@starci/hfs 4.2.17 → 4.3.0

package/runtime/scripts/hfs/check.mjs

@@ -16,7 +16,7 @@
 //   HFS_SLOT_REQUIRED_MISSING     a file or directory a required slot (or an instance of one) must contain
 //   HFS_MIN_INSTANCES             fewer instances of a slot than minInstances
 //   HFS_PLAINTEXT_SECRET          (R06, rules/secrets.mjs) a plaintext secret file or value in a tracked file; a `.enc` that is no sops envelope
-//   HFS_STACKS_SHAPE              (R10, rules/stacks.mjs) a `.starcistacks` path outside the standard shape, or a Sonar owner that is not the host
+//   HFS_STACKS_SHAPE              (R10, rules/stacks.mjs) invalid stack shape, Swarm runtime policy, host crontab installation or lite backing duplication
 //   HFS_CI_MISSING_CANON          (R13, rules/pipeline.mjs) CI without the pinned `starci app check`, pre-push without typecheck or lint
 //   HFS_DEP_VERSION_SKEW          (R14, rules/deps.mjs) a dependency at two versions in the workspace, or a nested copy in the lockfile
 //   HFS_CONTRACT_SNAPSHOT_DRIFT   (R23, rules/contract.mjs) an uncommitted back-end snapshot, or a front-end copy that differs from it
@@ -25,7 +25,7 @@
 //   FE_STACK_FORBIDDEN            (rules/fe-stack.mjs) a front-end manifest (the fe side's, or the app root's minus the back end's own libraries)
 //                                 declares a package knowledge/hfs/fe-stack.yaml forbids
 //   HFS_LITE_SECRET_CUSTODY       (R220, rules/supabase-secrets.mjs) under edition lite: secret material or a forbidden custody path; the R06 scan itself runs for every edition
-//   HFS_EDITION_FORBIDDEN_PRESENT (R212, rules/edition.mjs) under edition lite: an e2e, contract, stack or browser script, or a
+//   HFS_EDITION_FORBIDDEN_PRESENT (R212, rules/edition.mjs) under edition lite: an e2e, contract, test-stack or browser script, or a
 //                                 dependency of self-hosted infrastructure (test containers, fault proxy, BullMQ, Kafka, Redis)
 //   DB_MIGRATION_SHAPE ... DB_TYPES_DRIFT (R213-R216, rules/database.mjs, async: passed in as extraFindings) the Supabase migrations, policies, definer functions, buckets, config.toml and generated types
 //   BE_SPEC_PLACEMENT             (R102, rules/spec-placement.mjs) a spec or test file outside the four test layers, scripts/ and tools/ included
@@ -67,14 +67,15 @@ import { diff as gitDiff } from '../api/git/diff.mjs';
 import { mergeBase } from '../api/git/merge-base.mjs';
 import { gitOutputOf } from '../lib/git.mjs';
 import { posixPath } from '../lib/path-key.mjs';
-import { readTree, treeFacts, untrackedEntries } from './tree.mjs';
+import { treeFindings } from './tree-findings.mjs';
 import { contractFindings } from './rules/contract.mjs';
 import { appRootFindings } from './rules/app-root.mjs';
 import { frontendFindings } from './rules/frontend-tree.mjs';
 import { lintSuppressionFindings } from './rules/lint-suppression.mjs';
 import { repoLocalCheckFindings } from './rules/repo-local-checks.mjs';
 import { supabaseSecretFindings } from './rules/supabase-secrets.mjs';
-import { pathFindings } from './path-findings.mjs';
+import { untrackedSecretFindings } from './rules/secrets.mjs';
+import { liteStarciworkFinding, pathFindings } from './path-findings.mjs';
 import { onLintSurface } from './architecture/surface.mjs';
 import { checkAppRoot, trackedTreeView } from './architecture/hfs.mjs';
 import { testTopologyFindings } from './rules/test-topology.mjs';
@@ -83,6 +84,7 @@ import { editionFindings } from './rules/edition.mjs';
 import { feStackFindings } from './rules/fe-stack.mjs';
 import { byCodeUnit } from '../lib/list.mjs';
 import { pinFindings } from './pin-findings.mjs';
+import { requiredFileApplies } from './slot-required.mjs';
 // The database rules (R213-R216) read SQL through a WASM parser, so they are async: `starci app check` calls them beside the other emitters and passes the findings in as `extraFindings`.
 export { checkDatabase } from './rules/database.mjs';
 
