@starci/hfs 4.2.17 → 4.4.0

package/runtime/scripts/hfs/manifest-shape.mjs

@@ -4,7 +4,7 @@
 // (sides, app kinds) and refuses a manifest whole on any problem (HFS_MANIFEST_INVALID). Pure: every function takes a
 // parsed manifest or slot and returns a list of problems in the words of modules/schemas/hfs-slots.schema.yaml.
 import { isPlainObject } from '../../engine/plain-object.mjs';
-import { stringList, byCodeUnit } from '../lib/list.mjs';
+import { stringList, byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
 
 export const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
 export const NAME = /^[a-z][a-z0-9-]*$/;
@@ -86,7 +86,7 @@ export const MANIFEST_KINDS = [APP_KIND, RUNTIME_KIND];
 export const manifestKind = (m) => (isPlainObject(m) && m.kind !== undefined ? m.kind : APP_KIND);
 const strList = (v) => stringList(v);
 
-const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome'];
+const APP_SLOT_KEYS = ['id', 'profiles', 'path', 'presence', 'tracked', 'tier', 'tests', 'owner', 'appKind', 'minInstances', 'requiredWhen', 'requiredInstances', 'requires', 'pattern', 'trigger', 'allows', 'forbids', 'layers', 'kinds', 'roles', 'composedBy', 'budget', 'managedBy', 'liteManagedBy', 'rules', 'goesTo', 'why', 'since', 'perConnection', 'parent', 'editions', 'editionWhy', 'litePresence', 'lite', 'provider', 'coverage', 'entries', 'outcomeHome', 'templateNa', 'exemplifiedBy'];
 /** The fields a slot's `lite` overlay may hold: the same keys it would carry in the slot body, resolved under edition lite. */
 const LITE_OVERLAY_KEYS = ['path', 'requires', 'allows', 'forbids', 'minInstances', 'requiredInstances', 'why'];
 /** A runtime slot has no app kind, side composition, layer or managed template; it may name the generator of a generated copy. */
@@ -184,6 +184,9 @@ function slotListProblems(slot, at) {
 
 function slotAppOptionProblems(slot, at) {
   const bad = [];
+  bad.push(...slotEditionWhyProblems(slot, at), ...slotCoverageEvidenceProblems(slot, at));
+  // Legacy coverage status derives only from an explicit `since`; a slot that omits it is refused, so a new slot can never be taken for an old one.
+  if (slot.since === undefined) bad.push(`${at}: since is required (the manifest version that added the slot)`);
   if (slot.editions !== undefined && !(Array.isArray(slot.editions) && slot.editions.length && slot.editions.every((e) => EDITIONS.includes(e)) && new Set(slot.editions).size === slot.editions.length)) bad.push(`${at}: editions must be a non-empty subset of ${EDITIONS.join(', ')}`);
   if (slot.litePresence !== undefined && !(PRESENCE.includes(slot.litePresence) || (isPlainObject(slot.litePresence) && Object.keys(slot.litePresence).length && Object.entries(slot.litePresence).every(([side, value]) => ['be', 'fe'].includes(side) && PRESENCE.includes(value))))) bad.push(`${at}: litePresence must be a presence value or map sides to presence values`);
   if (slot.provider !== undefined) {
@@ -193,6 +196,38 @@ function slotAppOptionProblems(slot, at) {
   return bad;
 }
 
+function slotEditionWhyProblems(slot, at) {
+  if (slot.editionWhy === undefined) return [];
+  return typeof slot.editionWhy === 'string' && slot.editionWhy.trim()
+    ? [] : [`${at}: editionWhy must be non-empty text`];
+}
+
+const slotEvidencePathValid = (value) => relPath(value) && /^[^\s]+$/.test(value);
+
+function slotEvidenceRefValid(ref) {
+  if (typeof ref === 'string') return slotEvidencePathValid(ref);
+  if (!isPlainObject(ref) || !slotEvidencePathValid(ref.path)) return false;
+  if (!Object.keys(ref).every((key) => ['path', 'edition', 'editions'].includes(key))) return false;
+  if (ref.edition !== undefined && !EDITIONS.includes(ref.edition)) return false;
+  if (ref.editions !== undefined && !nonemptyUniqueList(ref.editions, (edition) => EDITIONS.includes(edition))) return false;
+  return ref.edition === undefined || ref.editions === undefined;
+}
+
+const slotEvidenceRefKey = (ref) => typeof ref === 'string' ? ref
+  : JSON.stringify([ref.path, ref.edition, ref.editions]);
+
+function slotCoverageEvidenceProblems(slot, at) {
+  const bad = [];
+  if (slot.templateNa !== undefined && !(typeof slot.templateNa === 'string' && slot.templateNa.trim()))
+    bad.push(`${at}: templateNa must be non-empty text`);
+  if (slot.exemplifiedBy === undefined) return bad;
+  const refs = slot.exemplifiedBy;
+  const valid = Array.isArray(refs) && refs.length > 0 && refs.every(slotEvidenceRefValid)
+    && new Set(refs.map(slotEvidenceRefKey)).size === refs.length;
+  if (!valid) bad.push(`${at}: exemplifiedBy must be unique repository-relative paths or {path, edition? | editions?} references`);
+  return bad;
+}
+
 function slotLiteOverlayProblems(slot, at) {
   if (slot.lite === undefined) return [];
   const ok = isPlainObject(slot.lite) && Object.keys(slot.lite).length && Object.keys(slot.lite).every((key) => LITE_OVERLAY_KEYS.includes(key))
@@ -209,7 +244,7 @@ function slotEntryProblems(slot, at) {
   if (slot.entries !== undefined) {
     const listed = strList(slot.entries) && slot.entries.length > 0 && new Set(slot.entries).size === slot.entries.length && slot.entries.every(relPath);
     if (!listed) bad.push(`${at}: entries must be a non-empty list of unique relative file paths`);
-    else if (typeof slot.path !== 'string' || !slot.path.endsWith('/') || slot.owner === true) bad.push(`${at}: entries belong to a directory slot that is not an owner (they name extra public entries of the owner that holds it)`);
+    else if (typeof slot.path !== 'string' || !slot.path.endsWith('/')) bad.push(`${at}: entries belong to a directory slot (they name its explicit public API files)`);
     else if (Array.isArray(slot.allows) && slot.entries.some((entry) => !slot.allows.includes(entry))) bad.push(`${at}: every entry must be one of the names the slot allows`);
   }
   if (slot.outcomeHome !== undefined && !(slot.outcomeHome === true && typeof slot.path === 'string' && slot.path && !slot.path.endsWith('/'))) bad.push(`${at}: outcomeHome is true and belongs to a file slot (the one file that declares the repository's Outcome union)`);
@@ -323,21 +358,71 @@ function runtimeParamProblems(rp) {
   ];
 }
 
