@starci/hfs 4.11.8 → 4.11.12

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## 4.11.12 - 2026-10-29
+
+- Changed: the skeleton canon gate (`src/scaffold-template-canon-be.spec.mjs`) lints every file under `be/src/modules/platform` of both editions with the starci-be rules, no longer `platform/http` alone; both editions are green.
+- Fixed: the lite skeleton's `platform/http-security` reads and writes its rate limit windows through `RateWindowEntity` on the EntityManager (R334), no longer through full's `rate-limit.sql.ts` and `.query(`: a live window grows in one atomic `increment`, an ended one restarts with `update`, a missing one opens with an `orIgnore` insert builder, and the prune deletes a bounded `find` batch. The entity maps `public.http_security_rate_windows` of the baseline migration (`persistence/entities/rate-window.entity.ts`, `httpSecurityEntities` in its barrel, listed in `PRIMARY_ENTITIES`); a lite platform capability takes its `persistence/` from the lite overlay alone. The guard spec uses the kit's `mockEntityManager` and `queueQueryBuilders`.
+- Changed: a fresh lite app no longer carries the raw SQL helpers nothing in it calls: `platform/database/database.sql.ts` and `database.client.ts` (with its spec) are written by the first generator that needs them (`add table` the sql helpers, `add queue`, `add job` and `add webhook` both), and the barrel exports `sql`, `callDbFunction` and `advisoryXactLock` are registered by those generators (`jobs` registers `advisoryXactLock`); `notify` is no longer exported by the starter.
+- Fixed: `source-suffix` (BE_SOURCE_FORM, R89) admits the one file a file slot names by its path, read from the slot manifest: the lite entity registry `src/modules/platform/database/entities.ts` (slot `be.platform.database.entities`) was refused for having no role suffix.
+- Fixed: the lite skeleton types its entity lists with `EntityClass` (`new () => object`, declared in `platform/database/database.options.ts` as full declares it): `DatabaseOptions.entities` and `PRIMARY_ENTITIES` of `entities.ts` were `ReadonlyArray<Function>`, which `starci-be/no-function-or-eval` refuses.
+- Changed: R334 `BE_PERSISTENCE_NO_RAW_SQL` covers test code with one owner exception (ruling lite-test-sql-owner): specs, builders and fixtures seed and assert through entities on `world.db.<connection>`, and only `src/tests/world` holds raw SQL beside `platform/database`, as named world helpers for what entities cannot express. The bundled catalog law and the failure-code hint say so; the bundled canon pins name hfs 4.11.12, eslint-canon-be 3.8.11, eslint-canon-fe 9.5.13 and the Grammar family 0.15.24.
+
+## 4.11.11 - 2026-10-29
+
+- Changed: `server-key <env> --backup github` stores the server identity as the secret `SOPS_AGE_KEY` of the GitHub Environment `<env>` (`BACKUP_SECRET`, `gh secret set SOPS_AGE_KEY --env <env>`), the name the deploy workflows read: an Environment secret overrides a repository secret of the same name for every job bound to that Environment, so the deploy of `<env>` decrypts with that environment's own server key. `backupSecretName` and the `SOPS_AGE_KEY_<ENV>` name are gone.
+- Changed: `server-key <env> --restore github` dispatches `stack-key-restore.yml` with `-f recipient=<deploy.remote.serverRecipient>` instead of a secret name, and is refused `STACK_SERVER_KEY_NO_RECIPIENT` when none is recorded. The managed workflow (both editions) reads `secrets.SOPS_AGE_KEY` of the bound environment, takes the `recipient` input in place of `secret`, and on the server writes the identity beside its target, keeping it only when `age-keygen -y` of it is that recipient (exit 6 otherwise, nothing written), so neither the owner key nor a stale identity can land there.
+- Added: `--backup github` and `--restore github`, dry run or not, read the repository's Actions secret names (`gh api repos/<o>/<r>/actions/secrets`, names only, `repositoryKeyWarnings`) and warn while a repository-level `SOPS_AGE_KEY` exists, naming `gh secret delete SOPS_AGE_KEY --repo <o>/<r>`; the owner key never belongs in GitHub. An unreadable list is a warning too.
+- Changed: R251 (`HFS_DEPLOY_WORKFLOW`, `rules/deploy-workflow.mjs`) refuses any app workflow job, deployment job or not, that reads `secrets.SOPS_AGE_KEY` (job or workflow `env`, an active step's `env`, `with` or `run`, a reusable workflow's `secrets`) without an `environment`; a disabled step does not count. The managed `stack-deploy.yml` (both jobs) and `images.yml` (when an environment declares images) already bind theirs; their headers now say the key they read is that environment's server identity.
+- Changed: the bundled canon pins name hfs 4.11.11, eslint-canon-be 3.8.10, eslint-canon-fe 9.5.12 and the Grammar family 0.15.23.
+
+## 4.11.10 - 2026-10-29
+
+- Fixed: the skeleton's `platform/http` passes the canon it ships with, so an app that copies it byte-identical lints clean. `FetchHttpClient.send` hands `fetch` its deadline at the call (`fetch(request.url, { ...this.routed(init), signal })`): the signal was set inside `init` and handed through `routed`, whose declared `RequestInit` leaves `signal` optional, so `starci-be/http-needs-timeout` (R70) could not prove it. The client spec provides `HTTP_OPTIONS` with the kit's `builder<HttpOptions>({})(overrides)`, the double `starci-be/spec-infra-double-from-kit` (R48) asks for an `*_OPTIONS` token, instead of a parameter it cannot trace.
+- Fixed: the lite skeleton's api app reads `http: parseHttpConfig(env)` into its options (`api.env.ts`, `api.options.ts`, the wiring proof's `http: {}`) and registers `HttpModule.register({ isGlobal: true, ...options.http })`, as the full app does, so a lite test world passes its fake CA as `HTTP_TRUSTED_CA` too and `parseHttpConfig` and `HttpOptions` are no longer exports nothing imports (`starci-be/dead-exports`).
+- Changed: the bundled canon pins name hfs 4.11.10, eslint-canon-be 3.8.9, eslint-canon-fe 9.5.11 and the Grammar family 0.15.22.