@@ -103,7 +105,7 @@ export const CHECK_CODES = Object.freeze([
   'HFS_MANAGED_FILE_DRIFT', 'HFS_TOOL_CONFIG_LOCAL', 'HFS_RULE_OFF_WITHOUT_REPLACEMENT', 'HFS_TS_STRICT',
   'HFS_PLAINTEXT_SECRET', 'HFS_STACKS_SHAPE', 'HFS_CI_MISSING_CANON', 'HFS_DEP_VERSION_SKEW', 'HFS_CONTRACT_SNAPSHOT_DRIFT',
   'BE_TEST_TOPOLOGY', 'BE_SPEC_PLACEMENT', 'HFS_REPO_LOCAL_CHECK', 'HFS_LINT_SUPPRESSION_FILE', 'HFS_PROOF_COMMAND_FILE_MISSING', 'HFS_PEER_INTEGRATION_MISSING', 'BE_INTEGRATION_SPEC_MISSING', 'FE_GRAPHQL_CONTRACT', 'FE_NO_TESTS', 'HFS_MONO_WORKSPACES', 'HFS_MONO_FE_WORKSPACE', 'HFS_MONO_NEST_PROJECTS', 'HFS_MONO_WORKSPACE_DEP', 'BE_CLI_REQUIRED', 'FE_WIRE_GENERATED', 'FE_I18N_PLACEMENT', 'FE_I18N_CATALOG', 'HFS_SERVICE_PLACEMENT', 'HFS_IMAGE_UNPINNED', 'HFS_SERVICE_STACK_DECLARATION', 'HFS_EVENT_CONTRACT', 'BE_ASYNC_SPEC_MISSING', 'BE_SAGA_STEP_COMPENSATION', 'BE_SAGA_STATE_VERSIONED', 'BE_SAGA_EVENT_CONTRACT', 'BE_SAGA_CONSUMER_DEDUPE', 'BE_EVENT_CLASS_CONTRACT', 'BE_PATTERN_SPEC_MISSING', 'BE_CONTRACT_BREAKING', 'BE_KIND_DECLARATION', 'BE_KIND_EMPTY', 'HFS_DOCKER_BUILD_CONTEXT', 'HFS_DOCKER_STAGES', 'HFS_DOCKER_ENTRY', 'HFS_DOCKER_BASE_PIN', 'HFS_DOCKER_SECRETS', 'BE_SAGA_E2E_MISSING',
-  'FE_STACK_FORBIDDEN', 'HFS_EDITION_FORBIDDEN_PRESENT', 'HFS_LITE_SECRET_CUSTODY',
+  'FE_STACK_FORBIDDEN', 'HFS_EDITION_FORBIDDEN_PRESENT', 'HFS_LITE_SECRET_CUSTODY', 'HFS_STARCIWORK_LITE_FORBIDDEN',
   'DB_MIGRATION_SHAPE', 'DB_RLS_REQUIRED', 'DB_DYNAMIC_DDL', 'DB_POLICY_SHAPE', 'DB_DEFINER_SAFE', 'DB_STORAGE_POLICY', 'DB_CONFIG_POLICY', 'DB_TYPES_DRIFT',
   'HFS_GITIGNORE_BLOCK_DRIFT', 'HFS_SONAR_CONFIG', 'HFS_COVERAGE_SCOPE_DRIFT', 'HFS_FORMAT',
   'HFS_EMPTY_DIR', 'HFS_GHOST_TREE', 'HFS_UNTRACKED_ROOT_ENTRY',
@@ -182,6 +184,7 @@ function summarize(findings) {
   }
   return {
     error: findings.filter((f) => f.level === 'error').length,
+    warning: findings.filter((f) => f.level === 'warning').length,
     info: findings.filter((f) => f.level === 'info').length,
     byCode,
   };
@@ -197,25 +200,6 @@ function judgedFindings(findings, edition, root) {
   return findings.filter((finding) => catalog.judgedIn(finding.code, edition));
 }
 
-/** The tree findings of R03: empty directories, ghost siblings, untracked entries outside an ignored slot. */
-function treeFindings({ repoRoot, resolver }) {
-  const inIgnoredSlot = (rel) => resolver.classifyPath(`${rel}/.probe`).tracking === 'ignored';
-  const findings = [];
-  const facts = treeFacts(readTree(repoRoot, { isIgnored: inIgnoredSlot }));
-  for (const { path: dir, below } of facts.empty) {
-    findings.push({ code: 'HFS_EMPTY_DIR', level: 'error', path: dir, below, message: `${dir} has no file below it` + (below ? ` (nor in its ${below} sub-director${below === 1 && 'y' || 'ies'})` : '') + '; git tracks no empty directory, so it is a leftover' });
-  }
-  for (const { path: dir, of, distance } of facts.ghosts) {
-    findings.push({ code: 'HFS_GHOST_TREE', level: 'error', path: dir, of, distance, message: `${dir} is empty and ${distance} edit${distance === 1 ? '' : 's'} from its sibling ${of}: a renamed or misspelt structure that was never removed` });
-  }
-  for (const entry of untrackedEntries(repoRoot)) {
-    const bare = entry.replace(/\/$/, '');
-    const ignored = entry.endsWith('/') ? inIgnoredSlot(bare) : resolver.classifyPath(bare).tracking === 'ignored';
-    if (!ignored) findings.push({ code: 'HFS_UNTRACKED_ROOT_ENTRY', level: 'error', path: bare, message: `${entry} is neither tracked nor git-ignored, and no ignored slot owns it` });
-  }
-  return findings;
-}
-
 /** A side-relative path (or null) as an app-relative one. */
 const onSide = (side, p) => (p ? path.posix.normalize(`${side}/${p}`) : p);
 
@@ -223,7 +207,7 @@ function appendRequiredPathFindings(findings, resolver, files, required, present
   const missing = new Set();
   const missingFile = (slot, p, via) => {
     const key = `${slot}|${p}`;
-    if (missing.has(key) || present(p)) return;
+    if (missing.has(key) || present(p) || !requiredFileApplies(slot, p, files)) return;
     missing.add(key);
     const app = appOf(p);
     const appNote = app ? ` (app ${app})` : '';
@@ -347,7 +331,9 @@ export function checkRepo({ repoRoot, root = skillRoot, declaration, files, only
     findings.push(...keep(scopeFindings({ repoRoot, root, repo, resolver, files: tracked, scoped, manifest }), repoRoot));
   }
   findings.push(...extraFindings);
-  if (tree) findings.push(...treeFindings({ repoRoot, resolver }));
+  const untrackedSecrets = untrackedSecretFindings({ repoRoot, files: tracked, repo });
+  findings.push(...untrackedSecrets);
+  if (tree) findings.push(...treeFindings({ repoRoot, resolver, tracked, reportedUntracked: new Set(untrackedSecrets.map((finding) => finding.path)) }));
 
