@starci/hfs 4.2.17 → 4.4.0

package/templates/app/skeleton/.starcistacks/production/infra/swarm/stack.yaml

@@ -0,0 +1,142 @@
+# Rendered production model. All-zero app digests are illustrative; publish verified images before use.
+version: "3.8"
+services:
+  core:
+    image: "{{project}}/core:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    environment:
+      NODE_ENV: production
+      PORT: "3001"
+      HTTP_SECURITY_ALLOWED_ORIGINS: https://{{project}}.example.invalid
+      PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
+    secrets:
+      - source: primary-db-url
+        target: primary-db-url
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == production"]
+      update_config:
+        parallelism: 1
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+  app:
+    image: "{{project}}/app:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    environment:
+      NODE_ENV: production
+      PORT: "3000"
+      HOSTNAME: 0.0.0.0
+      NEXT_PUBLIC_SITE_URL: https://{{project}}.example.invalid
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == production"]
+      update_config:
+        parallelism: 1
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+  landing:
+    image: "{{project}}/landing:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    environment:
+      NODE_ENV: production
+      PORT: "3002"
+      HOSTNAME: 0.0.0.0
+      NEXT_PUBLIC_APP_URL: https://{{project}}.example.invalid
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3002/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == production"]
+      update_config:
+        parallelism: 1
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+  ingress:
+    image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
+    configs:
+      - source: ingress-config
+        target: /etc/caddy/Caddyfile
+    ports:
+      - { target: 80, published: 80, protocol: tcp, mode: ingress }
+      - { target: 443, published: 443, protocol: tcp, mode: ingress }
+    volumes:
+      - ingress-data:/data
+      - ingress-config-data:/config
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == production"]
+      update_config:
+        parallelism: 1
+        order: stop-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+networks:
+  app:
+    driver: overlay
+secrets:
+  primary-db-url:
+    external: true
+    name: "{{project}}-production-primary-db-url-v1"
+configs:
+  ingress-config:
+    file: ./Caddyfile
+volumes:
+  ingress-data:
+    external: true
+    name: "{{project}}-production-ingress-data"
+  ingress-config-data:
+    external: true
+    name: "{{project}}-production-ingress-config-data"

package/templates/app/skeleton/.starcistacks/production/runtime/env/KEYS.md

@@ -0,0 +1,14 @@
+# Production environment key roster
+
+This inventory declares names, consumers and mounted file paths. Scaffolding seals a generated database placeholder to this app's own recipient. Replace it with the real credential before use; no successful deployment is claimed by scaffolding.
+
+| Key | Consumer |
+| --- | --- |
+| `PORT` | Core API listener |
+| `HTTP_SECURITY_ALLOWED_ORIGINS` | Core API origin allowlist |
+| `PRIMARY_DB_URL` | Core API and CLI primary database connection; the API reads `PRIMARY_DB_URL_FILE` at `/run/secrets/primary-db-url` |
+| `NEXT_PUBLIC_SITE_URL` | Product front-end site URL |
+| `NEXT_PUBLIC_GRAPHQL_URL` | Product front-end GraphQL transport |
+| `NEXT_PUBLIC_APP_URL` | Landing front-end product link |
+
+Public front-end configuration is supplied at build time and stays outside sealed custody. Replace the generated private placeholder only in `.starcistacks/production/secrets/primary-db-url.enc`, already declared by the manifest. The versioned external database secret is `{{project}}-production-primary-db-url-v1`.

package/templates/app/skeleton/README.md

@@ -1,19 +1,19 @@
 # {{project}}
 
-One StarCi app: its back end in be/, its front end in fe/, one install at the root.
+One StarCi app: its back end in `be/`, its front end in `fe/`, one install at the root.
 
 ## Overview
 
-The app starts with the core api app (be/apps/core) and the cli app (be/apps/cli) over one primary database, two Next apps (fe/apps/landing, the public front door, and fe/apps/app, the product) over the shared packages fe/packages/{{project}}-ui and fe/packages/{{project}}-i18n.
+The app starts with the core api app (`be/apps/core`) and the cli app (`be/apps/cli`) over one primary database, two Next apps (`fe/apps/landing`, the public front door, and `fe/apps/app`, the product) over the shared packages `fe/packages/{{project}}-ui` and `fe/packages/{{project}}-i18n`.
 