+- Spec: `src/scaffold-template-canon-be.spec.mjs` scaffolds each edition and lints its `be/src/modules/platform/http/**` (code and specs) with the starci-be rules of the sibling eslint-canon-be, typed against this package's installs and the built kit, and asserts no finding; on the skeleton before this fix it names exactly the R70 and R48 findings above.
+
+## 4.11.9 - 2026-10-29
+
+- Added: `starci app secret server-key <env> [--execute]` makes the deploy server's own age identity ON the server, reached through the deploy's own transport (`deploy.remote`, `withRunner`: the same host, user and key source; an environment whose deploy declares no remote is refused `STACK_SERVER_KEY_NO_REMOTE` before any ssh). The server keeps `/root/.config/sops/age/keys.txt` (`SERVER_AGE_IDENTITY`, `stack/server-key.mjs`, sops' default key file of root) when it exists, else `age-keygen -o` makes it (umask 077, mode 600, owner root); only `age-keygen -y` comes back, and any other output is refused unseen. age-keygen missing is installed by stack prepare's installer (`installAge`) or refused naming the install commands. Locally the recipient joins the environment's rule beside the owner key (`STACK_SERVER_KEY_NO_OWNER` when the rule names none), is recorded as `deploy.remote.serverRecipient`, and every member is wrapped again with `sops updatekeys` (`updateKeys` of the sops seam, `api/sops/update-keys.mjs`, `runSelectedUpdateKeys` for an inline identity): the owner identity opens the data key only, no value is decrypted. A dry run until `--execute`; a second run keeps the identity and changes nothing.
+- Added: `server-key <env> --rotate --execute` stages a new identity at `<identity>.next`, wraps the members to it, swaps it in keeping the old file on the server as `<identity>.retired-<UTC stamp>` until the owner deletes it, then removes the old recipient and wraps them again.
+- Added: `deploy.remote.serverRecipient` (a public age recipient) in the deploy block; `audit` raises `RECIPIENT_DRIFT` for an environment whose rule does not name it beside another recipient (the owner key), and for a production swarm deploy with a remote that records none.
+- Added: `server-key <env> --backup github [--execute]` streams the server identity from the server's ssh stdout straight into the stdin of `gh secret set SOPS_AGE_KEY_<ENV> --env <env> --repo <origin>` (the stack context's `pipe` seam and the ssh runner's `argv(command)`): never printed, held or written locally. It is refused unless that GitHub Environment exists with required reviewers or deployment branches limited to main (`STACK_SERVER_KEY_GITHUB_ENVIRONMENT`, `STACK_SERVER_KEY_UNPROTECTED`). `--restore github` dispatches the managed `.github/workflows/stack-key-restore.yml` (slot `app.ci-stack-key-restore`, slot manifest 3.14.0), which writes the secret to the server over the deploy's CI ssh key with umask 077 and mode 600, never echoing it and never over an existing identity.
+
 ## 4.11.8 - 2026-10-29
 
 - Added: `starci app secret migrate <env> <member> --to <existing> --into-existing` and `split <env> <member> --into-existing` merge into a member that already exists (never a legacy `.enc` one: migrate it first). Without the flag an existing target is refused, naming the flag. Every existing target is decrypted in memory and checked before anything is written: a key it already holds with another value refuses the whole move (`refused, nothing was written: <env>/<member>.enc.yaml already holds KEY with another value`, names only); an identical value merges. Each target is written once, and the source is removed only after every target is written (an own target is staged as `<member>-staged.enc.yaml` and moved over it). The dry run names each target's keys, which targets exist and the keys they already hold (`secret-standard.mjs` `plannedTargets`, `moveKeys`).

package/README.md

@@ -24,7 +24,7 @@ starci app db drift [--url-env <NAME>] [--json] [--cwd <dir>]
 starci app new service <dir> <name> [--inject <binding>...] [--cwd <dir>]
 starci app new spec <file>.service.ts [--cwd <dir>]
 starci app new image [--cwd <dir>]
-starci app secret init|set|get|unset|rename|remove|materialize|list|verify|recipients|migrate|split|audit ... [--cwd <dir>]
+starci app secret init|set|get|unset|rename|remove|materialize|list|verify|recipients|migrate|split|audit|server-key ... [--cwd <dir>]
 starci app hygiene [--cwd <dir>]
 ```
 
@@ -234,8 +234,11 @@ by itself (`localAgeIdentity`): SOPS_AGE_KEY or SOPS_AGE_KEY_FILE of the environ
 `.claude/secret.env`, else of its main checkout's when the app is a git worktree, else the `hostIdentity` the harness CLI passes
 (its own secret.env), else the sops `keys.txt`; with none, the verb refuses before asking for a value, naming every place it
 looked and the one line that fixes it. `audit [<env>]` names every deviation and exits 1; `migrate <env> <member> [--to
-<provider>]` and `split <env> <member>` repair them, dry runs until `--execute` (`secret-standard.mjs`). No output carries a
-value except `get --reveal`.
+<provider>]` and `split <env> <member>` repair them, dry runs until `--execute` (`secret-standard.mjs`). `server-key <env>` makes
+the deploy server's own age identity on the server through the deploy's transport and seals the environment to it beside the
+owner key, `--rotate` replaces it, `--backup github` stores it as the SOPS_AGE_KEY of the GitHub Environment `<env>` that
+every CI job bound to `<env>` reads, and `--restore github` writes it back (`stack/server-key.mjs`). No output carries a value
+except `get --reveal`.
 
 ## Sonar
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.11.8",
+  "version": "4.11.12",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,35 +31,35 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.15.20
+    version: 0.15.24
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.8.7
+    version: 3.8.11
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.5.9
+    version: 9.5.13
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.15.20
+    version: 0.15.24
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.15.20
+    version: 0.15.24
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 4.11.8
+    version: 4.11.12
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/rules.yaml

@@ -4195,7 +4195,7 @@ rules:
     editions: [lite, full]
     docs:
       - {path: docs/application-stacks.md#r251-deploy-workflow, editions: [lite, full]}
-    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*], the release candidate branches release/candidate-* (required in ci.yml: starci app release push waits for that run, owner ruling candidate-ci 2026-10-18) or workflow_dispatch; ci.yml also runs on main, and other branch pushes are refused."
