  - id: R233
+    code: "RT_EDGE_CASE_REGISTRY"
+    law: "Every edge case met is a declared entry of modules/reconciler/edge-cases.yaml with its family, its real occurrence and a status of covered or open; a covered entry names the rule that handles it and the spec that reproduces it, and both exist, and an open entry says why."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_EDGE_CASE_REGISTRY"]
+    enforcers:
+      - {kind: runtime, id: edge-case-registry, at: scripts/checks/check-edge-case-registry.mjs}
+  - id: R234
+    code: "RT_SECRET_TRACKED"
+    law: "The runtime repository is public and tracks no secret material, not even ciphertext: no tracked *.enc member and no tracked secret.env or .env file, except the paths ruleParams.runtime.heldSecrets names with their reason (a list that only shrinks). Every secret the host needs lives in the one untracked .claude/secret.env, read only through engine/secrets.mjs, its names listed in the tracked secret.env.example; a product repository keeps its own custody in its own repository. Two Sonar servers, no overlap: SonarCloud serves everything that lives in the runtime repository (the runtime and the example apps, token SONAR_TOKEN), the self-hosted ext/sonar serves product repositories only."
+    scope: runtime
+    kinds: [check]
+    gates: [land, runtime]
+    failureCodes: ["RT_SECRET_TRACKED"]
+    enforcers:
+      - {kind: runtime, id: secret-tracked, at: scripts/hfs/runtime-rules/secret-tracked.mjs}
+  - id: R235
+    code: "SCAN_SMELL"
+    law: "Code carries none of the smells SonarCloud measures that a lint rule can decide: no `await` inside a loop (S9382; an endless loop is spared), no `charCodeAt`/`fromCharCode` (S7758), no string that only escapes backslashes (S7780; a Next `matcher` is spared, it is read statically), no nested conditional expression (S3358), no `void` on anything but a call (S3735), no unused import (S1128), no import that is only handed on instead of `export ... from` (S7763), no prop of a component's props type the component never reads (S6767, front end), and, through typescript-eslint with type information, no deprecated API (S1874), no object turned into text (S6551) and no `async` function that never awaits and returns no promise (S7503). The files a unit or an end-to-end spec names are outside the scan, so outside these rules."
+    kinds: [lint, codemod]
+    gates: [pre-commit, pre-push, settle, land, ci]
+    failureCodes: ["SCAN_SMELL"]
+    enforcers:
+      - {kind: eslint-be, id: no-await-in-loop}
+      - {kind: eslint-be, id: prefer-code-point}
+      - {kind: eslint-be, id: prefer-string-raw}
+      - {kind: eslint-be, id: no-nested-conditional}
+      - {kind: eslint-be, id: no-void-operator}
+      - {kind: eslint-be, id: no-unused-import}
+      - {kind: eslint-be, id: prefer-export-from}
+      - {kind: eslint-fe, id: no-await-in-loop}
+      - {kind: eslint-fe, id: prefer-code-point}
+      - {kind: eslint-fe, id: prefer-string-raw}
+      - {kind: eslint-fe, id: no-nested-conditional}
+      - {kind: eslint-fe, id: no-void-operator}
+      - {kind: eslint-fe, id: no-unused-import}
+      - {kind: eslint-fe, id: prefer-export-from}
+      - {kind: eslint-fe, id: no-unused-prop-types}