+const folderKindsValid = list => strList(list) && list.length > 0 && new Set(list).size === list.length && list.every(kind => NAME.test(kind));
+const kindPairValid = pair => isPlainObject(pair) && Object.keys(pair).sort(byCodeUnit).join() === 'from,to'
+  && ['from', 'to'].every(side => folderKindsValid(pair[side]));
+const kindRestrictionValid = kinds => isPlainObject(kinds) && Object.keys(kinds).length > 0
+  && Object.entries(kinds).every(([target, pair]) => NAME.test(target) && kindPairValid(pair));
+const slotIdsValid = list => strList(list) && list.length > 0 && new Set(list).size === list.length
+  && list.every(id => SLOT_ID.test(id) || RUNTIME_SLOT_ID.test(id));
+const slotRestrictionPairValid = pair => isPlainObject(pair) && Object.keys(pair).join() === 'from' && slotIdsValid(pair.from);
+const slotRestrictionValid = slots => isPlainObject(slots) && Object.keys(slots).length > 0
+  && Object.entries(slots).every(([target, pair]) => NAME.test(target) && slotRestrictionPairValid(pair));
+
+function tierDefinitionProblems(profile, tier, def) {
+  const bad = [];
+  const at = `tiers.${profile}.${tier}`;
+  if (!isPlainObject(def) || !Array.isArray(def.mayImport) || !def.mayImport.every((t) => NAME.test(String(t)))) bad.push(`${at}.mayImport must be a list of tier names`);
+  if (def?.mayImportKinds !== undefined && !kindRestrictionValid(def.mayImportKinds)) bad.push(`${at}.mayImportKinds must map tier names to {from, to} non-empty lists of unique folder kinds`);
+  if (def?.mayImportSlots !== undefined && !slotRestrictionValid(def.mayImportSlots)) bad.push(`${at}.mayImportSlots must map tier names to {from} non-empty lists of unique slot ids`);
+  for (const key of Object.keys(def ?? {})) if (!['mayImport', 'mayImportKinds', 'mayImportSlots', 'acyclic', 'lowerLayerOnly'].includes(key)) bad.push(`${at}.${key} is not a tier field`);
+  return bad;
+}
+
 /** Shape problems of the tier map of one profile. */
 export function tierMapProblems(profile, tiers) {
   const bad = [];
   if (!isPlainObject(tiers) || !Object.keys(tiers).length) return [`tiers.${profile} must be a non-empty map`];
   for (const [tier, def] of Object.entries(tiers)) {
     if (!NAME.test(tier)) bad.push(`tiers.${profile}.${tier} is not a tier name`);
-    if (!isPlainObject(def) || !Array.isArray(def.mayImport) || !def.mayImport.every((t) => NAME.test(String(t)))) bad.push(`tiers.${profile}.${tier}.mayImport must be a list of tier names`);
-    for (const key of Object.keys(def ?? {})) if (!['mayImport', 'acyclic', 'lowerLayerOnly'].includes(key)) bad.push(`tiers.${profile}.${tier}.${key} is not a tier field`);
+    bad.push(...tierDefinitionProblems(profile, tier, def));
+  }
+  return bad;
+}
+
+function tierFolderKindProblems(manifest, profile, tier, kinds, at) {
+  const known = new Set(manifest.slots.filter((slot) => slot.profiles.includes(profile) && slot.tier === tier).flatMap((slot) => [...(slot.kinds ?? []), ...(slot.layers ?? [])]));
+  return kinds.filter(kind => !known.has(kind)).map(kind => `${at} names ${kind}, which is not a folder kind of the ${tier} tier`);
+}
+
+function tierSlotRestrictionProblems(manifest, profile, tier, def) {
+  const bad = [];
+  const known = new Set(manifest.slots.filter(slot => slot.profiles.includes(profile) && slot.tier === tier).map(slot => slot.id));
+  for (const [target, restriction] of Object.entries(def.mayImportSlots ?? {})) {
+    const at = `tiers.${profile}.${tier}.mayImportSlots.${target}`;
+    if (!def.mayImport.includes(target)) bad.push(`${at} restricts a tier that mayImport does not allow`);
+    for (const id of restriction.from) if (!known.has(id)) bad.push(`${at}.from names ${id}, which is not a slot of the ${profile} ${tier} tier`);
+  }
+  return bad;
+}
+
+/** Kind and slot restrictions narrow allowed tier edges and name declared source and target roles. */
+export function tierKindProblems(manifest, profile) {
+  const bad = [];
+  for (const [tier, def] of Object.entries(manifest.tiers[profile])) {
+    bad.push(...tierSlotRestrictionProblems(manifest, profile, tier, def));
+    for (const [target, kinds] of Object.entries(def.mayImportKinds ?? {})) {
+      const at = `tiers.${profile}.${tier}.mayImportKinds.${target}`;
+      if (!def.mayImport.includes(target)) bad.push(`${at} restricts a tier that mayImport does not allow`);
+      bad.push(...tierFolderKindProblems(manifest, profile, tier, kinds.from, `${at}.from`), ...tierFolderKindProblems(manifest, profile, target, kinds.to, `${at}.to`));
+    }
   }
   return bad;
 }
 