   // The app-root tree check reports machine codes: their why is read with the check's own.
   const judged = judgedFindings(findings, repo.edition ?? 'full', root);
@@ -461,6 +447,12 @@ export function explainPath({ repoRoot, input, root = skillRoot, declaration, ma
   const resolver = createSlotResolver(manifest, repo);
   const why = readWhy(root);
   const c = resolver.classifyPath(input);
+  const dir = /[\\/]$/.test(input) || (repoRoot && fs.existsSync(path.join(repoRoot, c.path)) && fs.statSync(path.join(repoRoot, c.path)).isDirectory());
+  const liteWork = liteStarciworkFinding(c.path, resolver, { dir });
+  if (liteWork) {
+    const entry = why[liteWork.code];
+    return { ...c, ...liteWork, status: 'forbidden', titleVi: entry.titleVi, whyVi: entry.whyVi };
+  }
   if (c.status === 'no-slot') {
     return { path: c.path, status: 'no-slot', code: 'HFS_SLOT_UNDECLARED', nearest: c.nearest, titleVi: why.HFS_SLOT_UNDECLARED.titleVi, whyVi: why.HFS_SLOT_UNDECLARED.whyVi };
   }

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -323,6 +323,12 @@ function runtimeParamProblems(rp) {
   ];
 }
 
+const folderKindsValid = list => strList(list) && list.length > 0 && new Set(list).size === list.length && list.every(kind => NAME.test(kind));
+const kindPairValid = pair => isPlainObject(pair) && Object.keys(pair).sort(byCodeUnit).join() === 'from,to'
+  && ['from', 'to'].every(side => folderKindsValid(pair[side]));
+const kindRestrictionValid = kinds => isPlainObject(kinds) && Object.keys(kinds).length > 0
+  && Object.entries(kinds).every(([target, pair]) => NAME.test(target) && kindPairValid(pair));
+
 /** Shape problems of the tier map of one profile. */
 export function tierMapProblems(profile, tiers) {
   const bad = [];
@@ -330,14 +336,33 @@ export function tierMapProblems(profile, tiers) {
   for (const [tier, def] of Object.entries(tiers)) {
     if (!NAME.test(tier)) bad.push(`tiers.${profile}.${tier} is not a tier name`);
     if (!isPlainObject(def) || !Array.isArray(def.mayImport) || !def.mayImport.every((t) => NAME.test(String(t)))) bad.push(`tiers.${profile}.${tier}.mayImport must be a list of tier names`);
-    for (const key of Object.keys(def ?? {})) if (!['mayImport', 'acyclic', 'lowerLayerOnly'].includes(key)) bad.push(`tiers.${profile}.${tier}.${key} is not a tier field`);
+    if (def?.mayImportKinds !== undefined && !kindRestrictionValid(def.mayImportKinds)) bad.push(`tiers.${profile}.${tier}.mayImportKinds must map tier names to {from, to} non-empty lists of unique folder kinds`);
+    for (const key of Object.keys(def ?? {})) if (!['mayImport', 'mayImportKinds', 'acyclic', 'lowerLayerOnly'].includes(key)) bad.push(`tiers.${profile}.${tier}.${key} is not a tier field`);
+  }
+  return bad;
+}
+
+function tierFolderKindProblems(manifest, profile, tier, kinds, at) {
+  const known = new Set(manifest.slots.filter((slot) => slot.profiles.includes(profile) && slot.tier === tier).flatMap((slot) => [...(slot.kinds ?? []), ...(slot.layers ?? [])]));
+  return kinds.filter(kind => !known.has(kind)).map(kind => `${at} names ${kind}, which is not a folder kind of the ${tier} tier`);
+}
+
+/** Kind restrictions narrow an allowed tier edge and name kinds that its source and target slots actually declare. */
+export function tierKindProblems(manifest, profile) {
+  const bad = [];
+  for (const [tier, def] of Object.entries(manifest.tiers[profile])) {
+    for (const [target, kinds] of Object.entries(def.mayImportKinds ?? {})) {
+      const at = `tiers.${profile}.${tier}.mayImportKinds.${target}`;
+      if (!def.mayImport.includes(target)) bad.push(`${at} restricts a tier that mayImport does not allow`);
+      bad.push(...tierFolderKindProblems(manifest, profile, tier, kinds.from, `${at}.from`), ...tierFolderKindProblems(manifest, profile, target, kinds.to, `${at}.to`));
+    }
   }
   return bad;
 }
 
 /** The semantic rules of a runtime manifest beyond the slot rules both kinds share: tier names and the schema major. */
 export function runtimeSemanticProblems(m) {
-  const bad = [];
+  const bad = tierKindProblems(m, RUNTIME_KIND);
   const tiers = m.tiers.runtime;
   for (const [tier, def] of Object.entries(tiers)) {
     for (const target of def.mayImport) if (!(target in tiers)) bad.push(`tiers.runtime.${tier}.mayImport names ${target}, which is not a runtime tier`);

package/runtime/scripts/hfs/path-findings.mjs

@@ -3,6 +3,7 @@
 // (scripts/hfs/project-graph.mjs) runs it over the same tree and serves the findings on a TypeScript file as ESLint reports.
 //   HFS_SLOT_UNDECLARED / HFS_SLOT_AMBIGUOUS / HFS_SLOT_NOT_ENABLED / HFS_FORBIDDEN_PRESENT / HFS_TOOL_CONFIG_LOCAL / HFS_TRACKED_MUST_BE_IGNORED (R01, R16)
 //   BE_SOURCE_FORM (R89, the file name), BE_SPEC_PLACEMENT (R102)
+import fs from 'node:fs';
 import path from 'node:path';
 import { allowsFile } from './allows.mjs';
 import { isFeTestPath } from './rules/fe-no-tests.mjs';
@@ -30,8 +31,11 @@ function sourceFormContext(file, resolver, suffixes, bannedSuffixes) {
   const slot = resolver.slot(c.slot);
   if ([...(slot?.requires ?? []), ...(slot?.allows ?? [])].includes(base)) return null;
   const admitted = allowsFile(resolver, file);
+  // Environment parsing is an app slot role, not a source suffix admitted outside that matching app file.
+  if (c.slot.startsWith('be.app.') && admitted?.allowed && admitted.entry === '<app>.env.ts') return null;
   if (admitted?.allowed && admitted.entry?.includes('/') && path.posix.basename(admitted.entry) === base) return null;
-  if (admitted?.allowed && PLAIN_ENTRY.test(admitted.entry ?? '') && KEBAB.test(base.slice(0, -'.ts'.length))) return null;
+  // A plain entry names its file by a variable only (`<x>.ts`, or `compose/<area>.ts` of an app slot): a kebab name is its form.
+  if (admitted?.allowed && PLAIN_ENTRY.test(path.posix.basename(admitted.entry ?? '')) && KEBAB.test(base.slice(0, -'.ts'.length))) return null;
   if (c.slot === 'be.persistence' && path.posix.basename(path.posix.dirname(file)) === 'migrations') return null;
   return { c, base, suffixes, bannedSuffixes };
 }
@@ -54,7 +58,7 @@ function sourceFormFinding(file, { c, base, suffixes, bannedSuffixes }, boundSuf
 