package/runtime/knowledge/hfs/slots.yaml

@@ -1,7 +1,7 @@
 # HFS slot manifest (owner-approved 2026-09-29, decisions 1-10 in the owner decisions record).
 # The one place that says what may exist in a StarCi product repository and where. A product is ONE app repository
 # (hfs 4, manifest major 2): the app root holds the one package.json, lockfile and node_modules, the hfs.json of kind app,
-# the CI, the hooks and .starciwork (slots of profile `app`); `be/` and `fe/` are its two sides, each laid out as the old
+# the CI, the hooks and .starciwork (slots of profile `app`); `be/` and `fe/` are its two sides, each laid out as a
 # standalone repository root (slots of profile be or fe, paths relative to the side folder). Every tracked path of every
 # repository must match exactly one slot. Checks, lint factories, the architecture machine, templates and the why
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
@@ -20,9 +20,6 @@ versioning:
     change or remove an existing slot, make an optional slot required, promote a rule warn to error, change the
     direction matrix. Needs owner approval and a migration lane per repo. There is no compatibility window: the old
     MAJOR is refused the day the new one lands (owner ruling: no backward compatibility).
-  retire: >-
-    a slot is never edited in place; it gets retiredIn (a major) and a successor slot id. After that major a
-    path matching a retired slot is HFS_SLOT_RETIRED (error).
   pins: knowledge/hfs/canon-pins.yaml carries the exact versions of every @starci/* package and framework this MAJOR supports.
 # 2.1.0 is such a minor: it ADDS the edition mechanism (the `editions` list, the per-slot `editions`, `litePresence`, `lite`
 # overlays and `provider`, and `sides.<side>.reads` of an app-root tree) and the lite slots; an app without `edition` in its
@@ -83,7 +80,7 @@ versioning:
 #               requiredInstances), each shaped as the same field in the slot body; every other field is the edition's.
 #               Under lite `tests` is none on every slot: a lite app has no test world.
 #   provider    the hfs.json connections[].provider that enables this opt-in slot (supabase); never an app kind.
-#   since / retiredIn / successor   lifecycle.
+#   since       the manifest version that introduced the slot.
 presenceValues: [required, optional, opt-in, forbidden]
 trackedValues: [tracked, ignored, external]
 testValues: [unit-beside, e2e, none]
@@ -177,7 +174,7 @@ ruleParams:
       http: [platform/http]
       https: [platform/http]
       cache-manager: [integrations/cache, integrations/redis]
-      "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability (retired local rule must-use-cache-service)
+      "@nestjs/cache-manager": [integrations/cache, integrations/redis]     # the CACHE_MANAGER token: caching goes through the cache capability
       redis: [integrations/cache, integrations/redis]
       ioredis: [integrations/cache, integrations/redis]
       bullmq: [platform/queue]               # pattern queue: BullMQ jobs and job schedulers (the relay of the outbox into queues)
@@ -389,7 +386,7 @@ slots:
     rules: [HFS_MANAGED_FILE_DRIFT, HFS_TOOL_CONFIG_LOCAL]
   - id: app.tool-config-optional
     profiles: [app]
-    path: .npmrc
+    path: "{.npmrc,.npmignore}"     # .npmignore: npm reads the nearest ignore file instead of the root files negations, so an app that ships inside another package keeps its sealed credentials out of the tarball here
     presence: optional
     tracked: tracked
     tier: none
@@ -530,12 +527,12 @@ slots:
              "features/<feature>/<family>/<name>/index.yaml", "features/<feature>/br/<rule>/ac/<name>/index.yaml",
              "features/<feature>/ui/<name>/assets/<approved-file>", "features/<feature>/uat/<name>/{index,accounts,fixtures}.yaml",
              "features/<feature>/uat/<name>/{seed,cleanup}.sql", "_resources/{identities,environments,fixtures}/<slug>/resource.yaml"]
-    forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/, "work/node records"]
+    forbids: [evidence/, logs/, reports/, captures/, runs/, "kernel-*/", "*.sqlite*", _derived/]
     # Lite keeps the product catalog, feature overviews, grammar and brand drawing records; UAT records belong to the forbidden slot below.
     lite:
       requires: [.gitignore, workspace.yaml, index.yaml]
       allows: [workspace.yaml, index.yaml, "brand/**", shell/index.yaml, "features/<feature>/index.yaml", "features/<feature>/ui/<name>/index.yaml", "features/<feature>/ui/<name>/assets/<approved-file>"]
-    rules: [HFS_AGENT_DATA_TRACKED, HFS_WORK_NODE_RETIRED, HFS_IDENTITY_CUSTODY]
+    rules: [HFS_AGENT_DATA_TRACKED, HFS_IDENTITY_CUSTODY]
   - id: app.starciwork.uat
     profiles: [app]
     # The UAT records of the full edition: a lite app has no UAT (no tests, no record of one), so the trees are forbidden paths
@@ -699,7 +696,7 @@ slots:
     goesTo: "a be feature: webhooks/<provider> for a third-party callback, api for an endpoint, a cli command on a schedule (pg_cron / pg_net)"
     since: 2.1.0
 
-  # ----- side root (both sides): what the old standalone repository root held, less the app-root files ----------
+  # ----- side root (both sides): what a standalone repository root holds, less the app-root files ----------
   - id: repo.side-root-forbidden
     profiles: [be, fe]
     path: "{package.json,package-lock.json,hfs.json,README.md,.gitignore,.gitattributes,.husky/,.github/,.starciwork/,.starcistacks/,supabase/,.sops.yaml,sonar-project.properties,codecov.yml,.prettierrc,.prettierignore,scripts/}"
@@ -1640,7 +1637,7 @@ slots:
     coverage: none
     why: provider sandbox contracts, skipped without sandbox config; run only by test:contract, never part of test or test:e2e
     rules: [BE_TEST_TOPOLOGY]
-  - id: be.tests.e2e-world-retired
+  - id: be.tests.e2e-world-dir
     profiles: [be]
     path: "src/tests/e2e/world/"
     presence: forbidden
@@ -1694,15 +1691,15 @@ slots:
     tier: route
     roles: {proxy: proxy.ts, instrumentation: instrumentation.ts, instrumentation-client: instrumentation-client.ts}
     tests: none
-    rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16 (fe.source-root-retired)
-  - id: fe.source-root-retired
+    rules: [FE_NEXT_CONVENTIONS]   # middleware.ts is refused on Next >= 16 (fe.source-root-middleware)
+  - id: fe.source-root-middleware
     profiles: [fe]
     path: "apps/<app>/src/{middleware.ts,middleware.js}"
     presence: forbidden
     tracked: external
     tier: none
     tests: none
-    goesTo: "apps/<app>/src/proxy.ts: Next >= 16 renamed middleware to proxy and refuses the old name"
+    goesTo: "apps/<app>/src/proxy.ts: Next >= 16 reads proxy.ts and refuses middleware.ts"
     rules: [FE_NEXT_CONVENTIONS]
   - id: fe.route.callback
     profiles: [fe]