 ## Stack
 
-TypeScript everywhere; NestJS in be/, Next.js with next-intl in fe/; npm with one package.json and one lockfile at the root.
+TypeScript everywhere; NestJS in `be/`, Next.js with next-intl in `fe/`; npm with one `package.json` and one lockfile at the root.
 
 ## Repository layout
 
-- `be/`: the back end, `apps/<app>/src` composes `src/features` and `src/modules`; its tests live under `src/tests`.
-- `fe/`: the front end, one Next app per `apps/<app>` and the shared workspace packages under `packages/` (the ui drawings and the next-intl stack both apps call).
+- `be/`: the back end, `be/apps/<app>/src` composes `be/src/features` and `be/src/modules`; its tests live under `be/src/tests`.
+- `fe/`: the front end, one Next app per `fe/apps/<app>` and the shared workspace packages under `fe/packages/` (the ui drawings and the next-intl stack both apps call).
 - `scripts/`: the app's operational scripts; `hfs.json` declares both sides.
 
 ## Development
@@ -31,7 +31,7 @@ The core api app reads `PORT`, `HTTP_SECURITY_ALLOWED_ORIGINS` (comma-separated
 requests) and `PRIMARY_DB_URL` at boot; every door is closed until it is marked public or sign-in is designed. The cli app reads
 `PRIMARY_DB_URL`: `npm run migrate` applies the migrations of the primary database before the api starts, and
 `npm run cli -- seed run` runs the dev seeds of `.starcistacks/dev/seeds` (run both from the app root). The product app reads
-`NEXT_PUBLIC_SITE_URL` and `NEXT_PUBLIC_GRAPHQL_URL` (the back end it calls through `src/modules/api`, read once the first GraphQL operation exists), the landing `NEXT_PUBLIC_APP_URL` (the product app it hands the reader over to). A missing key stops the process with an error that names it.
+`NEXT_PUBLIC_SITE_URL` and `NEXT_PUBLIC_GRAPHQL_URL` (the back end it calls through `fe/apps/app/src/modules/api`, read once the first GraphQL operation exists), the landing `NEXT_PUBLIC_APP_URL` (the product app it hands the reader over to). A missing key stops the process with an error that names it.
 
 ## Work
 

package/templates/app/skeleton/scripts/codegen.mjs

@@ -1,7 +1,6 @@
 // codegen.mjs - the app's generated code, the one step behind `npm run codegen` (lint, typecheck, dev and build run it first).
 // The front end reads the back end's committed contracts in place (be/contracts/, hfs.json sides.fe.reads) and generates its
 // client from them into a gitignored __generated__/ folder. A new app has no contract yet, so there is nothing to generate.
-import fs from "node:fs"
-import path from "node:path"
+// {{> app/codegen-prelude.mjs.partial}}
 
 // {{> app/codegen-graphql.mjs.partial}}

package/templates/app/skeleton-lite/.editorconfig

@@ -0,0 +1,16 @@
+{{header}}
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 4
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{json,yml,yaml}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

package/templates/app/skeleton-lite/.gitattributes

@@ -0,0 +1,8 @@
+{{header}}
+* text=auto eol=lf
+*.enc binary
+# Scripts and the deploy data are mounted into Linux containers: CRLF there fails (set: Illegal option -).
+*.sh text eol=lf
+*.mjs text eol=lf
+.starcistacks/** text eol=lf
+.starcistacks/**/*.enc binary

package/templates/app/skeleton-lite/.github/dependabot.yml

@@ -0,0 +1,17 @@
+{{header}}
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directories:
+      - /be/apps/*
+      - /fe/apps/*
+    schedule:
+      interval: weekly

package/templates/app/skeleton-lite/.nvmrc

@@ -0,0 +1 @@
+{{nodeMajor}}

package/templates/app/skeleton-lite/.sops.yaml

@@ -1,3 +1,4 @@
-# Lite secrets have encrypted twins only under .starcistacks/<environment>/secrets.
-# Set a project-owned age recipient before encrypting the first secret.
+# The runtime template tracks no sealed members or shared recipient.
+# Scaffolding configures this app's own age recipient and generates sealed placeholders.
+# The private identity lives only in untracked .claude/secret.env as SOPS_AGE_KEY.
 creation_rules: []