 /**
  * BE_SOURCE_FORM (R89): every tracked src/ or apps/ TypeScript file of a back end is index.ts, main.ts, a migration of
- * be.persistence, or <kebab-name>.<suffix>.ts with <suffix> in the closed vocabulary ruleParams.be.suffixes (a name such
+ * be.persistence, the matching <app>.env.ts explicitly admitted by its app slot, or <kebab-name>.<suffix>.ts with <suffix> in the closed vocabulary ruleParams.be.suffixes (a name such
  * as order.service.spec.ts keeps its inner words kebab-case). A suffix of ruleParams.be.bannedSuffixes anywhere in the
  * name is refused by name. Paths no slot owns are HFS_SLOT_UNDECLARED's, not this code's.
  */
@@ -86,6 +90,8 @@ function forbiddenPathFinding(file, c, resolver) {
 }
 
 function pathStatusFinding(file, resolver) {
+  const liteWork = liteStarciworkFinding(file, resolver);
+  if (liteWork) return liteWork;
   const c = resolver.classifyPath(file);
   if (c.status === 'no-slot') {
     const nearestNote = c.nearest ? `; nearest slot ${c.nearest.slot} (${c.nearest.pattern}), matched ${c.nearest.matchedPrefix || '.'} then expected ${c.nearest.expectedNext ?? 'nothing'}` : '';
@@ -98,6 +104,30 @@ function pathStatusFinding(file, resolver) {
   return null;
 }
 
+/** The lite Work boundary, read from app.starciwork's edition-specific admission list, including paths a narrower slot owns. */
+export function liteStarciworkFinding(file, resolver, { dir = false } = {}) {
+  if (resolver.repo?.edition !== 'lite' || !resolver.slot('app.starciwork')) return null;
+  const p = resolver.classifyPath(file).path;
+  if (!p.startsWith('.starciwork/')) return null;
+  const admitted = allowsFile(resolver, dir ? `${p}/.probe` : p);
+  if (admitted?.slot === 'app.starciwork' && admitted.allowed) return null;
+  return { code: 'HFS_STARCIWORK_LITE_FORBIDDEN', level: 'error', path: p, slot: 'app.starciwork', message: `${p}: lite .starciwork holds only workspace.yaml and brand/ (plus .gitignore); remove this path or use the full edition` };
+}
+
+/** Local lite Work leftovers, including metadata ignored by an old full-edition .gitignore. */
+export function liteStarciworkTreeFindings(repoRoot, resolver, tracked) {
+  if (resolver.repo?.edition !== 'lite' || !resolver.slot('app.starciwork')) return [];
+  let entries = [];
+  try { entries = fs.readdirSync(path.join(repoRoot, '.starciwork'), { withFileTypes: true }); } catch { /* Work is optional. */ }
+  const trackedSet = new Set(tracked);
+  return entries.flatMap(entry => {
+    const file = `.starciwork/${entry.name}`;
+    if (trackedSet.has(file)) return [];
+    const finding = liteStarciworkFinding(file, resolver, { dir: entry.isDirectory() });
+    return finding ? [finding] : [];
+  });
+}
+
 /** The findings of the slot manifest over `files` (repository-relative tracked paths) of a repository of `profile`. */
 export function pathFindings({ files, resolver, profile }) {
   const findings = [];

package/runtime/scripts/hfs/rules/database-migrations.mjs

@@ -1,7 +1,6 @@
 // database-migrations.mjs - L02 migration name, UTC ordering and base-branch immutability checks. Git reads go
 // through the runtime API call files, and specs may inject the same small runner contract used by database.mjs.
 import { lsTree } from '../../api/git/ls-tree.mjs';
-import { log } from '../../api/git/log.mjs';
 import { mergeBase } from '../../api/git/merge-base.mjs';
 import { show } from '../../api/git/show.mjs';
 import { withoutGitLocalEnv } from '../../lib/git.mjs';
@@ -27,7 +26,6 @@ export function defaultGit(args, { cwd }) {
   if (verb === 'merge-base') { const sha = mergeBase(cwd, rest[0], rest[1]); return { ok: sha !== null, stdout: sha ?? '' }; }
   let call = show;
   if (verb === 'ls-tree') call = lsTree;
-  else if (verb === 'log') call = log;
   const result = call(rest, { cwd, env, maxBuffer: 64 * 1024 * 1024 });
   return { ok: !result.error && result.status === 0, stdout: result.stdout };
 }
@@ -45,11 +43,11 @@ async function baseShaOf(git, repoRoot, base) {
   return found;
 }
 
-async function baseMigrationNames(git, repoRoot, sha) {
+async function migrationFilesAt(git, repoRoot, sha) {
   const result = await runGit(git, repoRoot, ['ls-tree', '-r', '--name-only', '-z', sha, '--', MIGRATIONS_DIR]);
   if (!result.ok) return [];
   const prefix = `${MIGRATIONS_DIR}/`;
-  return result.stdout.split('\0').filter(Boolean).filter(isActiveMigration).map((entry) => entry.slice(prefix.length));
+  return result.stdout.split('\0').filter((entry) => entry.startsWith(prefix));
 }
 
 async function baseFileText(git, repoRoot, sha, file) {
@@ -58,46 +56,48 @@ async function baseFileText(git, repoRoot, sha, file) {
   return result.ok ? result.stdout : null;
 }
 