 /** The semantic rules of a runtime manifest beyond the slot rules both kinds share: tier names and the schema major. */
 export function runtimeSemanticProblems(m) {
-  const bad = [];
+  const bad = tierKindProblems(m, RUNTIME_KIND);
   const tiers = m.tiers.runtime;
   for (const [tier, def] of Object.entries(tiers)) {
     for (const target of def.mayImport) if (!(target in tiers)) bad.push(`tiers.runtime.${tier}.mayImport names ${target}, which is not a runtime tier`);

package/runtime/scripts/hfs/path-findings.mjs

@@ -3,6 +3,7 @@
 // (scripts/hfs/project-graph.mjs) runs it over the same tree and serves the findings on a TypeScript file as ESLint reports.
 //   HFS_SLOT_UNDECLARED / HFS_SLOT_AMBIGUOUS / HFS_SLOT_NOT_ENABLED / HFS_FORBIDDEN_PRESENT / HFS_TOOL_CONFIG_LOCAL / HFS_TRACKED_MUST_BE_IGNORED (R01, R16)
 //   BE_SOURCE_FORM (R89, the file name), BE_SPEC_PLACEMENT (R102)
+import fs from 'node:fs';
 import path from 'node:path';
 import { allowsFile } from './allows.mjs';
 import { isFeTestPath } from './rules/fe-no-tests.mjs';
@@ -30,8 +31,11 @@ function sourceFormContext(file, resolver, suffixes, bannedSuffixes) {
   const slot = resolver.slot(c.slot);
   if ([...(slot?.requires ?? []), ...(slot?.allows ?? [])].includes(base)) return null;
   const admitted = allowsFile(resolver, file);
+  // Environment parsing is an app slot role, not a source suffix admitted outside that matching app file.
+  if (c.slot.startsWith('be.app.') && admitted?.allowed && admitted.entry === '<app>.env.ts') return null;
   if (admitted?.allowed && admitted.entry?.includes('/') && path.posix.basename(admitted.entry) === base) return null;
-  if (admitted?.allowed && PLAIN_ENTRY.test(admitted.entry ?? '') && KEBAB.test(base.slice(0, -'.ts'.length))) return null;
+  // A plain entry names its file by a variable only (`<x>.ts`, or `compose/<area>.ts` of an app slot): a kebab name is its form.
+  if (admitted?.allowed && PLAIN_ENTRY.test(path.posix.basename(admitted.entry ?? '')) && KEBAB.test(base.slice(0, -'.ts'.length))) return null;
   if (c.slot === 'be.persistence' && path.posix.basename(path.posix.dirname(file)) === 'migrations') return null;
   return { c, base, suffixes, bannedSuffixes };
 }
@@ -54,7 +58,7 @@ function sourceFormFinding(file, { c, base, suffixes, bannedSuffixes }, boundSuf
 
 /**
  * BE_SOURCE_FORM (R89): every tracked src/ or apps/ TypeScript file of a back end is index.ts, main.ts, a migration of
- * be.persistence, or <kebab-name>.<suffix>.ts with <suffix> in the closed vocabulary ruleParams.be.suffixes (a name such
+ * be.persistence, the matching <app>.env.ts explicitly admitted by its app slot, or <kebab-name>.<suffix>.ts with <suffix> in the closed vocabulary ruleParams.be.suffixes (a name such
  * as order.service.spec.ts keeps its inner words kebab-case). A suffix of ruleParams.be.bannedSuffixes anywhere in the
  * name is refused by name. Paths no slot owns are HFS_SLOT_UNDECLARED's, not this code's.
  */
@@ -86,6 +90,8 @@ function forbiddenPathFinding(file, c, resolver) {
 }
 
 function pathStatusFinding(file, resolver) {
+  const liteWork = liteStarciworkFinding(file, resolver);
+  if (liteWork) return liteWork;
   const c = resolver.classifyPath(file);
   if (c.status === 'no-slot') {
     const nearestNote = c.nearest ? `; nearest slot ${c.nearest.slot} (${c.nearest.pattern}), matched ${c.nearest.matchedPrefix || '.'} then expected ${c.nearest.expectedNext ?? 'nothing'}` : '';
@@ -98,6 +104,30 @@ function pathStatusFinding(file, resolver) {
   return null;
 }
 
+/** The lite Work boundary, read from app.starciwork's edition-specific admission list, including paths a narrower slot owns. */
+export function liteStarciworkFinding(file, resolver, { dir = false } = {}) {
+  if (resolver.repo?.edition !== 'lite' || !resolver.slot('app.starciwork')) return null;
+  const p = resolver.classifyPath(file).path;
+  if (!p.startsWith('.starciwork/')) return null;
+  const admitted = allowsFile(resolver, dir ? `${p}/.probe` : p);
+  if (admitted?.slot === 'app.starciwork' && admitted.allowed) return null;
+  return { code: 'HFS_STARCIWORK_LITE_FORBIDDEN', level: 'error', path: p, slot: 'app.starciwork', message: `${p}: lite .starciwork holds only workspace.yaml and brand/ (plus .gitignore); remove this path or use the full edition` };
+}
+
+/** Local lite Work leftovers, including metadata ignored by an old full-edition .gitignore. */
+export function liteStarciworkTreeFindings(repoRoot, resolver, tracked) {
+  if (resolver.repo?.edition !== 'lite' || !resolver.slot('app.starciwork')) return [];
+  let entries = [];
+  try { entries = fs.readdirSync(path.join(repoRoot, '.starciwork'), { withFileTypes: true }); } catch { /* Work is optional. */ }
+  const trackedSet = new Set(tracked);
+  return entries.flatMap(entry => {
+    const file = `.starciwork/${entry.name}`;
+    if (trackedSet.has(file)) return [];
+    const finding = liteStarciworkFinding(file, resolver, { dir: entry.isDirectory() });
+    return finding ? [finding] : [];
+  });
+}
+
 /** The findings of the slot manifest over `files` (repository-relative tracked paths) of a repository of `profile`. */
 export function pathFindings({ files, resolver, profile }) {
   const findings = [];

