@starci/hfs 4.3.0 → 4.4.0

package/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml

@@ -1,16 +1,193 @@
 # The stack declaration of the lite app, at the app root beside be/, fe/ and .starciwork.
-# Production compute is authored for an operated environment; the starter invents no deployment.
+# The source models declare intended compute; they prove no completed deployment.
+# All-zero application digests are illustrative and must be replaced by verified release digests.
 schema: starci/application-stacks@1
+sources:
+  - repository: {{project}}
 backing:
   supabase:
     provider: supabase
     managed: true
+components:
+  api:
+    role: service
+    image: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    compose: infra/swarm/stack.yaml
+    purpose: The application's GraphQL API; managed Supabase supplies its database and Auth integration.
+    required: true
+  web:
+    role: service
+    image: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    compose: infra/swarm/stack.yaml
+    purpose: The standalone Next.js application with public configuration supplied at build time.
+    required: true
+  ingress:
+    role: ingress
+    stateful: true
+    volumes: [ingress-data, ingress-config-data]
+    image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
+    compose: infra/swarm/stack.yaml
+    purpose: The single declared ingress; certificates and persistent volumes are owner-provisioned.
+    required: true
+environments:
+  dev:
+    status: supported
+    runtime: docker-swarm
+    composeFiles: [infra/swarm/stack.yaml]
+    components:
+      api: {replicas: 1, port: 3001}
+      web: {replicas: 1, port: 3000}
+      ingress: {replicas: 1, port: 80}
+    runbook: README.md
+    ingress:
+      component: ingress
+      hosts: ["dev.{{project}}.example.invalid"]
+    dns:
+      - host: "dev.{{project}}.example.invalid"
+        owner: Development operator
+        receipt: .starcistacks/dev/infra/swarm/owner-actions.md#dns
+    tls:
+      owner: Development operator
+      receipt: .starcistacks/dev/infra/swarm/owner-actions.md#tls
+    release:
+      imagesLock: .starcistacks/dev/infra/swarm/releases/images.lock.yaml
+      pointer: .starcistacks/dev/infra/swarm/releases/current.yaml
+      previous: .starcistacks/dev/infra/swarm/releases/previous.yaml
+      healthAssertions: [API /health/live, API /health/ready, Web /health/live]
+    backup:
+      - component: ingress
+        target: Owner-provisioned encrypted off-host storage for both ingress volumes
+        retention: Seven daily snapshots
+        owner: Development operator
+        restoreProof: .starcistacks/dev/infra/swarm/recovery/restore-proof.md
+      - component: supabase
+        target: Owner-provisioned encrypted off-host storage for development database exports
+        retention: Seven daily exports
+        owner: Development operator
+        restoreProof: .starcistacks/dev/infra/swarm/recovery/restore-proof.md
+    # Scaffolding seals generated placeholders to this app's own recipient; set real values before use.
+    secrets:
+      - name: primary-db-url
+        runtimeName: "{{project}}-dev-primary-db-url-v1"
+        version: 1
+        where: secrets/primary-db-url
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: supabase-service-role-key
+        runtimeName: "{{project}}-dev-supabase-service-role-key-v1"
+        version: 1
+        where: secrets/supabase-service-role-key
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+  production:
+    status: supported
+    runtime: docker-swarm
+    composeFiles: [infra/swarm/stack.yaml]
+    components:
+      api: {replicas: 1, port: 3001}
+      web: {replicas: 1, port: 3000}
+      ingress: {replicas: 1, port: 443, httpPort: 80}
+    runbook: README.md
+    ingress:
+      component: ingress
+      hosts: ["{{project}}.example.invalid", "api.{{project}}.example.invalid"]
+    dns:
+      - host: "{{project}}.example.invalid"
+        owner: Production operator
+        receipt: .starcistacks/production/infra/swarm/owner-actions.md#dns
+      - host: "api.{{project}}.example.invalid"
+        owner: Production operator