+    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets; every job that reads secrets.SOPS_AGE_KEY, a deployment job or not, is bound to the GitHub Environment whose members it opens, so it reads that environment's server key and never a repository secret of that name. Deployment jobs never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*], the release candidate branches release/candidate-* (required in ci.yml: starci app release push waits for that run, owner ruling candidate-ci 2026-10-18) or workflow_dispatch; ci.yml also runs on main, and other branch pushes are refused."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DEPLOY_WORKFLOW", "HFS_WORKFLOW_PIN", "HFS_CI_TOOL_INSTALL", "HFS_APP_WORKFLOW_TRIGGER"]
@@ -5828,7 +5828,7 @@ rules:
         ruling: "Lite entities only map tables the migrations create, so each entity column is checked against the migrated schema by starci app db drift, which CI runs in the build job and the release gate runs as its db-drift row."
   - id: R334
     code: "BE_PERSISTENCE_NO_RAW_SQL"
-    law: "Lite domain and feature code reads and writes through TypeORM entities on the injected EntityManager (find, findOne, findBy, count, exists, insert, save, update, delete, upsert, increment, and createQueryBuilder(Entity, alias) with named parameters for joins, aggregates, FOR UPDATE / SKIP LOCKED and jsonb or vector operators; never a table-name builder, a builder with no entity or a Repository); no .query( call and no sql template outside platform/database; a database function TypeORM cannot express is called through the callDbFunction, advisoryXactLock and notify helpers of platform/database/database.client.ts, and callDbFunction names only a function ruleParams.be.dbFunctions or hfs.json sides.be.dbFunctions lists with a reason: a function of a migration schema-qualified (public.job_claim), a pg built-in bare (pg_notify, called in pg_catalog). That file alone composes the call statement, from the name parts its validator checked and double-quotes and a numbered parameter list. Entities only map tables db/migrations created (synchronize stays false); entity-versus-schema drift is BE_ENTITY_SCHEMA_DRIFT of starci app db drift."
+    law: "Lite domain, feature and test code reads and writes through TypeORM entities on an EntityManager (domain code the injected one, integration and e2e specs, builders and fixtures the world's `world.db.<connection>`) (find, findOne, findBy, count, exists, insert, save, update, delete, upsert, increment, and createQueryBuilder(Entity, alias) with named parameters for joins, aggregates, FOR UPDATE / SKIP LOCKED and jsonb or vector operators; never a table-name builder, a builder with no entity or a Repository); no .query( call and no sql template outside the two raw SQL owners, platform/database and the test world src/tests/world, which wraps only what entities cannot express (a trigger, a database function, a row-level-security probe, a pgmq queue) in a named, typed world helper specs call; a database function TypeORM cannot express is called, in domain and test code alike, through the callDbFunction, advisoryXactLock and notify helpers of platform/database/database.client.ts, and callDbFunction names only a function ruleParams.be.dbFunctions or hfs.json sides.be.dbFunctions lists with a reason: a function of a migration schema-qualified (public.job_claim), a pg built-in bare (pg_notify, called in pg_catalog). That file alone composes the call statement, from the name parts its validator checked and double-quotes and a numbered parameter list. Entities only map tables db/migrations created (synchronize stays false); entity-versus-schema drift is BE_ENTITY_SCHEMA_DRIFT of starci app db drift."
     kinds: [lint]
     gates: [pre-commit, settle, land, ci]
     failureCodes: ["BE_PERSISTENCE_NO_RAW_SQL"]

package/runtime/knowledge/hfs/slots.yaml

@@ -7,7 +7,7 @@
 # catalog READ this file through scripts/hfs/slots.mjs; none of them hardcodes a path.
 # Shape: modules/schemas/hfs-slots.schema.yaml. The repository side is hfs.json: modules/schemas/hfs-repo.schema.yaml.
 schema: starci/hfs-slots@3
-version: 3.13.0
+version: 3.14.0
 
 versioning:
   # MAJOR.MINOR.PATCH of this manifest. A repository pins only the MAJOR in hfs.json ("hfs": 3).
@@ -58,6 +58,8 @@ versioning:
 # 3.13.0 (rulings lite-pgmq-bus-bullmq-jobs and lite-db-image-in-stacks, 2026-10-29) is a change for lite only: ruleParams.db.extensions
 # admits pgmq, the event bus, ruleParams.db.queueOutbox is retired with the pg_cron half of R258, the lite event-bus functions replace
 # event_bus_write in ruleParams.be.dbFunctions, and app.db.image moves to .starcistacks/images/db/Dockerfile (db/ keeps schema and data).
+# 3.14.0 (ruling app-secrets-one-standard, 2026-10-29) adds the optional app.ci-stack-key-restore, the managed workflow that writes the
+# deploy server's age identity back from its GitHub Environment backup.
 
 # Field meaning, per slot.
 #   id          stable name, never changes meaning inside a major.
@@ -676,6 +678,19 @@ slots:
     managedBy: ci-workflows
     liteManagedBy: ci-workflows-lite
     rules: [HFS_MANAGED_FILE_DRIFT]
+  - id: app.ci-stack-key-restore
+    since: 3.14.0
+    profiles: [app]
+    editionWhy: "ruling:app-secrets-one-standard: both editions deploy to a Docker Swarm server whose own age identity the owner backs up as a protected GitHub Environment secret; this workflow writes it back."
+    # The server identity restore workflow: workflow_dispatch only (like app.ci-stack-deploy); `starci app secret server-key <env> --restore github` dispatches it, rendered by starci app sync.
+    path: ".github/workflows/stack-key-restore.yml"
+    presence: optional
+    tracked: tracked
+    tier: none
+    tests: none
+    managedBy: ci-workflows
+    liteManagedBy: ci-workflows-lite
+    rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.dockerignore
     since: 3.1.0
     profiles: [app]

package/runtime/modules/kernel/failure-codes.yaml

@@ -5581,12 +5581,12 @@ LITE_DB_MIGRATION:
   kind: check-finding
 
 BE_PERSISTENCE_NO_RAW_SQL:
-  title: "Lite domain code runs raw SQL instead of TypeORM entities"
-  title_vi: "Mã domain của app lite chạy SQL thô thay vì entity TypeORM"
-  meaning_vi: "File `<path>` gọi `.query(` hoặc dùng template `sql` ngoài platform/database và ngoài danh sách hàm ruleParams.be.lite.rawSqlFunctions."