package/runtime/scripts/hfs/refusal-codes.mjs

@@ -0,0 +1,6 @@
+// Infrastructure refusals are shared with the dependency-free runtime copy generator.
+// They describe checks that could not run, rather than catalogued obligations.
+export const REFUSAL_CODES = Object.freeze([
+  'HFS_REPO_UNREADABLE',
+  'HFS_DECLARATION_INVALID', 'HFS_MANIFEST_MAJOR_MISMATCH', 'HFS_MANIFEST_INVALID', 'HFS_FORMAT_TOOL_MISSING', 'HFS_EDITION_INVALID',
+]);

package/runtime/scripts/hfs/rule-catalog.mjs

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { skillRoot } from '../../engine/runtime-root.mjs';
 import { parseYamlCached } from '../lib/yaml-cached.mjs';
+import { jsonClone } from '../lib/json-clone.mjs';
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { SEMVER } from './manifest-shape.mjs';
 import { enforcerJudgedInEdition, judgedInEdition, ruleEditionProblems } from './edition-slots.mjs';
@@ -15,10 +16,129 @@ const RULE_KINDS = Object.freeze(['codemod', 'lint', 'check', 'design']);
 const FINDING_CODE = /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/;
 const ENFORCER_ID = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const FILE_ENFORCERS = new Set(['machine', 'hfs', 'work-validate', 'sonar', 'runtime']);
-const RULE_KEYS = new Set(['id', 'code', 'law', 'scope', 'kinds', 'gates', 'failureCodes', 'editions', 'enforcers', 'cases']);
-const CASE_KEYS = new Set(['id', 'date', 'source', 'ruling', 'quote']);
+const RULE_KEYS = new Set(['id', 'code', 'law', 'scope', 'kinds', 'gates', 'failureCodes', 'editions', 'codeEditions', 'enforcers', 'cases', 'docs', 'exemplifiedBy', 'proves', 'witness', 'editionWhy', 'amendedBy', 'templateNa']);
+const CASE_KEYS = new Set(['id', 'date', 'source', 'ruling', 'quote', 'supersedes', 'status', 'staleWhen', 'amendedBy']);
 const CASE_DATE = /^\d{4}-\d{2}-\d{2}$/;
-const ENFORCER_KEYS = new Set(['kind', 'id', 'status', 'at', 'editions']);
+const ENFORCER_KEYS = new Set(['kind', 'id', 'status', 'at', 'editions', 'editionWhy']);
+const CASE_REFERENCE = /^(?:case-[1-9][0-9]*|(?:ruling:)?R[0-9]{2,3}(?:\/case-[1-9][0-9]*)?|owner:[a-z][a-z0-9]*(?:-[a-z0-9]+)*)$/;
+const EVIDENCE_KEYS = new Set(['path', 'edition', 'editions']);
+const PROOF_KEYS = new Set([...EVIDENCE_KEYS, 'codes', 'fixtures']);
+const WITNESS_KEYS = new Set(['edition', 'base', 'mutate', 'expect']);
+const MUTATION_KEYS = new Set(['op', 'path', 'content']);
+
+function textProblem(value, label, bad) {
+  if (typeof value !== 'string' || !value.trim()) bad.push(`${label} must be non-empty text`);
+}
+
+function dateProblem(value, label, bad) {
+  const date = typeof value === 'string' && CASE_DATE.test(value) ? new Date(`${value}T00:00:00Z`) : null;
+  if (!date || !Number.isFinite(date.getTime()) || date.toISOString() !== `${value}T00:00:00.000Z`) bad.push(`${label} must be a valid YYYY-MM-DD date`);
+}
+
+function relativePathProblem(value, label, bad, anchor = false) {
+  const parts = typeof value === 'string' ? value.split('#') : [];
+  const file = parts[0];
+  const valid = typeof value === 'string' && value.trim() === value && value.length > 0
+    && !/[\r\n\u0000\\]/.test(value) && !/^(?:\/|[a-z][a-z0-9+.-]*:)/i.test(value) && !file.includes(':')
+    && !file.split('/').some((part) => ['', '.', '..'].includes(part))
+    && (parts.length === 1 || (anchor && parts.length === 2 && /^[A-Za-z0-9][A-Za-z0-9_.:-]*$/.test(parts[1])));
+  if (!valid) bad.push(`${label} must be a repository-relative path${anchor ? ' with an optional #anchor' : ''}`);
+}
+
+function unknownKeys(item, allowed, label, bad) {
+  for (const key of Object.keys(item)) if (!allowed.has(key)) bad.push(`${label} has unknown key ${key}`);
+}
+
+function nonEmptyList(value, label, bad) {
+  if (!Array.isArray(value) || !value.length) { bad.push(`${label} must be a non-empty list`); return false; }
+  const normalized = value.map((value) => JSON.stringify(value, (_key, item) => isPlainObject(item) ? Object.fromEntries(Object.keys(item).sort().map((key) => [key, item[key]])) : item));
+  if (new Set(normalized).size !== value.length) bad.push(`${label} repeats a value`);
+  return true;
+}
+
+function optionalText(item, key, label, bad) {
+  if (item[key] !== undefined) textProblem(item[key], `${label}.${key}`, bad);
+}
+
+function evidenceEditionProblems(item, label, bad) {
+  if (item.edition !== undefined && !['full', 'lite'].includes(item.edition)) bad.push(`${label}.edition must be full or lite`);