package/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml

@@ -0,0 +1,193 @@
+# The stack declaration of the lite app, at the app root beside be/, fe/ and .starciwork.
+# The source models declare intended compute; they prove no completed deployment.
+# All-zero application digests are illustrative and must be replaced by verified release digests.
+schema: starci/application-stacks@1
+sources:
+  - repository: {{project}}
+backing:
+  supabase:
+    provider: supabase
+    managed: true
+components:
+  api:
+    role: service
+    image: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    compose: infra/swarm/stack.yaml
+    purpose: The application's GraphQL API; managed Supabase supplies its database and Auth integration.
+    required: true
+  web:
+    role: service
+    image: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    compose: infra/swarm/stack.yaml
+    purpose: The standalone Next.js application with public configuration supplied at build time.
+    required: true
+  ingress:
+    role: ingress
+    stateful: true
+    volumes: [ingress-data, ingress-config-data]
+    image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
+    compose: infra/swarm/stack.yaml
+    purpose: The single declared ingress; certificates and persistent volumes are owner-provisioned.
+    required: true
+environments:
+  dev:
+    status: supported
+    runtime: docker-swarm
+    composeFiles: [infra/swarm/stack.yaml]
+    components:
+      api: {replicas: 1, port: 3001}
+      web: {replicas: 1, port: 3000}
+      ingress: {replicas: 1, port: 80}
+    runbook: README.md
+    ingress:
+      component: ingress
+      hosts: ["dev.{{project}}.example.invalid"]
+    dns:
+      - host: "dev.{{project}}.example.invalid"
+        owner: Development operator
+        receipt: .starcistacks/dev/infra/swarm/owner-actions.md#dns
+    tls:
+      owner: Development operator
+      receipt: .starcistacks/dev/infra/swarm/owner-actions.md#tls
+    release:
+      imagesLock: .starcistacks/dev/infra/swarm/releases/images.lock.yaml
+      pointer: .starcistacks/dev/infra/swarm/releases/current.yaml
+      previous: .starcistacks/dev/infra/swarm/releases/previous.yaml
+      healthAssertions: [API /health/live, API /health/ready, Web /health/live]
+    backup:
+      - component: ingress
+        target: Owner-provisioned encrypted off-host storage for both ingress volumes
+        retention: Seven daily snapshots
+        owner: Development operator
+        restoreProof: .starcistacks/dev/infra/swarm/recovery/restore-proof.md
+      - component: supabase
+        target: Owner-provisioned encrypted off-host storage for development database exports
+        retention: Seven daily exports
+        owner: Development operator
+        restoreProof: .starcistacks/dev/infra/swarm/recovery/restore-proof.md
+    # Scaffolding seals generated placeholders to this app's own recipient; set real values before use.
+    secrets:
+      - name: primary-db-url
+        runtimeName: "{{project}}-dev-primary-db-url-v1"
+        version: 1
+        where: secrets/primary-db-url
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: supabase-service-role-key
+        runtimeName: "{{project}}-dev-supabase-service-role-key-v1"
+        version: 1
+        where: secrets/supabase-service-role-key
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+  production:
+    status: supported
+    runtime: docker-swarm
+    composeFiles: [infra/swarm/stack.yaml]
+    components:
+      api: {replicas: 1, port: 3001}
+      web: {replicas: 1, port: 3000}
+      ingress: {replicas: 1, port: 443, httpPort: 80}
+    runbook: README.md
+    ingress:
+      component: ingress
+      hosts: ["{{project}}.example.invalid", "api.{{project}}.example.invalid"]
+    dns:
+      - host: "{{project}}.example.invalid"
+        owner: Production operator
+        receipt: .starcistacks/production/infra/swarm/owner-actions.md#dns
+      - host: "api.{{project}}.example.invalid"
+        owner: Production operator