package/runtime/knowledge/patterns/be/api.yaml

@@ -94,32 +94,15 @@ rules:
       `@CommandHandler(X)` or `@QueryHandler(X)` on a class that `extends ICQRSHandler<X, XResult>` and implements
       `protected override async process(message)`; it never overrides `execute`. `ICQRSHandler.execute` is load-bearing: it
       logs `OperationFailed` with the operation name and the error and rethrows, and counts refused outcomes. `<Action>Result`
-      is a plain projection type or an `Outcome<Value, Code>` and the return type of `process` is declared. The handler opens
-      the transaction (`this.entityManager.transaction(async (manager) => ...)`), stamps `this.clock.now()` once and passes
-      it down. The handler is thin (R203 `BE_FEATURE_THIN`): its `process` maps the message, makes one delegating call to an
-      injected `*.service` and returns the result, so it has no unit spec; the decisions (persisted state, the `where` that
-      holds ownership, nothing written on a refusal) live in the service and its `<name>.service.spec.ts` asserts them.
+      is a plain projection type or an `Outcome<Value, Code>` and the return type of `process` is declared. The handler is
+      thin (R203 `BE_FEATURE_THIN`): its `process` maps the message, makes one delegating call to an injected `*.service`
+      and returns the result, so it has no unit spec. The service owns the work: it opens the one transaction
+      (`this.entityManager.transaction(async (manager) => ...)`), stamps `this.clock.now()` once and passes it down, and it
+      holds the decisions (persisted state, the `where` that holds ownership, nothing written on a refusal), which its
+      `<name>.service.spec.ts` asserts under the per-file coverage law of BE-TEST-13.
     rationale: |-
       A single template gives every operation the same failure log and metric, and the service spec pins the decision the
       handler delegates.
-    cases:
-      - id: case-1
-        when: A handler
-        write: |-
-          @CommandHandler(StartCheckoutCommand)
-          /** Opens a checkout, or refuses with a purchase code. */
-          export class StartCheckoutHandler extends ICQRSHandler<StartCheckoutCommand, StartCheckoutResult> {
-              constructor(
-                  @InjectPrimaryEntityManager() private readonly entityManager: EntityManager,
-                  @InjectClock() private readonly clock: Clock,
-                  private readonly purchaseService: PurchaseService,
-              ) { super() }
-
-              protected override async process(command: StartCheckoutCommand): Promise<StartCheckoutResult> {
-                  const at = this.clock.now()
-                  return this.entityManager.transaction(async (manager) => this.purchaseService.open({ manager, learnerId: command.params.principal.id, offerId: command.params.request.offerId, at }))
-              }
-          }
     verification:
       automated:
         - BE_CQRS_SHAPE
@@ -129,7 +112,7 @@ rules:
         - BE_FEATURE_THIN
       manual:
         - Confirm the service spec the handler calls asserts refusal paths and ownership, not only that a mock was called.
-    relatedExamples: []
+    relatedExamples: [api]
   - id: BE-CQRS-4
     title: The bus is the only way into a handler; nothing forwards
     kind: mandatory