-async function migrationTimeLimit(git, repoRoot, file, now) {
-  const result = await runGit(git, repoRoot, ['log', '-1', '--format=%ct', '--', file]);
-  const seconds = Number(result.stdout.trim());
-  if (result.ok && Number.isFinite(seconds) && seconds > 0) return { at: seconds * 1000, tracked: true };
-  return { at: now(), tracked: false };
-}
-
-async function localMigrationFindings(local, repoRoot, git, now) {
+function localMigrationFindings(local) {
   const findings = [];
   const stamps = new Map();
-  await eachInOrder(local, async (entry) => {
+  for (const entry of local) {
     if (!entry.match) {
       findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is not named <ts14>_<kebab>.sql; a migration is created by \`npm run db:new\` (supabase migration new), never renamed by hand`, { expected: '<ts14>_<kebab>.sql' }));
-      return;
+      continue;
     }
     const stamp = migrationStamp(entry.match[1]);
     if (stamp === null) {
-      findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} carries ${entry.match[1]}, which is no valid UTC time; the stamp is the real creation time`, { stamp: entry.match[1] }));
-      return;
-    }
-    const limit = await migrationTimeLimit(git, repoRoot, entry.file, now);
-    if (stamp > limit.at) {
-      const boundary = limit.tracked ? `the file's commit time ${new Date(limit.at).toISOString()}` : `the current time ${new Date(limit.at).toISOString()}`;
-      findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is stamped ${entry.match[1]}, in the future relative to ${boundary}; a migration stamp is its real creation time, never a hand-picked date`, { stamp: entry.match[1], tracked: limit.tracked }));
+      findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} carries ${entry.match[1]}, which is no valid UTC time; a migration stamp must name a valid UTC instant`, { stamp: entry.match[1] }));
+      continue;
     }
     if (stamps.has(stamp)) findings.push(found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} shares stamp ${entry.match[1]} with ${stamps.get(stamp)}; stamps are strictly increasing`, { stamp: entry.match[1], other: stamps.get(stamp) }));
     stamps.set(stamp, entry.file);
-  });
+  }
   return findings;
 }
 
-async function baseMigrationEntryFindings(entry, repoRoot, git, baseSha, onBase, baseMax) {
+/** HEAD owns the append boundary. Archived names retire the old chain, so a replacement baseline starts afresh. */
+function migrationHistory(files, retired, localNames) {
+  const prefix = `${MIGRATIONS_DIR}/`;
+  const onHead = new Set(files.filter(isActiveMigration).map((file) => file.slice(prefix.length)));
+  const retiredNames = new Set([...retired, ...files.filter((file) => file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`)).map((file) => file.slice(MIGRATIONS_ARCHIVE_DIR.length + 1))].filter((name) => !localNames.has(name)));
+  const stamps = [...onHead].filter((name) => !retiredNames.has(name)).map((name) => MIGRATION_NAME.exec(name)?.[1]).filter(Boolean).map(migrationStamp).filter((stamp) => stamp !== null);
+  return { onHead, latest: stamps.length ? Math.max(...stamps) : null };
+}
+
+function migrationOrderingFindings(local, history) {
+  return local.flatMap((entry) => {
+    const stamp = entry.match ? migrationStamp(entry.match[1]) : null;
+    if (history.onHead.has(entry.name) || stamp === null || history.latest === null || stamp > history.latest) return [];
+    return [found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is stamped ${entry.match[1]}, not after every migration already in repository history (latest active ${new Date(history.latest).toISOString()}); a new migration sorts after the committed active chain`, { stamp: entry.match[1], latest: new Date(history.latest).toISOString() })];
+  });
+}
+
+async function baseMigrationEntryFindings(entry, repoRoot, git, baseSha, onBase) {
   if (!entry.match) return [];
-  const stamp = migrationStamp(entry.match[1]);
   if (onBase.has(entry.name)) {
     const committed = await baseFileText(git, repoRoot, baseSha.sha, entry.file);
     const current = readText(repoRoot, entry.file);
     if (!sameText(current, committed)) return [found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} differs from its content on ${baseSha.ref}; a migration on the base branch is immutable - write a new migration`, { base: baseSha.ref })];
-  } else if (baseMax !== null && stamp !== null && stamp <= baseMax) {
-    return [found(DB_MIGRATION_SHAPE, entry.file, `${entry.file} is stamped ${entry.match[1]}, not after every migration on ${baseSha.ref} (latest ${String(new Date(baseMax).toISOString())}); a new migration sorts after the base ones`, { stamp: entry.match[1], base: baseSha.ref })];
   }
   return [];
 }
@@ -112,26 +112,27 @@ function removedMigrationFindings(local, retired, baseNames, baseSha) {
 