+        receipt: .starcistacks/production/infra/swarm/owner-actions.md#dns
+    tls:
+      owner: Production operator
+      receipt: .starcistacks/production/infra/swarm/owner-actions.md#tls
+    release:
+      imagesLock: .starcistacks/production/infra/swarm/releases/images.lock.yaml
+      pointer: .starcistacks/production/infra/swarm/releases/current.yaml
+      previous: .starcistacks/production/infra/swarm/releases/previous.yaml
+      healthAssertions: [API /health/live, API /health/ready, Web /health/live, Signed-in GraphQL request over TLS]
+    backup:
+      - component: ingress
+        target: Owner-provisioned encrypted off-host storage for both ingress volumes
+        retention: Thirty daily snapshots
+        owner: Production operator
+        restoreProof: .starcistacks/production/infra/swarm/recovery/restore-proof.md
+      - component: supabase
+        target: Provider PITR plus owner-provisioned encrypted off-host database exports
+        retention: Seven days PITR and thirty daily exports
+        owner: Production operator
+        restoreProof: .starcistacks/production/infra/swarm/recovery/restore-proof.md
+    # Scaffolding seals generated placeholders to this app's own recipient; set real values before use.
+    secrets:
+      - name: primary-db-url
+        runtimeName: "{{project}}-production-primary-db-url-v1"
+        version: 1
+        where: secrets/primary-db-url
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: supabase-service-role-key
+        runtimeName: "{{project}}-production-supabase-service-role-key-v1"
+        version: 1
+        where: secrets/supabase-service-role-key
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+    # What `starci app stack` deploys (verbs: prepare, doctor, deploy, verify, rollback); names and shapes only, never a value.
+    # Add a backup block (digest-pinned tar helper image) once the stateful volumes are provisioned.
+    deploy:
+      stack: {{project}}-production
+      # The image registry. The canon scaffold writes `public` (the owner's default: images cost nothing there); the value belongs to the app from now on
+      # and `starci app sync` never rewrites it. While it is public, `starci app stack build --push` scans every image for secret material first.
+      registry:
+        host: ghcr.io
+        visibility: {{registryVisibility}}
+      images:
+        api:
+          app: api
+        web:
+          app: web
+          buildArgs:
+            values:
+              NEXT_PUBLIC_SITE_URL: "https://{{project}}.example.invalid"
+      volumes:
+        - {{project}}-production-ingress-data
+        - {{project}}-production-ingress-config-data
+      secrets:
+        grants:
+          - service: api
+            filePointers: true
+            from:
+              - member: primary-db-url
+              - member: supabase-service-role-key
+      verify:
+        http:
+          - name: api liveness
+            url: "https://api.{{project}}.example.invalid/health/live"
+            status: 200
+            retry: true
+          - name: api readiness
+            url: "https://api.{{project}}.example.invalid/health/ready"
+            status: 200
+            retry: true
+          - name: web liveness
+            url: "https://{{project}}.example.invalid/health/live"
+            status: 200
+            retry: true
+k8s:
+  status: deferred
+  reason: Lite production uses Docker Swarm with managed Supabase backing; Kubernetes belongs to a future full-edition deployment.
+services:
+  sonar:
+    provider: sonarqube
+    mode: local
+    qualityGate: {{sonarGate}}
+    host: {local: http://127.0.0.1:9000}
+    stack:
+      owner: host
+      root: .claude/ext/sonar
+      environment: dev
+      compose: compose.yaml
+    auth: token
+    ci: {wiring: optional-follow-up}
+    ownerAction:
+      needed: Provision the shared host Sonar project and its analysis credential through sealed custody.
+      reason: A fresh app declares its quality service without fabricating credentials or a successful analysis.

