@starci/hfs 4.2.17 → 4.4.0

package/runtime/scripts/hfs/architecture/supabase.mjs

@@ -1,15 +1,15 @@
 import { machineKit } from './machine-ast.mjs';
-import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, moduleNameOf, reportAt, supabaseClientType, SUPABASE_MODULES } from './supabase-ast.mjs';
+import { callName, chainParts, contextTypesClient, isDatabaseType, isSupabaseCall, jwtPolicyProblems, moduleNameOf, reportAt, supabaseClientType, supabaseDataAccess, SUPABASE_MODULES } from './supabase-ast.mjs';
 import { checkBackendJwt } from './supabase-be.mjs';
 
 /**
- * L10-L16, the slot-driven Supabase machine. On the back end Supabase is one data transport with one owner,
+ * L10-L16, the slot-driven Supabase machine. On the back end Supabase provides Auth/Storage with one owner,
  * `be.integrations.supabase`. On the front end Supabase is auth only (owner ruling 2026-10-13): `fe.modules.auth` is the one
  * importer of `@supabase/*` and calls only the auth API; data, storage, rpc and realtime go through the back end (modules/api).
  * The checks below recognise provider calls and types by their imported package declarations, not by local variable or type names.
  */
 export const FRONTEND_SUPABASE_RULE_IDS = Object.freeze(['FE_SUPABASE_CLIENT_OWNER', 'FE_SERVICE_ROLE_FORBIDDEN']);
-export const BACKEND_SUPABASE_RULE_IDS = Object.freeze(['BE_SUPABASE_CLIENT_OWNER', 'BE_SUPABASE_JWT_VERIFIED']);
+export const BACKEND_SUPABASE_RULE_IDS = Object.freeze(['BE_SUPABASE_CLIENT_OWNER', 'BE_SUPABASE_JWT_VERIFIED', 'BE_JWT_ALG_PINNED']);
 
 const FE_CLIENT_OWNER = 'FE_SUPABASE_CLIENT_OWNER';
 const BE_CLIENT_OWNER = 'BE_SUPABASE_CLIENT_OWNER';
@@ -19,7 +19,7 @@ const FE_AUTH_SLOT = 'fe.modules.auth';
 /** The front-end provider slot: enabled exactly when a connection declares provider supabase. */
 const FE_SUPABASE_PROVIDER_SLOT = 'fe.route.callback';
 const FE_CONFIG_SLOT = 'fe.modules.config';
-const SUPABASE_CALLS = new Set(['from', 'rpc']);
+const BE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'functions', 'channel', 'realtime', 'getChannels', 'removeChannel', 'removeAllChannels']);
 /** The members of a Supabase client that read or write data, files or channels: never called from the front end. */
 const FE_DATA_MEMBERS = new Set(['from', 'rpc', 'schema', 'storage', 'functions', 'realtime', 'channel', 'getChannels', 'removeChannel', 'removeAllChannels']);
 const supabaseSlotEnabled = (input, slotId) => {
@@ -55,12 +55,21 @@ function inspectClientFactoryCall(scope, node) {
 }
 
 function inspectProviderCall(scope, node) {
-  const { kit, checker, file, slots, ruleId, violations, counters } = scope;
+  const { kit, checker, file, slots, ruleId, violations, counters, reportedData } = scope;
   const { ts } = kit;
+  const data = supabaseDataAccess(kit, checker, node, BE_DATA_MEMBERS, { storageAllowed: true });
+  if (data) {
+    if (!reportedData.has(data.node.pos)) {
+      reportedData.add(data.node.pos);
+      reportAt(violations, kit, ruleId, file, data.node, `A Supabase .${data.name} data call is made from ${file.slot ?? 'an unowned path'}; the back-end SDK is Auth/Storage only, including inside ${BE_SUPABASE_SLOT}. Data uses EntityManager as app_be.`, { member: data.name, slot: file.slot ?? null });
+    }
+    if (ts.isCallExpression(node)) counters.calls += 1;
+    return;
+  }
   if (!isSupabaseCall(kit, checker, node)) return;
   const properties = chainParts(ts, node);
   const method = callName(ts, node);
-  if (!SUPABASE_CALLS.has(method) && !properties.includes('auth') && !properties.includes('storage')) return;
+  if (!properties.includes('auth') && !properties.includes('storage')) return;
   counters.calls += 1;
   if (!slots.has(file.slot)) reportAt(violations, kit, ruleId, file, node, `A Supabase ${method ?? 'client'} call is made from ${file.slot ?? 'an unowned path'}; database, auth and storage calls belong only to ${[...slots].join(' or ')}.`, { method, slot: file.slot ?? null });
 }
@@ -68,8 +77,9 @@ function inspectProviderCall(scope, node) {
 function inspectOwnershipNode(scope, node) {
   inspectSupabaseImport(scope, node);
   inspectClientTypeReference(scope, node);
-  if (!scope.kit.ts.isCallExpression(node)) return;
-  inspectClientFactoryCall(scope, node);
+  const { ts } = scope.kit;
+  if (!ts.isCallExpression(node) && !ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return;
+  if (ts.isCallExpression(node)) inspectClientFactoryCall(scope, node);
   inspectProviderCall(scope, node);
 }
 
@@ -79,7 +89,7 @@ function checkClientOwnership(input, { slots, ruleId }) {
   const counters = { imports: 0, clients: 0, calls: 0 };
   for (const file of input.graph.files.values()) {
     const checker = kit.checkerOf(file.sourceFile);
-    const scope = { kit, checker, file, slots, ruleId, violations, counters };
+    const scope = { kit, checker, file, slots, ruleId, violations, counters, reportedData: new Set() };
     kit.walk(file.sourceFile, node => inspectOwnershipNode(scope, node));
   }
   return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [...slots] } };
@@ -138,7 +148,7 @@ function checkFrontendSecretNames(input) {
 }
 
