@starci/hfs 4.11.21 → 4.11.22

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 4.11.22 - 2026-10-30
+
+- Changed: `starci app check` and `starci app lint` are green while fewer than 20 error findings remain and none is a hard blocker (owner ruling gate-threshold-20, contexts/harness/decisions.md; `runtime/scripts/hfs/gate-threshold.mjs` `gateVerdict`): a plaintext secret (HFS_PLAINTEXT_SECRET and its family), the boot proof (BE_APP_BOOT_PROOF_MISSING) or a migration finding (DB_MIGRATION_SHAPE, DB_MIGRATION_DESTRUCTIVE, LITE_DB_MIGRATION, BE_MIGRATION_REVERSIBLE) blocks at any count. Every finding is still printed and kept in the report (`gate` carries the verdict); typecheck, build and the tests are not judged by it. Specs: `src/gate-threshold.spec.mjs`; `src/check-eslint.spec.mjs` now expects green for one or two ordinary findings.
+- Changed: the bundled canon pins name eslint-canon-be 3.8.21, eslint-canon-fe 9.5.23 and the Grammar family 0.15.34.
+
 ## 4.11.21 - 2026-10-30
 
 - Changed: an urgent release runs typecheck and the build only (owner ruling urgent-typecheck-build, contexts/harness/decisions.md): `URGENT_CHECKS` are the release gates `typecheck`, `build`, `build-be` and `build-fe` the app declares (`release/urgent.mjs`); app check, lint and the tests wait for the back-fill. `--lint-baseline` is retired with lint itself and refused (`RELEASE_URGENT_LINT_BASELINE_RETIRED`); `release/lint-baseline.mjs` is gone.

package/lint/run.mjs

@@ -27,6 +27,7 @@ import { STYLE_GLOB } from '../sync/index.mjs';
 import { byCodeUnit } from '../report/order.mjs';
 import { braceVariants, globExpression } from '../runtime/scripts/lib/glob.mjs';
 import { grammarLintFor } from '../runtime/scripts/lib/grammar-lint.mjs';
+import { gateVerdict } from '../runtime/scripts/hfs/gate-threshold.mjs';
 
 // --side judges only that side; root HFS findings belong to be, its Sonar report stays on that side.
 export const LINT_SCHEMA = 'starci/lint@1';
@@ -436,8 +437,10 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
     linterReport('eslint', raw.eslint, { root: repoRoot, sourceRoots, tracked }),
     linterReport('stylelint', raw.stylelint, { root: repoRoot, sourceRoots, tracked }),
   ]);
-  const report = { schema: LINT_SCHEMA, ok: findings.length === 0 && errors.length === 0, repoRoot, changed: changed ? [...changed].sort(byCodeUnit) : null, workspace, ...(opts.side === undefined ? {} : { side: opts.side }), counts: { error: findings.length }, engines, errors, findings };
-  return { report, sonar, exit: errors.length ? 2 : findings.length ? 1 : 0 };
+  // Green under the threshold (gate-threshold.mjs): every finding is still reported, only the verdict changes.
+  const gate = gateVerdict(findings);
+  const report = { schema: LINT_SCHEMA, ok: gate.pass && errors.length === 0, repoRoot, changed: changed ? [...changed].sort(byCodeUnit) : null, workspace, ...(opts.side === undefined ? {} : { side: opts.side }), counts: { error: findings.length }, engines, errors, findings, gate };
+  return { report, sonar, exit: errors.length ? 2 : gate.pass ? 0 : 1 };
 }
 
 export function printLintText(report, out) {
@@ -445,4 +448,5 @@ export function printLintText(report, out) {
   for (const e of report.errors) out(`ERROR ${e}\n`);
   const per = Object.keys(report.engines).map((engine) => `${engine} ${report.findings.filter((f) => f.engine === engine).length}`).join(', ');
   out(`\nstarci app lint: ${report.counts.error} finding${report.counts.error === 1 ? '' : 's'} (${per})${report.errors.length ? `, ${report.errors.length} tool error${report.errors.length === 1 ? '' : 's'}` : ''}\n`);
+  if (report.gate?.line) out(`${report.gate.line}\n`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.11.21",
+  "version": "4.11.22",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.33
+    version: 0.15.34
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.8.20
+    version: 3.8.21
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.5.22
+    version: 9.5.23
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.33
+    version: 0.15.34
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.33
+    version: 0.15.34
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.11.21
+    version: 4.11.22
     group: starci
     install: registry
     side: both