package/templates/app/skeleton-lite/.starcistacks/dev/README.md

@@ -0,0 +1,20 @@
+# Development stack
+
+The app services may run in a local Docker Swarm; local Supabase is started separately with its CLI and supplies the database and broker. The tracked model contains no self-hosted database.
+The application image references contain illustrative all-zero digests. Replace them with verified published release digests in the manifest, model and `.starcistacks/dev/infra/swarm/releases/images.lock.yaml` before starting the container model. Replace its starter `SUPABASE_URL` with the local Supabase endpoint reachable from the Swarm node, and seal that local database connection and integration credential; a container cannot use the host's loopback address without owner-configured networking. Local source development remains available through the app scripts.
+
+The runtime template tracks no encrypted members. Scaffolding generates the two declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set dev` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
+
+| Command | Operation |
+| --- | --- |
+| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
+| doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local Supabase availability. |
+| up | Run `docker stack deploy -c infra/swarm/stack.yaml {{project}}-dev` from this directory after preparation. |
+| status | Run `docker stack services {{project}}-dev`. |
+| logs | Run `docker service logs {{project}}-dev_api`; never print mounted credentials. |
+| down | Run `docker stack rm {{project}}-dev`. |
+| verification | Confirm the API `/health/live` and `/health/ready` endpoints and web `/health/live`, then run `npm run lint` from the app root. Retain the last accepted release in `.starcistacks/dev/infra/swarm/releases/previous.yaml` before recording the verified release in `.starcistacks/dev/infra/swarm/releases/current.yaml`. |
+
+Keep real sealed members under `.starcistacks/dev/secrets/*.enc` at the declared paths and inventory their key names in `.starcistacks/dev/runtime/env/KEYS.md`. Rotation creates a new immutable `-v<N>` external secret and updates its version and runtime name together in the manifest and model. Only the declared ingress publishes port 80; the local route uses HTTP with automatic TLS disabled.
+
+The manifest declares seven daily encrypted off-host database exports and ingress-volume snapshots owned by the development operator. `.starcistacks/dev/infra/swarm/recovery/restore-proof.md` is a pending recovery record. Complete an isolated restore and attach a dated receipt before relying on these backups. Release, DNS and restore records remain explicitly pending until an operator supplies real evidence.

package/templates/app/skeleton-lite/.starcistacks/dev/environment.json

@@ -1,5 +1,6 @@
 {
   "environment": "dev",
   "provider": "supabase",
-  "project": "{{project}}"
+  "project": "{{project}}",
+  "runtime": "docker-swarm"
 }

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/Caddyfile

@@ -0,0 +1,16 @@
+{
+    admin 127.0.0.1:2019
+    auto_https off
+}
+
+http://dev.{{project}}.example.invalid {
+    handle /graphql* {
+        reverse_proxy api:3001
+    }
+    handle /health/* {
+        reverse_proxy api:3001
+    }
+    handle {
+        reverse_proxy web:3000
+    }
+}

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/owner-actions.md

@@ -0,0 +1,11 @@
+# Development prerequisite record
+
+Status: pending owner execution. This record states intended configuration and contains no completed operational receipt.
+
+## DNS
+
+The development operator replaces `dev.{{project}}.example.invalid` with a locally owned development name, updates the manifest, Caddyfile and public configuration together, and resolves the name to the Swarm node. Record the actual resolver mapping and dated verification here.
+
+## TLS
+
+The local development route uses HTTP on ingress port 80 with `auto_https off`. The development operator owns this local-only choice and both external ingress volumes. Record any change to locally issued TLS, certificate custody and verification here before exposing the development stack outside the local network.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/recovery/restore-proof.md

@@ -0,0 +1,7 @@
+# Development recovery record
+
+Status: pending owner execution. No backup or restore has been run by scaffolding.
+
+The development operator owns recovery of the managed Supabase database and both external ingress volumes, `{{project}}-dev-ingress-data` and `{{project}}-dev-ingress-config-data`. Retain seven daily encrypted off-host exports or snapshots for each target.
+
+Before relying on the backup policy, restore a database export and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored ingress configuration and state. Attach the dated result here without credentials.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/current.yaml

@@ -0,0 +1,6 @@
+schema: starci/release-pointer@1
+environment: dev
+status: pending-owner-release
+release: null
+verification: null
+# Write a real release digest and dated health receipt only after convergence and verification.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/images.lock.yaml

@@ -0,0 +1,8 @@
+# Illustrative inventory only. Replace application digests with verified published images.
+schema: starci/images-lock@1
+environment: dev
+status: pending-owner-release
+images:
+  api: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  web: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  ingress: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/previous.yaml

@@ -0,0 +1,6 @@
+schema: starci/release-pointer@1
+environment: dev
+status: no-previous-release
+release: null
+verification: null
+# Before moving current, retain the last accepted release here for rollback.