 function inspectFrontendNode(scope, node) {
-  const { kit, checker, file, violations, counters } = scope;
+  const { kit, checker, file, violations, counters, reportedData } = scope;
   const { ts } = kit;
   const moduleName = moduleNameOf(ts, node);
   if (moduleName?.startsWith('@supabase/')) {
@@ -146,14 +156,19 @@ function inspectFrontendNode(scope, node) {
     if (file.slot !== FE_AUTH_SLOT) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `${moduleName} is imported by ${file.rel}, whose slot is ${file.slot ?? 'unowned'}; on the front end Supabase is auth only and ${FE_AUTH_SLOT} (modules/auth) is its one importer.`, { module: moduleName, slot: file.slot ?? null });
     return;
   }
-  if (!ts.isCallExpression(node) || !isSupabaseCall(kit, checker, node)) return;
+  if (!ts.isCallExpression(node) && !ts.isPropertyAccessExpression(node) && !ts.isElementAccessExpression(node)) return;
+  const data = supabaseDataAccess(kit, checker, node, FE_DATA_MEMBERS);
+  if (data) {
+    if (!reportedData.has(data.node.pos)) {
+      reportedData.add(data.node.pos);
+      reportAt(violations, kit, FE_CLIENT_OWNER, file, data.node, `A Supabase .${data.name} call is made from the front end; Supabase on the front end is auth only - read and write data, files and realtime through the back end (a modules/api GraphQL operation, an SWR hook, hooks/socketio).`, { member: data.name, slot: file.slot ?? null });
+    }
+    return;
+  }
+  if (!isSupabaseCall(kit, checker, node)) return;
   counters.calls += 1;
-  const member = callName(ts, node);
   const parts = chainParts(ts, node);
-  let data = null;
-  if (FE_DATA_MEMBERS.has(member)) data = parts.find(name => FE_DATA_MEMBERS.has(name)) ?? member;
-  if (data) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase .${data} call is made from the front end; Supabase on the front end is auth only - read and write data, files and realtime through the back end (a modules/api GraphQL operation, an SWR hook, hooks/socketio).`, { member: data, slot: file.slot ?? null });
-  else if (file.slot !== FE_AUTH_SLOT && parts.includes('auth')) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase auth call is made from ${file.slot ?? 'an unowned path'}; the auth client is called only inside ${FE_AUTH_SLOT}, which exports the session and the access token.`, { slot: file.slot ?? null });
+  if (file.slot !== FE_AUTH_SLOT && parts.includes('auth')) reportAt(violations, kit, FE_CLIENT_OWNER, file, node, `A Supabase auth call is made from ${file.slot ?? 'an unowned path'}; the auth client is called only inside ${FE_AUTH_SLOT}, which exports the session and the access token.`, { slot: file.slot ?? null });
 }
 
 function checkFrontendClientOwner(input) {
@@ -161,15 +176,18 @@ function checkFrontendClientOwner(input) {
   const violations = [];
   const counters = { imports: 0, calls: 0 };
   for (const file of input.graph.files.values()) {
-    const scope = { kit, checker: kit.checkerOf(file.sourceFile), file, violations, counters };
+    const scope = { kit, checker: kit.checkerOf(file.sourceFile), file, violations, counters, reportedData: new Set() };
     kit.walk(file.sourceFile, node => inspectFrontendNode(scope, node));
   }
   return { violations, coverage: { status: 'checked', ...counters, ownerSlots: [FE_AUTH_SLOT] } };
 }
 
 export function checkFrontendSupabase(input) {
-  if (!supabaseSlotEnabled(input, FE_SUPABASE_PROVIDER_SLOT)) return { violations: [], coverage: { status: 'not-applicable', reason: 'no connection declares provider supabase' } };
   const owner = checkFrontendClientOwner(input);
+  if (!supabaseSlotEnabled(input, FE_SUPABASE_PROVIDER_SLOT)) return {
+    violations: owner.violations,
+    coverage: { status: owner.coverage.imports || owner.coverage.calls || owner.violations.length ? 'checked' : 'not-applicable', owner: owner.coverage, reason: 'no connection declares provider supabase; SDK ownership is still checked' },
+  };
   const secrets = checkFrontendSecretNames(input);
   return {
     violations: [...owner.violations, ...secrets.violations],
@@ -178,11 +196,31 @@ export function checkFrontendSupabase(input) {
 }
 
 export function checkBackendSupabase(input) {
-  if (!supabaseSlotEnabled(input, BE_SUPABASE_SLOT)) return { violations: [], coverage: { status: 'not-applicable', reason: 'the Supabase back-end integration slot is not enabled' } };
   const owner = checkClientOwnership(input, { slots: new Set([BE_SUPABASE_SLOT]), ruleId: BE_CLIENT_OWNER });
+  if (!supabaseSlotEnabled(input, BE_SUPABASE_SLOT)) return {
+    violations: owner.violations,
+    coverage: { status: owner.coverage.imports || owner.coverage.calls || owner.violations.length ? 'checked' : 'not-applicable', owner: owner.coverage, reason: 'the Supabase integration slot is disabled; SDK ownership is still checked' },
+  };
   const jwt = checkBackendJwt(input);
+  const policy = checkJwtPolicy(input);
   return {
-    violations: [...owner.violations, ...jwt.violations],
-    coverage: { status: 'checked', owner: owner.coverage, jwt: jwt.coverage },
+    violations: [...owner.violations, ...jwt.violations, ...policy.violations],
+    coverage: { status: 'checked', owner: owner.coverage, jwt: jwt.coverage, jwtPolicy: policy.coverage },
   };
 }
+
+export function checkJwtPolicy(input) {
+  const kit = machineKit(input);
+  const violations = [];
+  let verifyCalls = 0;
+  for (const file of input.graph.files.values()) {
+    const checker = kit.checkerOf(file.sourceFile);
+    kit.walk(file.sourceFile, node => {
+      if (!kit.ts.isCallExpression(node) || !kit.isImportOf(checker, node.expression, 'jwtVerify', 'jose')) return;
+      verifyCalls += 1;
+      const problems = jwtPolicyProblems(kit.ts, checker, node);
+      if (problems.length) reportAt(violations, kit, 'BE_JWT_ALG_PINNED', file, node, problems.join(' '));
+    });
+  }
+  return { violations, coverage: { status: 'checked', verifyCalls } };
+}