+  bad.push(...ruleEditionProblems(item, label));
+  if (item.edition !== undefined && item.editions !== undefined) bad.push(`${label} names edition or editions, not both`);
+}
+
+function codeListProblems(codes, label, bad) {
+  if (!nonEmptyList(codes, label, bad)) return;
+  for (const code of codes) if (typeof code !== 'string' || !FINDING_CODE.test(code)) bad.push(`${label} must contain UPPER_SNAKE finding codes`);
+}
+
+function evidenceMapProblems(item, key, label, bad) {
+  unknownKeys(item, key === 'docs' ? EVIDENCE_KEYS : PROOF_KEYS, label, bad);
+  relativePathProblem(item.path, `${label}.path`, bad, key === 'docs');
+  evidenceEditionProblems(item, label, bad);
+  if (item.codes !== undefined) codeListProblems(item.codes, `${label}.codes`, bad);
+  if (item.fixtures !== undefined && nonEmptyList(item.fixtures, `${label}.fixtures`, bad)) item.fixtures.forEach((value) => textProblem(value, `${label}.fixtures`, bad));
+}
+
+function evidenceProblems(rule, key, label, bad) {
+  if (rule[key] === undefined || !nonEmptyList(rule[key], `${label}.${key}`, bad)) return;
+  rule[key].forEach((item, index) => {
+    const at = `${label}.${key}[${index}]`;
+    if (typeof item === 'string') { relativePathProblem(item, at, bad, key === 'docs'); return; }
+    if (!isPlainObject(item)) { bad.push(`${at} must be a path or a map`); return; }
+    evidenceMapProblems(item, key, at, bad);
+  });
+}
+
+function mutationProblems(item, label, bad) {
+  if (!isPlainObject(item)) { bad.push(`${label} must be a map`); return; }
+  unknownKeys(item, MUTATION_KEYS, label, bad);
+  if (!['add', 'edit', 'delete'].includes(item.op)) bad.push(`${label}.op must be add, edit or delete`);
+  relativePathProblem(item.path, `${label}.path`, bad);
+  if (['add', 'edit'].includes(item.op) && typeof item.content !== 'string') bad.push(`${label}.content must be text for add or edit`);
+  if (item.op === 'delete' && item.content !== undefined) bad.push(`${label}.content is absent for delete`);
+}
+
+function witnessEntryProblems(item, label, bad) {
+  if (!isPlainObject(item)) { bad.push(`${label} must be a map`); return; }
+  if (Object.hasOwn(item, 'path')) { evidenceMapProblems(item, 'proves', label, bad); return; }
+  unknownKeys(item, WITNESS_KEYS, label, bad);
+  if (!['full', 'lite'].includes(item.edition)) bad.push(`${label}.edition must be full or lite`);
+  relativePathProblem(item.base, `${label}.base`, bad);
+  codeListProblems(item.expect, `${label}.expect`, bad);
+  if (nonEmptyList(item.mutate, `${label}.mutate`, bad)) item.mutate.forEach((mutation, index) => mutationProblems(mutation, `${label}.mutate[${index}]`, bad));
+}
+
+function witnessProblems(rule, label, bad) {
+  const value = rule.witness;
+  if (value === undefined) return;
+  const at = `${label}.witness`;
+  if (isPlainObject(value)) {
+    unknownKeys(value, new Set(['status', 'reason', 'date']), at, bad);
+    if (value.status !== 'unreachable') bad.push(`${at}.status must be unreachable`);
+    textProblem(value.reason, `${at}.reason`, bad);
+    dateProblem(value.date, `${at}.date`, bad);
+    return;
+  }
+  if (!nonEmptyList(value, at, bad)) return;
+  value.forEach((item, index) => witnessEntryProblems(item, `${at}[${index}]`, bad));
+}
+
+function caseReferenceProblems(value, label, bad) {
+  const values = Array.isArray(value) ? value : [value];
+  if (!nonEmptyList(values, label, bad)) return;
+  for (const ref of values) if (typeof ref !== 'string' || !CASE_REFERENCE.test(ref)) bad.push(`${label} must name case-N, R<id>[/case-N], ruling:R<id>[/case-N] or owner:<id>`);
+}
+
+function caseTransitionProblems(item, label, bad) {
+  if (item.status !== undefined && !['live', 'superseded', 'amended'].includes(item.status)) bad.push(`${label}.status must be live, superseded or amended`);
+  for (const key of ['supersedes', 'amendedBy']) if (item[key] !== undefined) caseReferenceProblems(item[key], `${label}.${key}`, bad);
+  if (item.staleWhen !== undefined && nonEmptyList(item.staleWhen, `${label}.staleWhen`, bad)) {
+    for (const pattern of item.staleWhen) {
+      if (typeof pattern !== 'string' || !pattern.trim()) { bad.push(`${label}.staleWhen must contain non-empty regex strings`); continue; }
+      try { new RegExp(pattern, 'i'); } catch { bad.push(`${label}.staleWhen has an invalid regex ${JSON.stringify(pattern)}`); }
+    }
+  }
+}
 