+        receipt: .starcistacks/production/infra/swarm/owner-actions.md#dns
+    tls:
+      owner: Production operator
+      receipt: .starcistacks/production/infra/swarm/owner-actions.md#tls
+    release:
+      imagesLock: .starcistacks/production/infra/swarm/releases/images.lock.yaml
+      pointer: .starcistacks/production/infra/swarm/releases/current.yaml
+      previous: .starcistacks/production/infra/swarm/releases/previous.yaml
+      healthAssertions: [API /health/live, API /health/ready, Web /health/live, Signed-in GraphQL request over TLS]
+    backup:
+      - component: ingress
+        target: Owner-provisioned encrypted off-host storage for both ingress volumes
+        retention: Thirty daily snapshots
+        owner: Production operator
+        restoreProof: .starcistacks/production/infra/swarm/recovery/restore-proof.md
+      - component: supabase
+        target: Provider PITR plus owner-provisioned encrypted off-host database exports
+        retention: Seven days PITR and thirty daily exports
+        owner: Production operator
+        restoreProof: .starcistacks/production/infra/swarm/recovery/restore-proof.md
+    # Scaffolding seals generated placeholders to this app's own recipient; set real values before use.
+    secrets:
+      - name: primary-db-url
+        runtimeName: "{{project}}-production-primary-db-url-v1"
+        version: 1
+        where: secrets/primary-db-url
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+      - name: supabase-service-role-key
+        runtimeName: "{{project}}-production-supabase-service-role-key-v1"
+        version: 1
+        where: secrets/supabase-service-role-key
+        recipientPolicy: This app's own age recipient configured in .sops.yaml
+        keyCustody: SOPS_AGE_KEY in the host's untracked .claude/secret.env
+    # What `starci app stack` deploys (verbs: prepare, doctor, deploy, verify, rollback); names and shapes only, never a value.
+    # Add a backup block (digest-pinned tar helper image) once the stateful volumes are provisioned.
+    deploy:
+      stack: {{project}}-production
+      # The image registry. The canon scaffold writes `public` (the owner's default: images cost nothing there); the value belongs to the app from now on
+      # and `starci app sync` never rewrites it. While it is public, `starci app stack build --push` scans every image for secret material first.
+      registry:
+        host: ghcr.io
+        visibility: {{registryVisibility}}
+      images:
+        api:
+          app: api
+        web:
+          app: web
+          buildArgs:
+            values:
+              NEXT_PUBLIC_SITE_URL: "https://{{project}}.example.invalid"
+      volumes:
+        - {{project}}-production-ingress-data
+        - {{project}}-production-ingress-config-data
+      secrets:
+        grants:
+          - service: api
+            filePointers: true
+            from:
+              - member: primary-db-url
+              - member: supabase-service-role-key
+      verify:
+        http:
+          - name: api liveness
+            url: "https://api.{{project}}.example.invalid/health/live"
+            status: 200
+            retry: true
+          - name: api readiness
+            url: "https://api.{{project}}.example.invalid/health/ready"
+            status: 200
+            retry: true
+          - name: web liveness
+            url: "https://{{project}}.example.invalid/health/live"
+            status: 200
+            retry: true
+k8s:
+  status: deferred
+  reason: Lite production uses Docker Swarm with managed Supabase backing; Kubernetes belongs to a future full-edition deployment.
 services:
   sonar:
     provider: sonarqube
     mode: local
     qualityGate: {{sonarGate}}
+    host: {local: http://127.0.0.1:9000}
     stack:
       owner: host
       root: .claude/ext/sonar
       environment: dev
+      compose: compose.yaml
+    auth: token
+    ci: {wiring: optional-follow-up}
+    ownerAction:
+      needed: Provision the shared host Sonar project and its analysis credential through sealed custody.
+      reason: A fresh app declares its quality service without fabricating credentials or a successful analysis.