package/runtime/scripts/hfs/architecture/surface.mjs

@@ -64,7 +64,8 @@ export const LINT_ENFORCERS = Object.freeze([
   enforcer('public-contract-form', BE, ['BE_PUBLIC_CONTRACT_FORM'], 'A public signature is typed by a named contract, never inline or untyped.'),
   enforcer('frontend-source-layout', FE, ['FE_SOURCE_LAYOUT_INVALID'], 'A front-end source file sits in a tier folder.'),
   enforcer('component-purity', FE, ['FE_COMPONENT_WORLD_OWNERSHIP', 'FE_WORLD_OWNER_RENDER_BOUNDARY', 'FE_CONNECTED_BLOCK_RENDER_PAIR', 'FE_PURE_REACHES_DATA', 'FE_PURE_WORLD_HOOK', 'FE_PURE_WORLD_IMPORT'], 'A pure component reaches no data or world state; its connected entry owns them.'),
-  enforcer('grammar-entry', FE, ['ARCH_GRAMMAR_CONTRACT_INVALID', 'ARCH_GRAMMAR_EXPORT_BYPASS'], 'Vendor grammar is reached only through its owner entry.'),
+  // Package-manifest contract findings stay with app check; only source import bypasses belong to lint.
+  enforcer('grammar-entry', FE, ['ARCH_GRAMMAR_EXPORT_BYPASS'], 'Vendor grammar is reached only through its owner entry.'),
   enforcer('i18n-keys', FE, ['FE_I18N_KEYS'], 'Translation keys read by source and keys held by catalogs agree both ways.'),
   // The per-path judgements of the slot manifest (scripts/hfs/path-findings.mjs), on a tracked TypeScript file.
   enforcer('slot-undeclared', BOTH, ['HFS_SLOT_UNDECLARED', 'HFS_SLOT_AMBIGUOUS', 'HFS_SLOT_NOT_ENABLED'], 'A TypeScript file is owned by exactly one slot of the repository.', { origin: 'repo' }),

package/runtime/scripts/hfs/architecture/tiers.mjs

@@ -7,15 +7,22 @@ import { byCodeUnit } from '../../lib/list.mjs';
  *      is the one direction with its own code (BE_FEATURE_IMPORTS_FEATURE, R28), never BE_TIER_DIRECTION, and a feature of one trigger
  *      kind (slot field `trigger`: api, webhooks, realtime, saga, reactors, jobs, cli) importing a feature of another is
  *      BE_KIND_ISOLATION, whose fix is the event bus,
- *      an app never imports another app (FE_APP_ISOLATION), and a component layer imports only the layers after it;
+ *      an app never imports another app (BE_SERVICE_ISOLATION / FE_APP_ISOLATION), and a component layer imports only the layers after it;
  *   2. owner cycles: a strongly connected component of the owner graph, type-only imports included (ARCH_OWNER_CYCLE),
  *      reported with the cycle path and the import that closes each hop.
  * Importing inside one owner is always allowed; the public-entry rule stays with owners.mjs (ARCH_OWNER_EXPORT_BYPASS).
  */
-export const TIER_RULE_IDS = ['BE_TIER_DIRECTION', 'BE_FEATURE_IMPORTS_FEATURE', 'BE_KIND_ISOLATION', 'FE_TIER_DIRECTION', 'FE_APP_ISOLATION', 'ARCH_OWNER_CYCLE'];
+export const TIER_RULE_IDS = ['BE_TIER_DIRECTION', 'BE_FEATURE_IMPORTS_FEATURE', 'BE_KIND_ISOLATION', 'BE_SERVICE_ISOLATION', 'FE_TIER_DIRECTION', 'FE_APP_ISOLATION', 'ARCH_OWNER_CYCLE'];
+
+function tierDirectionText({ fromTier, toTier, mayImport, kindRestriction, fromKind, toKind }) {
+  if (!kindRestriction) return `a ${fromTier} may import only ${mayImport.join(', ') || 'nothing'}; it imports a ${toTier}`;
+  const source = fromKind ?? 'no folder kind';
+  const target = toKind ?? 'no folder kind';
+  return `a ${fromTier} may import ${toTier} owners only from kinds ${kindRestriction.from.join(', ')} to kinds ${kindRestriction.to.join(', ')}; it imports ${source} -> ${target}`;
+}
 
 const REASON_TEXT = {
-  tierDirection: ({ fromTier, toTier, mayImport }) => `a ${fromTier} may import only ${mayImport.join(', ') || 'nothing'}; it imports a ${toTier}`,
+  tierDirection: tierDirectionText,
   layerOrder: ({ fromLayer, toLayer }) => `a ${fromLayer} component may import only the layers after it; it imports a ${toLayer}`,
   crossApp: ({ from, to }) => `app ${from} imports app ${to}; apps never import each other, shared code is a packages/<pkg> slot`,
 };
@@ -111,7 +118,7 @@ function reportReasonedTierViolation(graph, edge, verdict, tierRule, counts, vio
   let ruleId = tierRule;
   if (featureToFeature) ruleId = 'BE_FEATURE_IMPORTS_FEATURE';
   if (crossKind) ruleId = 'BE_KIND_ISOLATION';
-  if (verdict.reason === 'crossApp') ruleId = 'FE_APP_ISOLATION';
+  if (verdict.reason === 'crossApp') ruleId = graph.profile === 'be' ? 'BE_SERVICE_ISOLATION' : 'FE_APP_ISOLATION';
   const typeOnly = edge.runtime ? '' : ' (type-only imports count)';
   const message = crossKind
     ? `${edge.from} -> ${edge.to}: a ${fromKind} feature imports a ${toKind} feature; no kind imports another, every cross-kind call is an event published with eventBus.publish(event, tx) from a domain service${typeOnly}.`

package/runtime/scripts/hfs/architecture/typescript.mjs

@@ -9,6 +9,7 @@ import { createTypeScriptProgram, readTypeScriptProject, resolveTypeScriptModule
 import { readJsonFile } from '../../lib/json.mjs';
 import { sourceLocation } from '../../lib/ts-ast.mjs';
 import { locateDeclaration } from '../slots.mjs';
+export { unwrapExpression } from '../../lib/ts-analysis.mjs';
 
 const CODE_EXTENSIONS = /\.(?:[cm]?[jt]sx?)$/i;
 const SCRIPT_TAIL = '[cm]?[jt]sx?';
@@ -399,14 +400,6 @@ export function reachableViolation(edges, firstEdge, forbidden, { follow = () =>
 /** A framework identity the checkers cannot prove statically. */
 export const UNPROVEN_FRAMEWORK = '(unproven framework identity)';
 
-/** The expression under parentheses, type assertions, non-null and satisfies wrappers. */
-export function unwrapExpression(ts, expression) {
-  while (expression && (ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression)
-    || ts.isTypeAssertionExpression(expression) || ts.isNonNullExpression(expression)
-    || (ts.isSatisfiesExpression?.(expression) ?? false))) expression = expression.expression;
-  return expression;
-}
-
 /* ---- the AST walks every architecture checker shares ---- */
 