 function vocabularyProblems(catalog, key, names, bad) {
   if (!isPlainObject(catalog[key])) { bad.push(`${key} must be a map`); return; }
@@ -75,13 +195,15 @@ function checkRuleCases(rule, label, bad) {
     if (typeof item.date !== 'string' || !CASE_DATE.test(item.date)) bad.push(`${at}.date must be YYYY-MM-DD`);
     if (item.source !== 'owner') bad.push(`${at}.source must be owner`);
     for (const key of ['ruling', ...(item.quote === undefined ? [] : ['quote'])]) if (typeof item[key] !== 'string' || !item[key].trim()) bad.push(`${at}.${key} must be text`);
+    caseTransitionProblems(item, at, bad);
   });
 }
 
-function checkRuleGates(label, gates, bad) {
+function checkRuleGates(rule, label, gates, bad) {
   if (!gates.length) return;
-  if (!gates.includes('land')) bad.push(`${label} must run at the land gate (every rule does)`);
-  if (gates.includes('pre-commit') && !gates.includes('pre-push')) bad.push(`${label} runs at pre-commit, so it also runs at pre-push`);
+  const releaseGate = gates.includes('land') || gates.includes('ci');
+  const runtimeGate = rule.scope === 'runtime' && gates.includes('runtime');
+  if (!releaseGate && !runtimeGate) bad.push(`${label} must run at land or ci or, for runtime scope, the runtime gate`);
 }
 
 function checkRuleFailureCodes(rule, label, codeOwner, bad) {
@@ -97,6 +219,19 @@ function checkRuleFailureCodes(rule, label, codeOwner, bad) {
   }
 }
 
+function checkCodeEditions(rule, label, bad) {
+  const value = rule.codeEditions;
+  if (value === undefined) return;
+  if (!isPlainObject(value) || !Object.keys(value).length) { bad.push(`${label}.codeEditions must be a non-empty map`); return; }
+  const editions = Array.isArray(rule.editions) ? rule.editions : ['full', 'lite'];
+  for (const [code, selected] of Object.entries(value)) {
+    const at = `${label}.codeEditions.${code}`;
+    if (!Array.isArray(rule.failureCodes) || !rule.failureCodes.includes(code)) bad.push(`${at} must name a code owned by this rule`);
+    enumListProblems({ editions: selected }, at, 'editions', ['full', 'lite'], bad);
+    if (Array.isArray(selected) && selected.some((edition) => !editions.includes(edition))) bad.push(`${at} must be a subset of the rule's editions`);
+  }
+}
+
 function checkEnforcerIdentity(enforcer, label, seen, bad) {
   if (!ENFORCER_FAMILIES.includes(enforcer.kind)) bad.push(`${label}.kind must be one of ${ENFORCER_FAMILIES.join(', ')}`);
   if (!ENFORCER_ID.test(String(enforcer.id))) bad.push(`${label}.id must be kebab-case`);
@@ -119,6 +254,7 @@ function checkEnforcer(enforcer, index, ruleLabel, seen, bad) {
     if (!ENFORCER_KEYS.has(key)) bad.push(`${label} has unknown key ${key}`);
   }
   bad.push(...ruleEditionProblems(enforcer, label));
+  optionalText(enforcer, 'editionWhy', label, bad);
   checkEnforcerIdentity(enforcer, label, seen, bad);
   if (enforcer.status !== undefined && enforcer.status !== 'planned') bad.push(`${label}.status is either absent or planned`);
   checkEnforcerLocation(enforcer, label, bad);
@@ -140,11 +276,17 @@ function checkRule(rule, index, catalog, codeOwner, bad) {
   checkRuleIdentity(rule, index, catalog, at, label, bad);
   checkRuleText(rule, label, bad);
   checkRuleCases(rule, label, bad);
+  if (rule.amendedBy !== undefined) caseReferenceProblems(rule.amendedBy, `${label}.amendedBy`, bad);
+  optionalText(rule, 'editionWhy', label, bad);
+  optionalText(rule, 'templateNa', label, bad);
+  for (const key of ['docs', 'exemplifiedBy', 'proves']) evidenceProblems(rule, key, label, bad);
+  witnessProblems(rule, label, bad);
   enumListProblems(rule, label, 'kinds', RULE_KINDS, bad);
   bad.push(...ruleEditionProblems(rule, label));
   const gates = enumListProblems(rule, label, 'gates', RULE_GATES, bad);
-  checkRuleGates(label, gates, bad);
+  checkRuleGates(rule, label, gates, bad);
   checkRuleFailureCodes(rule, label, codeOwner, bad);
+  checkCodeEditions(rule, label, bad);
   checkRuleEnforcers(rule, label, bad);
   if (Array.isArray(rule.gates)) {
     const hasSonar = rule.enforcers.some((enforcer) => isPlainObject(enforcer) && enforcer.kind === 'sonar');
@@ -183,15 +325,18 @@ export function loadRuleCatalog({ root = skillRoot, file = path.join(root, HFS_R
   const byCode = new Map(list.flatMap((rule) => rule.failureCodes.map((code) => [code, rule])));
   return Object.freeze({
     version: doc.version, major, minor, patch,
-    gates: deepFreeze(structuredClone(doc.gates)),
-    enforcerKinds: deepFreeze(structuredClone(doc.enforcerKinds)),
+    gates: deepFreeze(jsonClone(doc.gates)),
+    enforcerKinds: deepFreeze(jsonClone(doc.enforcerKinds)),
     rules: list,
     /** The rule with this id (R01..), or null. */
     rule: (id) => byId.get(id) ?? null,
     /** The rule that owns this failure code (its own or a sub-check code), or null. */
     byCode: (code) => byCode.get(code) ?? null,
-    /** Whether a finding code is judged under `edition`: a code of a rule that names `editions` without it is not (a code outside the catalog always is). */
-    judgedIn: (code, edition = 'full') => judgedInEdition(byCode.get(code), edition),
+    /** Whether a finding code is judged under `edition`: codeEditions narrows its owner's editions; uncatalogued codes remain judged. */
+    judgedIn: (code, edition = 'full') => {
+      const owner = byCode.get(code);
+      return judgedInEdition(owner, edition) && (!owner?.codeEditions?.[code] || owner.codeEditions[code].includes(edition));
+    },
     enforcerJudgedIn: (kind, id, edition = 'full') => enforcerJudgedInEdition(list, kind, id, edition),
     /** The rules that run at a gate. */
     forGate: (gate) => list.filter((rule) => rule.gates.includes(gate)),

package/runtime/scripts/hfs/rule-params-shape.mjs

@@ -4,22 +4,33 @@
 import { isPlainObject } from '../../engine/plain-object.mjs';
 import { paramNamesOk } from './param-names.mjs';
 import { kindParamProblems, scenarioProblem } from './declaration-slots.mjs';
-import { roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
-import { byCodeUnit } from '../lib/list.mjs';
+import { NAME, roleListProblems, SCHEMA_AUTHORITIES, unitRolesProblems } from './manifest-shape.mjs';
+import { byCodeUnit, nonemptyUniqueList } from '../lib/list.mjs';
 