+  title: "Lite domain, feature or test code runs raw SQL instead of TypeORM entities"
+  title_vi: "Mã domain, feature hoặc test của app lite chạy SQL thô thay vì entity TypeORM"
+  meaning_vi: "File `<path>` gọi `.query(` hoặc dùng template `sql` ngoài hai chủ của SQL thô là platform/database và test world src/tests/world, hoặc gọi callDbFunction với một hàm không có trong ruleParams.be.dbFunctions hay hfs.json sides.be.dbFunctions."
   causes_vi:
-    - "Vi phạm R334: dữ liệu của app lite đi qua entity TypeORM trên EntityManager (find, save, update, upsert, createQueryBuilder)."
-  nextStep_vi: "Khai entity ở persistence/entities/<table>.entity.ts và đọc/ghi bằng EntityManager hoặc createQueryBuilder với tham số có tên; hàm pg/SECURITY DEFINER không diễn đạt được thì khai vào rawSqlFunctions kèm lý do."
+    - "Vi phạm R334: dữ liệu của app lite, kể cả spec, builder và fixture, đi qua entity TypeORM trên EntityManager (find, save, update, upsert, createQueryBuilder); spec dùng world.db.<connection>."
+  nextStep_vi: "Đọc/ghi bằng entity trên EntityManager hoặc createQueryBuilder với tham số có tên (trong test là world.db.<connection>); hàm database TypeORM không diễn đạt được thì gọi qua callDbFunction với hàm đã khai kèm lý do; điều entity không diễn đạt được trong test (trigger, thăm dò row-level security, hàng đợi pgmq) thì gọi một helper có tên của src/tests/world."
   owner: op-retry
   kind: check-finding
 

package/runtime/scripts/api/sops/lib.mjs

@@ -310,6 +310,36 @@ export function runSelectedSops(bin, request, { selection, invocation, env, cwd,
   }
 }
 
+/**
+ * `sops --config <config> updatekeys -y --input-type <type> <file>` under an inline selected identity: the member's data key is
+ * opened with SOPS_AGE_KEY in an isolated child environment and wrapped again to the recipients the config's rule names; no value
+ * is decrypted to stdout or disk. The tool profile is the selected one; captures are wiped.
+ */
+export function runSelectedUpdateKeys(bin, { file, config, inputType }, { selection, invocation, env, cwd, timeout } = {}) {
+  if (selection?.error?.identityRefusal !== 'inline-context-unqualified' || typeof selection.inlineName !== 'string' || !env || typeof env !== 'object') return held('selected-context-missing');
+  if (!invocation || typeof invocation.runProgram !== 'function' || typeof invocation.resolveRealTool !== 'function') return held('selected-context-missing');
+  if (!['yaml', 'dotenv', 'json'].includes(inputType) || !path.isAbsolute(file ?? '') || !path.isAbsolute(config ?? '')) return held('invalid-request');
+  const key = env[selection.inlineName];
+  if (typeof key !== 'string' || !/^AGE-SECRET-KEY-1[0-9A-Z]+$/.test(key.trim())) return held('invalid-inline');
+  const captures = [];
+  try {
+    const exe = bin ?? resolveSops(env), age = invocation.resolveRealTool('age-keygen', { env });
+    if (!nativeFile(exe) || !nativeFile(age)) return held('native-tool-unavailable');
+    if (!auditAbsent(cwd)) return held('unsupported-audit-context');
+    const publicEnv = isolatedSopsEnv(env, null);
+    const options = { cwd, shell: false, encoding: 'buffer', windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'], timeout: timeout ?? IDENTITY_TIMEOUT_MS, maxBuffer: CREDENTIAL_FILE_MAX_BYTES };
+    const run = (program, args, childEnv) => {
+      const result = invocation.runProgram(program, args, { ...options, env: childEnv });
+      captures.push(result); return result;
+    };
+    if (!toolProfileSupported(run(exe, ['--disable-version-check', '--version'], publicEnv), run(age, ['--version'], publicEnv))) return held('unsupported-tool-profile');
+    const result = run(exe, ['--disable-version-check', '--config', config, 'updatekeys', '-y', '--input-type', inputType, file], isolatedSopsEnv(env, selection.inlineName));
+    if (!captured(result)) return { status: result?.status ?? null, stdout: '', stderr: '', error: result?.error ?? null };
+    return { status: 0, stdout: '', stderr: '', error: null };
+  } catch { return held('selected-native-refused'); }
+  finally { wipeCaptures(captures); }
+}
+
 const identityRequestValid = ({ env, cwd, invocation, assertLease, consume }) =>
   env && typeof env === 'object' && path.isAbsolute(cwd ?? '') && typeof consume === 'function'
     && typeof assertLease === 'function' && typeof invocation?.runProgram === 'function'

package/runtime/scripts/api/sops/update-keys.mjs

@@ -0,0 +1,20 @@
+// update-keys.mjs — the public SOPS `updatekeys` call: a sealed member is wrapped again to the recipients its .sops.yaml rule
+// names. Only the member's data key is opened (with the caller's identity); no value is decrypted to stdout or disk.
+import { spawnSync } from 'node:child_process';
+import { sopsIdentityEnv } from '../../../engine/secrets.mjs';
+import { resolveSops, runSelectedUpdateKeys } from './lib.mjs';
+
+/**
+ * Run `<bin> --config <config> updatekeys -y --input-type <inputType> <file>` (bin null: the sops resolveSops finds). An inline
+ * SOPS_AGE_KEY goes through the selected isolation (runSelectedUpdateKeys); a SOPS_AGE_KEY_FILE runs with the selected environment.
+ * {status, stdout, stderr, error}; stdout and stderr carry public key names only.