 /** The names of `expected` an import or re-export statement binds (all of them for a namespace or star form). */

package/runtime/scripts/hfs/architecture/unit-spec-providers.mjs

@@ -4,6 +4,8 @@ import { machineKit } from './machine-ast.mjs';
 import { constructorDependencies } from './constructor-deps.mjs';
 import { treeOf } from './required-files.mjs';
 import { byCodeUnit } from '../../lib/list.mjs';
+import { importsOf } from '../../lib/ts-analysis.mjs';
+import { checkFunctionSubject, functionSubjectExports, keyOf as literalKey, valueObjectSubjects } from './function-spec-providers.mjs';
 
 /**
  * R48 `unit-spec-providers` (BE_SPEC_QUALITY), the unit test standard's rule 3: the unit spec of a service builds its
@@ -14,7 +16,10 @@ import { byCodeUnit } from '../../lib/list.mjs';
  * outside the production program, so it is read from disk). A parameter decorated with a custom `Inject<Thing>()` provides
  * the token that decorator's `injector<T>(TOKEN)` names; an undecorated parameter of a class type provides that class (see
  * constructor-deps.mjs). Providers are matched by the exported name of the imported binding (`import { CACHE as C }` is
- * CACHE), never by text. A provider is a class, or `{ provide: TOKEN, useValue: double }` and nothing else.
+ * CACHE), never by text. A provider is a class, or `{ provide: TOKEN, useValue: double }` and nothing else. A sibling
+ * containing only exported functions instead provides its complete real function object and exercises it through module.get;
+ * the constants, enums, re-exports and overload signatures beside those functions do not count. A value-object subject (an
+ * undecorated class whose constructor parameters carry no injection token) is built with `new`, Nest never constructs it.
  *
  * Findings: an extra provider, a missing provider, a service that is not the first provider, a dependency whose token cannot
  * be resolved, a spec with no createTestingModule providers array, and a provider that is neither a class nor
@@ -25,17 +30,6 @@ export const UNIT_SPEC_PROVIDERS_RULE_IDS = ['BE_SPEC_QUALITY'];
 const RULE = 'BE_SPEC_QUALITY';
 const SPEC_ROOT = /^(?:src|apps)\//u;
 
-/** local name -> {name, module} for every named import of a source file. */
-function importsOf(ts, sourceFile) {
-  const imports = new Map();
-  for (const statement of sourceFile.statements) {
-    const bindings = ts.isImportDeclaration(statement) ? statement.importClause?.namedBindings : null;
-    if (!bindings || !ts.isNamedImports(bindings)) continue;
-    for (const element of bindings.elements) imports.set(element.name.text, { name: (element.propertyName ?? element.name).text, module: statement.moduleSpecifier.text });
-  }
-  return imports;
-}
-
 /** The `Test.createTestingModule(...)` calls of a spec. */
 function testingModules(ts, sourceFile) {
   const calls = [];
@@ -47,7 +41,6 @@ function testingModules(ts, sourceFile) {
   return calls;
 }
 
-const literalKey = (ts, property) => (ts.isPropertyAssignment(property) || ts.isShorthandPropertyAssignment(property)) && (ts.isIdentifier(property.name) || ts.isStringLiteralLike(property.name)) ? property.name.text : null;
 
 function providerList(ts, call, rel, report) {
   const options = call.arguments[0];
@@ -107,6 +100,8 @@ function checkDependencies(kit, rel, service, serviceFile, list, provided, repor
 function checkTestingModule({ ts, kit, rel, serviceRel, serviceFile, imports, call, report }) {
   const list = providerList(ts, call, rel, report);
   if (!list) return;
+  const names = functionSubjectExports(ts, serviceFile.sourceFile);
+  if (names) return checkFunctionSubject({ ts, rel, serviceRel, imports, call, list, names, report });
   const nameOf = identifier => imports.get(identifier.text)?.name ?? identifier.text;
   const { provided, readable } = readProviders(ts, list, rel, nameOf, report);
   if (!readable) return;
@@ -125,6 +120,7 @@ function checkServiceSpec({ config, graph, kit, ts, rel, violations }) {
   const serviceFile = graph.files.get(serviceRel);
   if (!serviceFile) { report(sourceFile, `${rel} has no ${path.posix.basename(serviceRel)} beside it; a service spec sits next to the service it tests.`); return true; }
   const modules = testingModules(ts, sourceFile);
+  if (!modules.length && valueObjectSubjects(ts, serviceFile.sourceFile)) return true;
   if (!modules.length) { report(sourceFile, `${rel} never calls Test.createTestingModule({ providers: [...] }); build the service from a testing module holding exactly its constructor dependencies.`); return true; }
   for (const call of modules) checkTestingModule({ ts, kit, rel, serviceRel, serviceFile, imports, call, report });
   return true;

package/runtime/scripts/hfs/check-results.mjs

@@ -0,0 +1,28 @@
+// Common result shaping for the slot check and its optional proof reports.
+import { loadRuleCatalog } from './slots.mjs';
+
+/** Attach the localized catalog explanation to every finding. */
+export function withWhy(findings, why) {
+  return findings.map((f) => ({ ...f, title: why[f.code].title, titleVi: why[f.code].titleVi, whyVi: why[f.code].whyVi, nextStepVi: why[f.code].nextStepVi }));
+}
+
+/** Count findings by severity and code without dropping report-only results. */
+export function summarize(findings) {
+  const byCode = {};
+  for (const f of findings) {
+    byCode[f.code] ??= { level: f.level, count: 0 };
+    byCode[f.code].count += 1;
+  }
+  return {
+    error: findings.filter((f) => f.level === 'error').length,
+    warning: findings.filter((f) => f.level === 'warning').length,
+    info: findings.filter((f) => f.level === 'info').length,
+    byCode,
+  };
+}
+
+/** Keep findings judged in this edition; uncatalogued refusal codes always remain. */
+export function judgedFindings(findings, edition, root) {
+  const catalog = loadRuleCatalog({ root });
+  return findings.filter((finding) => catalog.judgedIn(finding.code, edition));
+}