package/runtime/scripts/hfs/gate-threshold.mjs

@@ -0,0 +1,36 @@
+// gate-threshold.mjs - the verdict of `starci app check` and `starci app lint` (owner ruling gate-threshold-20, 2026-10-30): green
+// while fewer than GATE_ERROR_LIMIT error findings remain and none of them is a hard blocker, so a release is not held back finding
+// by finding (5, 4, 3, ...) by the last few structural nits. A plaintext secret, a failed boot proof and a broken migration block at
+// any count. Every finding is still printed; only the exit code changes. Typecheck, build and the tests are not judged here.
+
+export const GATE_ERROR_LIMIT = 20;
+
+/** The limit in force: policy/quality.yaml `gate.errorLimit`, handed in by the harness CLI as STARCI_GATE_ERROR_LIMIT, else 20. */
+export function gateErrorLimit(env = process.env) {
+  const value = Number(env.STARCI_GATE_ERROR_LIMIT);
+  return Number.isInteger(value) && value > 0 ? value : GATE_ERROR_LIMIT;
+}
+export const GATE_THRESHOLD_RULING = 'owner ruling gate-threshold-20 2026-10-30: app check and lint pass under 20 error findings with no plaintext secret, boot proof or migration finding';
+
+/** The codes that block at any count: plaintext secrets, the boot proof, the migrations. */
+export const HARD_BLOCKERS = Object.freeze(new Set([
+  'HFS_PLAINTEXT_SECRET', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'RT_SECRET_TRACKED',
+  'STACKS_SECRET_ENV_LITERAL', 'APP_SECRET_IN_CI', 'BE_LOG_SECRET',
+  'BE_APP_BOOT_PROOF_MISSING',
+  'DB_MIGRATION_SHAPE', 'DB_MIGRATION_DESTRUCTIVE', 'LITE_DB_MIGRATION', 'BE_MIGRATION_REVERSIBLE',
+]));
+
+/**
+ * The verdict over the error findings (each with `code`): { pass, count, hard, line }. `pass` is true when no hard blocker is
+ * among them and there are fewer than GATE_ERROR_LIMIT; `line` says which, for the report.
+ */
+export function gateVerdict(errors, limit = gateErrorLimit()) {
+  const hard = [...new Set(errors.map((finding) => finding.code).filter((code) => HARD_BLOCKERS.has(code)))].sort();
+  const count = errors.length;
+  const pass = hard.length === 0 && count < limit;
+  const line = count === 0 ? null
+    : hard.length > 0 ? `gate: red, ${hard.join(', ')} block${hard.length === 1 ? 's' : ''} at any count (${count} error finding(s))`
+      : pass ? `gate: green under the threshold, ${count} error finding(s) < ${limit} and no hard blocker (owner ruling gate-threshold-20); they stay listed above`
+        : `gate: red, ${count} error finding(s), the threshold is fewer than ${limit}`;
+  return { pass, count, hard, line };
+}

package/src/main.mjs

@@ -73,6 +73,7 @@ import { dbBaselineMain } from '../runtime/scripts/hfs/db-baseline-verb.mjs';
 import { dbRestampMain } from '../runtime/scripts/hfs/db-restamp-verb.mjs';
 import { dbPlanMain } from '../runtime/scripts/hfs/db-plan-verb.mjs';
 import { formatCoverageReport } from '../runtime/scripts/hfs/coverage-from.mjs';
+import { gateVerdict } from '../runtime/scripts/hfs/gate-threshold.mjs';
 import { HFS_DECLARATION_FILE, HfsSlotsError, loadSlotManifest, readRepoDeclaration } from '../runtime/scripts/hfs/slots.mjs';
 import { formatFindings } from '../sync/format.mjs';
 import { main as syncMain } from '../sync/cli.mjs';
@@ -363,9 +364,11 @@ async function checkMain(opts, { cwd: repoRoot, harness, edition, stdout: out, p
   const existing = changed ? changed.filter(file => fs.existsSync(path.join(repoRoot, file))) : [];
   const eslint = await eslintRepository({ repoRoot, changed, existing, run: runLinter });
   const findings = [...proof.findings, ...eslint.findings.map(finding => ({ ...finding, code: finding.code ?? finding.rule, level: 'error' }))];
-  const result = { ...proof, findings, counts: { ...proof.counts, error: proof.counts.error + eslint.findings.length }, eslint: { ...eslint.engine, errors: eslint.errors }, ok: proof.ok && eslint.findings.length === 0 && eslint.errors.length === 0 };
+  // Green under the threshold (gate-threshold.mjs): every finding is still listed, only the verdict changes.
+  const verdict = gateVerdict(findings.filter(finding => finding.level === 'error'));
+  const result = { ...proof, findings, counts: { ...proof.counts, error: proof.counts.error + eslint.findings.length }, eslint: { ...eslint.engine, errors: eslint.errors }, ok: verdict.pass && eslint.errors.length === 0, gate: verdict };
   if (opts.json) out(`${JSON.stringify(result, null, 2)}\n`);
-  else { printCheck(result, out); printCheckProofs(result, out); }
+  else { printCheck(result, out); printCheckProofs(result, out); if (verdict.line) out(`${verdict.line}\n`); }
   return eslint.errors.length ? 2 : result.ok ? 0 : 1;
 }