+ */
+export function updateKeys(bin, { file, config, inputType }, { invocation = null, env = process.env, cwd = undefined, timeout = undefined } = {}) {
+  const selected = sopsIdentityEnv(env, { required: true });
+  if (selected.error?.identityRefusal === 'inline-context-unqualified') return runSelectedUpdateKeys(bin, { file, config, inputType }, { selection: selected, invocation, env, cwd, timeout });
+  if (selected.error) return { status: null, stdout: '', stderr: '', error: selected.error };
+  const exe = bin ?? resolveSops(selected.env);
+  if (!exe) return { status: null, stdout: '', stderr: '', error: Object.assign(new Error('sops is not installed (Windows: winget install Mozilla.SOPS)'), { code: 'SOPS_MISSING' }) };
+  const r = spawnSync(exe, ['--disable-version-check', '--config', config, 'updatekeys', '-y', '--input-type', inputType, file], { cwd, env: selected.env, encoding: 'utf8', windowsHide: true, timeout, stdio: ['ignore', 'pipe', 'pipe'] });
+  return { status: r.status, stdout: r.stdout, stderr: r.stderr, error: r.error ?? null };
+}

package/runtime/scripts/hfs/path-findings.mjs

@@ -29,6 +29,8 @@ function sourceFormContext(file, resolver, suffixes, bannedSuffixes) {
   const base = path.posix.basename(file);
   if (FREE_NAMES.has(base)) return null;
   const slot = resolver.slot(c.slot);
+  // A file slot declares its one file by its path (be.platform.database.entities: src/modules/platform/database/entities.ts).
+  if (slot?.path === c.path) return null;
   if ([...(slot?.requires ?? []), ...(slot?.allows ?? [])].includes(base)) return null;
   const admitted = allowsFile(resolver, file);
   // Environment parsing is an app slot role, not a source suffix admitted outside that matching app file.
@@ -57,8 +59,8 @@ function sourceFormFinding(file, { c, base, suffixes, bannedSuffixes }, boundSuf
 }
 
 /**
- * BE_SOURCE_FORM (R89): every tracked src/ or apps/ TypeScript file of a back end is index.ts, main.ts, a migration of
- * be.persistence, the matching <app>.env.ts explicitly admitted by its app slot, or <kebab-name>.<suffix>.ts with <suffix> in the closed vocabulary ruleParams.be.suffixes (a name such
+ * BE_SOURCE_FORM (R89): every tracked src/ or apps/ TypeScript file of a back end is index.ts, main.ts, the one file a file
+ * slot names by its path (the lite entity registry src/modules/platform/database/entities.ts), a migration of be.persistence, the matching <app>.env.ts explicitly admitted by its app slot, or <kebab-name>.<suffix>.ts with <suffix> in the closed vocabulary ruleParams.be.suffixes (a name such
  * as order.service.spec.ts keeps its inner words kebab-case). A suffix of ruleParams.be.bannedSuffixes anywhere in the
  * name is refused by name. Paths no slot owns are HFS_SLOT_UNDECLARED's, not this code's.
  */

package/runtime/scripts/hfs/rules/deploy-workflow.mjs

@@ -160,6 +160,24 @@ function deploymentJobFindings(name, job, doc, refuse) {
   return findings;
 }
 
+const AGE_KEY_REFERENCE = /\$\{\{[^}]*\bsecrets\s*(?:\.\s*SOPS_AGE_KEY\b|\[\s*(['"])SOPS_AGE_KEY\1\s*\])/;
+const readsAgeKey = (value) => strings(value).some((text) => AGE_KEY_REFERENCE.test(text));
+
+/**
+ * A job that reads secrets.SOPS_AGE_KEY opens the members of one environment, so it is bound to that GitHub Environment, whose
+ * SOPS_AGE_KEY is the environment's server identity (PROJECT-STACKS-5/7); unbound, it would read a repository secret of that name.
+ * Disabled steps do not count. A deployment job is judged by deploymentJobFindings, which already requires its environment.
+ */
+function ageKeyJobFindings(doc, file, refuse) {
+  const deployment = new Set(deploymentJobs(doc, file).map(([name]) => name));
+  const workflowWide = readsAgeKey(doc.env);
+  const jobs = record(doc.jobs) ? Object.entries(doc.jobs).filter(([, job]) => record(job)) : [];
+  return jobs
+    .filter(([name, job]) => !deployment.has(name) && !validEnvironment(job.environment))
+    .filter(([, job]) => workflowWide || readsAgeKey({ env: job.env, with: job.with, secrets: job.secrets, steps: activeSteps(job).map((step) => ({ env: step.env, with: step.with, run: nonempty(step.run) ? executable(step.run) : undefined })) }))
+    .map(([name]) => refuse(DEPLOY, `job ${name} reads secrets.SOPS_AGE_KEY without an environment; bind it to the GitHub Environment whose members it opens (environment: <env>), which holds that environment's server key`));
+}
+
 function deploymentFindings(doc, file, refuse) {
   const deployment = deploymentJobs(doc, file);
   const named = deployName(file) || deployName(String(doc.name ?? ''));
@@ -216,7 +234,7 @@ function perWorkflow({ path: file, text }) {
   const refuse = (code, message) => found(code, file, `${code} ${file}: ${message}`);
   const doc = parseWorkflow(text);
   if (!record(doc)) return [refuse(TRIGGER, 'the workflow must be valid YAML with a release-only on block'), ...(deployName(file) ? [refuse(DEPLOY, 'the deploy workflow must be valid YAML')] : [])];
-  return [...triggerFindings(doc, refuse, file), ...deploymentFindings(doc, file, refuse), ...toolFindings(doc, refuse)];
+  return [...triggerFindings(doc, refuse, file), ...deploymentFindings(doc, file, refuse), ...ageKeyJobFindings(doc, file, refuse), ...toolFindings(doc, refuse)];
 }
 
 /** Synchronous R251 findings over the tracked workflows of a lite/full app. */

package/runtime/scripts/hfs/secret-sops.mjs

@@ -5,6 +5,8 @@ import { runProgram } from "../api/process/run-program.mjs";
 import { resolveRealTool } from "../api/process/resolve-real-tool.mjs";
 import { decrypt as sopsDecrypt } from "../api/sops/decrypt.mjs";
 import { seal as sopsSeal } from "../api/sops/seal.mjs";
+import { updateKeys as sopsUpdateKeys } from "../api/sops/update-keys.mjs";
+import { isLegacyName } from "../lib/sealed-member.mjs";
 import { invocationDir } from "../lib/roots.mjs";
 import { envelopeOf } from "./secret-document.mjs";
 import { configuredRecipients, localAgeIdentity, secretTools } from "./secret-init.mjs";
@@ -194,6 +196,19 @@ export function defaultSops(
         );
       return String(result.stdout);
     },
+    /**
+     * Wraps member `file` again to the recipients its environment's rule of the app's .sops.yaml names (sops updatekeys): the
+     * selected identity opens the data key only, no value is decrypted, nothing is printed.