package/templates/app/skeleton-lite/.starcistacks/dev/README.md

@@ -0,0 +1,20 @@
+# Development stack
+
+The app services may run in a local Docker Swarm; local Supabase is started separately with its CLI and supplies the database and broker. The tracked model contains no self-hosted database.
+The application image references contain illustrative all-zero digests. Replace them with verified published release digests in the manifest, model and `.starcistacks/dev/infra/swarm/releases/images.lock.yaml` before starting the container model. Replace its starter `SUPABASE_URL` with the local Supabase endpoint reachable from the Swarm node, and seal that local database connection and integration credential; a container cannot use the host's loopback address without owner-configured networking. Local source development remains available through the app scripts.
+
+The runtime template tracks no encrypted members. Scaffolding generates the two declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set dev` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
+
+| Command | Operation |
+| --- | --- |
+| prepare | Run `npm run db:start` at the app root; obtain the local Supabase connection and Auth configuration. An owner who chooses local Swarm initializes it, labels its node `{{project}}=dev` and provisions the ingress volumes. Replace the reserved development host consistently in the manifest, Caddyfile and public configuration; resolve it to the node and record this in `.starcistacks/dev/infra/swarm/owner-actions.md`. Create the external development secrets named in the model from real sealed members. |
+| doctor | From this directory, run `docker stack config -c infra/swarm/stack.yaml`. Confirm image, secret and local Supabase availability. |
+| up | Run `docker stack deploy -c infra/swarm/stack.yaml {{project}}-dev` from this directory after preparation. |
+| status | Run `docker stack services {{project}}-dev`. |
+| logs | Run `docker service logs {{project}}-dev_api`; never print mounted credentials. |
+| down | Run `docker stack rm {{project}}-dev`. |
+| verification | Confirm the API `/health/live` and `/health/ready` endpoints and web `/health/live`, then run `npm run lint` from the app root. Retain the last accepted release in `.starcistacks/dev/infra/swarm/releases/previous.yaml` before recording the verified release in `.starcistacks/dev/infra/swarm/releases/current.yaml`. |
+
+Keep real sealed members under `.starcistacks/dev/secrets/*.enc` at the declared paths and inventory their key names in `.starcistacks/dev/runtime/env/KEYS.md`. Rotation creates a new immutable `-v<N>` external secret and updates its version and runtime name together in the manifest and model. Only the declared ingress publishes port 80; the local route uses HTTP with automatic TLS disabled.
+
+The manifest declares seven daily encrypted off-host database exports and ingress-volume snapshots owned by the development operator. `.starcistacks/dev/infra/swarm/recovery/restore-proof.md` is a pending recovery record. Complete an isolated restore and attach a dated receipt before relying on these backups. Release, DNS and restore records remain explicitly pending until an operator supplies real evidence.

package/templates/app/skeleton-lite/.starcistacks/dev/environment.json

@@ -1,5 +1,6 @@
 {
   "environment": "dev",
   "provider": "supabase",
-  "project": "{{project}}"
+  "project": "{{project}}",
+  "runtime": "docker-swarm"
 }

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/Caddyfile

@@ -0,0 +1,16 @@
+{
+    admin 127.0.0.1:2019
+    auto_https off
+}
+
+http://dev.{{project}}.example.invalid {
+    handle /graphql* {
+        reverse_proxy api:3001
+    }
+    handle /health/* {
+        reverse_proxy api:3001
+    }
+    handle {
+        reverse_proxy web:3000
+    }
+}

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/owner-actions.md

@@ -0,0 +1,11 @@
+# Development prerequisite record
+
+Status: pending owner execution. This record states intended configuration and contains no completed operational receipt.
+
+## DNS
+
+The development operator replaces `dev.{{project}}.example.invalid` with a locally owned development name, updates the manifest, Caddyfile and public configuration together, and resolves the name to the Swarm node. Record the actual resolver mapping and dated verification here.
+
+## TLS
+
+The local development route uses HTTP on ingress port 80 with `auto_https off`. The development operator owns this local-only choice and both external ingress volumes. Record any change to locally issued TLS, certificate custody and verification here before exposing the development stack outside the local network.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/recovery/restore-proof.md

@@ -0,0 +1,7 @@
+# Development recovery record
+
+Status: pending owner execution. No backup or restore has been run by scaffolding.
+
+The development operator owns recovery of the managed Supabase database and both external ingress volumes, `{{project}}-dev-ingress-data` and `{{project}}-dev-ingress-config-data`. Retain seven daily encrypted off-host exports or snapshots for each target.
+
+Before relying on the backup policy, restore a database export and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored ingress configuration and state. Attach the dated result here without credentials.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/current.yaml

@@ -0,0 +1,6 @@
+schema: starci/release-pointer@1
+environment: dev
+status: pending-owner-release
+release: null
+verification: null
+# Write a real release digest and dated health receipt only after convergence and verification.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/images.lock.yaml

@@ -0,0 +1,8 @@
+# Illustrative inventory only. Replace application digests with verified published images.
+schema: starci/images-lock@1
+environment: dev
+status: pending-owner-release
+images:
+  api: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  web: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  ingress: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/previous.yaml

@@ -0,0 +1,6 @@
+schema: starci/release-pointer@1
+environment: dev
+status: no-previous-release
+release: null
+verification: null
+# Before moving current, retain the last accepted release here for rollback.

