@starci/hfs 4.11.19 → 4.11.21

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 4.11.21 - 2026-10-30
+
+- Changed: an urgent release runs typecheck and the build only (owner ruling urgent-typecheck-build, contexts/harness/decisions.md): `URGENT_CHECKS` are the release gates `typecheck`, `build`, `build-be` and `build-fe` the app declares (`release/urgent.mjs`); app check, lint and the tests wait for the back-fill. `--lint-baseline` is retired with lint itself and refused (`RELEASE_URGENT_LINT_BASELINE_RETIRED`); `release/lint-baseline.mjs` is gone.
+- Added: the one-command urgent release. `starci app stack deploy --env <env> --urgent --reason "<text>" --execute` with no `--image` and no `--source-sha` releases HEAD (unless it already has a pushed urgent record; a tag already on HEAD is adopted), builds and pushes its images on this machine before the deploy's Docker transport reaches the server, and deploys their digests under the unchanged floor (`stack/urgent-release.mjs`, wired in `stack/cli.mjs`; `--reason` and `--remote` belong to it; `STACK_URGENT_REASON_MISSING`). A dry run plans the release and the build and stops. Specs: `src/stack-urgent-release.spec.mjs`, `src/release-urgent.spec.mjs`.
+- Changed: `deploy.remote.sealed` is one member name (`sealed: vps`: `vps.enc.yaml` holds VPS_HOST, VPS_USER, `privateKey` and `knownHosts`), read as the member of all three SSH roles (`stack-deploy-config.mjs`, schema `deployRemote.sealed`). The three-role object `{ ops, sshKey, knownHosts }` is refused (STACKS_DEPLOY_CONFIG_INVALID), its message naming `starci app secret migrate <env> <member> --to vps --into-existing` to fold a member per role into one (owner, 2026-10-30: one form only). Spec: `src/hfs-stacks-deploy-schema.spec.mjs`.
+- Changed: `secret audit` takes a grouped member as declared, not MIXED_PROVIDERS: the member `deploy.remote.sealed` names groups VPS_HOST, VPS_USER, privateKey and knownHosts, and a `secrets:` entry naming a member may list the keys it groups (`keys: [...]`, schema `secret.keys`) instead of an entry per key; the stacks gate refuses a listed key the envelope does not hold, and an entry with both `key` and `keys` (`secret-standard.mjs` `declaredGroup`, `stacks-gate.mjs`). Spec: `src/hfs-secret-standard.spec.mjs`.
+- Changed: the bundled canon pins name eslint-canon-be 3.8.20, eslint-canon-fe 9.5.22 and the Grammar family 0.15.33.
+
+## 4.11.20 - 2026-10-30
+
+- Added: a slot may declare the files of its own that carry logic: `logic: [file, ...]` (owner ruling slot-declared-logic, contexts/decisions/rulings.yaml), valid only on a tracked be directory slot with `coverage: required` and `tests: unit-beside`, each a `<name>.<part>.ts` the slot requires or allows and not already a logic-role file (`manifest-shape.mjs` `slotLogicProblems`, `declaredLogicOf`). A declared file is measured at 100 per file like a logic role (`coverage-scope.mjs` `files` and `measuredBy`, `rules/coverage-below.mjs`, `sync/index.mjs` renders `files` into be/jest.config.js, Sonar no longer excludes it), and its colocated `.spec.ts` is admitted unlisted (`allows.mjs`). `be.integrations.passport` declares `passport.tokens.ts`, `passport.password.ts` and `passport.cookie.ts`; the lite skeleton ships their specs in the testing-module form (`passport.password.spec.ts` and `passport.cookie.spec.ts` are new), each file at 100. Specs: `src/slot-declared-logic.spec.mjs`; `codecov-scope` and `scaffold-template-canon-be` follow.
+- Fixed: the object-storage slot requires and allows the skeleton's names, `object-storage.{config,options,decorators,client}.ts` (it named `storage.*`, so the scaffold failed HFS_SLOT_REQUIRED_MISSING and a renamed app's module was judged a sub-module), and allows `object-storage.module.ts` and `object-storage.module-definition.ts`.
+- Fixed: `BE_AUTH_JWT_OWN_JWKS` takes an audience of typed configuration as pinned, as R260 already did (`identity.mjs` with `fromConfig` of `jwt-ast.mjs`), so the skeleton's `audience: options.audience` passes; an audience that is neither a literal nor typed configuration is still refused. Spec: `src/be-auth-jwt-own-jwks.spec.mjs`.
+- Changed: the bundled canon pins name jest-preset 2.5.2, eslint-canon-be 3.8.19, eslint-canon-fe 9.5.21 and the Grammar family 0.15.32.
+
 ## 4.11.19 - 2026-10-30
 
 - Fixed: `HFS_SCHEDULE_UNDECLARED` (R268) reads an application SQL template whose `${}` sits where Postgres wants an identifier (`LISTEN ${channel}`, `SET x = ${n}`): the template is read with each `${}` as NULL, and when that does not parse, again with each as an identifier (`stacks-release.mjs` `templateObservations`). Such a statement was taken for an undeclared pg_cron job. A bare interpolated function name (`FROM ${fn}(...)`) still fails closed, since it may be `cron.schedule`; the skeleton's `callDbFunction` quotes `"${schema}"."${name}"` and parses as it is.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.11.19",
+  "version": "4.11.21",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/index.mjs

@@ -1,7 +1,7 @@
 // index.mjs - `starci app release <gate|push>` and the plumbing the release and database verbs share: the context built from the app's IO, strict flag
 // parsing, the optional `release:` / `database:` blocks of .starcistacks/application-stacks.yaml, text and --json output and the exit-code mapping.
 //   starci app release gate [--execute] [--sonar] [--source <ref>] [--tag-prefix <prefix>] [--backfill <tag>] [--json]
-//   starci app release push [--execute] [--remote <name>] [--urgent --reason <text> [--lint-baseline <tag>]] [--json]
+//   starci app release push [--execute] [--remote <name>] [--urgent --reason <text>] [--json]
 // `harness` of the app IO ({ version, role, openTicket }) is what the starci CLI hands in: the caller's role an urgent record names and the ticket
 // queue a red back-fill files into.
 // Every action is a dry run unless --execute is given. A refusal is a StackError (exit 2); a failed step returns ok false (exit 1).
@@ -58,7 +58,7 @@ function readPackage(root) {
 }
 
 /** The normalised `release:` block (tolerant of absence) with the package version: { root, version, gates, tagPrefix, defaultBranch, requireCi }. */
-function loadReleaseConfig(root) {
+export function loadReleaseConfig(root) {
   const pkg = readPackage(root);
   if (typeof pkg.version !== 'string' || !VERSION.test(pkg.version)) throw refusal(RELEASE_CODE, 'package.json needs a version like 1.2.3 (the release tag derives from it)');
   const declaration = readDeclaration(root);

package/release/urgent.mjs

@@ -1,5 +1,5 @@
 // urgent.mjs - `starci app release push --urgent --reason "<text>"`, the sanctioned urgent path (owner ruling urgent-release, 2026-10-29: an urgent
-// deploy needs no CI). It runs only the fast local checks (app check, typecheck, lint of the files changed since the previous release tag, unit), or
+// deploy needs no CI). It runs only the fast local checks (typecheck and the build: owner ruling urgent-typecheck-build, 2026-10-30), or
 // reuses a green row the gate already recorded for HEAD with the same command and an unchanged log; tags HEAD (annotated) and pushes the default
 // branch and the tag in ONE atomic push through the repository's hook (never --no-verify, `git push --dry-run --atomic` first); then writes the
 // URGENT record <git common dir>/starci-release/<HEAD>.urgent.json naming who (the caller's role), why (the reason), each check with its verdict and the
@@ -11,15 +11,14 @@ import { firstLine } from '../stack/context.mjs';
 import { failure, refusal } from '../stack/errors.mjs';
 import { assertUnmoved, git, inspect, releaseDir, runGate, summaryOf } from './gate.mjs';
 import { assertNames, branchRefs, probe, tagRefs } from './push.mjs';
-import { baselineLint } from './lint-baseline.mjs';
 import { URGENT_RULING, URGENT_SCHEMA, greenRow, recordRow, writeUrgent } from './records.mjs';
 
-/** The fast local checks of an urgent release, by gate name, in the order they run. */
-export const URGENT_CHECKS = Object.freeze(['app-check', 'typecheck', 'lint', 'test']);
+/**
+ * The fast local checks of an urgent release, by gate name, in the order they run: what can break production, the types and the build
+ * (owner ruling urgent-typecheck-build, 2026-10-30). App check, lint and the tests wait for the back-fill (`release gate --backfill`).
+ */
+export const URGENT_CHECKS = Object.freeze(['typecheck', 'build', 'build-be', 'build-fe']);
 const REASON_MAX = 500;
-const CHANGED_MAX = 200;
-const PATH_WORD = /^[A-Za-z0-9_@%+=:,./\\-]+$/u;
-const MANAGED_LINT = 'npm run lint';
 
 /** The reason, one line of plain text; an urgent release without one is refused. */
 function reasonOf(value) {
@@ -29,37 +28,11 @@ function reasonOf(value) {
   return reason;
 }
 
-/** The newest release tag reachable from HEAD's parent, or null on a first release. */
-function previousTag(ctx, prefix) {
-  const found = git(ctx, ['describe', '--tags', '--abbrev=0', '--match', `${prefix}[0-9]*`, 'HEAD^'], { allowFail: true });
-  return found.code === 0 && found.stdout !== '' ? found.stdout : null;
-}
-
-/** The lint row of an urgent release: the managed whole-app lint narrowed to the source files changed since the previous release tag. */
-function changedLint(ctx, gate, prefix) {
-  if (gate.command.join(' ') !== MANAGED_LINT) return { gate, note: null };
-  const since = previousTag(ctx, prefix);
-  if (!since) return { gate, note: 'no previous release tag: the whole app is linted' };
-  const files = git(ctx, ['diff', '--name-only', '--diff-filter=d', `${since}..HEAD`]).stdout.split('\n').map((file) => file.trim())
-    .filter((file) => /\.(?:[cm]?[jt]sx?|css)$/u.test(file));
-  if (files.length === 0) return { gate: null, note: `no source file changed since ${since}` };
-  if (files.length > CHANGED_MAX || !files.every((file) => PATH_WORD.test(file))) return { gate, note: `${files.length} changed file(s) since ${since}: the whole app is linted` };
-  return { gate: { ...gate, command: ['npx', 'starci', 'app', 'lint', '--changed', ...files] }, note: `${files.length} file(s) changed since ${since}` };
-}
-
-/**
- * The urgent checks this app declares, from its release gates; a lint row is narrowed to the changed files, or, with `lintBaseline` (a release
- * tag), judged whole against that tag's findings (lint-baseline.mjs), which only the managed lint can be.
- */
-function urgentGates(ctx, config, prefix, lintBaseline) {
+/** The urgent checks this app declares, from its release gates, in URGENT_CHECKS order. */
+function urgentGates(config) {
   const declared = URGENT_CHECKS.map((name) => config.gates.find((gate) => gate.name === name)).filter(Boolean);
   if (declared.length === 0) throw refusal('RELEASE_URGENT_NO_CHECKS', `the release gates declare none of ${URGENT_CHECKS.join(', ')}: an urgent release still runs its fast local checks`);
-  return declared.map((gate) => {
-    if (gate.name !== 'lint') return { name: gate.name, gate, note: null };
-    if (lintBaseline === undefined) return { name: gate.name, ...changedLint(ctx, gate, prefix) };
-    if (gate.command.join(' ') !== MANAGED_LINT) throw refusal('RELEASE_URGENT_LINT_BASELINE_UNMANAGED', `--lint-baseline judges the managed lint (${MANAGED_LINT}), and this app's lint gate runs ${gate.command.join(' ')}`);
-    return { name: gate.name, gate, baseline: lintBaseline, note: `the whole app, judged against ${lintBaseline}: only a finding new since it is red (owner ruling urgent-lint-baseline)` };
-  });
+  return declared.map((gate) => ({ name: gate.name, gate, note: null }));
 }
 