+     */
+    updateKeys(file) {
+      const result = sopsUpdateKeys(
+        binary,
+        { file: path.resolve(file), config: path.join(path.resolve(repoRoot), ".sops.yaml"), inputType: isLegacyName(file) ? "dotenv" : "yaml" },
+        { env: selectedEnv, cwd: repoRoot, invocation },
+      );
+      if (result.status !== 0)
+        throw refuse(`update the keys of ${path.basename(file)}; is the age identity a recipient of it?`, result, file);
+    },
     seal(request) {
       const recipients = request.recipients.length
         ? request.recipients

package/runtime/scripts/hfs/secret-standard.mjs

@@ -86,6 +86,8 @@ export function auditSecrets(repoRoot, environment = null) {
       }
       if (tracked && !tracked.has(name)) add("UNTRACKED", "is not committed; commit it (it is ciphertext)");
     }
+    const drift = serverRecipientDrift(repoRoot, env, spec);
+    if (drift) findings.push({ code: "RECIPIENT_DRIFT", env, member: ".sops.yaml", detail: drift });
     for (const entry of Array.isArray(spec?.secrets) ? spec.secrets : []) {
       const member = entry?.member ?? /^secrets\/([a-z0-9-]+)/u.exec(entry?.where ?? "")?.[1];
       if (member && !fs.existsSync(fileOf(directory, member)))
@@ -165,6 +167,58 @@ export function declareKeys(repoRoot, environment, member, keys) {
   return { declared: missing, byHand: [] };
 }
 
+/**
+ * Records `recipient` as `environments.<environment>.deploy.remote.serverRecipient` of application-stacks.yaml: the public age
+ * recipient of the deploy server's own identity, which `starci app secret server-key` made on the server and audit holds the
+ * environment's rule to. Edits the text in place (comments and order kept), replacing the line or adding it as the last child of
+ * `remote:`, and proves the result parses to the expected document; a shape this edit cannot place is refused.
+ */
+export function recordServerRecipient(repoRoot, environment, recipient) {
+  const file = path.join(repoRoot, ".starcistacks", "application-stacks.yaml");
+  const text = fs.readFileSync(file, "utf8");
+  const document = parseYaml(text) ?? {};
+  const newline = text.includes("\r\n") ? "\r\n" : "\n";
+  const lines = text.replace(/\r\n/gu, "\n").split("\n");
+  const root = lines.findIndex((line) => /^environments:\s*(?:#.*)?$/u.test(line));
+  const envLine = root < 0 ? -1 : childLine(lines, blockOf(lines, root), environment);
+  const deploy = envLine < 0 ? -1 : childLine(lines, blockOf(lines, envLine), "deploy");
+  const remote = deploy < 0 ? -1 : childLine(lines, blockOf(lines, deploy), "remote");
+  const unplaced = new SecretError(`cannot record the server recipient in environments.${environment}.deploy.remote of application-stacks.yaml; add serverRecipient: ${recipient} there by hand`);
+  if (remote < 0 || !/^ *remote:\s*(?:#.*)?$/u.test(lines[remote])) throw unplaced;
+  const block = blockOf(lines, remote);
+  const own = childLine(lines, block, "serverRecipient");
+  const first = lines.slice(block.from, block.to).find(meaningful);
+  const pad = " ".repeat(first === undefined ? indentOf(lines[remote]) + 2 : indentOf(first));
+  if (own >= 0) lines[own] = `${pad}serverRecipient: ${recipient}`;
+  else lines.splice(block.to, 0, `${pad}serverRecipient: ${recipient}`);
+  const expected = structuredClone(document);
+  expected.environments[environment].deploy.remote.serverRecipient = recipient;
+  const edited = lines.join(newline);
+  let parsed;
+  try { parsed = parseYaml(edited); } catch { parsed = undefined; }
+  if (JSON.stringify(parsed) !== JSON.stringify(expected)) throw unplaced;
+  if (edited !== text) fs.writeFileSync(file, edited);
+}
+
+/**
+ * The RECIPIENT_DRIFT of an environment's rule against its deploy server: a rule that does not name the recorded
+ * `deploy.remote.serverRecipient` together with another recipient (the owner key), or a production swarm deploy with a remote
+ * and no server recipient recorded. Null when the rule holds.
+ */
+function serverRecipientDrift(repoRoot, env, spec) {
+  const remote = spec?.deploy?.remote;
+  if (!remote || typeof remote !== "object") return null;
+  const server = remote.serverRecipient;
+  if (server === undefined)
+    return env === "production" && spec.runtime === "docker-swarm"
+      ? `records no deploy server recipient; production is sealed to the server key and the owner key: starci app secret server-key ${env} --execute`
+      : null;
+  const rule = recipientsFor(repoRoot, path.join(repoRoot, ".starcistacks", env, "secrets", `member${MEMBER_SUFFIX}`));
+  if (!rule.includes(server)) return `its rule names ${keyList(rule) || "no recipient"}, not the deploy server recipient ${server}; run starci app secret server-key ${env} --execute`;
+  if (rule.length < 2) return `its rule names only the deploy server recipient ${server}; add the owner key: starci app secret recipients ${env} --add owner, then starci app secret server-key ${env} --execute`;
+  return null;
+}
+
 /** `starci app secret audit [<env>]`: each deviation on its own line and exit 1, else one clean line and exit 0. */
 export function printAudit(repoRoot, environment, stdout) {
   const findings = auditSecrets(repoRoot, environment);

package/runtime/scripts/hfs/secret.mjs

@@ -5,6 +5,7 @@
 // Every verb runs at the app root or --cwd. Exit 0 done, 2 refusal; --reveal is the only plaintext stdout path.