 /**
  * L02 findings for names, stamps, ordering and immutability of supabase/migrations/*.sql. `archived` are the files of
- * supabase/migrations/_archive/ (app.supabase.migrations.archive): never judged, and a base migration moved there at a baseline
- * cutover is retired, not removed.
+ * supabase/migrations/_archive/ (app.supabase.migrations.archive): never judged, and a migration moved there at a baseline
+ * cutover is retired from the ordering chain, not removed. New files append after HEAD's active migrations; timestamps
+ * on archived migrations, remote branches and the wall clock do not constrain a replacement baseline.
  */
-export async function migrationShapeFindings({ repoRoot, migrations, archived = [], git, base, now }) {
+export async function migrationShapeFindings({ repoRoot, migrations, archived = [], git, base }) {
   const prefix = `${MIGRATIONS_DIR}/`;
   const local = migrations.map((file) => {
     const name = file.startsWith(prefix) ? file.slice(prefix.length) : file;
     return { file, name, match: MIGRATION_NAME.exec(name) };
   });
-  const findings = await localMigrationFindings(local, repoRoot, git, now);
+  const findings = localMigrationFindings(local);
+  const retired = new Set(archived.map((file) => file.slice(MIGRATIONS_ARCHIVE_DIR.length + 1)));
+  const history = migrationHistory(await migrationFilesAt(git, repoRoot, 'HEAD'), retired, new Set(local.map((entry) => entry.name)));
+  findings.push(...migrationOrderingFindings(local, history));
   const baseSha = await baseShaOf(git, repoRoot, base);
   if (!baseSha) return findings;
-  const baseNames = await baseMigrationNames(git, repoRoot, baseSha.sha);
+  const baseNames = (await migrationFilesAt(git, repoRoot, baseSha.sha)).filter(isActiveMigration).map((file) => file.slice(prefix.length));
   const onBase = new Set(baseNames);
-  const baseStamps = baseNames.map((name) => MIGRATION_NAME.exec(name)?.[1]).filter(Boolean).map(migrationStamp).filter((stamp) => stamp !== null);
-  const baseMax = baseStamps.length ? Math.max(...baseStamps) : null;
   await eachInOrder(local, async (entry) => {
-    findings.push(...await baseMigrationEntryFindings(entry, repoRoot, git, baseSha, onBase, baseMax));
+    findings.push(...await baseMigrationEntryFindings(entry, repoRoot, git, baseSha, onBase));
   });
-  const retired = new Set(archived.map((file) => file.slice(MIGRATIONS_ARCHIVE_DIR.length + 1)));
   findings.push(...removedMigrationFindings(local, retired, baseNames, baseSha));
   return findings;
 }

package/runtime/scripts/hfs/rules/database.mjs

@@ -51,7 +51,7 @@ async function migrationAnalyses({ repoRoot, migrations, exposed, forceRls, find
  * starts neither Docker nor the Supabase CLI. A full app is judged when it declares a Supabase connection, while
  * lite apps are judged even before their initial Supabase files have all been scaffolded.
  */
-export async function checkDatabase({ repoRoot, files, base, git, edition, supabase, emitTypes, now = () => Date.now() } = {}) {
+export async function checkDatabase({ repoRoot, files, base, git, edition, supabase, emitTypes } = {}) {
   const findings = [];
   const migrations = files.filter(isActiveMigration).sort(byCodeUnit);
   const archived = files.filter((file) => file.startsWith(`${MIGRATIONS_ARCHIVE_DIR}/`));
@@ -71,7 +71,7 @@ export async function checkDatabase({ repoRoot, files, base, git, edition, supab
   const apiSchemas = (config?.api?.schemas ?? []).filter((schema) => typeof schema === 'string');
   const exposed = new Set(['public', ...apiSchemas]);
   const forceRls = new Set((declared?.forceRls ?? []).map((name) => (name.includes('.') ? name : `public.${name}`)));
-  findings.push(...await migrationShapeFindings({ repoRoot, migrations, archived, git: git ?? defaultGit, base, now }));
+  findings.push(...await migrationShapeFindings({ repoRoot, migrations, archived, git: git ?? defaultGit, base }));
 
   const analyses = await migrationAnalyses({ repoRoot, migrations, exposed, forceRls, findings });
   findings.push(

package/runtime/scripts/hfs/rules/edition.mjs

@@ -1,6 +1,6 @@
 // edition.mjs - L01, the edition rule. An hfs.json edition is `full` or `lite` (absent means full); under lite the standard is a
-// filter plus a few additions over the same manifest, never a second engine. Lite is the full architecture deployed without
-// self-hosted infrastructure (owner ruling 2026-10-12): the same slots, patterns and unit specs, Supabase adapters behind the same
+// filter plus a few additions over the same manifest, never a second engine. Lite keeps the full code structure and swaps only
+// backing infrastructure for Supabase (owner ruling 2026-10-13): the api and sidecars run on Swarm, with the same slots, patterns and unit specs behind the same
 // ports, and no e2e or contract world. The slot layer already answers the paths lite removed (slots lite excludes, or whose
 // litePresence is forbidden, come back HFS_FORBIDDEN_PRESENT with their goesTo); this rule reports what no path can state:
 //   - inside a package.json: an e2e, contract, stack or browser script (`test:e2e`, `test:contract`, `test:stack`, `test:browser`,
@@ -9,7 +9,7 @@
 //     while full owns them (BullMQ, Kafka, Redis: lite runs pgmq and Postgres locks instead);
 //   - a declaration of what lite does not have: an app kind, pattern or trigger kind every slot of which is forbidden under
 //     lite. The forbidden names are DERIVED from the manifest, so adding or restoring a kind is a manifest edit, not an edit here
-//     (under the 2026-10-12 ruling no pattern, trigger or app kind is gone).
+//     (under the 2026-10-13 ruling no pattern, trigger or app kind is gone).
 // A full app answers []: the rule tests the edition once and a full view forbids none of these names.
 import { found, readJson } from './read.mjs';
 import { DEPENDENCY_SECTIONS } from './fe-no-tests.mjs';
@@ -18,7 +18,7 @@ import { editionRuleParams } from '../edition-slots.mjs';
 export const HFS_EDITION_FORBIDDEN_PRESENT = 'HFS_EDITION_FORBIDDEN_PRESENT';
 