 /** Runs (or reuses) each check in order and stops at the first red one. Returns the rows of the record. */
@@ -71,12 +44,6 @@ function runChecks(ctx, checks, { common, head, dir, platform }) {
       rows.push({ name: check.name, command: null, pass: true, reused: false, detail: check.note, log: null, logSha256: null });
       continue;
     }
-    if (check.baseline !== undefined) {
-      const row = baselineLint(ctx, check.gate, { tag: check.baseline, dir, platform });
-      rows.push({ ...row, reused: false, note: check.note });
-      if (!row.pass) break;
-      continue;
-    }
     const command = check.gate.command.join(' ');
     const reused = greenRow(common, head, check.name, command);
     if (reused) {
@@ -104,6 +71,7 @@ function planOf(checks) {
  */
 export async function releaseUrgentPush(ctx, config, options = {}) {
   const reason = reasonOf(options.reason);
+  if (options.lintBaseline !== undefined) throw refusal('RELEASE_URGENT_LINT_BASELINE_RETIRED', 'an urgent release no longer lints (owner ruling urgent-typecheck-build): lint runs in the back-fill, so --lint-baseline has nothing to judge');
   const role = options.role ?? 'unset';
   const remote = options.remote ?? 'origin';
   const branch = config.defaultBranch;
@@ -112,7 +80,7 @@ export async function releaseUrgentPush(ctx, config, options = {}) {
   const { head, chosen } = facts;
   const common = releaseDir(ctx);
   const dir = path.join(common, head.slice(0, 12));
-  const checks = urgentGates(ctx, config, config.tagPrefix, options.lintBaseline);
+  const checks = urgentGates(config);
   const out = [...facts.out, `urgent         ${URGENT_RULING}`, `reason         ${reason}`, `role           ${role}`, ...planOf(checks)];
   const data = { head, tag: chosen.tag, remote, branch, urgent: true, reason, role, checks: [], pushed: false };
   if (facts.red.length > 0) return { ok: false, lines: [...out, ...facts.red.map((item) => `RED: ${item}`), 'nothing run, nothing pushed.'], data: { ...data, red: facts.red } };

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.31
+    version: 0.15.33
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.8.18
+    version: 3.8.20
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.5.20
+    version: 9.5.22
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.31
+    version: 0.15.33
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.31
+    version: 0.15.33
     group: starci
     install: registry
     side: fe
@@ -85,7 +85,7 @@ pins:
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.5.1
+    version: 2.5.2
     group: starci
     install: registry
     side: be
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.11.19
+    version: 4.11.21
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -918,7 +918,7 @@ rules:
     code: "BE_TEST_TOPOLOGY"
     editions: [lite, full]
     docs: [docs/quality-bar.md#r47-test-topology]
-    law: "One jest config, projects `unit`, `integration`, `e2e` and `contract`, live by folder, `diagnostics: false`; unit specs are `<name>.<role>.spec.ts` beside the file they test: required for the roles of `ruleParams.be.unitRoles` (`<name>.service.spec.ts` beside a `<name>.service.ts`, `<name>.cli.spec.ts` beside a cli command `<name>.cli.ts` of `src/features/cli`), optional for any other logic role (`ruleParams.be.logicRoles`) inside a slot whose `coverage` is required, except that the commit adding a measured logic file stages its `<name>.<role>.spec.ts` beside it (owner 2026-10-20, judged by `starci app hygiene` in the pre-commit hook), and nowhere else but beside a webhook or realtime door that has no service of its own (`<provider>.webhook.spec.ts`, `<channel>.gateway.spec.ts`, `<x>.subscription.spec.ts`) (every unit-tested subject has exactly one; any other `*.spec.ts` outside `be/src/tests/{world,integration,e2e,contract}` is a finding, including specs in apps), and the unit project collects coverage from the logic roles of the measured roots only (the scope derived from the slot manifest, R204) with a per-file threshold of 100 on lines, branches, functions and statements (`test` runs `--coverage`; `importHelpers` and `tslib`); `be/src/tests/world/` is the ONLY test infrastructure: `global-setup.ts` starts the app's own stack (`.starcistacks/<env>`, named by `stack` in `test-world.config.ts`, the declaration of the test-world library in its one named form `export const { useTestWorld, useSandbox } = defineTestWorld({...})` (a default export is not read): every service it declares runs REAL, behind toxiproxy, images and versions read from the stack at run time, never spelled in test source) or attaches to a warm one that answers, and runs the migrations once over the cli app's connections (the runner of the cli migrate command); `global-teardown.ts` stops only what its setup started; `use-test-world.ts` exports `useTestWorld({ apps } | { modules })` (`world.apps.<name>.api`, `world.db.<connection>`, `world.infra.<service>` with `latency(ms)`, `cut()` and `restore()` on the real service, `world.fake.<provider>`, `world.waitFor`) and `fakes/<provider>/` holds the network-edge fakes (`failNext`, `replayWebhook`, `delay`, payload fixtures) of external SaaS the team does not operate ONLY: a fake of a service the stack declares is refused, except stateless compute that needs special hardware or an external model (GPU inference, a self-hosted embedding model), whose `stacks` entry in `test-world.config.ts` declares `{ fakedBy: <fake>, reason }` with a non-empty `reason` (a stateful service, or one with a persistent volume, is never accepted); it alone owns containers, DataSource, migrations and `process.env`; nothing under `be/src/tests` overrides a provider or DI token; `be/src/tests/integration/<capability>/*.integration-spec.ts` (`{ modules }`, with the real peer apps its client calls beside them as `apps`; real infrastructure, no HTTP door of ours), `be/src/tests/e2e/<area>/*.e2e-spec.ts` (`{ apps }`) and `be/src/tests/contract/<provider>/*.contract-spec.ts` (provider sandboxes, skipped without sandbox config, run only by `test:contract`, never by `test` or `test:e2e`) agree folder with suffix; an integration or e2e spec passes `useTestWorld` one object literal with plain keys (no variable, spread or computed key) and calls it; the contract layer has no skip either: a contract spec writes `sandbox.describe(...)` from the test-world library's `useSandbox(...)`, and when the sandbox config is absent that describe registers one failing test naming the missing keys (the body never runs), and every `fakes/<provider>/` that serves payload fixtures (`payloads/*.json`) has a `contract/<provider>/*.contract-spec.ts` that references those fixtures and asserts `shapeOf(real)` equals `shapeOf(fixture)` (the helper `shapeOf` is named by `ruleParams.be.contractShape` of the slot manifest; fakes the test-world library provides are guarded by the library); no `.test.ts`, `int-spec` or `harness-spec`, no `live/` and no `be/src/tests/e2e/world`."
+    law: "One jest config, projects `unit`, `integration`, `e2e` and `contract`, live by folder, `diagnostics: false`; unit specs are `<name>.<role>.spec.ts` beside the file they test: required for the roles of `ruleParams.be.unitRoles` (`<name>.service.spec.ts` beside a `<name>.service.ts`, `<name>.cli.spec.ts` beside a cli command `<name>.cli.ts` of `src/features/cli`), optional for any other logic role (`ruleParams.be.logicRoles`) inside a slot whose `coverage` is required and beside a logic file such a slot declares (`logic`: `passport.tokens.spec.ts` beside `passport.tokens.ts`), except that the commit adding a measured logic file stages its `<name>.<role>.spec.ts` beside it (owner 2026-10-20, judged by `starci app hygiene` in the pre-commit hook), and nowhere else but beside a webhook or realtime door that has no service of its own (`<provider>.webhook.spec.ts`, `<channel>.gateway.spec.ts`, `<x>.subscription.spec.ts`) (every unit-tested subject has exactly one; any other `*.spec.ts` outside `be/src/tests/{world,integration,e2e,contract}` is a finding, including specs in apps), and the unit project collects coverage from the logic roles of the measured roots and the logic files their slots declare only (the scope derived from the slot manifest, R204) with a per-file threshold of 100 on lines, branches, functions and statements (`test` runs `--coverage`; `importHelpers` and `tslib`); `be/src/tests/world/` is the ONLY test infrastructure: `global-setup.ts` starts the app's own stack (`.starcistacks/<env>`, named by `stack` in `test-world.config.ts`, the declaration of the test-world library in its one named form `export const { useTestWorld, useSandbox } = defineTestWorld({...})` (a default export is not read): every service it declares runs REAL, behind toxiproxy, images and versions read from the stack at run time, never spelled in test source) or attaches to a warm one that answers, and runs the migrations once over the cli app's connections (the runner of the cli migrate command); `global-teardown.ts` stops only what its setup started; `use-test-world.ts` exports `useTestWorld({ apps } | { modules })` (`world.apps.<name>.api`, `world.db.<connection>`, `world.infra.<service>` with `latency(ms)`, `cut()` and `restore()` on the real service, `world.fake.<provider>`, `world.waitFor`) and `fakes/<provider>/` holds the network-edge fakes (`failNext`, `replayWebhook`, `delay`, payload fixtures) of external SaaS the team does not operate ONLY: a fake of a service the stack declares is refused, except stateless compute that needs special hardware or an external model (GPU inference, a self-hosted embedding model), whose `stacks` entry in `test-world.config.ts` declares `{ fakedBy: <fake>, reason }` with a non-empty `reason` (a stateful service, or one with a persistent volume, is never accepted); it alone owns containers, DataSource, migrations and `process.env`; nothing under `be/src/tests` overrides a provider or DI token; `be/src/tests/integration/<capability>/*.integration-spec.ts` (`{ modules }`, with the real peer apps its client calls beside them as `apps`; real infrastructure, no HTTP door of ours), `be/src/tests/e2e/<area>/*.e2e-spec.ts` (`{ apps }`) and `be/src/tests/contract/<provider>/*.contract-spec.ts` (provider sandboxes, skipped without sandbox config, run only by `test:contract`, never by `test` or `test:e2e`) agree folder with suffix; an integration or e2e spec passes `useTestWorld` one object literal with plain keys (no variable, spread or computed key) and calls it; the contract layer has no skip either: a contract spec writes `sandbox.describe(...)` from the test-world library's `useSandbox(...)`, and when the sandbox config is absent that describe registers one failing test naming the missing keys (the body never runs), and every `fakes/<provider>/` that serves payload fixtures (`payloads/*.json`) has a `contract/<provider>/*.contract-spec.ts` that references those fixtures and asserts `shapeOf(real)` equals `shapeOf(fixture)` (the helper `shapeOf` is named by `ruleParams.be.contractShape` of the slot manifest; fakes the test-world library provides are guarded by the library); no `.test.ts`, `int-spec` or `harness-spec`, no `live/` and no `be/src/tests/e2e/world`."
     kinds: [check, codemod, lint]
     gates: [land, ci]
     failureCodes: ["BE_TEST_TOPOLOGY", "BE_CONTRACT_UNGUARDED", "BE_UNIT_SPEC_NOT_STAGED"]
@@ -3525,7 +3525,7 @@ rules:
     code: "HFS_COVERAGE_SCOPE_DRIFT"
     editions: [lite, full]
     docs: [docs/quality-bar.md#r204-coverage-scope]
-    law: "What a back end measures at 100 per file is derived once from the slot manifest (the `coverage: required|none` field of every be slot and ruleParams.be.logicRoles, scripts/hfs/coverage-scope.mjs), and the three files that state it are its render: be/jest.config.js (thresholds), the `sonar.coverage.exclusions` line of sonar-project.properties, and codecov.yml (paths and one component per service app plus platform, each at 100). A difference is drift; the scope is never edited by hand."
+    law: "What a back end measures at 100 per file is derived once from the slot manifest (the `coverage: required|none` field of every be slot, ruleParams.be.logicRoles and the `logic` files a required slot declares, scripts/hfs/coverage-scope.mjs), and the three files that state it are its render: be/jest.config.js (thresholds), the `sonar.coverage.exclusions` line of sonar-project.properties, and codecov.yml (paths and one component per service app plus platform, each at 100). A difference is drift; the scope is never edited by hand."
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_COVERAGE_SCOPE_DRIFT"]
@@ -4642,7 +4642,7 @@ rules:
       - {path: packages/hfs/src/hfs-boot-proof.spec.mjs, edition: lite}
   - id: R273
     code: "HFS_COVERAGE_BELOW"
-    law: "An app check supplied with a coverage-from lcov report proves 100 percent lines, functions and branches per tracked back-end logic file in the edition's slot-derived measured scope; a missing source record or unavailable metric is refused. The unit runner also enforces statement coverage. Reports list the measured scope and the source files outside it, including features, cli and webhooks."
+    law: "An app check supplied with a coverage-from lcov report proves 100 percent lines, functions and branches per tracked back-end logic file (a logic-role file or a file its slot declares in `logic`) in the edition's slot-derived measured scope; a missing source record or unavailable metric is refused. The unit runner also enforces statement coverage. Reports list the measured scope and the source files outside it, including features, cli and webhooks."
     kinds: [check]
     gates: [ci]
     failureCodes: ["HFS_COVERAGE_BELOW"]