 // unset, rename and remove edit one sealed member and are dry runs until --execute (scripts/hfs/secret-edit.mjs).
 // verify decrypts each member in memory and names only keys and violated shapes, never a value (R249).
+// server-key makes the deploy server's own age identity on the server and seals the environment to it (stack/server-key.mjs).
 import fs from "node:fs";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
@@ -19,11 +20,14 @@ import { SecretError, publicStorage, secretErrorMessage } from "./secret-errors.
 import { editSecret, validateEditNames } from "./secret-edit.mjs";
 import { verifySecrets } from "./rules/env-value-shape.mjs";
 import { setValues } from "./secret-prompt.mjs";
+import { stackContext } from "../../../stack/context.mjs";
+import { StackError } from "../../../stack/errors.mjs";
+import { serverKey } from "../../../stack/server-key.mjs";
 
 export { envelopeOf, formatOf, plaintextOf } from "./secret-document.mjs";
 export { setSecretValues } from "./secret-store.mjs";
 
-const VERBS = new Set(["init", "list", "get", "set", "unset", "rename", "remove", "materialize", "verify", "recipients", "migrate", "split", "audit"]);
+const VERBS = new Set(["init", "list", "get", "set", "unset", "rename", "remove", "materialize", "verify", "recipients", "migrate", "split", "audit", "server-key"]);
 const MOVE_VERBS = new Set(["migrate", "split"]);
 const LIST_FLAGS = ["--add", "--remove", "--from-file", "--group"];
 const EDIT_VERBS = new Set(["unset", "rename", "remove"]);
@@ -45,9 +49,9 @@ function parse(argv) {
       const value = inline ?? argv[++i];
       if (value === undefined || value.startsWith("--")) throw new SecretError(`${flag} needs a value`);
       (opts[flag.slice(2)] ??= []).push(value);
-    } else if (["--cwd", "--generate", "--to", "--group-file"].includes(flag)) {
+    } else if (["--cwd", "--generate", "--to", "--group-file", "--backup", "--restore"].includes(flag)) {
       valueOption(opts, flag, inline ?? argv[++i]);
-    } else if (["--to-file", "--reveal", "--execute", "--force-nonempty", "--into-existing"].includes(flag)) {
+    } else if (["--to-file", "--reveal", "--execute", "--force-nonempty", "--into-existing", "--rotate"].includes(flag)) {
       if (inline !== undefined && !["true", "false"].includes(inline))
         throw new SecretError(`${flag} expects true or false`);
       opts[flag.slice(2)] = inline !== "false";
@@ -69,12 +73,15 @@ function usageArguments(verb) {
   if (verb === "migrate") return "<env> <slug> [--to <slug>] [--into-existing] [--execute]";
   if (verb === "split") return "<env> <slug> [--group KEY=member ...] [--group-file <yaml>] [--into-existing] [--execute]";
   if (verb === "audit") return "[<env>]";
+  if (verb === "server-key") return "<env> [--rotate | --backup github | --restore github] [--execute]";
   return "<env>";
 }
 
 function editOptionsFor(verb, opts) {
-  if (opts.execute !== undefined && !EDIT_VERBS.has(verb) && !MOVE_VERBS.has(verb))
-    throw new SecretError("--execute is only valid for unset, rename, remove, migrate and split");
+  if (opts.execute !== undefined && !EDIT_VERBS.has(verb) && !MOVE_VERBS.has(verb) && verb !== "server-key")
+    throw new SecretError("--execute is only valid for unset, rename, remove, migrate, split and server-key");
+  if ((opts.rotate !== undefined || opts.backup !== undefined || opts.restore !== undefined) && verb !== "server-key")
+    throw new SecretError("--rotate, --backup and --restore are only valid for server-key");
   if (opts.to !== undefined && verb !== "migrate") throw new SecretError("--to is only valid for migrate");
   if ((opts.group || opts["group-file"] !== undefined) && verb !== "split") throw new SecretError("--group and --group-file are only valid for split");
   if (opts["into-existing"] !== undefined && !MOVE_VERBS.has(verb)) throw new SecretError("--into-existing is only valid for migrate and split");
@@ -110,6 +117,7 @@ function optionsFor(verb, opts) {
     migrate: [2, 2],
     split: [2, 2],
     audit: [0, 1],
+    "server-key": [1, 1],
   }[verb];
   if (count < bounds[0] || count > bounds[1])
     throw new SecretError(
@@ -173,6 +181,22 @@ function sealedLine(environment, slug, keys, file, created, seam) {
   return `${head}; a new member: adding keys to it later needs the age identity${of}${held}\n`;
 }
 
+/** `server-key`: the deploy server's identity through the stack transport (`serverKeyIo`: { io, deps } of the specs), lines out. */
+async function serverKeyVerb(repoRoot, environment, opts, { env, stdout, stderr, open, serverKeyIo }) {
+  const ctx = stackContext({ cwd: repoRoot, env, stdout, stderr, openSops: open, ...serverKeyIo.io });
+  try {
+    const result = await serverKey(ctx, environment, {
+      execute: opts.execute === true, rotate: opts.rotate === true, backup: opts.backup, restore: opts.restore,
+    }, serverKeyIo.deps ?? {});
+    for (const line of result.lines) stdout(`${line}\n`);
+    return result.ok ? 0 : 1;
+  } catch (error) {
+    if (!(error instanceof StackError)) throw error;
+    stderr(`starci app secret: ${error.message}\n`);
+    return error.exit;
+  }
+}
+
 /**
  * All app secrets verbs; stdin, prompt, sops, random and tool ports permit isolated custody specs. `hostIdentity`
  * (`{ label, read }`) is the harness CLI's secret.env SOPS_AGE_KEY, the last place before keys.txt the age identity is looked for.