package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/stack.yaml

@@ -0,0 +1,120 @@
+# Illustrative development model. Replace all-zero application digests with verified published release digests before use.
+version: "3.8"
+services:
+  api:
+    image: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    environment:
+      NODE_ENV: development
+      PORT: "3001"
+      HTTP_SECURITY_ALLOWED_ORIGINS: http://dev.{{project}}.example.invalid
+      PRIMARY_DB_URL_FILE: /run/secrets/primary-db-url
+      PRIMARY_DB_SCHEMA: public
+      SUPABASE_URL: https://{{project}}.supabase.co
+      SUPABASE_SERVICE_ROLE_KEY_FILE: /run/secrets/supabase-service-role-key
+    secrets:
+      - source: primary-db-url
+        target: primary-db-url
+      - source: supabase-service-role-key
+        target: supabase-service-role-key
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3001/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == dev"]
+      update_config:
+        parallelism: 1
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+  web:
+    image: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    environment:
+      NODE_ENV: development
+      PORT: "3000"
+      HOSTNAME: 0.0.0.0
+      NEXT_PUBLIC_SITE_URL: http://dev.{{project}}.example.invalid
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/health/live').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      start_period: 20s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == dev"]
+      update_config:
+        parallelism: 1
+        order: start-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+  ingress:
+    image: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb
+    configs:
+      - source: ingress-config
+        target: /etc/caddy/Caddyfile
+    ports:
+      - { target: 80, published: 80, protocol: tcp, mode: ingress }
+    volumes:
+      - ingress-data:/data
+      - ingress-config-data:/config
+    networks: [app]
+    healthcheck:
+      test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:2019/config/"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+    deploy:
+      replicas: 1
+      placement:
+        constraints: ["node.labels.{{project}} == dev"]
+      update_config:
+        parallelism: 1
+        order: stop-first
+        failure_action: rollback
+        monitor: 30s
+      rollback_config:
+        parallelism: 1
+        order: stop-first
+      restart_policy:
+        condition: on-failure
+        delay: 5s
+networks:
+  app:
+    driver: overlay
+secrets:
+  primary-db-url:
+    external: true
+    name: "{{project}}-dev-primary-db-url-v1"
+  supabase-service-role-key:
+    external: true
+    name: "{{project}}-dev-supabase-service-role-key-v1"
+configs:
+  ingress-config:
+    file: ./Caddyfile
+volumes:
+  ingress-data:
+    external: true
+    name: "{{project}}-dev-ingress-data"
+  ingress-config-data:
+    external: true
+    name: "{{project}}-dev-ingress-config-data"

package/templates/app/skeleton-lite/.starcistacks/dev/runtime/env/KEYS.md

@@ -0,0 +1,18 @@
+# Environment key roster
+
+This roster declares names only. Scaffolding generates the two declared encrypted members with placeholder values encrypted to this app's own age recipient. Replace their values through `starci app secret set dev` before creating external secrets. The runtime template tracks no ciphertext; its specs generate members with ephemeral identities in disposable copies. Store product credential values in sealed custody and materialize private KEY files outside the repository.
+
+| Key | Consumer |
+| --- | --- |
+| `PORT` | API listener |
+| `HTTP_SECURITY_ALLOWED_ORIGINS` | API origin allowlist |
+| `PRIMARY_DB_URL` | API primary database connection; `.starcistacks/dev/secrets/primary-db-url.enc` maps to external `{{project}}-dev-primary-db-url-v1` and mounted `/run/secrets/primary-db-url` |
+| `PRIMARY_DB_SCHEMA` | API primary database schema |
+| `SUPABASE_URL` | API Auth and Storage integration |
+| `SUPABASE_SERVICE_ROLE_KEY` | API Auth and Storage integration; `.starcistacks/dev/secrets/supabase-service-role-key.enc` maps to external `{{project}}-dev-supabase-service-role-key-v1` and mounted `/run/secrets/supabase-service-role-key` |
+| `NEXT_PUBLIC_SITE_URL` | Front-end site URL |
+| `NEXT_PUBLIC_GRAPHQL_URL` | Front-end GraphQL transport |
+| `NEXT_PUBLIC_SUPABASE_URL` | Browser Auth client |
+| `NEXT_PUBLIC_SUPABASE_ANON_KEY` | Browser Auth client public key |
+
+Public front-end configuration is supplied at build time and stays outside sealed custody. Production database deployment consumes `SUPABASE_ACCESS_TOKEN`, `SUPABASE_DB_PASSWORD` and `SUPABASE_PROJECT_ID` from its environment's sealed custody; the GitHub secret store carries only the age identity.