package/runtime/knowledge/hfs/slots.yaml

@@ -94,10 +94,14 @@ versioning:
 #   allows / forbids   names inside the instance; the loader exposes them, slot-check enforces them.
 #   tests       unit-beside | e2e | none.
 #   coverage    required | none, on every tracked slot of profile be. A required slot's subtree is measured at 100 per file on every
-#               ruleParams.be.logicRoles file (lines, branches, functions, statements); a none slot's subtree is never measured and
-#               is excluded from Sonar's coverage. scripts/hfs/coverage-scope.mjs derives the jest per-file thresholds, Sonar's
-#               sonar.coverage.exclusions and the Codecov paths and components from this field and nowhere else (R204).
-#               Orthogonal to the lite `editions`: an edition never changes what a slot measures.
+#               ruleParams.be.logicRoles file and on every file a slot of it declares in `logic` (lines, branches, functions,
+#               statements); a none slot's subtree is never measured and is excluded from Sonar's coverage. scripts/hfs/coverage-scope.mjs
+#               derives the jest per-file thresholds, Sonar's sonar.coverage.exclusions and the Codecov paths and components from this
+#               field and `logic` and nowhere else (R204). Orthogonal to the lite `editions`: an edition never changes what a slot measures.
+#   logic       on a coverage-required unit-beside directory slot: the files of the slot that carry logic without a logic-role suffix
+#               (`<name>.<part>.ts`, relative to the slot path, each one the slot requires or allows, none of a logic role). Each is
+#               measured at 100 per file like a logic-role file, and its `<name>.<part>.spec.ts` beside it is a legitimate unit spec
+#               (R47, R48): the slot admits it without listing it. No role name is added to ruleParams.be.logicRoles.
 #   composedBy the app kinds allowed to compose a transport slot (an app of another kind imports none of its modules); on an
 #               owner slot (be.cli) the app kinds that list its root module, every folder of the root holding one static module.
 #   budget      size budgets (lines per file, files per slot, exports).
@@ -2012,6 +2016,7 @@ slots:
     owner: true
     requires: [index.ts, passport.config.ts, passport.options.ts, passport.decorators.ts, passport.tokens.ts, passport.password.ts, passport.cookie.ts]   # Secrets, no defaults (R44); options and named injectors (R83); tokens and JWKS; bcrypt; the refresh cookie
     allows: [index.ts, passport.config.ts, passport.options.ts, passport.decorators.ts, passport.tokens.ts, passport.password.ts, passport.cookie.ts, strategies/, errors/]
+    logic: [passport.tokens.ts, passport.password.ts, passport.cookie.ts]   # JWT sign and verify over the own JWKS, bcrypt, the refresh cookie: measured at 100 per file
     tests: unit-beside
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INFRA_OWNER, BE_AUTH_PASSPORT_OWNER, BE_AUTH_JWT_OWN_JWKS, BE_AUTH_REFRESH_COOKIE]
     coverage: required
@@ -2028,8 +2033,8 @@ slots:
     tracked: tracked
     tier: integrations
     owner: true
-    requires: [index.ts, storage.config.ts, storage.options.ts, storage.decorators.ts, storage.client.ts]
-    allows: [index.ts, storage.config.ts, storage.options.ts, storage.decorators.ts, storage.client.ts, errors/]
+    requires: [index.ts, object-storage.config.ts, object-storage.options.ts, object-storage.decorators.ts, object-storage.client.ts]
+    allows: [index.ts, object-storage.module.ts, object-storage.module-definition.ts, object-storage.config.ts, object-storage.options.ts, object-storage.decorators.ts, object-storage.client.ts, errors/]
     tests: unit-beside
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT, BE_INFRA_OWNER, BE_STORAGE_OWNER]
     coverage: required

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -650,14 +650,8 @@ $defs:
         pattern: '^[A-Za-z0-9][A-Za-z0-9._-]*$'
       releasesBase: {$ref: '#/$defs/deployAbsolutePath'}
       sealed:
-        description: 'Owner-machine session for prepare and doctor: members of .starcistacks/<environment>/secrets.'
-        type: object
-        additionalProperties: false
-        required: [ops, sshKey, knownHosts]
-        properties:
-          ops: {$ref: '#/$defs/deployName'}
-          sshKey: {$ref: '#/$defs/deployName'}
-          knownHosts: {$ref: '#/$defs/deployName'}
+        description: 'Owner-machine session for prepare, doctor and deploy: the one member of .starcistacks/<environment>/secrets holding VPS_HOST, VPS_USER, privateKey and knownHosts.'
+        $ref: '#/$defs/deployName'
       serverRecipient:
         description: The deploy server's public age recipient, recorded by starci app secret server-key <env> --execute.
         type: string
@@ -865,5 +859,11 @@ $defs:
       where: {type: string, minLength: 1}
       member: {type: string, pattern: '^[a-z0-9][a-z0-9-]*$', description: "The provider member holding this key (`secrets/<member>`, the slug of where); with key, the entry declares one key of it."}
       key: {type: string, pattern: '^[A-Z][A-Z0-9_]*$', description: "The one key of the member this entry declares; materialized as its own file, read by the app as <KEY>_FILE."}
+      keys:
+        description: The keys a member groups on purpose (several providers in one member), declared in one entry instead of an entry per key; every one must be in the member's envelope.
+        type: array
+        minItems: 1
+        uniqueItems: true
+        items: {type: string, pattern: '^[A-Za-z][A-Za-z0-9_]*$'}
       recipientPolicy: {type: string, minLength: 1, description: "Which age recipients the envelope is encrypted to: its environment's rule of the app's managed .sops.yaml."}
       keyCustody: {type: string, minLength: 1, description: "Where the shared decrypting identity is held; docs/host-secrets.md owns host custody and its execution prerequisites."}

package/runtime/scripts/hfs/allows.mjs

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { braceVariants, globExpression } from '../lib/glob.mjs';
+import { declaredLogicOf } from './manifest-shape.mjs';
 
 /**
  * What a slot's `requires`, `allows` and `forbids` entries (knowledge/hfs/slots.yaml) say about a file, read through the
@@ -8,9 +9,26 @@ import { braceVariants, globExpression } from '../lib/glob.mjs';
  *
  * An entry is a name relative to the slot instance root: `<var>` is the instance's bound variable when the slot binds it
  * (`<feature>`, `<capability>`) and one path segment of any text otherwise (`<action>`), `*` and `?` stay inside a segment,
- * `{a,b}` alternates, a trailing `/` names a directory and everything below it.
+ * `{a,b}` alternates, a trailing `/` names a directory and everything below it. A slot also admits, unlisted, the unit spec beside each
+ * measured file it names (isMeasuredSpec): a file it declares in `logic`, or a named file of a logic role.
  */
 const VAR = /<([A-Za-z][A-Za-z0-9-]*)>/g;
+const SPEC = /\.spec\.ts$/;
+
+/**
+ * Whether `relative` is the unit spec `<stem>.spec.ts` of a measured file beside it that the slot names: a file the slot declares in
+ * `logic`, or a `requires`/`allows` file of a logic role (ruleParams.be.logicRoles), in a slot whose coverage is required and whose tests
+ * are unit-beside. The slot admits that spec without listing it, as unit-test-colocated (R47) accepts it.
+ */
+function isMeasuredSpec(resolver, classified, slot, relative, named) {
+  if (!SPEC.test(relative) || slot.coverage !== 'required' || slot.tests !== 'unit-beside') return false;
+  const subject = relative.replace(SPEC, '.ts');
+  if (declaredLogicOf(slot).includes(subject)) return true;
+  const role = /\.([a-z0-9-]+)\.ts$/.exec(subject)?.[1];
+  // An app resolver keeps no rule parameters of its own: a path on a side reads that side's.
+  const params = classified.side ? resolver.sides?.[classified.side]?.ruleParams() : resolver.ruleParams?.();
+  return (params?.logicRoles ?? []).includes(role) && named.some(matcher => matcher.expression.test(subject));
+}
 
 function matchersOf(entries, bindings) {
   return (entries ?? []).flatMap(entry => {
@@ -36,7 +54,8 @@ export function slotAdmitsFile(resolver, file) {
   if (classified.status === 'no-slot' || classified.status === 'ambiguous' || !classified.slot) return null;
   const slot = resolver.slot(classified.slot);
   const relative = relativeToRoot(classified.path, classified.root);
-  const hit = matchersOf([...(slot.requires ?? []), ...(slot.allows ?? [])], classified.bindings).some(matcher => matcher.expression.test(relative));
+  const named = matchersOf([...(slot.requires ?? []), ...(slot.allows ?? [])], classified.bindings);
+  const hit = named.some(matcher => matcher.expression.test(relative)) || isMeasuredSpec(resolver, classified, slot, relative, named);
   const forbidden = matchersOf(slot.forbids, classified.bindings).some(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
   return hit && !forbidden;
 }
@@ -51,7 +70,9 @@ export function allowsFile(resolver, file) {
   const slot = resolver.slot(classified.slot);
   if (!slot?.allows?.length) return null;
   const relative = relativeToRoot(classified.path, classified.root);
-  const hit = matchersOf([...(slot.requires ?? []), ...slot.allows], classified.bindings).find(matcher => matcher.expression.test(relative));
+  const named = matchersOf([...(slot.requires ?? []), ...slot.allows], classified.bindings);
+  const hit = named.find(matcher => matcher.expression.test(relative));
+  const spec = !hit && isMeasuredSpec(resolver, classified, slot, relative, named);
   const forbidden = matchersOf(slot.forbids, classified.bindings).find(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
-  return { slot: slot.id, root: classified.root, relative, allowed: Boolean(hit) && !forbidden, entry: hit?.entry, forbiddenBy: forbidden?.entry, allows: slot.allows };
+  return { slot: slot.id, root: classified.root, relative, allowed: (Boolean(hit) || spec) && !forbidden, entry: hit?.entry, forbiddenBy: forbidden?.entry, allows: slot.allows };
 }