 const PROFILES = ['be', 'fe'];
 const BE_OWN = ['infraOwners', 'eventBus', 'specDoubles', 'paramNames', 'suffixes', 'bannedSuffixes', 'contractShape', 'unitRoles', 'logicRoles', 'thinRoles', 'patternScenarios', 'kindPatterns', 'addKinds'];
 const FORM_NAMES = new Set(['call', 'new', 'curried', 'object', 'primitive', 'array']);
 const blockOk = (v) => isPlainObject(v) && Number.isInteger(v.lines) && v.lines >= 2 && Number.isInteger(v.tokens) && v.tokens >= 1 && Object.keys(v).length === 2;
 const fileLinesOk = (v) => isPlainObject(v) && Number.isInteger(v.soft) && v.soft >= 1 && typeof v.hardGrowth === 'boolean' && Object.keys(v).length === 2;
-const sharedParam = (key, v) => (key === 'fileLines' ? fileLinesOk(v) : blockOk(v));
-const sideOk = (side, own, extra = []) => own.every((k) => side[k] !== undefined) && Object.entries(side).every(([k, v]) => own.includes(k) || extra.includes(k) || (['fileLines', 'duplicateBlock'].includes(k) && sharedParam(k, v)));
-const liteOk = (lite, keys) => lite === undefined || (isPlainObject(lite) && Object.keys(lite).length > 0 && Object.keys(lite).every((k) => k !== 'lite' && keys.includes(k)));
+const SHARED_PARAMS = {
+  fileLines: fileLinesOk,
+  duplicateBlock: blockOk,
+  functionLines: v => Number.isInteger(v) && v >= 1,
+  featureFiles: v => Number.isInteger(v) && v >= 1,
+};
+const SHARED_KEYS = Object.keys(SHARED_PARAMS);
+const sharedParam = (key, v) => Object.hasOwn(SHARED_PARAMS, key) && SHARED_PARAMS[key](v);
+const sideOk = (side, own, extra = []) => own.every((k) => side[k] !== undefined) && Object.entries(side).every(([k, v]) => own.includes(k) || extra.includes(k) || sharedParam(k, v));
+const liteKeyOk = (lite, key, keys) => key !== 'lite' && keys.includes(key)
+  && (!['functionLines', 'featureFiles'].includes(key) || sharedParam(key, lite[key]));
+const liteOk = (lite, keys) => lite === undefined || (isPlainObject(lite) && Object.keys(lite).length > 0 && Object.keys(lite).every((k) => liteKeyOk(lite, k, keys)));
 const memberMap = (v, allowEmpty) => isPlainObject(v) && Object.keys(v).length > 0 && Object.values(v).every((list) => Array.isArray(list) && (allowEmpty || list.length > 0) && list.every((x) => /^[A-Z][A-Za-z0-9]*$/.test(String(x))) && new Set(list).size === list.length);
-const roleList = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => /^[a-z][a-z0-9-]*$/.test(String(x))) && new Set(v).size === v.length;
+const roleList = (v) => nonemptyUniqueList(v, (role) => NAME.test(String(role)));
 const formsOk = (v) => Array.isArray(v) && v.length > 0 && v.every((x) => FORM_NAMES.has(x)) && new Set(v).size === v.length;
 const doubleOk = (v) => isPlainObject(v) && /^[A-Za-z][A-Za-z0-9]*$/.test(String(v.double)) && formsOk(v.forms);
 const regexOk = (v) => { try { return typeof v === 'string' && v.length > 0 && Boolean(new RegExp(v)); } catch { return false; } };
+const dbExtensionsOk = (value) => Array.isArray(value) && value.every((name) => typeof name === 'string' && name.length > 0) && new Set(value).size === value.length;
+const dbParamsOk = (db) => db === undefined || (isPlainObject(db) && Object.entries(db).every(([key, value]) => key === 'extensions' && dbExtensionsOk(value)));
 
 function beSpecificProblems(be, manifest) {
   const bad = [];
@@ -43,14 +54,15 @@ function beSpecificProblems(be, manifest) {
 export function ruleParamsProblems(m) {
   const bad = [];
   const rp = m.ruleParams;
-  if (!isPlainObject(rp) || Object.keys(rp).some((k) => ![...PROFILES, 'common'].includes(k)) || !isPlainObject(rp.common) || !isPlainObject(rp.be) || (rp.fe !== undefined && !isPlainObject(rp.fe))) return ['ruleParams must be a map with common, be and optionally fe'];
+  if (!isPlainObject(rp) || Object.keys(rp).some((k) => ![...PROFILES, 'common', 'db'].includes(k)) || !isPlainObject(rp.common) || !isPlainObject(rp.be) || (rp.fe !== undefined && !isPlainObject(rp.fe))) return ['ruleParams must be a map with common, be and optionally fe and db'];
   else {
     // common holds the parameters both sides share; a side may restate one of them (a valid value) as an override, nothing else.
     // Edition lite: a side's optional `lite` map overrides keys of the same side (never `lite` itself) when the app declares edition lite.
-    if (Object.keys(rp.common).length !== 2 || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs exactly fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}');
-    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, 'fileLines', 'duplicateBlock', 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns and addKinds (fileLines and duplicateBlock live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
+    if (!sideOk(rp.common, []) || !fileLinesOk(rp.common.fileLines) || !blockOk(rp.common.duplicateBlock)) bad.push('ruleParams.common needs fileLines {soft, hardGrowth} and duplicateBlock {lines >= 2, tokens >= 1}; optional functionLines and featureFiles must be positive integers');
+    if (!sideOk(rp.be, BE_OWN, ['schemaAuthority', 'lite']) || (rp.be.schemaAuthority !== undefined && !SCHEMA_AUTHORITIES.includes(rp.be.schemaAuthority)) || !liteOk(rp.be.lite, [...BE_OWN, ...SHARED_KEYS, 'schemaAuthority'])) bad.push('ruleParams.be needs infraOwners, eventBus, specDoubles, paramNames, suffixes, bannedSuffixes, contractShape {helper}, unitRoles, logicRoles, thinRoles, patternScenarios, kindPatterns and addKinds (shared parameters live in ruleParams.common, a side may override them); optional: schemaAuthority (' + SCHEMA_AUTHORITIES.join(' | ') + ') and lite (overrides of the same keys)'); else bad.push(...unitRolesProblems(rp.be), ...roleListProblems(rp.be));
     bad.push(...beSpecificProblems(rp.be, m));
-    if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, ['fileLines', 'duplicateBlock']))) bad.push('ruleParams.fe may only restate fileLines and duplicateBlock of ruleParams.common, and carry a lite override of them');
+    if (rp.fe !== undefined && (!sideOk(rp.fe, [], ['lite']) || !liteOk(rp.fe.lite, SHARED_KEYS))) bad.push('ruleParams.fe may only restate the shared parameters of ruleParams.common, and carry a lite override of them');
+    if (!dbParamsOk(rp.db)) bad.push('ruleParams.db may contain only extensions: a list of unique non-empty extension names');
   }
   return bad;
 }