package/runtime/scripts/hfs/check.mjs

@@ -16,7 +16,7 @@
 //   HFS_SLOT_REQUIRED_MISSING     a file or directory a required slot (or an instance of one) must contain
 //   HFS_MIN_INSTANCES             fewer instances of a slot than minInstances
 //   HFS_PLAINTEXT_SECRET          (R06, rules/secrets.mjs) a plaintext secret file or value in a tracked file; a `.enc` that is no sops envelope
-//   HFS_STACKS_SHAPE              (R10, rules/stacks.mjs) a `.starcistacks` path outside the standard shape, or a Sonar owner that is not the host
+//   HFS_STACKS_SHAPE              (R10, rules/stacks.mjs) invalid stack shape, Swarm runtime policy, host crontab installation or lite backing duplication
 //   HFS_CI_MISSING_CANON          (R13, rules/pipeline.mjs) CI without the pinned `starci app check`, pre-push without typecheck or lint
 //   HFS_DEP_VERSION_SKEW          (R14, rules/deps.mjs) a dependency at two versions in the workspace, or a nested copy in the lockfile
 //   HFS_CONTRACT_SNAPSHOT_DRIFT   (R23, rules/contract.mjs) an uncommitted back-end snapshot, or a front-end copy that differs from it
@@ -25,7 +25,7 @@
 //   FE_STACK_FORBIDDEN            (rules/fe-stack.mjs) a front-end manifest (the fe side's, or the app root's minus the back end's own libraries)
 //                                 declares a package knowledge/hfs/fe-stack.yaml forbids
 //   HFS_LITE_SECRET_CUSTODY       (R220, rules/supabase-secrets.mjs) under edition lite: secret material or a forbidden custody path; the R06 scan itself runs for every edition
-//   HFS_EDITION_FORBIDDEN_PRESENT (R212, rules/edition.mjs) under edition lite: an e2e, contract, stack or browser script, or a
+//   HFS_EDITION_FORBIDDEN_PRESENT (R212, rules/edition.mjs) under edition lite: an e2e, contract, test-stack or browser script, or a
 //                                 dependency of self-hosted infrastructure (test containers, fault proxy, BullMQ, Kafka, Redis)
 //   DB_MIGRATION_SHAPE ... DB_TYPES_DRIFT (R213-R216, rules/database.mjs, async: passed in as extraFindings) the Supabase migrations, policies, definer functions, buckets, config.toml and generated types
 //   BE_SPEC_PLACEMENT             (R102, rules/spec-placement.mjs) a spec or test file outside the four test layers, scripts/ and tools/ included
@@ -56,46 +56,47 @@
 // findings fail the check.
 import fs from 'node:fs';
 import path from 'node:path';
+import { appWiring, BOOT_PROOF_CODE } from './app-wiring.mjs';
+import { coverageFrom as coverageFromReport } from './coverage-from.mjs';
 import { skillRoot } from '../../engine/runtime-root.mjs';
 import { ARCHITECTURE_RULE_IDS, checkArchitecture } from './architecture/index.mjs';
 import { parseYaml } from '../../engine/yaml.mjs';
 import { readCatalogOnce } from './catalog-once.mjs';
-import { APP_SCOPE, HFS_DECLARATION_FILE, appRelativeMessages, HfsSlotsError, SIDES, createSlotResolver, loadRuleCatalog, loadSlotManifest, readRepoDeclaration, resolveRepoDeclaration } from './slots.mjs';
+import { APP_SCOPE, HFS_DECLARATION_FILE, appRelativeMessages, HfsSlotsError, SIDES, createSlotResolver, loadSlotManifest, readRepoDeclaration, resolveRepoDeclaration } from './slots.mjs';
+import { judgedFindings, summarize, withWhy } from './check-results.mjs';
 import { RUNTIME_KIND } from './manifest-shape.mjs';
 import { lsFiles } from '../api/git/ls-files.mjs';
 import { diff as gitDiff } from '../api/git/diff.mjs';
 import { mergeBase } from '../api/git/merge-base.mjs';
 import { gitOutputOf } from '../lib/git.mjs';
 import { posixPath } from '../lib/path-key.mjs';
-import { readTree, treeFacts, untrackedEntries } from './tree.mjs';
+import { treeFindings } from './tree-findings.mjs';
 import { contractFindings } from './rules/contract.mjs';
 import { appRootFindings } from './rules/app-root.mjs';
 import { frontendFindings } from './rules/frontend-tree.mjs';
 import { lintSuppressionFindings } from './rules/lint-suppression.mjs';
 import { repoLocalCheckFindings } from './rules/repo-local-checks.mjs';
 import { supabaseSecretFindings } from './rules/supabase-secrets.mjs';
-import { pathFindings } from './path-findings.mjs';
+import { untrackedSecretFindings } from './rules/secrets.mjs';
+import { liteStarciworkFinding, pathFindings } from './path-findings.mjs';
 import { onLintSurface } from './architecture/surface.mjs';
 import { checkAppRoot, trackedTreeView } from './architecture/hfs.mjs';
 import { testTopologyFindings } from './rules/test-topology.mjs';
 import { feNoTestsFindings } from './rules/fe-no-tests.mjs';
 import { editionFindings } from './rules/edition.mjs';
 import { feStackFindings } from './rules/fe-stack.mjs';
+import { A15_CODES, a15Findings } from './rules/a15-findings.mjs';
+import { trackedStacksGateFindings } from './stacks-gate.mjs';
 import { byCodeUnit } from '../lib/list.mjs';
 import { pinFindings } from './pin-findings.mjs';
+import { requiredFileApplies } from './slot-required.mjs';
+import { REFUSAL_CODES } from './refusal-codes.mjs';
+export { REFUSAL_CODES } from './refusal-codes.mjs';
 // The database rules (R213-R216) read SQL through a WASM parser, so they are async: `starci app check` calls them beside the other emitters and passes the findings in as `extraFindings`.
 export { checkDatabase } from './rules/database.mjs';
 