package/runtime/scripts/hfs/architecture/identity.mjs

@@ -4,7 +4,7 @@
 // In both editions every jwtVerify call holds the JWT policy (R260, jwtPolicyProblems).
 import path from 'node:path';
 import { machineKit } from './machine-ast.mjs';
-import { importedFrom, jwtPolicyProblems, reportAt, unwrap } from './jwt-ast.mjs';
+import { fromConfig, importedFrom, jwtPolicyProblems, reportAt, unwrap } from './jwt-ast.mjs';
 import { accessName } from '../../lib/ts-ast.mjs';
 
 const PASSPORT_SLOT = 'be.integrations.passport';
@@ -87,7 +87,11 @@ function verifyJwtCall(kit, checker, file, node, counters, violations) {
   const issuer = property('issuer');
   const audience = values('audience');
   const algorithms = values('algorithms');
-  const good = jwksArgument(kit, checker, node.arguments[1]) && issuer != null && audience !== null && audience.length > 0
+  // The audience is pinned by a literal or, as R260 accepts, by typed configuration (the skeleton's TokenOptions.audience).
+  const audienceEntry = property('audience');
+  const pinnedAudience = (audience !== null && audience.length > 0)
+    || (audienceEntry != null && fromConfig(kit.ts, checker, kit.valueOfProperty(audienceEntry)));
+  const good = jwksArgument(kit, checker, node.arguments[1]) && issuer != null && pinnedAudience
     && algorithms !== null && algorithms.length > 0;
   if (!good) {
     reportAt(violations, kit, BE_JWT_VERIFIED, file, node, 'jwtVerify must check the app\'s own key set (createLocalJWKSet(...) over the keys integrations/passport signs with) and pin issuer, audience and a non-empty algorithms list; jwtVerify then enforces signature and exp.');

package/runtime/scripts/hfs/architecture/jwt-ast.mjs

@@ -62,7 +62,7 @@ const configType = (checker, node) => {
 };
 
 /** Trace an issuer or audience to typed configuration values through local URL/string transformations. */
-const fromConfig = (ts, checker, expression, seen = new Set()) => {
+export const fromConfig = (ts, checker, expression, seen = new Set()) => {
   const node = unwrap(ts, expression);
   if (!node || seen.has(node)) return false;
   const next = new Set(seen).add(node);

package/runtime/scripts/hfs/coverage-scope.mjs

@@ -1,10 +1,11 @@
 // coverage-scope.mjs - THE derivation of what a back end measures (R204 HFS_COVERAGE_SCOPE_DRIFT).
 //
-// One input: the slot manifest. Every tracked slot of the be profile declares `coverage: required | none`, and
-// `ruleParams.be.logicRoles` names the roles that carry logic. A file `<name>.<role>.ts` of a logic role inside a required slot is
-// measured at 100 per file; every other file of the back end is not. Three consumers read this module and nothing else:
-//   - the jest preset: `jestCoverage` (roots x roles, and the none subtrees inside a root) becomes the per-file thresholds and
-//     collectCoverageFrom of the rendered be/jest.config.js;
+// One input: the slot manifest. Every tracked slot of the be profile declares `coverage: required | none`,
+// `ruleParams.be.logicRoles` names the roles that carry logic, and a required slot may declare in `logic` the files of its own that
+// carry logic without a logic-role suffix. A file `<name>.<role>.ts` of a logic role inside a required slot, and every declared logic
+// file, is measured at 100 per file; every other file of the back end is not. Three consumers read this module and nothing else:
+//   - the jest preset: `jestCoverage` (roots x roles, the declared logic files, and the none subtrees inside a root) becomes the
+//     per-file thresholds and collectCoverageFrom of the rendered be/jest.config.js;
 //   - Sonar: `sonarCoverageExclusions` are the complement (SonarQube has no inclusions and no negation), rendered into
 //     sonar.coverage.exclusions;
 //   - Codecov: `codecovPaths` are the measured roots, and `coverageComponents` one component per service app plus platform,
@@ -12,7 +13,7 @@
 // starci app sync renders the three for an app, scripts/checks/check-examples-ci.mjs for the example apps of the runtime repository,
 // and `starci app check` compares the files with this derivation. Nothing here lists a path of a product: it all comes from slots.yaml.
 import { braceVariants, globExpression } from '../lib/glob.mjs';
-import { logicRolesOf } from './manifest-shape.mjs';
+import { declaredLogicOf, logicRolesOf } from './manifest-shape.mjs';
 import { byCodeUnit } from '../lib/list.mjs';
 import { trimTrailingSlashes } from './trailing-slashes.mjs';
 
@@ -68,7 +69,7 @@ function addRequiredPatterns(sonar, required, suffixes) {
 }
 
 function addEntryPatterns(sonar, slot, entry, isRole) {
-  if (!entry.endsWith('.ts') || entry.includes('<role>')) return;
+  if (!entry.endsWith('.ts') || entry.includes('<role>') || declaredLogicOf(slot).includes(entry)) return;
   for (const name of braceVariants(entry)) {
     if (isRole.test(star(name).replaceAll('*', 'x'))) continue;
     for (const dir of variantsOf(slot)) sonar.add(`be/${dir}${star(name)}`.replace(/\/\/+/g, '/'));
@@ -116,6 +117,7 @@ const minimal = (patterns) => {
  *   roles     ruleParams.be.logicRoles;
  *   roots     the minimal required directories (be-relative, `*` for a placeholder, trailing slash), sorted;
  *   excludes  the none directories inside a root (never measured though their root is);
+ *   files     the declared logic files of the required slots (be-relative, `*` for a placeholder) outside every none directory, sorted;
  *   none      the minimal none paths of the whole back end (a directory ends in a slash), sorted;
  *   sonar     sonar.coverage.exclusions, repository-relative from the app root, sorted;
  *   codecovPaths  the measured roots as `be/<root>**`.
@@ -135,13 +137,15 @@ export function coverageScope(manifest, providers = []) {
   const noneUnique = [...new Set(nonePaths)];
   const noneMinimal = noneUnique.filter((path) => !noneUnique.some((other) => other !== path && isDir(other) && nested(dirOf(path), other)));
   const excludes = noneMinimal.filter((path) => isDir(path) && roots.some((root) => nested(path, root))).sort(byCodeUnit);
+  const declared = required.flatMap((slot) => declaredLogicOf(slot).flatMap((file) => variantsOf(slot).map((dir) => `${dir}${file}`)));
+  const files = [...new Set(declared)].filter((file) => !noneMinimal.some((path) => isDir(path) && nested(dirOf(file), path))).sort(byCodeUnit);
   const suffixes = manifest.ruleParams.be.suffixes;
   const sonar = new Set(noneMinimal.map((path) => `be/${path}${isDir(path) ? '**' : ''}`));
   for (const role of suffixes.filter((suffix) => !roles.includes(suffix))) sonar.add(`be/**/*.${role}.ts`);
   addRequiredPatterns(sonar, required, suffixes);
   sonar.add('fe/**');
   noneMinimal.sort(byCodeUnit);
-  return { roles, roots, excludes, none: noneMinimal, sonar: withoutCovered([...sonar]).sort(byCodeUnit), codecovPaths: roots.map((root) => `be/${root}**`) };
+  return { roles, roots, files, excludes, none: noneMinimal, sonar: withoutCovered([...sonar]).sort(byCodeUnit), codecovPaths: roots.map((root) => `be/${root}**`) };
 }
 
 /** The glob a root measures: every file of a logic role below it (`src/modules/domain/*\/**\/*.{service,policy}.ts`). */
@@ -150,10 +154,10 @@ export const rootGlob = (root, roles) => {
   return `${root}**/*.${roleGlob}.ts`;
 };
 
-/** The jest coverage options of the rendered be/jest.config.js: { roots, roles, excludes }. */
+/** The jest coverage options of the rendered be/jest.config.js: { roots, roles, files, excludes }. */
 export function jestCoverage(manifest, providers = []) {
-  const { roots, roles, excludes } = coverageScope(manifest, providers);
-  return { roots, roles, excludes: excludes.map((dir) => `${dir}**`) };
+  const { roots, roles, files, excludes } = coverageScope(manifest, providers);
+  return { roots, roles, files, excludes: excludes.map((dir) => `${dir}**`) };
 }
 
 /** Sonar's sonar.coverage.exclusions of an app: the complement of the measured files, repository-relative from the app root. */
@@ -225,11 +229,20 @@ function assignRoot({ root, files, services, imports, platformPaths, ownedBy })
   }
 }
 
-/** True when the be-relative `file` is measured: it is `<name>.<role>.ts` of a logic role below a measured root and inside no none directory of it. */
-export function isMeasured(manifest, file) {
-  const { roots, roles, excludes } = coverageScope(manifest);
-  const role = /\.([a-z][a-z0-9-]*)\.ts$/.exec(file)?.[1];
-  if (!role || !roles.includes(role)) return false;
-  const inside = (dir) => globExpression(`${dir}**`).test(file);
-  return roots.some(inside) && !excludes.some(inside);
+/**
+ * The one test of whether a be-relative file is measured, over a coverage scope: a declared logic file of `files`, or `<name>.<role>.ts`
+ * of a logic role below a measured root and inside no none directory of it. isMeasured and R273 (rules/coverage-below.mjs) ask it.
+ */
+export function measuredBy({ roots, roles, files, excludes }) {
+  const declared = files.map((file) => globExpression(file));
+  const rootGlobs = roots.map((dir) => globExpression(`${dir}**`));
+  const excludeGlobs = excludes.map((dir) => globExpression(`${dir}**`));
+  return (file) => {
+    if (declared.some((glob) => glob.test(file))) return true;
+    const role = /\.([a-z][a-z0-9-]*)\.ts$/.exec(file)?.[1];
+    return Boolean(role) && roles.includes(role) && rootGlobs.some((glob) => glob.test(file)) && !excludeGlobs.some((glob) => glob.test(file));
+  };
 }
+
+/** True when the be-relative `file` is measured by the scope of the whole manifest (measuredBy). */
+export const isMeasured = (manifest, file) => measuredBy(coverageScope(manifest))(file);

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -58,6 +58,40 @@ export const unitRolesOf = (manifest) => manifest.ruleParams.be.unitRoles;
 /** The roles that carry logic (ruleParams.be.logicRoles): measured at 100 per file inside a coverage-required slot. */
 export const logicRolesOf = (manifest) => manifest.ruleParams.be.logicRoles;
 