package/runtime/scripts/hfs/rules/a15-findings.mjs

@@ -0,0 +1,88 @@
+// a15-findings.mjs - the one place where the alpha.15 content rules (R247-R280) are wired into `starci app check`.
+// Each rule module of a batch exports a synchronous finder `({ repoRoot, files, all, repo, resolver, manifest, isRoot, inScope }) => finding[]`
+// and is wired here by appending ONE import line and ONE entry to FINDERS. Nothing else in this file changes; the file is union-merged.
+// A finder judges its own edition (`repo.edition`): lite and full are both in scope unless the rule says otherwise.
+// finders-import-begin
+import { featureFileFindings } from './feature-files.mjs';
+import { lexiconFindings } from './lexicon.mjs';
+import { assetsFindings } from './assets.mjs';
+import { unusedSymbolFindings } from './unused-symbol.mjs';
+import { databaseBaselineFindings } from './database-baseline.mjs';
+import { databaseQueuesFindings } from './database-queues.mjs';
+import { databaseConfigFindings } from './database-config.mjs';
+import { docFreshFindings } from './doc-fresh.mjs';
+import { releaseProvenanceFindings } from './release-provenance.mjs';
+import { feStackAllowlistFindings } from './fe-stack.mjs';
+import { appEnvRequiredFindings } from './app-env-required.mjs';
+import { ageKeyCustodyFindings } from './secrets.mjs';
+import { canonCopyDriftFindings } from './canon-copy-drift.mjs';
+import { secretCustodyOnlyFindings } from './secret-custody-only.mjs';
+import { bootProofFindings } from './boot-proof.mjs';
+import { coverageBelowFindings } from './coverage-below.mjs';
+import { deployScanFindings } from './deploy-scan.mjs';
+import { deployWorkflowFindings } from './deploy-workflow.mjs';
+import { scriptHygieneFindings } from './script-hygiene.mjs';
+import { supplyChainFindings } from './supply-chain.mjs';
+import { envParityFindings } from './env-parity.mjs';
+import { envValueShapeFindings } from './env-value-shape.mjs';
+import { liteProofLaneFindings } from './lite-proof-lane.mjs';
+import { stacksSwarmFindings } from './stacks-swarm.mjs';
+import { stacksReleaseFindings } from './stacks-release.mjs';
+import { stacksIngressFindings } from './stacks-ingress.mjs';
+import { stacksLiteBackingFindings } from './stacks-lite-backing.mjs';
+import { stackToolingFindings } from './stack-tooling.mjs';
+import { stacksDeployFindings } from './stacks-deploy.mjs';
+// finders-import-end
+
+/** The failure codes the finders above emit, so `starci app check` ships their labels (check.mjs adds them to CHECK_CODES). Append-only; the coordinator regenerates it at merge time. */
+export const A15_CODES = [
+  // codes-begin
+  'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_API_EXPOSED', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_CRON_OWNED', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_SERVICE_ROLE_SCOPE', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
+  // codes-end
+];
+
+export const FINDERS = [
+  // finders-begin
+  featureFileFindings,
+  lexiconFindings,
+  assetsFindings,
+  unusedSymbolFindings,
+  databaseBaselineFindings,
+  databaseQueuesFindings,
+  databaseConfigFindings,
+  docFreshFindings,
+  releaseProvenanceFindings,
+  feStackAllowlistFindings,
+  appEnvRequiredFindings,
+  ageKeyCustodyFindings,
+  canonCopyDriftFindings,
+  secretCustodyOnlyFindings,
+  bootProofFindings,
+  coverageBelowFindings,
+  deployScanFindings,
+  deployWorkflowFindings,
+  scriptHygieneFindings,
+  supplyChainFindings,
+  envParityFindings,
+  envValueShapeFindings,
+  liteProofLaneFindings,
+  stacksSwarmFindings,
+  stacksReleaseFindings,
+  stacksIngressFindings,
+  stacksLiteBackingFindings,
+  stackToolingFindings,
+  stacksDeployFindings,
+  // finders-end
+];
+
+/** Findings of every alpha.15 content rule over one repository. */
+export function a15Findings(context) {
+  // `starci app check` always passes the full context; a partial one (a finder spec driving the registry with only the fields its rule reads) must not crash the finders of other rules.
+  const full = Boolean(context.repoRoot && context.repo && context.resolver && context.manifest);
+  return FINDERS.flatMap((finder) => {
+    if (full) return finder(context);
+    try { return finder(context); } catch { return []; }
+  });
+}
+
+// A02: include every deployment and supply-chain finding in the bundled app-check catalog.