 const CANON_PINS_FILE = 'knowledge/hfs/canon-pins.yaml';
 export const FAILURE_CODES_FILE = 'modules/kernel/failure-codes.yaml';
-/**
- * The codes `starci app check` reports when it cannot judge (an unreadable repository, a refused declaration or manifest, a missing
- * formatter): infrastructure refusals, never obligations, so no rule of knowledge/hfs/rules.yaml owns them.
- */
-export const REFUSAL_CODES = Object.freeze([
-  'HFS_REPO_UNREADABLE',
-  'HFS_DECLARATION_INVALID', 'HFS_MANIFEST_MAJOR_MISMATCH', 'HFS_MANIFEST_INVALID', 'HFS_FORMAT_TOOL_MISSING', 'HFS_EDITION_INVALID',
-]);
 /** The codes this module emits that are not the slot loader's own: the why bundle of packages/hfs ships exactly these plus the loader's. */
 export const CHECK_CODES = Object.freeze([
   'HFS_SLOT_UNDECLARED', 'HFS_SLOT_NOT_ENABLED', 'HFS_SLOT_AMBIGUOUS', 'HFS_TRACKED_MUST_BE_IGNORED', 'HFS_FORBIDDEN_PRESENT',
@@ -103,10 +104,13 @@ export const CHECK_CODES = Object.freeze([
   'HFS_MANAGED_FILE_DRIFT', 'HFS_TOOL_CONFIG_LOCAL', 'HFS_RULE_OFF_WITHOUT_REPLACEMENT', 'HFS_TS_STRICT',
   'HFS_PLAINTEXT_SECRET', 'HFS_STACKS_SHAPE', 'HFS_CI_MISSING_CANON', 'HFS_DEP_VERSION_SKEW', 'HFS_CONTRACT_SNAPSHOT_DRIFT',
   'BE_TEST_TOPOLOGY', 'BE_SPEC_PLACEMENT', 'HFS_REPO_LOCAL_CHECK', 'HFS_LINT_SUPPRESSION_FILE', 'HFS_PROOF_COMMAND_FILE_MISSING', 'HFS_PEER_INTEGRATION_MISSING', 'BE_INTEGRATION_SPEC_MISSING', 'FE_GRAPHQL_CONTRACT', 'FE_NO_TESTS', 'HFS_MONO_WORKSPACES', 'HFS_MONO_FE_WORKSPACE', 'HFS_MONO_NEST_PROJECTS', 'HFS_MONO_WORKSPACE_DEP', 'BE_CLI_REQUIRED', 'FE_WIRE_GENERATED', 'FE_I18N_PLACEMENT', 'FE_I18N_CATALOG', 'HFS_SERVICE_PLACEMENT', 'HFS_IMAGE_UNPINNED', 'HFS_SERVICE_STACK_DECLARATION', 'HFS_EVENT_CONTRACT', 'BE_ASYNC_SPEC_MISSING', 'BE_SAGA_STEP_COMPENSATION', 'BE_SAGA_STATE_VERSIONED', 'BE_SAGA_EVENT_CONTRACT', 'BE_SAGA_CONSUMER_DEDUPE', 'BE_EVENT_CLASS_CONTRACT', 'BE_PATTERN_SPEC_MISSING', 'BE_CONTRACT_BREAKING', 'BE_KIND_DECLARATION', 'BE_KIND_EMPTY', 'HFS_DOCKER_BUILD_CONTEXT', 'HFS_DOCKER_STAGES', 'HFS_DOCKER_ENTRY', 'HFS_DOCKER_BASE_PIN', 'HFS_DOCKER_SECRETS', 'BE_SAGA_E2E_MISSING',
-  'FE_STACK_FORBIDDEN', 'HFS_EDITION_FORBIDDEN_PRESENT', 'HFS_LITE_SECRET_CUSTODY',
+  'FE_STACK_FORBIDDEN', 'HFS_EDITION_FORBIDDEN_PRESENT', 'HFS_LITE_SECRET_CUSTODY', 'HFS_STARCIWORK_LITE_FORBIDDEN',
   'DB_MIGRATION_SHAPE', 'DB_RLS_REQUIRED', 'DB_DYNAMIC_DDL', 'DB_POLICY_SHAPE', 'DB_DEFINER_SAFE', 'DB_STORAGE_POLICY', 'DB_CONFIG_POLICY', 'DB_TYPES_DRIFT',
+  'HFS_DOCKER_HEALTHCHECK_FAKE', 'DB_BE_ONLY_ACCESS', 'DB_REALTIME_UNLISTED', 'DB_APP_ROLE', 'DB_FORCE_RLS_DEFAULT',
+  'DB_POLICY_TAUTOLOGY', 'DB_VIEW_UNSAFE', 'DB_STORAGE_PREFIX', 'DB_DEFINER_REVOKE',
   'HFS_GITIGNORE_BLOCK_DRIFT', 'HFS_SONAR_CONFIG', 'HFS_COVERAGE_SCOPE_DRIFT', 'HFS_FORMAT',
   'HFS_EMPTY_DIR', 'HFS_GHOST_TREE', 'HFS_UNTRACKED_ROOT_ENTRY',
+  ...A15_CODES,
   ...REFUSAL_CODES,
 ]);
 /** Every code `starci app check` can report: its own and every code the architecture machine can emit (derived from the machine's rule id lists). */
@@ -170,52 +174,6 @@ const requiredOf = (slot, instance) => (slot.requires ?? []).map((entry) => {
 
 const appOf = (p) => /^apps\/([^/]+)\//.exec(p)?.[1];
 
-function withWhy(findings, why) {
-  return findings.map((f) => ({ ...f, title: why[f.code].title, titleVi: why[f.code].titleVi, whyVi: why[f.code].whyVi, nextStepVi: why[f.code].nextStepVi }));
-}
-
-function summarize(findings) {
-  const byCode = {};
-  for (const f of findings) {
-    byCode[f.code] ??= { level: f.level, count: 0 };
-    byCode[f.code].count += 1;
-  }
-  return {
-    error: findings.filter((f) => f.level === 'error').length,
-    info: findings.filter((f) => f.level === 'info').length,
-    byCode,
-  };
-}
-
-/**
- * THE edition filter of findings: a finding whose code belongs, through the rule catalog, to a rule the app's edition does not
- * judge (rules.yaml `editions`) is dropped. Codes outside the catalog (refusals, machine codes without a rule) stay. This is the
- * only place the edition touches a finding; no check below it knows the edition.
- */
-function judgedFindings(findings, edition, root) {
-  const catalog = loadRuleCatalog({ root });
-  return findings.filter((finding) => catalog.judgedIn(finding.code, edition));
-}
-
-/** The tree findings of R03: empty directories, ghost siblings, untracked entries outside an ignored slot. */
-function treeFindings({ repoRoot, resolver }) {
-  const inIgnoredSlot = (rel) => resolver.classifyPath(`${rel}/.probe`).tracking === 'ignored';
-  const findings = [];
-  const facts = treeFacts(readTree(repoRoot, { isIgnored: inIgnoredSlot }));
-  for (const { path: dir, below } of facts.empty) {
-    findings.push({ code: 'HFS_EMPTY_DIR', level: 'error', path: dir, below, message: `${dir} has no file below it` + (below ? ` (nor in its ${below} sub-director${below === 1 && 'y' || 'ies'})` : '') + '; git tracks no empty directory, so it is a leftover' });
-  }
-  for (const { path: dir, of, distance } of facts.ghosts) {
-    findings.push({ code: 'HFS_GHOST_TREE', level: 'error', path: dir, of, distance, message: `${dir} is empty and ${distance} edit${distance === 1 ? '' : 's'} from its sibling ${of}: a renamed or misspelt structure that was never removed` });
-  }
-  for (const entry of untrackedEntries(repoRoot)) {
-    const bare = entry.replace(/\/$/, '');
-    const ignored = entry.endsWith('/') ? inIgnoredSlot(bare) : resolver.classifyPath(bare).tracking === 'ignored';
-    if (!ignored) findings.push({ code: 'HFS_UNTRACKED_ROOT_ENTRY', level: 'error', path: bare, message: `${entry} is neither tracked nor git-ignored, and no ignored slot owns it` });
-  }
-  return findings;
-}
-
 /** A side-relative path (or null) as an app-relative one. */
 const onSide = (side, p) => (p ? path.posix.normalize(`${side}/${p}`) : p);
 