+/** A declared logic file: `<name>.<part>.ts` below the slot path, kebab-case parts, no placeholder, glob or spec. */
+const LOGIC_FILE = /^(?:[a-z0-9]+(?:-[a-z0-9]+)*\/)*[a-z0-9]+(?:-[a-z0-9]+)*(?:\.[a-z0-9]+(?:-[a-z0-9]+)*)+\.ts$/;
+
+/** The role suffix of a file name (`passport.tokens.ts` gives `tokens`). */
+export const suffixOf = (file) => /\.([a-z0-9-]+)\.ts$/.exec(file)?.[1] ?? null;
+
+/**
+ * The files a slot declares as logic (`logic`, names relative to the slot path): a file that carries logic without a logic-role suffix.
+ * Each is measured at 100 per file like a logic-role file (scripts/hfs/coverage-scope.mjs), and its `<stem>.spec.ts` beside it is a
+ * legitimate unit spec its slot admits (scripts/hfs/allows.mjs, eslint-canon-be unit-test-colocated). No role name is added for it.
+ */
+export const declaredLogicOf = (slot) => (Array.isArray(slot?.logic) ? slot.logic : []);
+
+/** The unit spec beside a declared logic file: `passport.tokens.ts` gives `passport.tokens.spec.ts`. */
+export const declaredLogicSpecOf = (file) => file.replace(/\.ts$/, '.spec.ts');
+
+/**
+ * Shape problems of a slot's `logic`: a non-empty list of unique `<name>.<part>.ts` files, each one the slot requires or allows by that
+ * exact name, on a tracked directory slot of profile be that is coverage: required and unit-beside, and (given the logic roles) none
+ * already of a logic role, which its role measures.
+ */
+export function slotLogicProblems(slot, at, logicRoles = []) {
+  if (slot.logic === undefined) return [];
+  const list = slot.logic;
+  if (!strList(list) || !list.length || new Set(list).size !== list.length || !list.every((file) => LOGIC_FILE.test(file) && !file.endsWith('.spec.ts'))) return [`${at}: logic must be a non-empty list of unique <name>.<part>.ts files relative to the slot path`];
+  const bad = [];
+  const home = typeof slot.path === 'string' && slot.path.endsWith('/') && slot.tracked === 'tracked' && Array.isArray(slot.profiles) && slot.profiles.includes('be') && slot.coverage === 'required' && slot.tests === 'unit-beside';
+  if (!home) bad.push(`${at}: logic belongs to a tracked directory slot of profile be whose coverage is required and whose tests are unit-beside`);
+  const named = [...(slot.requires ?? []), ...(slot.allows ?? [])];
+  for (const file of list.filter((entry) => !named.includes(entry))) bad.push(`${at}: logic file ${file} must be one the slot requires or allows by that name`);
+  for (const file of list.filter((entry) => logicRoles.includes(suffixOf(entry)))) bad.push(`${at}: logic file ${file} is of the logic role ${suffixOf(file)}, which measures it already`);
+  return bad;
+}
+
 
 /** Shape problems of ruleParams.be.unitRoles: unique roles of the suffix vocabulary, each spec `<role>.spec`. */
 export function unitRolesProblems(be) {
@@ -87,7 +121,7 @@ export const MANIFEST_KINDS = [APP_KIND, RUNTIME_KIND];
 export const manifestKind = (m) => (isPlainObject(m) && m.kind !== undefined ? m.kind : APP_KIND);
 const strList = (v) => stringList(v);
 
-const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'editionWhy', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'templateNa', 'exemplifiedBy', 'role', 'importedBy', 'rewrittenBy'];
+const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'editionWhy', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'templateNa', 'exemplifiedBy', 'role', 'importedBy', 'rewrittenBy', 'logic'];
 /** The roles a file slot may play that a rule reads (`role`): the entity registry of persistence.md BE-PERSISTENCE-3 (architecture/entity-registry.mjs). */
 const SLOT_ROLES = ['entity-registry'];
 /** The fields a slot's `lite` overlay may hold: the same keys it would carry in the slot body, resolved under edition lite. */
@@ -267,7 +301,7 @@ function slotPolicyProblems(slot, at) {
   return bad;
 }
 
-export function slotProblems(slot, index, kind, { appScope = 'app', scopes = [] } = {}) {
+export function slotProblems(slot, index, kind, { appScope = 'app', scopes = [], logicRoles = [] } = {}) {
   const runtime = kind === RUNTIME_KIND;
   const slotKeys = new Set(runtime ? RUNTIME_SLOT_KEYS : APP_SLOT_KEYS);
   const tracked = runtime ? RUNTIME_TRACKED : TRACKED;
@@ -277,6 +311,7 @@ export function slotProblems(slot, index, kind, { appScope = 'app', scopes = []
   bad.push(...slotLocationProblems(slot, at, runtime, tracked), ...slotPatternProblems(slot, at), ...slotListProblems(slot, at));
   if (!runtime) bad.push(...slotAppOptionProblems(slot, at), ...slotLiteOverlayProblems(slot, at));
   bad.push(...slotEntryProblems(slot, at), ...slotPolicyProblems(slot, at));
+  if (!runtime) bad.push(...slotLogicProblems(slot, at, logicRoles));
   return bad;
 }
 

package/runtime/scripts/hfs/rules/coverage-below.mjs

@@ -3,9 +3,8 @@
 // lcov carries lines, functions and branches; the unit runner also enforces its statement threshold.
 import fs from 'node:fs';
 import path from 'node:path';
-import { coverageScope } from '../coverage-scope.mjs';
+import { coverageScope, measuredBy } from '../coverage-scope.mjs';
 import { editionRuleParams, effectiveSlot, slotInEdition } from '../edition-slots.mjs';
-import { globExpression } from '../../lib/glob.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
 import { found } from './read.mjs';
 
@@ -102,17 +101,11 @@ function inventory({ files, all, repo, manifest }) {
   const prefix = repo.profile === 'app' || repo.sides ? 'be/' : '';
   const effective = manifestOfEdition(manifest, repo.edition ?? 'full');
   const scope = coverageScope(effective, repo.providers ?? repo.sides?.be?.providers ?? []);
-  const roots = scope.roots.map((dir) => globExpression(`${dir}**`));
-  const excludes = scope.excludes.map((dir) => globExpression(`${dir}**`));
+  const measures = measuredBy(scope);
   const candidates = [...new Set((all ?? files ?? []).map(slash))].filter((file) => file.startsWith(prefix) && file.endsWith('.ts') && !SPEC.test(file)).sort(byCodeUnit);
   const measured = [];
   const unmeasured = [];
-  for (const file of candidates) {
-    const relative = file.slice(prefix.length);
-    const role = /\.([a-z][a-z0-9-]*)\.ts$/.exec(relative)?.[1];
-    const measuredFile = scope.roles.includes(role) && roots.some((root) => root.test(relative)) && !excludes.some((exclude) => exclude.test(relative));
-    (measuredFile ? measured : unmeasured).push(file);
-  }
+  for (const file of candidates) (measures(file.slice(prefix.length)) ? measured : unmeasured).push(file);
   return { measured, unmeasured, unmeasuredScopes: scope.none.map((entry) => `${prefix}${entry}`), scope, prefix };
 }
 

package/runtime/scripts/hfs/secret-standard.mjs

@@ -20,21 +20,31 @@ export const providerOf = (key) => key.split("_")[0].toLowerCase();
 const sameSet = (left, right) => left.length === right.length && left.every((item) => right.includes(item));
 const keyList = (keys) => keys.join(", ");
 
+/** The member a `secrets:` entry names: `member`, else the slug of `where`, else its `name`. */
+const memberOfEntry = (entry) => entry?.member ?? /^secrets\/([a-z0-9-]+)/u.exec(entry?.where ?? "")?.[1] ?? entry?.name;
+
 /** The keys an environment's `secrets:` declares for `member`: an entry naming `key` with that `member`, or a whole-member entry. */
 function declaredKeys(spec, member, keys) {
   const entries = Array.isArray(spec?.secrets) ? spec.secrets : [];
-  const memberOfEntry = (entry) => entry?.member ?? /^secrets\/([a-z0-9-]+)/u.exec(entry?.where ?? "")?.[1] ?? entry?.name;
   if (entries.some((entry) => entry?.key === undefined && memberOfEntry(entry) === member)) return keys;
   return entries.filter((entry) => entry?.key !== undefined && memberOfEntry(entry) === member).map((entry) => entry.key);
 }
 
+/** The keys of the one sealed SSH member `deploy.remote.sealed` names (stack/remote.mjs): the deploy transport reads exactly these. */
+const SSH_GROUP = Object.freeze(["VPS_HOST", "VPS_USER", "privateKey", "knownHosts"]);
+
 /**
- * True when the stack groups `member` on purpose: the environment's `secrets:` declares every key of it per key, naming this member.
- * A member the owner groups (an app's own keys, the keys one service reads) holds keys of several first words by design.
+ * True when the stack groups `member` on purpose: every key of it is declared in the environment's `secrets:`, per key (`key` with
+ * `member: <member>`) or in the `keys` list of an entry naming the member, or is a key of the sealed SSH member the deploy names.
+ * A member the owner groups (an app's own keys, the keys one service reads, the VPS session) holds keys of several first words by design.
  */
 function declaredGroup(spec, member, keys) {
   const entries = Array.isArray(spec?.secrets) ? spec.secrets : [];
-  return keys.length > 0 && keys.every((key) => entries.some((entry) => entry?.key === key && entry?.member === member));
+  const sealed = spec?.deploy?.remote?.sealed;
+  const ssh = (typeof sealed === "string" ? [sealed] : Object.values(sealed ?? {})).includes(member) ? SSH_GROUP : [];
+  const declared = (key) => ssh.includes(key) || entries.some((entry) => memberOfEntry(entry) === member
+    && (entry?.key === key || (Array.isArray(entry?.keys) && entry.keys.includes(key))));
+  return keys.length > 0 && keys.every(declared);
 }
 
 /** The tracked member file names of one environment, or null outside a git work tree. */
@@ -75,7 +85,7 @@ export function auditSecrets(repoRoot, environment = null) {
       const providers = [...new Set(envelope.keys.map(providerOf))];
       if (isLegacyName(name)) add("LEGACY_MEMBER", `is a dotenv .enc member; move it: starci app secret migrate ${env} ${member} [--to <provider>] --execute`);
       if (providers.length > 1 && !declaredGroup(spec, member, envelope.keys))
-        add("MIXED_PROVIDERS", `holds keys of ${providers.length} providers by their first word (${providers.join(", ")}) that the stack does not group in it; split it (starci app secret split ${env} ${member} [--group KEY=member] --execute) or declare each key with member: ${member} in environments.${env}.secrets`);
+        add("MIXED_PROVIDERS", `holds keys of ${providers.length} providers by their first word (${providers.join(", ")}) that the stack does not group in it; split it (starci app secret split ${env} ${member} [--group KEY=member] --execute) or declare its keys in environments.${env}.secrets (an entry naming ${member} with keys: [...])`);
       const wanted = recipientsFor(repoRoot, path.join(directory, `${member}${MEMBER_SUFFIX}`));
       if (!isLegacyName(name) && wanted.length && !sameSet(wanted, envelope.recipients))
         add("RECIPIENT_DRIFT", `is sealed to ${keyList(envelope.recipients)}, its environment's rule names ${keyList(wanted)}; seal it again: starci app secret migrate ${env} ${member} --execute`);

package/runtime/scripts/hfs/slot-manifest-shape.mjs

@@ -53,7 +53,8 @@ function checkAppKindAndTierShapes(m, bad) {
 
 function checkSlotShapes(m, bad) {
   if (!Array.isArray(m.slots) || !m.slots.length) { bad.push('slots must be a non-empty list'); return false; }
-  m.slots.forEach((slot, index) => bad.push(...slotProblems(slot, index, APP_KIND, { appScope: APP_SCOPE, scopes: SCOPES })));
+  const logicRoles = Array.isArray(m.ruleParams?.be?.logicRoles) ? m.ruleParams.be.logicRoles : [];
+  m.slots.forEach((slot, index) => bad.push(...slotProblems(slot, index, APP_KIND, { appScope: APP_SCOPE, scopes: SCOPES, logicRoles })));
   return true;
 }
 