package/runtime/knowledge/patterns/be/cli.yaml

@@ -87,22 +87,13 @@ rules:
       command and its spec are found from the name alone.
     cases:
       - id: case-1
-        when: The migrate group
-        write: |-
-          // be/src/features/cli/migrate/migrate.cli.ts
-          @Command({ name: "migrate", subCommands: [RunCli], description: "Schema migrations of every connection" })
-          /** The migrate group; without a sub-command it shows its help. */
-          export class MigrateCli extends CommandRunner {
-              async run(): Promise<void> { this.command.help() }
-          }
-      - id: case-2
         when: A `@SubCommand` declared in src/modules/platform/database/reindex.cli.ts or in features/api/
         write: 'Refused (BE_CLI_COMMAND_SHAPE, BE_CLI_OWNER): move it to src/features/cli/<group>/subs/reindex.cli.ts and register it in the group module.'
     verification:
       automated:
         - BE_CLI_COMMAND_SHAPE
       manual: []
-    relatedExamples: []
+    relatedExamples: [cli]
   - id: BE-CLI-3
     title: A command is an action runner with its own unit spec
     kind: mandatory
@@ -134,7 +125,7 @@ rules:
         - BE_FEATURE_THIN
       manual:
         - Confirm a command that writes is safe to re-run or refuses a second run explicitly.
-    relatedExamples: []
+    relatedExamples: [cli]
   - id: BE-CLI-4
     title: Only the cli parses the command line
     kind: mandatory
@@ -180,7 +171,7 @@ rules:
         - BE_CLI_REQUIRED
       manual:
         - Confirm the deploy runs `cli migrate run` to completion before the api and worker apps start.
-    relatedExamples: []
+    relatedExamples: [cli]
 files:
   - path: apps/cli/Dockerfile
     slot: repo.app-image

package/runtime/knowledge/patterns/be/realtime.yaml

@@ -78,7 +78,7 @@ rules:
         - BE_CONTRACT_UNGUARDED
         - BE_REALTIME_SHAPE
       manual:
-        - Confirm a query or mutation an old subscription door carried now lives in an api feature.
+        - Confirm no query or mutation lives in a subscription door; it lives in an api feature.
     relatedExamples: [realtime]
   - id: BE-REALTIME-2
     title: A realtime door reads and pushes, it never writes
@@ -95,19 +95,6 @@ rules:
     rationale: |-
       A door that can only touch the hub cannot change business state, so the biggest risk of a long-lived unauthenticated-looking
       connection, a write through it, is removed by type.
-    cases:
-      - id: case-1
-        when: A subscription that pushes order status changes
-        write: |-
-          @Resolver()
-          export class OrderStatusSubscription {
-              constructor(private readonly hub: RealtimeHub) {}
-
-              @Subscription(() => OrderStatusChangedType)
-              orderStatusChanged(@CurrentPrincipal() principal: Principal, @Args("orderId") orderId: string): AsyncIterable<OrderStatusChangedType> {
-                  return this.hub.subscribe(orderStatusTopic(principal.id, orderId))
-              }
-          }
     verification:
       automated:
         - BE_REALTIME_WRITES

package/runtime/knowledge/patterns/be/webhooks.yaml

@@ -92,25 +92,6 @@ rules:
       that skips it, and a door with one call and no decision has nothing left to test except the proof and the hand-over.
     cases:
       - id: case-1
-        when: The door of a payment gateway
-        write: |-
-          @Controller("webhooks/payment-gateway")
-          export class PaymentGatewayWebhook {
-              constructor(
-                  @InjectWebhookSignature() private readonly signature: WebhookSignatureService,
-                  private readonly payments: PaymentService,
-              ) {}
-
-              @Post()
-              @HttpCode(HttpStatus.NO_CONTENT)
-              @Public({ reason: PublicReason.SignedWebhook })
-              @RateLimit(RateTier.Strict)
-              async receive(@Req() request: RawBodyRequest<Request>, @Headers("x-signature") signature: string | undefined, @Headers("x-timestamp") timestamp: string | undefined, @Body() body: PaymentNotificationRequest): Promise<void> {
-                  this.signature.verify({ provider: "payment-gateway", rawBody: request.rawBody, signature, timestamp })
-                  await this.payments.acceptNotification(body)
-              }
-          }
-      - id: case-2
         when: A delivery whose raw body must be hashed
         write: 'enable the raw body for the app (`NestFactory.create(..., { rawBody: true })` in the api app) and read `request.rawBody`; never hash a re-serialized `body`.'
     verification:

package/runtime/modules/kernel/failure-codes.yaml

@@ -1337,7 +1337,7 @@ HFS_APP_LAYOUT_INVALID:
 HFS_ARCH_CONFIG_UNREAD:
   title: "The machine reads `hfs.json`; zero files analysed is red"
   title_vi: "Máy kiến trúc không đọc được hfs.json"
-  meaning_vi: "Kiểm tra kiến trúc không đọc được `hfs.json` phân tích 0 tệp, hoặc repo còn một tệp cấu hình mà máy không đọc nữa (`architecture.json`) — đây là đỏ, không phải 'chưa có dữ liệu'."
+  meaning_vi: "Kiểm tra kiến trúc không đọc được `hfs.json` phân tích 0 tệp — đây là đỏ, không phải 'chưa có dữ liệu'."
   causes_vi:
     - "Vi phạm luật R24: Máy kiến trúc tự đọc `hfs.json`; phân tích 0 tệp hay `unavailable` cho một profile đã khai = thất bại."
   nextStep_vi: "Op vừa tạo ra bản này sẽ được chạy lại để sửa theo lời nhắn của bộ kiểm tra; không cần ai can thiệp thêm."