@@ -223,7 +181,7 @@ function appendRequiredPathFindings(findings, resolver, files, required, present
   const missing = new Set();
   const missingFile = (slot, p, via) => {
     const key = `${slot}|${p}`;
-    if (missing.has(key) || present(p)) return;
+    if (missing.has(key) || present(p) || !requiredFileApplies(slot, p, files)) return;
     missing.add(key);
     const app = appOf(p);
     const appNote = app ? ` (app ${app})` : '';
@@ -245,7 +203,7 @@ function minimumInstanceFindings(resolver, required, instances) {
   return findings;
 }
 
-function contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, editionDeclaration, manifest }) {
+function contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, appSide, editionDeclaration, manifest, phase }) {
   const findings = [
     ...pinFindings({ repoRoot, files, profile: repo.profile, pins, only: scoped }),
     ...supabaseSecretFindings({ repoRoot, files: files.filter((file) => inScope(file)), resolver, repo }),
@@ -253,10 +211,12 @@ function contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pin
     ...feStackFindings({ repoRoot, files: files.filter((file) => inScope(file)), repo, manifest }),
     ...repoLocalCheckFindings({ repoRoot, files }),
     ...lintSuppressionFindings({ repoRoot, files }),
+    ...a15Findings({ repoRoot, files, all, repo, resolver, manifest, isRoot, appSide, inScope }),
   ];
+  findings.push(...trackedStacksGateFindings({ repoRoot, files, all, repo, resolver, manifest, isRoot, inScope, existingFindings: findings }));
   if (isRoot) {
     findings.push(
-      ...appRootFindings({ repoRoot, files, all, repo, resolver, pins }),
+      ...appRootFindings({ repoRoot, files, all, repo, resolver, pins, phase }),
       ...checkAppRoot({ root: repoRoot, resolver, tree: trackedTreeView(all) }).violations.map((item) => ({ code: item.ruleId, level: 'error', path: item.path, line: item.line, column: item.column, source: 'machine', message: `${item.path}: ${item.message}` })),
     );
   } else if (repo.profile === 'be') {
@@ -285,7 +245,7 @@ function sizeSoftFindings({ repoRoot, resolver, files, inScope }) {
  * relative to it, exactly as the standalone repository root was). `files` are the scope's tracked paths; `all` (root only) every
  * tracked path of the app, for the rules that read across it (dependency skew, proof commands).
  */
-function scopeFindings({ repoRoot, root, repo, resolver, files, all = files, scoped, manifest, editionDeclaration = true }) {
+function scopeFindings({ repoRoot, root, repo, resolver, files, all = files, scoped, manifest, appSide = false, editionDeclaration = true, phase }) {
   const inScope = (file) => !scoped || scoped.has(file);
   // A required directory of the root (be/, fe/) is present through the files below it, which are the sides' own.
   const trackedSet = new Set(all);
@@ -299,7 +259,7 @@ function scopeFindings({ repoRoot, root, repo, resolver, files, all = files, sco
   if (repo.kind === RUNTIME_KIND) return findings;
 
   const pins = readPins(root);
-  findings.push(...contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, editionDeclaration, manifest }));
+  findings.push(...contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, appSide, editionDeclaration, manifest, phase }));
   if (!isRoot) findings.push(...sizeSoftFindings({ repoRoot, resolver, files, inScope }));
   return findings;
 }
@@ -314,8 +274,11 @@ function scopeFindings({ repoRoot, root, repo, resolver, files, all = files, sco
  * The root scope and each side run their own rules over their own files (hfs checks per side, the side folder as the old repository
  * root, plus the root checks); every finding path is app-relative. Returns {ok, profile, apps, manifest, tracked, findings, counts};
  * a missing or invalid hfs.json is one HFS_DECLARATION_INVALID / HFS_MANIFEST_MAJOR_MISMATCH error finding, never an exception.
+ * `phase: 'source'` is the runtime's no-install example-render pass: tracked obligations still run, while ignored generated
+ * artifact presence/freshness belongs to the default `workspace` phase after codegen. Ordinary app check/lint always use it.
  */
-export function checkRepo({ repoRoot, root = skillRoot, declaration, files, only, extraFindings = [], tree = files === undefined, manifest = loadSlotManifest({ root }), surface = 'all' }) {
+export function checkRepo({ repoRoot, root = skillRoot, declaration, files, only, extraFindings = [], tree = files === undefined, manifest = loadSlotManifest({ root }), surface = 'all', phase = 'workspace' }) {
+  if (!['source', 'workspace'].includes(phase)) throw new Error(`unknown HFS inspection phase ${phase}`);
   const why = readWhy(root);
   let repo;
   try {
@@ -333,21 +296,23 @@ export function checkRepo({ repoRoot, root = skillRoot, declaration, files, only
   const keep = (list, scopeRoot) => (surface === 'check' ? list.filter((finding) => !(finding.origin === 'repo' && onLintSurface(scopeRoot, finding))) : list);
   if (repo.profile === APP_SCOPE) {
     const own = tracked.filter((file) => resolver.sideOf(file) === null);
-    findings.push(...keep(scopeFindings({ repoRoot, root, repo, resolver, files: own, all: tracked, scoped, manifest }), repoRoot));
+    findings.push(...keep(scopeFindings({ repoRoot, root, repo, resolver, files: own, all: tracked, scoped, manifest, phase }), repoRoot));
     for (const side of SIDES) {
       const prefix = `${side}/`;
       const sideRoot = path.join(repoRoot, side);
       const sideFiles = tracked.filter((file) => file.startsWith(prefix)).map((file) => file.slice(prefix.length));
       const sideScoped = scoped ? new Set([...scoped].filter((file) => file.startsWith(prefix)).map((file) => file.slice(prefix.length))) : null;
-      const sideFindings = scopeFindings({ repoRoot: sideRoot, root, repo: repo.sides[side], resolver: resolver.sides[side], files: sideFiles, scoped: sideScoped, manifest, editionDeclaration: false });
+      const sideFindings = scopeFindings({ repoRoot: sideRoot, root, repo: repo.sides[side], resolver: resolver.sides[side], files: sideFiles, scoped: sideScoped, manifest, appSide: true, editionDeclaration: false, phase });
       const message = appRelativeMessages(side, sideRoot);
       findings.push(...keep(sideFindings, sideRoot).map((finding) => ({ ...finding, side, path: onSide(side, finding.path), message: message(finding.message) })));
     }
   } else {
-    findings.push(...keep(scopeFindings({ repoRoot, root, repo, resolver, files: tracked, scoped, manifest }), repoRoot));
+    findings.push(...keep(scopeFindings({ repoRoot, root, repo, resolver, files: tracked, scoped, manifest, phase }), repoRoot));
   }
   findings.push(...extraFindings);
-  if (tree) findings.push(...treeFindings({ repoRoot, resolver }));
+  const untrackedSecrets = untrackedSecretFindings({ repoRoot, files: tracked, repo });
+  findings.push(...untrackedSecrets);
+  if (tree) findings.push(...treeFindings({ repoRoot, resolver, tracked, reportedUntracked: new Set(untrackedSecrets.map((finding) => finding.path)) }));
 