package/runtime/scripts/hfs/stack-deploy-config.mjs

@@ -65,9 +65,12 @@ function remote(c, block) {
   if (block.releasesBase !== undefined && (!REMOTE_BASE.test(String(block.releasesBase)) || String(block.releasesBase).includes('..')))
     c.problem('deploy.remote.releasesBase', 'must be an absolute path without ..');
   let sealed = null;
-  if (block.sealed !== undefined && closedFields(c, 'deploy.remote.sealed', block.sealed, FIELDS.sealed)) {
-    for (const key of FIELDS.sealed) nameField(c, `deploy.remote.sealed.${key}`, block.sealed[key]);
-    sealed = { ...block.sealed };
+  // One member holds VPS_HOST, VPS_USER, privateKey and knownHosts (`sealed: vps`); it plays all three SSH roles of the transport.
+  if (typeof block.sealed === 'string') {
+    nameField(c, 'deploy.remote.sealed', block.sealed);
+    sealed = Object.fromEntries(FIELDS.sealed.map((key) => [key, block.sealed]));
+  } else if (block.sealed !== undefined) {
+    c.problem('deploy.remote.sealed', 'names one member holding VPS_HOST, VPS_USER, privateKey and knownHosts (sealed: vps); fold a member per role into it with starci app secret migrate <env> <member> --to vps --into-existing');
   }
   return { host: block.host ?? 'vps', releasesBase: block.releasesBase ?? null, sealed, serverRecipient: block.serverRecipient ?? null };
 }

package/runtime/scripts/hfs/stacks-gate.mjs

@@ -264,6 +264,12 @@ const checkSecret=(secret,at,{envDir,environment,root,tracked,secretNames,add})=
     add('encrypted-ref-invalid',`${at}.where`,'secret must resolve to <where>.enc.yaml (or a legacy <where>.enc) as a recognizable SOPS envelope, an existing regular file below the environment directory');
   else if(nonempty(secret.key)&&!envelopeOf(fs.readFileSync(enc,'utf8')).keys.includes(secret.key))
     add('encrypted-ref-invalid',`${at}.key`,`the member at ${secret.where} holds no ${secret.key}`);
+  else if(Array.isArray(secret.keys)){
+    // A grouped member declares its keys in one entry; each must be in the envelope, and one entry declares one key or a group, not both.
+    if(nonempty(secret.key))add('encrypted-ref-invalid',`${at}.keys`,'an entry declares one key (key) or a group (keys), not both');
+    const held=envelopeOf(fs.readFileSync(enc,'utf8')).keys;
+    for(const key of secret.keys.filter(key=>!held.includes(key)))add('encrypted-ref-invalid',`${at}.keys`,`the member at ${secret.where} holds no ${key}`);
+  }
   if(nonempty(secret.where)&&!plain)
     add('materialized-path-invalid',`${at}.where`,'secret plaintext path and its existing ancestors must remain below the environment directory without symlinks');
   if(!String(secret.recipientPolicy??'').trim()||!String(secret.keyCustody??'').trim())

package/src/main.mjs

@@ -116,11 +116,11 @@ starci app db migrate [--execute] [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app db post-cutover [--execute] [--green-at <ISO> | --owner-confirms-old-app-gone] [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app db drift [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app release gate [--execute] [--source <ref>] [--tag-prefix <prefix>] [--backfill <tag>] [--json] [--cwd <dir>]
-starci app release push [--execute] [--remote <name>] [--urgent --reason <text> [--lint-baseline <tag>]] [--json] [--cwd <dir>]
+starci app release push [--execute] [--remote <name>] [--urgent --reason <text>] [--json] [--cwd <dir>]
 starci app upgrade [--plan] [--cwd <dir>]
 starci app stack <up|down|status> [--stack <dir>] [--services <list>] [--k3d] [--force] [--json] [--cwd <dir>]
 starci app stack <prepare|doctor|connect|disconnect|build-args|render|deploy|converge|verify|rollback|prune|backup|jobs> --env <env> [--execute] [--json] [--cwd <dir>]
-starci app stack deploy --env <env> --source-sha <sha> --urgent [--db-url-env <NAME>] [--backup-out <dir>] [--first-start --db-service <service>] [--execute] [--json] [--cwd <dir>]
+starci app stack deploy --env <env> --urgent (--reason <text> [--remote <name>] | --source-sha <sha> --image <service>=<ref>) [--db-url-env <NAME>] [--backup-out <dir>] [--first-start --db-service <service>] [--execute] [--json] [--cwd <dir>]
 starci app explain <path> [--cwd <dir>] [--json]
 starci app emit [--cwd <dir>]
 starci app new service <dir> <name> [--inject <binding>...] [--cwd <dir>]
@@ -435,8 +435,8 @@ function declaredEdition(cwd) {
  * `starci app stack`: the deploy actions (prepare, doctor, render, deploy, converge, verify, rollback, prune, backup, jobs, ...) are the Swarm
  * tooling of stack/cli.mjs; up, down and status are the full edition's test-world infrastructure.
  */
-async function stackAppMain(argv, { cwd, edition, stackMain, stdout: out, stderr: err, env, sops, hostIdentity, stackIo }) {
-  if (STACK_ACTIONS.includes(argv[0])) return deployStackMain(argv, { ...stackIo, cwd, stdout: out, stderr: err, env, hostIdentity, ...(sops ? { sops } : {}) });
+async function stackAppMain(argv, { cwd, edition, stackMain, stdout: out, stderr: err, env, sops, hostIdentity, stackIo, harness }) {
+  if (STACK_ACTIONS.includes(argv[0])) return deployStackMain(argv, { ...stackIo, cwd, stdout: out, stderr: err, env, hostIdentity, harness, ...(sops ? { sops } : {}) });
   if ((edition ?? declaredEdition(cwd)) === 'lite') throw new Error('starci app stack up|down|status manage the local test world of the full edition; a lite app starts its local database with npm run db:start');
   const run = stackMain ?? await installedStackMain(cwd);
   return run(argv, { cwd, out, err });

package/stack/cli.mjs

@@ -8,6 +8,7 @@ import { loadDeployConfig } from './config.mjs';
 import { withDockerTransport } from './docker-transport.mjs';
 import { StackError, EXIT, refusal } from './errors.mjs';
 import { parseTargetBinding, bindStackTarget, nativeToolEnvironment } from './target-binding.mjs';
+import { oneCommand, prepareUrgentRelease } from './urgent-release.mjs';
 
 /** The actions that drive the docker CLI of the operator machine (pointed at the manager by docker-transport.mjs when the key is sealed). */
 const DOCKER_ACTIONS = new Set(['deploy', 'accept', 'converge', 'verify', 'rollback', 'prune']);
@@ -15,7 +16,7 @@ const DOCKER_ACTIONS = new Set(['deploy', 'accept', 'converge', 'verify', 'rollb
 export const ACTIONS = Object.freeze(['prepare', 'doctor', 'connect', 'disconnect', 'build-args', 'render', 'deploy', 'converge', 'verify', 'rollback', 'prune', 'backup', 'jobs', 'task', 'ingress', 'retire', 'build', 'accept']);
 
 const BOOLEAN = new Set(['--execute', '--json', '--swarm-state', '--init-swarm', '--owner-approved', '--fix-live-restore', '--skip-public', '--skip-internal', '--allow-unpinned', '--push', '--urgent', '--first-start']);
-const VALUE = new Set(['--env', '--image', '--source-sha', '--previous', '--out', '--release', '--since', '--timeout', '--retry', '--keep', '--app', '--ssh-cmd', '--extra-compose', '--project', '--target-binding', '--db-url-env', '--backup-out', '--db-service']);
+const VALUE = new Set(['--env', '--image', '--source-sha', '--previous', '--out', '--release', '--since', '--timeout', '--retry', '--keep', '--app', '--ssh-cmd', '--extra-compose', '--project', '--target-binding', '--db-url-env', '--backup-out', '--db-service', '--reason', '--remote']);
 const REPEAT = new Set(['--image', '--keep', '--extra-compose', '--project']);
 
 /** Splits argv into { flags, positional }; an unknown flag or a flag without its value is a refusal. */
@@ -72,7 +73,7 @@ const OPTIONS = {
     images: parseImages(flags.image), sourceSha: flags['source-sha'], execute: flags.execute === true,
     out: flags.out ? path.resolve(cwd, flags.out) : null, timeoutSeconds: number(flags, 'timeout'), retrySeconds: number(flags, 'retry'), skipPublic: flags['skip-public'] === true,
     urgent: flags.urgent === true, dbUrlEnv: flags['db-url-env'], backupOut: flags['backup-out'] ? path.resolve(cwd, flags['backup-out']) : undefined,
-    firstStart: flags['first-start'] === true, dbService: flags['db-service'],
+    firstStart: flags['first-start'] === true, dbService: flags['db-service'], reason: flags.reason, remote: flags.remote,
   }),
   converge: ({ flags }) => ({ since: flags.since, timeoutSeconds: number(flags, 'timeout') }),
   verify: ({ flags }) => ({ retrySeconds: number(flags, 'retry'), skipPublic: flags['skip-public'] === true, skipInternal: flags['skip-internal'] === true }),
@@ -127,15 +128,27 @@ export async function stackMain(argv, io = {}) {
     if (binding && (!['deploy', 'verify'].includes(action) || flags['ssh-cmd'] || flags['skip-public'] || flags['skip-internal']))
       throw refusal('STACK_USAGE', 'the bound native consumer supports only complete deploy or verify');
     const config = bindStackTarget(ctx, loadDeployConfig({ repoRoot: ctx.cwd, env: flags.env ?? 'production' }), binding);
-    if (action !== 'deploy' && (flags.urgent || flags['db-url-env'] || flags['backup-out'] || flags['first-start'] || flags['db-service'])) throw refusal('STACK_USAGE', '--urgent, --db-url-env, --backup-out, --first-start and --db-service belong to deploy');
+    if (action !== 'deploy' && (flags.urgent || flags['db-url-env'] || flags['backup-out'] || flags['first-start'] || flags['db-service'] || flags.reason || flags.remote)) throw refusal('STACK_USAGE', '--urgent, --db-url-env, --backup-out, --first-start, --db-service, --reason and --remote belong to deploy');
+    if (!flags.urgent && (flags.reason || flags.remote)) throw refusal('STACK_USAGE', '--reason and --remote release HEAD in the one-command urgent deploy: add --urgent');
     if (!flags.urgent && (flags['first-start'] || flags['db-service'])) throw refusal('STACK_USAGE', '--first-start and --db-service are the first start of an empty database under the urgent floor: add --urgent');
     if (action === 'deploy' && !flags.urgent && (flags['db-url-env'] || flags['backup-out'])) throw refusal('STACK_USAGE', '--db-url-env and --backup-out choose the urgent floor\'s database and backup folder: add --urgent');
-    const options = OPTIONS[action]({ flags, positional, cwd: ctx.cwd });
+    let options = OPTIONS[action]({ flags, positional, cwd: ctx.cwd });
+    // The one-command urgent deploy releases HEAD and builds its images here, before the Docker transport reaches the server.
+    let prepared = null;
+    if (action === 'deploy' && oneCommand(options)) {
+      prepared = await prepareUrgentRelease(ctx, config, { ...options, role: io.harness?.role ?? ctx.env.STARCI_ROLE });
+      if (!prepared.images) {
+        print(ctx, action, flags, prepared);
+        return prepared.ok ? EXIT.ok : EXIT.failed;
+      }
+      options = { ...options, images: prepared.images, sourceSha: prepared.sourceSha };
+    }
     const handler = await handlerOf(action, io.importer ?? ((file) => import(file)));
     const sshCmd = flags['ssh-cmd'] ?? null;
     const call = (context) => handler(context, config, { ...options, sshCmd });
     const toolContext = nativeToolContext(ctx, binding);
-    const result = DOCKER_ACTIONS.has(action) ? await withDockerTransport(toolContext, config, { sshCmd }, call) : await call(toolContext);
+    const ran = DOCKER_ACTIONS.has(action) ? await withDockerTransport(toolContext, config, { sshCmd }, call) : await call(toolContext);
+    const result = prepared ? { ...ran, lines: [...prepared.lines, ...(ran.lines ?? [])] } : ran;
     print(ctx, action, flags, result);
     // A floor step of an urgent deploy that failed is a refusal with its own code (urgent-floor.mjs), printed after the lines that led to it.
     if (result.refused) {