@@ -191,13 +215,14 @@ export async function secretMain(
     cwd = invocationDir(),
     platform = process.platform,
     tools,
+    serverKeyIo = {},
   } = {},
 ) {
   const [verb, ...rest] = argv;
   try {
     if (!VERBS.has(verb))
       throw new SecretError(
-        "usage: starci app secret init | set <env> <slug> <KEY> [KEY ...] | get <env> <slug> [KEY] --to-file | unset <env> <slug> <KEY> | rename <env> <slug> <OLD> <NEW> | remove <env> <slug> | materialize <env> | list <env> | verify <env> | recipients <env> | migrate <env> <slug> [--to <slug>] [--into-existing] | split <env> <slug> [--group KEY=member] [--group-file <yaml>] [--into-existing] | audit [<env>]",
+        "usage: starci app secret init | set <env> <slug> <KEY> [KEY ...] | get <env> <slug> [KEY] --to-file | unset <env> <slug> <KEY> | rename <env> <slug> <OLD> <NEW> | remove <env> <slug> | materialize <env> | list <env> | verify <env> | recipients <env> | migrate <env> <slug> [--to <slug>] [--into-existing] | split <env> <slug> [--group KEY=member] [--group-file <yaml>] [--into-existing] | audit [<env>] | server-key <env> [--rotate | --backup github | --restore github] [--execute]",
       );
     const opts = parse(rest);
     optionsFor(verb, opts);
@@ -215,6 +240,11 @@ export async function secretMain(
         }),
       );
     const [environment, slug, key] = opts.positional;
+    if (verb === "server-key")
+      return await serverKeyVerb(repoRoot, environment, opts, {
+        env, stdout, stderr, serverKeyIo,
+        open: () => sops ?? defaultSops(env, repoRoot, platform, tools, hostIdentity),
+      });
     const directory = secretsDirectory(repoRoot, environment);
     if (verb === "list") return listSecrets(directory, stdout);
     const open = () => sops ?? defaultSops(env, repoRoot, platform, tools, hostIdentity);

package/runtime/scripts/hfs/stack-deploy-config.mjs

@@ -13,6 +13,7 @@ export const KEY = /^[A-Z][A-Z0-9_]*$/u;
 const VOLUME = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/u;
 const HOST_ALIAS = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u;
 const REMOTE_BASE = /^\/[A-Za-z0-9._/-]+$/u;
+const AGE_RECIPIENT = /^age1[a-z0-9]+$/u;
 const HTTP_URL = /^https?:\/\/[^\s]+$/u;
 const PINNED_HELPER_IMAGE = /^[a-z0-9./_-]+(?::[A-Za-z0-9._-]+)?@sha256:(?!0{64}$)[0-9a-f]{64}$/u;
 const ARGUMENT = /^[A-Za-z0-9_@%+=:,./-]+$/u;
@@ -20,7 +21,7 @@ const UPPER_ENV = KEY;
 
 const FIELDS = {
   deploy: ['stack', 'remote', 'images', 'volumes', 'secrets', 'environment', 'configs', 'passEnv', 'postDeploy', 'verify', 'jobs', 'tasks', 'backup', 'ingress', 'registry'],
-  remote: ['host', 'releasesBase', 'sealed'],
+  remote: ['host', 'releasesBase', 'sealed', 'serverRecipient'],
   sealed: ['ops', 'sshKey', 'knownHosts'],
   image: ['app', 'buildArgs'],
   buildArgs: ['values', 'sealed'],
@@ -51,9 +52,15 @@ function stringList(c, at, value, itemPattern, { nonEmpty = false } = {}) {
   return value;
 }
 
+/**
+ * `deploy.remote`: the ssh alias, the releases root, the sealed owner-machine session and `serverRecipient`, the public age
+ * recipient of the server's own identity that `starci app secret server-key` records.
+ */
 function remote(c, block) {
-  if (block === undefined) return { host: 'vps', releasesBase: null, sealed: null };
-  if (!closedFields(c, 'deploy.remote', block, FIELDS.remote)) return { host: 'vps', releasesBase: null, sealed: null };
+  const fallback = { host: 'vps', releasesBase: null, sealed: null, serverRecipient: null };
+  if (block === undefined) return fallback;
+  if (!closedFields(c, 'deploy.remote', block, FIELDS.remote)) return fallback;
+  if (block.serverRecipient !== undefined) patternField(c, 'deploy.remote.serverRecipient', block.serverRecipient, AGE_RECIPIENT);
   if (block.host !== undefined) nameField(c, 'deploy.remote.host', block.host, HOST_ALIAS);
   if (block.releasesBase !== undefined && (!REMOTE_BASE.test(String(block.releasesBase)) || String(block.releasesBase).includes('..')))
     c.problem('deploy.remote.releasesBase', 'must be an absolute path without ..');
@@ -62,7 +69,7 @@ function remote(c, block) {
     for (const key of FIELDS.sealed) nameField(c, `deploy.remote.sealed.${key}`, block.sealed[key]);
     sealed = { ...block.sealed };
   }
-  return { host: block.host ?? 'vps', releasesBase: block.releasesBase ?? null, sealed };
+  return { host: block.host ?? 'vps', releasesBase: block.releasesBase ?? null, sealed, serverRecipient: block.serverRecipient ?? null };
 }
 
 function imageBuildArgs(c, at, block, members) {

package/scaffold/add-inbox-lite.mjs

@@ -233,17 +233,13 @@ export function addLiteWebhookInbox({
   );
   if (!hasHandoffStorage)
     planned[0].text = `${template("platform/migration.sql.tpl", renderValues)}\n${template("platform/client-operation-outcomes.sql.tpl", renderValues)}\n${planned[0].text}`;
-  const databaseSql = "be/src/modules/platform/database/database.sql.ts";
-  if (!fs.existsSync(path.join(root, ...databaseSql.split("/")))) {
+  // The sql tag and the database-function call (with its spec) the inbox and the event bus use; the lite starter leaves them out.
+  for (const file of ["database.sql.ts", "database.client.ts", "database.client.spec.ts"]) {
+    const relative = `be/src/modules/platform/database/${file}`;
+    if (fs.existsSync(path.join(root, ...relative.split("/")))) continue;
     planned.push({
-      relative: databaseSql,
-      text: render(
-        fs.readFileSync(
-          path.join(TEMPLATES_DIR, "be", "skeleton-lite", "src", "modules", "platform", "database", "database.sql.ts"),
-          "utf8",
-        ),
-        {},
-      ),
+      relative,
+      text: render(fs.readFileSync(path.join(TEMPLATES_DIR, "be", "skeleton-lite", "src", "modules", "platform", "database", file), "utf8"), {}),
     });
   }
   const databaseClient = path.join(