   // The app-root tree check reports machine codes: their why is read with the check's own.
   const judged = judgedFindings(findings, repo.edition ?? 'full', root);
@@ -395,7 +360,7 @@ function machineFindings(report) {
  * templates or run the formatter (packages/hfs/sync), judged with checkRepo's own. `machine` is injectable for specs. A missing
  * merge-base under `fast` is an Error, never a silent full pass. `repoRoot` may also be a side folder: that side alone is checked.
  */
-export function checkRepository({ repoRoot, root = skillRoot, fast = false, base, extraFindings = [], manifest = loadSlotManifest({ root }), machine = checkArchitecture }) {
+export function checkRepository({ repoRoot, root = skillRoot, fast = false, base, extraFindings = [], manifest = loadSlotManifest({ root }), machine = checkArchitecture, wiring = false, coverageFrom }) {
   const changed = fast ? changedSince(repoRoot, base) : null;
   const slotResult = checkRepo({ repoRoot, root, manifest, extraFindings, surface: 'check', ...(changed ? { only: changed.files, tree: false } : {}) });
   if (slotResult.profile === null) return { ...slotResult, machine: { status: 'skipped', reason: 'hfs.json is not valid' } };
@@ -414,7 +379,7 @@ export function checkRepository({ repoRoot, root = skillRoot, fast = false, base
   const findings = [...slotResult.findings, ...withWhy(judgedFindings(found, repo.edition ?? 'full', root), why)];
   const counts = summarize(findings);
   const ran = runs.filter((info) => info.status === 'ran');
-  return {
+  const result = {
     ...slotResult,
     ok: counts.error === 0,
     findings,
@@ -424,6 +389,26 @@ export function checkRepository({ repoRoot, root = skillRoot, fast = false, base
       : { status: 'skipped', reason: runs.map((info) => info.reason).join('; '), sides: runs, ...(changed ? { base: changed.base } : {}) },
     ...(changed ? { fast: { base: changed.base, changed: changed.files.length } } : {}),
   };
+  return withCheckProofs(result, { repoRoot, root, manifest, wiring, coverageFrom });
+}
+
+/** Optional CLI proofs run over the whole tracked tree, including after a dry edition override. */
+export function withCheckProofs(result, { repoRoot, root = skillRoot, manifest = loadSlotManifest({ root }), wiring = false, coverageFrom, edition } = {}) {
+  if ((!wiring && coverageFrom === undefined) || result.profile === null) return result;
+  const declared = readRepoDeclaration(manifest, repoRoot);
+  const repo = { ...declared, edition: result.editionOverride?.judged ?? edition ?? declared.edition };
+  if (repo.sides) repo.sides = Object.fromEntries(Object.entries(repo.sides).map(([side, declaration]) => [side, { ...declaration, edition: repo.edition }]));
+  const context = { repoRoot, repo, manifest, files: trackedFiles(repoRoot) };
+  const reports = {};
+  if (wiring) reports.wiring = appWiring(context);
+  if (coverageFrom !== undefined) reports.coverage = coverageFromReport({ ...context, coverageFrom });
+  const proofFindings = Object.values(reports).flatMap(report => report.findings);
+  const why = readWhy(root, [...new Set(proofFindings.map(finding => finding.code))]);
+  // The explicit whole-tree wiring proof supersedes the ordinary finder's scoped result.
+  const previous = result.findings.filter(finding => !wiring || finding.code !== BOOT_PROOF_CODE);
+  const findings = [...previous, ...withWhy(judgedFindings(proofFindings, repo.edition ?? 'full', root), why)];
+  const counts = summarize(findings);
+  return { ...result, ...reports, findings, counts, ok: counts.error === 0 };
 }
 
 /** The architecture machine over one scope (a side folder): `{ info, findings }`, finding paths app-relative. */
@@ -461,6 +446,12 @@ export function explainPath({ repoRoot, input, root = skillRoot, declaration, ma
   const resolver = createSlotResolver(manifest, repo);
   const why = readWhy(root);
   const c = resolver.classifyPath(input);
+  const dir = /[\\/]$/.test(input) || (repoRoot && fs.existsSync(path.join(repoRoot, c.path)) && fs.statSync(path.join(repoRoot, c.path)).isDirectory());
+  const liteWork = liteStarciworkFinding(c.path, resolver, { dir });
+  if (liteWork) {
+    const entry = why[liteWork.code];
+    return { ...c, ...liteWork, status: 'forbidden', titleVi: entry.titleVi, whyVi: entry.whyVi };
+  }
   if (c.status === 'no-slot') {
     return { path: c.path, status: 'no-slot', code: 'HFS_SLOT_UNDECLARED', nearest: c.nearest, titleVi: why.HFS_SLOT_UNDECLARED.titleVi, whyVi: why.HFS_SLOT_UNDECLARED.whyVi };
   }