 const PACKAGE_JSON = /(?:^|\/)package\.json$/;
-/** The scripts of a world lite does not have: the e2e and contract layers, the self-hosted stack and the browser journey. */
+/** The scripts of a test world lite does not have: e2e, contract, test-stack and browser journeys. Production Swarm deployment is legal. */
 const LITE_FORBIDDEN_SCRIPT = /^(?:pre|post)?test:(?:e2e|contract|stack|browser)$/;
 /** The dependencies of a test infrastructure lite does not run: containers, fault proxies and browser runners. */
 const LITE_FORBIDDEN_TEST_INFRA = /^(?:testcontainers|@testcontainers\/.+|toxiproxy-node-client|playwright|playwright-core|@playwright\/.+|cypress)$/;
@@ -78,7 +78,7 @@ function dependencyFindings(rel, pkg, removed) {
     if (!isPlainObject(deps)) continue;
     for (const name of Object.keys(deps)) {
       if (LITE_FORBIDDEN_TEST_INFRA.test(name)) findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} ${section} has ${name}: a lite app runs no test containers, fault proxy or browser journey - its integration specs run against \`supabase start\``, { section, name }));
-      else if (removed.has(name)) findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} ${section} has ${name}: lite runs no self-hosted infrastructure - the pattern's port is implemented on Supabase (pgmq, Postgres locks)`, { section, name }));
+      else if (removed.has(name)) findings.push(found(HFS_EDITION_FORBIDDEN_PRESENT, rel, `${rel} ${section} has ${name}: lite replaces backing infrastructure with Supabase - the pattern's port is implemented on Supabase (pgmq, Postgres locks)`, { section, name }));
     }
   }
   return findings;

package/runtime/scripts/hfs/rules/proof-commands.mjs

@@ -12,6 +12,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { parseYaml } from '../../../engine/yaml.mjs';
 import { found, readText } from './read.mjs';
+import { liteStarciworkFinding } from '../path-findings.mjs';
 
 const PROOF_COMMAND_FILE_MISSING = 'HFS_PROOF_COMMAND_FILE_MISSING';
 const RECORD = /^\.starciwork\/.+\.ya?ml$/;
@@ -62,6 +63,7 @@ export function proofCommandFindings({ repoRoot, files, resolver, sides }) {
   const own = new Set(sides);
   for (const file of files) {
     if (!RECORD.test(file)) continue;
+    if (liteStarciworkFinding(file, resolver)) continue;
     const text = readText(repoRoot, file);
     if (text === null || !text.includes('requiresProof')) continue;
     let record;

package/runtime/scripts/hfs/rules/secrets.mjs

@@ -5,6 +5,8 @@
 //   - a tracked `.enc` that is not a sops envelope (an encrypted-looking file that holds plaintext);
 //   - a line of any other tracked text file that matches a secret pattern.
 // A finding names the file, the line and the pattern, never the value.
+import fs from 'node:fs';
+import path from 'node:path';
 import { FORBIDDEN_FILES, secretHits } from '../../lib/secret-patterns.mjs';
 import { isSopsEnvelope } from '../../lib/sops-envelope.mjs';
 import { found, readText } from './read.mjs';
@@ -16,6 +18,17 @@ const NOT_SCANNED = /(^|\/)package-lock\.json$/;
 /** True when the slot `id` of the manifest reports HFS_PLAINTEXT_SECRET for the paths it forbids. */
 export const slotOwnsSecrets = (slot) => slot?.rules?.includes(PLAINTEXT_SECRET) === true;
 
+/** A legacy lite root secrets.env is reported even when ignored; its presence is enough, so no value is read. */
+export function untrackedSecretFindings({ repoRoot, files, repo }) {
+  if (repo.profile !== 'app' || repo.edition !== 'lite' || files.includes('secrets.env')) return [];
+  try {
+    if (!fs.statSync(path.join(repoRoot, 'secrets.env')).isFile()) return [];
+  } catch {
+    return [];
+  }
+  return [found(PLAINTEXT_SECRET, 'secrets.env', 'secrets.env is an untracked plaintext secret at the lite app root; seal it with starci app secret set into .starcistacks/<env>/secrets/<slug>.enc and remove the plaintext file; read materialized values by *_FILE', { level: 'warning', pattern: 'untracked-secrets-env' })];
+}
+
 /**
  * The findings of R06 for one tracked file that no forbidden slot claims: a secret by being (an env file, a key file), an `.enc` that is
  * no sops envelope, or a line that matches a secret pattern. `text` is the file's text, or null when it cannot be read (binary, too