package/stack/urgent-release.mjs

@@ -0,0 +1,45 @@
+// urgent-release.mjs - the one-command urgent release (owner ruling urgent-typecheck-build, 2026-10-30):
+//   starci app stack deploy --env <env> --urgent --reason "<text>" [--execute]
+// with no --image and no --source-sha takes HEAD from the laptop to the server in one command, CI not involved:
+//   1. the urgent release of HEAD (release/urgent.mjs: typecheck and the build, tag, one atomic push, the urgent record), skipped when HEAD
+//      already has a pushed urgent record;
+//   2. the images of that tag built and pushed on THIS machine's Docker (stack/build.mjs), which yields their digests;
+//   3. the urgent deploy of those digests (stack/urgent-floor.mjs): backup, migrate preview then execute, deploy, verify, rollback on red.
+// Steps 1 and 2 run before the deploy's Docker transport reaches the server, so nothing is ever built on the server. A dry run prints the
+// urgent release plan and the build plan and stops: the deploy plan needs the digests the build makes.
+import { buildImages } from './build.mjs';
+import { refusal } from './errors.mjs';
+import { git, releaseDir } from '../release/gate.mjs';
+import { loadReleaseConfig } from '../release/index.mjs';
+import { readUrgent } from '../release/records.mjs';
+import { releaseUrgentPush } from '../release/urgent.mjs';
+
+/** True when an urgent deploy names neither images nor a source commit: the one-command form. */
+export const oneCommand = (options) => options.urgent === true && !options.sourceSha && Object.keys(options.images ?? {}).length === 0;
+
+/**
+ * Steps 1 and 2 on the local machine. options: { execute, reason, role, remote }. Returns { ok, lines, data } to print when it stops (a dry run,
+ * a red step), or { ok: true, lines, images, sourceSha } for the deploy to continue with.
+ */
+export async function prepareUrgentRelease(ctx, config, options, deps = {}) {
+  const d = { buildImages, loadReleaseConfig, releaseUrgentPush, ...deps };
+  const head = git(ctx, ['rev-parse', 'HEAD']).stdout;
+  const lines = [`one-command urgent release of ${head.slice(0, 12)} (owner ruling urgent-typecheck-build): urgent release, local build and push, urgent deploy`];
+  const record = readUrgent(releaseDir(ctx), head);
+  if (record?.pushed === true) lines.push(`urgent release ${record.tag} of ${head.slice(0, 10)} already pushed: reused`);
+  else {
+    if (options.reason === undefined) throw refusal('STACK_URGENT_REASON_MISSING', 'the one-command urgent deploy releases HEAD first and says why: --reason "<text>"');
+    const pushed = await d.releaseUrgentPush(ctx, d.loadReleaseConfig(ctx.cwd), { execute: options.execute, reason: options.reason, role: options.role, remote: options.remote });
+    lines.push(...pushed.lines);
+    if (!pushed.ok) return { ok: false, lines, data: { head, step: 'release', ...pushed.data } };
+    if (options.execute !== true) {
+      lines.push('then: the images of that tag are built and pushed on this machine (stack build --push), then the urgent deploy runs the floor on their digests.');
+      return { ok: true, lines: [...lines, 'dry run: nothing tagged, built or deployed.'], data: { head, step: 'release', executed: false } };
+    }
+  }
+  const built = await d.buildImages(ctx, config, { push: true, execute: options.execute === true });
+  lines.push(...built.lines);
+  if (!built.ok) return { ok: false, lines, data: { head, step: 'build', ...built.data } };
+  if (options.execute !== true) return { ok: true, lines: [...lines, 'then: the urgent deploy runs the floor on the pushed digests.', 'dry run: nothing built or deployed.'], data: { head, step: 'build', executed: false } };
+  return { ok: true, lines, images: built.data.images, sourceSha: built.data.sha };
+}

package/sync/index.mjs

@@ -279,13 +279,13 @@ export function componentsYaml(components, { prefix = '', ids = id => id } = {})
   return components.map(component => [`    - component_id: ${ids(component.id)}`, `      name: ${ids(component.name)}`, '      paths:', ...component.paths.map(glob => `        - ${JSON.stringify(prefix + glob)}`)].join('\n')).join('\n');
 }
 
-/** The managed be/jest.config.js option text of a coverage scope { roots, roles, excludes }, laid out exactly as prettier lays it out (width 120, indent 4). */
+/** The managed be/jest.config.js option text of a coverage scope { roots, roles, files, excludes }, laid out exactly as prettier lays it out (width 120, indent 4). */
 export function jestCoverageSource(coverage) {
   const list = (key, items) => {
     const one = `        ${key}: [${items.map(item => JSON.stringify(item)).join(', ')}],`;
     return one.length <= 120 ? one : [`        ${key}: [`, ...items.map(item => `            ${JSON.stringify(item)},`), '        ],'].join('\n');
   };
-  return ['{', list('roots', coverage.roots), list('roles', coverage.roles), list('excludes', coverage.excludes), '    }'].join('\n');
+  return ['{', list('roots', coverage.roots), list('roles', coverage.roles), list('files', coverage.files), list('excludes', coverage.excludes), '    }'].join('\n');
 }
 
 /**

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.cookie.spec.ts

@@ -0,0 +1,57 @@
+import { Test } from "@nestjs/testing"
+import type { Response } from "express"
+import { mock } from "@starci/jest-preset"
+import { clearRefreshCookie, newRefreshToken, refreshTokenHash, setRefreshCookie } from "./passport.cookie"
+
+const COOKIE: unique symbol = Symbol("passport.cookie")
+
+const OPTIONS = { name: "refresh", path: "/auth/refresh", ttlSeconds: 600 }
+
+const build = async () => {
+    const moduleRef = await Test.createTestingModule({
+        providers: [{ provide: COOKIE, useValue: { clearRefreshCookie, newRefreshToken, refreshTokenHash, setRefreshCookie } }],
+    }).compile()
+    return moduleRef.get<{
+        clearRefreshCookie: typeof clearRefreshCookie
+        newRefreshToken: typeof newRefreshToken
+        refreshTokenHash: typeof refreshTokenHash
+        setRefreshCookie: typeof setRefreshCookie
+    }>(COOKIE)
+}
+
+describe("refresh tokens", () => {
+    it("stores the sha256 of a token, never the token", async () => {
+        const subject = await build()
+
+        expect(subject.refreshTokenHash("abc")).toBe("ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad")
+    })
+
+    it("mints a 256-bit base64url token paired with its own hash", async () => {
+        const subject = await build()
+        const minted = subject.newRefreshToken()
+
+        expect(Buffer.from(minted.token, "base64url")).toHaveLength(32)
+        expect(minted.hash).toBe(subject.refreshTokenHash(minted.token))
+        expect(subject.newRefreshToken().token).not.toBe(minted.token)
+    })
+})
+
+describe("refresh cookie", () => {
+    it("sets the rotated token httpOnly, Secure, SameSite=Strict on the refresh path for its lifetime", async () => {
+        const subject = await build()
+        const response = mock<Response>()
+
+        subject.setRefreshCookie(response, OPTIONS, "token-1")
+
+        expect(response.cookie).toHaveBeenCalledWith("refresh", "token-1", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh", maxAge: 600_000 })
+    })
+
+    it("clears the cookie with the attributes it was set with", async () => {
+        const subject = await build()
+        const response = mock<Response>()
+
+        subject.clearRefreshCookie(response, OPTIONS)
+
+        expect(response.clearCookie).toHaveBeenCalledWith("refresh", { httpOnly: true, secure: true, sameSite: "strict", path: "/auth/refresh" })
+    })
+})

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.password.spec.ts

@@ -0,0 +1,28 @@
+import { Test } from "@nestjs/testing"
+import { hashPassword, verifyPassword } from "./passport.password"
+
+const PASSWORD: unique symbol = Symbol("passport.password")
+
+const build = async () => {
+    const moduleRef = await Test.createTestingModule({
+        providers: [{ provide: PASSWORD, useValue: { hashPassword, verifyPassword } }],
+    }).compile()
+    return moduleRef.get<{ hashPassword: typeof hashPassword; verifyPassword: typeof verifyPassword }>(PASSWORD)
+}
+
+describe("hashPassword and verifyPassword", () => {
+    it("hashes at bcrypt cost 12 and verifies only the password it hashed", async () => {
+        const subject = await build()
+        const stored = await subject.hashPassword("correct horse")
+
+        expect(stored.slice(0, 7)).toBe("$2b$12$")
+        expect(await subject.verifyPassword("correct horse", stored)).toBe(true)
+        expect(await subject.verifyPassword("wrong horse", stored)).toBe(false)
+    })
+
+    it("never matches an account that has no password hash", async () => {
+        const subject = await build()
+
+        expect(await subject.verifyPassword("correct horse", null)).toBe(false)
+    })
+})

package/templates/be/skeleton-lite/src/modules/integrations/passport/passport.tokens.spec.ts

@@ -1,32 +1,88 @@
-import { exportPKCS8, generateKeyPair } from "jose"
+import { Test } from "@nestjs/testing"
+import { exportPKCS8, generateKeyPair, SignJWT } from "jose"
 import { Secret } from "@modules/platform/config"
-import { createTokenKit } from "./passport.tokens"
+import { PassportErrorCode } from "./errors/passport.error"
+import { createTokenKit, tokenKit } from "./passport.tokens"
 
-const options = async () => {
+const TOKENS: unique symbol = Symbol("passport.tokens")
+
+type SigningKey = Awaited<ReturnType<typeof generateKeyPair>>["privateKey"]
+
+const ISSUER = "https://api.example.test"
+const AUDIENCE = "app"
+
+const build = async () => {
+    const moduleRef = await Test.createTestingModule({
+        providers: [{ provide: TOKENS, useValue: { createTokenKit, tokenKit } }],
+    }).compile()
+    return moduleRef.get<{ createTokenKit: typeof createTokenKit; tokenKit: typeof tokenKit }>(TOKENS)
+}
+
+const keyPair = async () => {
     const { privateKey } = await generateKeyPair("ES256", { extractable: true })
-    return {
-        issuer: "https://api.example.test",
-        audience: "app",
-        privateKey: new Secret(await exportPKCS8(privateKey)),
-        keyId: "k1",
-        accessTtlSeconds: 60,
-    }
+    return { privateKey, options: { issuer: ISSUER, audience: AUDIENCE, privateKey: new Secret(await exportPKCS8(privateKey)), keyId: "k1", accessTtlSeconds: 60 } }
+}
+
+/** A token the kit's own key signs with the given claims, so only the claim checks can refuse it. */
+const ownSigned = (privateKey: SigningKey, claims: Record<string, unknown>, { subject = "user-1", expires = true } = {}) => {
+    const jwt = new SignJWT(claims).setProtectedHeader({ alg: "ES256", kid: "k1" }).setIssuer(ISSUER).setAudience(AUDIENCE).setIssuedAt()
+    if (subject !== "") jwt.setSubject(subject)
+    if (expires) jwt.setExpirationTime("60s")
+    return jwt.sign(privateKey)
 }
 
 describe("createTokenKit", () => {
-    it("verifies its own token against its own key set and publishes only the public key", async () => {
-        const kit = await createTokenKit(await options())
-        const verified = await kit.verify(await kit.issue({ id: "user-1", email: "a@example.test" }))
+    it("verifies its own token with an email against its own key set and publishes only the public key", async () => {
+        const subject = await build()
+        const { options } = await keyPair()
+        const kit = await subject.createTokenKit(options)
 