package/runtime/scripts/hfs/rules/stacks-runtime.mjs

@@ -0,0 +1,128 @@
+// R10 runtime consistency: app-owned scheduling, managed lite backing and Swarm deployment safety.
+import fs from 'node:fs';
+import path from 'node:path';
+import { isPlainObject as plain } from '../../../engine/plain-object.mjs';
+import { readDeclaration } from '../../lib/stack-declaration.mjs';
+import { isInside } from '../../lib/walk.mjs';
+import { composeIncludePaths, swarmInventoryIssues, swarmModelIssues } from '../../lib/swarm-stack.mjs';
+import { found, readText } from './read.mjs';
+
+const CODE = 'HFS_STACKS_SHAPE';
+const DECLARATION = '.starcistacks/application-stacks.yaml';
+const HOST_CRON_PATH = /^(?:\.github\/workflows|deploy|scripts|\.starcistacks)\//;
+const HOST_CRON = /\bcrontab\s+(?:-l\b|-(?=\s|[;|&)]|$))|(?:\/etc\/)?\bcron\.d(?:\/|\b)|@reboot\b/i;
+const mapping = value => plain(value) ? value : {};
+const issueFinding = (file, issue) => found(CODE, file, `${file}: ${issue.at}: ${issue.message}`);
+
+/** The app's tracked automation sources; locations are reported without returning any source text. */
+export function hostCrontabFindings({ repoRoot, files }) {
+  const findings = [];
+  for (const file of files.filter(file => HOST_CRON_PATH.test(file) && !file.endsWith('.enc'))) {
+    const text = readText(repoRoot, file);
+    if (text === null) continue;
+    for (const [index, line] of text.split(/\r?\n/).entries()) {
+      if (HOST_CRON.test(line)) findings.push(found(CODE, file,
+        `${file}:${index + 1}: host crontab installation is forbidden; recurring work must use an app scheduler, pgmq/pg_cron, or a declared Swarm scheduler and replicated-job`, { line: index + 1 }));
+    }
+  }
+  return findings;
+}
+
+function safeStackFile(repoRoot, envDir, relative) {
+  if (typeof relative !== 'string' || path.isAbsolute(relative) || relative.split(/[\\/]/).includes('..')) return null;
+  const target = path.resolve(envDir, relative);
+  const base = path.resolve(repoRoot);
+  if (!isInside(base, envDir) || !isInside(envDir, target)) return null;
+  let cursor = target;
+  while (true) {
+    if (fs.existsSync(cursor) && fs.lstatSync(cursor).isSymbolicLink()) return null;
+    if (cursor === base) break;
+    cursor = path.dirname(cursor);
+  }
+  return target;
+}
+
+function mergeMapping(current, incoming) {
+  const result = { ...mapping(current) };
+  for (const [key, value] of Object.entries(mapping(incoming))) {
+    result[key] = plain(value) ? mergeMapping(result[key], value) : value;
+  }
+  return result;
+}
+
+function includePaths(doc, relative, file, findings) {
+  const { paths, errors } = composeIncludePaths(doc);
+  for (const message of errors) findings.push(issueFinding(file, { at: 'include', message }));
+  return paths.map(value => path.isAbsolute(value) ? value : path.posix.join(path.posix.dirname(relative), value));
+}
+
+function loadSwarmModel({ repoRoot, environment, spec, files, findings }) {
+  const prefix = `.starcistacks/${environment}/`, envDir = path.resolve(repoRoot, prefix);
+  const queue = [...(Array.isArray(spec.composeFiles) ? spec.composeFiles : [])], seen = new Set();
+  let model = {};
+  if (!queue.length) findings.push(found(CODE, DECLARATION, `${DECLARATION}: environments.${environment}.composeFiles must declare the Swarm stack sources`));
+  while (queue.length) {
+    const relative = queue.shift();
+    if (seen.has(relative)) continue;
+    seen.add(relative);
+    const file = `${prefix}${relative}`, target = safeStackFile(repoRoot, envDir, relative);
+    const parsed = target && files.includes(file) ? readDeclaration(target) : { error: 'missing, untracked or unsafe stack source' };
+    if (parsed.error) {
+      findings.push(found(CODE, file, `${file}: Swarm stack cannot be read: ${parsed.error}`));
+      continue;
+    }
+    model = mergeMapping(model, parsed.doc);
+    queue.push(...includePaths(parsed.doc, relative, file, findings));
+  }
+  return { model, sources: new Set([...seen].map(relative => `${prefix}${relative}`)) };
+}
+
+function swarmDeploymentFiles(repoRoot, files) {
+  return files.filter(file => {
+    const environment = /^\.starcistacks\/([^/]+)\/infra\/swarm\//.exec(file)?.[1];
+    if (!environment || file.endsWith('.enc')) return false;
+    const target = safeStackFile(repoRoot, path.resolve(repoRoot, '.starcistacks', environment), file.split('/').slice(2).join('/'));
+    if (!target) return true;
+    const parsed = readDeclaration(target);
+    return path.basename(file) === 'stack.yaml' || plain(parsed.doc?.services) || Array.isArray(parsed.doc?.include);
+  });
+}
+
+function liteEnvironmentFindings({ doc, environments, deployments }) {
+  const findings = [];
+  const delivery = deployments.length || Object.values(environments).some(spec => Array.isArray(spec?.composeFiles) && spec.composeFiles.length);
+  if (delivery && (doc.backing?.supabase?.provider !== 'supabase' || doc.backing?.supabase?.managed !== true))
+    findings.push(found(CODE, DECLARATION, `${DECLARATION}: lite Swarm delivery must declare backing.supabase with provider: supabase and managed: true`));
+  for (const [environment, spec] of Object.entries(environments)) {
+    if (!Array.isArray(spec?.composeFiles) || !spec.composeFiles.length) continue;
+    if (spec.runtime !== 'docker-swarm' || spec.composeFiles.some(file => typeof file !== 'string' || !file.startsWith('infra/swarm/')))
+      findings.push(found(CODE, DECLARATION, `${DECLARATION}: environments.${environment} lite delivery must use runtime: docker-swarm and infra/swarm sources`));
+  }
+  return findings;
+}
+
+function undeclaredSwarmFindings(deployments, environments, sources) {
+  return deployments.filter(file => !sources.has(file)).map(file => {
+    const environment = file.split('/')[1], spec = environments[environment];
+    const reason = spec?.runtime === 'docker-swarm' ? 'is not declared or reachable from composeFiles' : 'has no declared docker-swarm environment';
+    return found(CODE, file, `${file}: Swarm deployment ${reason}`);
+  });
+}
+
+/** Declared Swarm sources are checked for both editions; lite additionally refuses local managed backing images. */
+export function stacksRuntimeFindings({ repoRoot, files, doc, edition = 'full' }) {
+  const findings = [], lite = edition === 'lite', components = mapping(doc?.components), environments = mapping(doc?.environments);
+  const deployments = swarmDeploymentFiles(repoRoot, files), sources = new Set();
+  findings.push(...swarmInventoryIssues({ components, lite }).map(issue => issueFinding(DECLARATION, issue)));
+  if (lite) findings.push(...liteEnvironmentFindings({ doc, environments, deployments }));
+  for (const [environment, entry] of Object.entries(environments)) {
+    const spec = mapping(entry);
+    if (spec.runtime !== 'docker-swarm') continue;
+    const loaded = loadSwarmModel({ repoRoot, environment, spec, files, findings });
+    for (const file of loaded.sources) sources.add(file);
+    const file = `.starcistacks/${environment}/${spec.composeFiles?.[0] ?? 'infra/swarm/stack.yaml'}`;
+    findings.push(...swarmModelIssues({ model: loaded.model, components, bindings: spec.components, lite }).map(issue => issueFinding(file, issue)));
+  }
+  findings.push(...undeclaredSwarmFindings(deployments, environments, sources));
+  return findings;
+}