-        expect(verified).toEqual({ kind: "ok", value: { id: "user-1", role: "authenticated", email: "a@example.test" } })
+        expect(await kit.verify(await kit.issue({ id: "user-1", email: "a@example.test" }))).toEqual({ kind: "ok", value: { id: "user-1", role: "authenticated", email: "a@example.test" } })
         expect(kit.jwks.keys).toHaveLength(1)
+        expect(kit.jwks.keys[0]).toMatchObject({ kid: "k1", alg: "ES256", use: "sig", kty: "EC", crv: "P-256" })
         expect(kit.jwks.keys[0]).not.toHaveProperty("d")
     })
 
-    it("refuses a token another key signed", async () => {
-        const kit = await createTokenKit(await options())
-        const other = await createTokenKit(await options())
+    it("issues a token without an email claim for a user who has none", async () => {
+        const subject = await build()
+        const { options } = await keyPair()
+        const kit = await subject.createTokenKit(options)
+
+        expect(await kit.verify(await kit.issue({ id: "user-2" }))).toEqual({ kind: "ok", value: { id: "user-2", role: "authenticated" } })
+    })
+
+    it("refuses a token another key signed, naming the failed signature", async () => {
+        const subject = await build()
+        const kit = await subject.createTokenKit((await keyPair()).options)
+        const other = await subject.createTokenKit((await keyPair()).options)
+
+        expect(await kit.verify(await other.issue({ id: "user-1" }))).toEqual({
+            kind: "refused",
+            code: PassportErrorCode.AccessTokenInvalid,
+            params: { cause: "JWSSignatureVerificationFailed: signature verification failed" },
+        })
+    })
+
+    it("refuses a correctly signed token whose subject, expiry or role is not the one it issues", async () => {
+        const subject = await build()
+        const { privateKey, options } = await keyPair()
+        const kit = await subject.createTokenKit(options)
+        const invalid = { kind: "refused", code: PassportErrorCode.AccessTokenInvalid }
+
+        expect(await kit.verify(await ownSigned(privateKey, { role: "authenticated" }, { subject: "" }))).toEqual(invalid)
+        expect(await kit.verify(await ownSigned(privateKey, { role: "authenticated" }, { expires: false }))).toEqual(invalid)
+        expect(await kit.verify(await ownSigned(privateKey, { role: "service_role" }))).toEqual(invalid)
+        expect(await kit.verify(await ownSigned(privateKey, { role: "authenticated", email: 7 }))).toEqual({ kind: "ok", value: { id: "user-1", role: "authenticated" } })
+    })
+})
+
+describe("tokenKit", () => {
+    it("signs, verifies and publishes through the one key import it starts", async () => {
+        const subject = await build()
+        const { options } = await keyPair()
+        const kit = subject.tokenKit(options)
 
-        expect((await kit.verify(await other.issue({ id: "user-1" }))).kind).toBe("refused")
+        expect(await kit.verify(await kit.issue({ id: "user-3", email: "c@example.test" }))).toEqual({ kind: "ok", value: { id: "user-3", role: "authenticated", email: "c@example.test" } })
+        expect((await kit.jwks()).keys.map((key) => key.kid)).toEqual(["k1"])
     })
 })

package/release/lint-baseline.mjs

@@ -1,123 +0,0 @@
-// lint-baseline.mjs - the lint row of an urgent release judged against a baseline release tag (`release push --urgent --lint-baseline <tag>`,
-// owner ruling urgent-lint-baseline 2026-10-29: an app whose lint backlog predates the release ships when the release adds no finding of its own).
-// The managed lint (`npm run lint`, which ends in `starci app lint`) runs twice, each writing its findings as a Sonar Generic Issue Import file
-// (`-- --sonar <file>`): at HEAD, and at the baseline tag in a throwaway `git worktree` that borrows HEAD's installs (each node_modules folder is
-// linked in as a directory junction, unlinked before the worktree is removed, never deleted through). A finding is the same finding when its
-// engine, rule, file and message match (lines move); a finding left over is then matched on engine, rule and message alone (a file that moved).
-// What HEAD holds beyond the baseline is new: zero new findings is green, any is red, and a lint that could not run on either side is red. The
-// row names both counts and both reports with their sha256, and the new findings go to lint-new.json beside the record, so the back-fill's full
-// gate (which this changes nothing in) still sees the whole backlog.
-import { createHash, randomBytes } from 'node:crypto';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { refusal } from '../stack/errors.mjs';
-import { git, runGate } from './gate.mjs';
-
-/** The owner's ruling a baseline-judged lint row cites. */
-export const LINT_BASELINE_RULING = 'owner ruling urgent-lint-baseline 2026-10-29: an urgent release whose lint is red only with findings its baseline tag already had ships; a new finding is red';
-const LINK_DEPTH = 3;
-const NEW_SHOWN = 50;
-
-const sha256 = (file) => createHash('sha256').update(fs.readFileSync(file)).digest('hex');
-
-/** The findings of a Sonar Generic Issue Import file as { engine, rule, file, line, message }, or null when it is missing or unreadable. */
-export function sonarFindings(file) {
-  let doc;
-  try { doc = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
-  if (!doc || !Array.isArray(doc.issues)) return null;
-  return doc.issues.map((issue) => ({
-    engine: String(issue.engineId ?? ''), rule: String(issue.ruleId ?? ''), file: String(issue.primaryLocation?.filePath ?? ''),
-    line: issue.primaryLocation?.textRange?.startLine ?? null, message: String(issue.primaryLocation?.message ?? ''),
-  }));
-}
-
-/** The findings of `head` the `baseline` does not hold: matched on engine, rule, file and message, then the rest on engine, rule and message. */
-export function newFindings(head, baseline) {
-  const take = (pool, key) => { const left = pool.get(key) ?? 0; if (left === 0) return false; pool.set(key, left - 1); return true; };
-  const exact = (finding) => `${finding.engine}\u0000${finding.rule}\u0000${finding.file}\u0000${finding.message}`;
-  const loose = (finding) => `${finding.engine}\u0000${finding.rule}\u0000${finding.message}`;
-  const exactPool = new Map();
-  for (const finding of baseline) exactPool.set(exact(finding), (exactPool.get(exact(finding)) ?? 0) + 1);
-  const unmatched = head.filter((finding) => !take(exactPool, exact(finding)));
-  const loosePool = new Map();
-  for (const finding of baseline) {
-    const left = exactPool.get(exact(finding)) ?? 0;
-    if (left > 0) { exactPool.set(exact(finding), left - 1); loosePool.set(loose(finding), (loosePool.get(loose(finding)) ?? 0) + 1); }
-  }
-  return unmatched.filter((finding) => !take(loosePool, loose(finding)));
-}
-
-/** Every node_modules folder of `root` within LINK_DEPTH levels (never inside one), app-relative. */
-function installFolders(root) {
-  const found = [];
-  const walk = (rel, depth) => {
-    let entries;
-    try { entries = fs.readdirSync(path.join(root, rel), { withFileTypes: true }); } catch { return; }
-    for (const entry of entries) {
-      if (!entry.isDirectory() || entry.name === '.git') continue;
-      const child = rel ? path.join(rel, entry.name) : entry.name;
-      if (entry.name === 'node_modules') found.push(child);
-      else if (depth < LINK_DEPTH) walk(child, depth + 1);
-    }
-  };
-  walk('', 0);
-  return found;
-}
-
-/** Removes a link made by this module: the link alone, never what it points at. */
-function unlink(link) {
-  try { fs.unlinkSync(link); } catch { try { fs.rmdirSync(link); } catch { /* already gone */ } }
-}
-
-/** The lint of `gate` with its findings written to `report`: { row, findings } (findings null when the lint could not run). */
-function lintTo(ctx, gate, { name, report, dir, platform }) {
-  fs.rmSync(report, { force: true });
-  const row = runGate(ctx, { ...gate, name, command: [...gate.command, '--', '--sonar', report] }, { dir, platform, credentialNames: [] });
-  const ran = row.pass || row.detail === 'exit 1';
-  return { row, findings: ran ? sonarFindings(report) : null };
-}
-
-/**
- * The lint row of an urgent release against `tag`: { name, command, pass, detail, log, logSha256, baseline }. Refuses a tag that is not a
- * commit. `dir` is the record folder of HEAD, where both reports, both logs and lint-new.json are written.
- */
-export function baselineLint(ctx, gate, { tag, dir, platform }) {
-  const commit = git(ctx, ['rev-parse', '--verify', '--quiet', `${tag}^{commit}`], { allowFail: true });
-  if (commit.code !== 0 || commit.stdout === '') throw refusal('RELEASE_URGENT_LINT_BASELINE_TAG', `--lint-baseline ${tag} names no commit`);
-  fs.mkdirSync(dir, { recursive: true });
-  const headReport = path.join(dir, 'lint-head.sonar.json');
-  const head = lintTo(ctx, gate, { name: 'lint', report: headReport, dir, platform });
-  const row = (pass, detail, baseline = null) => ({ ...head.row, pass, detail, baseline: baseline && { tag, commit: commit.stdout, ruling: LINT_BASELINE_RULING, ...baseline } });
-  if (head.findings === null) return row(false, `the lint at HEAD could not run (${head.row.detail})`);
-  if (head.findings.length === 0) return row(true, 'no finding at HEAD', { findings: 0, headFindings: 0, newFindings: 0 });
-  const tree = path.join(os.tmpdir(), `starci-lint-baseline-${randomBytes(4).toString('hex')}`);
-  const links = [];
-  const added = git(ctx, ['worktree', 'add', '--detach', tree, commit.stdout], { allowFail: true });
-  if (added.code !== 0) return row(false, `the baseline worktree of ${tag} could not be made`);
-  try {
-    for (const rel of installFolders(ctx.cwd)) {
-      const link = path.join(tree, rel);
-      if (fs.existsSync(link) || !fs.existsSync(path.dirname(link))) continue;
-      fs.symlinkSync(path.join(ctx.cwd, rel), link, 'junction');
-      links.push(link);
-    }
-    const baseReport = path.join(dir, 'lint-baseline.sonar.json');
-    const base = lintTo(Object.create(ctx, { cwd: { value: tree } }), gate, { name: 'lint-baseline', report: baseReport, dir, platform });
-    if (base.findings === null) return row(false, `the lint at the baseline ${tag} could not run (${base.row.detail}; log ${base.row.log})`);
-    const fresh = newFindings(head.findings, base.findings);
-    fs.writeFileSync(path.join(dir, 'lint-new.json'), `${JSON.stringify(fresh, null, 2)}\n`);
-    const counts = {
-      findings: base.findings.length, headFindings: head.findings.length, newFindings: fresh.length,
-      headReport, headReportSha256: sha256(headReport), baselineReport: baseReport, baselineReportSha256: sha256(baseReport), baselineLog: base.row.log,
-      newShown: fresh.slice(0, NEW_SHOWN).map((finding) => `${finding.file}:${finding.line ?? '-'} ${finding.rule} ${finding.message}`),
-    };
-    const detail = `${head.findings.length} finding(s) at HEAD, ${base.findings.length} at ${tag}, ${fresh.length} new${fresh.length > 0 ? ` (${path.join(dir, 'lint-new.json')})` : ''}`;
-    return row(fresh.length === 0, detail, counts);
-  } finally {
-    links.reverse().forEach(unlink);
-    // A link still present would let the removal delete through it into HEAD's installs: the worktree then stays for a person to unlink.
-    if (links.every((link) => !fs.existsSync(link))) git(ctx, ['worktree', 'remove', '--force', tree], { allowFail: true });
-    else ctx.stderr?.(`lint baseline: ${tree} keeps a linked node_modules; unlink it (cmd /c rmdir <link>) before removing the worktree\n`);
-  }
-}