package/templates/app/skeleton-lite/.starcistacks/production/README.md

@@ -0,0 +1,38 @@
+# Production stack
+
+The tracked model declares Docker Swarm application services and one digest-pinned Caddy ingress.
+Supabase supplies PostgreSQL, Auth and pgmq. This stack runs no PostgreSQL, Redis or MongoDB service.
+The model is a deployment declaration. It contains no owner credentials, real DNS receipt, completed release or restore proof. Public records under `.starcistacks/production/infra/swarm/` explicitly mark those owner-run operations as pending.
+Its application image references contain illustrative all-zero digests; they identify no published image and must be replaced before deployment.
+
+The runtime template tracks no encrypted members. Scaffolding generates the two declared members with placeholder values encrypted to this app's own recipient in `.sops.yaml`. Replace those values with `starci app secret set production` using the matching host age identity in untracked local custody. Existing generated envelopes are decryptable with that app identity and can be updated in place. Each Docker secret contains the corresponding key's real value, and the API receives it through its declared mounted file.
+
+| Command | Operation |
+| --- | --- |
+| prepare | Owner provisions the Swarm, node label, database, DNS and real sealed secret members, then runs `starci app stack prepare --env production --execute` to create the missing external volumes (the one-time swarm initialization stays an owner-approved step: `--init-swarm` with `--execute`, after the owner's explicit approval). Release images are built and pushed by the managed the managed stack-deploy workflow. |
+| doctor | Run `starci app stack doctor --env production` (read-only): docker, swarm, volumes, services, secrets, configs and the release pointers on the intended manager. |
+| up | After preparation and review, run the manual stack-deploy workflow (Actions, deploy stack) on a release tag; it builds the images and runs `starci app stack deploy --env production --image <service>=<repository>@sha256:<digest> --source-sha <sha> --execute`. A dry run is `starci app stack render` or `deploy` without `--execute`. |
+| status | Run `starci app stack doctor --env production`, or `starci app stack converge --env production --since <ISO time>` to inspect desired and running replicas plus update state. |
+| logs | Run `docker service logs {{project}}-production_api` on the manager; never include secret values in a receipt. |
+| down | After the owner's removal decision, run `docker stack rm {{project}}-production`; persistent external volumes remain in owner custody. |
+| verification | Run `starci app stack verify --env production` (the journeys declared in `deploy.verify`); also confirm public TLS and a signed-in GraphQL request before moving the release pointer. |
+
+## Owner actions before the first release
+
+Every item is pending. Swarm initialization, provider URIs, DNS changes and key rotation are owner-run steps.
+
+| Area | Required owner action and evidence |
+| --- | --- |
+| Swarm and placement | Initialize the intended manager; label the intended stateful node `{{project}}=production`. Only that node owns the external ingress volumes. |
+| DNS | Replace the reserved `example.invalid` hosts consistently in the manifest, Caddyfile and public configuration; publish address records for the web and API hosts and retain a provider receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
+| TLS | Caddy issues certificates after real DNS resolves. Provision `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data` on the selected node; retain an issuance and renewal receipt in `.starcistacks/production/infra/swarm/owner-actions.md`. |
+| Database | Provision Supabase and the app_be connection; provider backups remain enabled. Record the provider URI and recovery owner without copying credentials here. |
+| Secret custody | Replace generated placeholder values with real values at the manifest's declared `.starcistacks/production/secrets/*.enc` paths; record their keys in `.starcistacks/production/runtime/env/KEYS.md`. The app's age identity stays only in the host's untracked `.claude/secret.env`. |
+| External secrets | Materialize the sealed members in owner custody and create `{{project}}-production-primary-db-url-v1` and `{{project}}-production-supabase-service-role-key-v1`. The API reads mounted files; rotation creates new versioned names before updating the model. |
+| Public build configuration | Build the front end with its declared public site and GraphQL URLs, the Supabase public URL and anonymous key. Public browser values stay outside sealed secret custody. |
+| Immutable release | Replace the illustrative all-zero application digests in the manifest, model and `.starcistacks/production/infra/swarm/releases/images.lock.yaml` with digests produced by the verified release. Store each rendered release under `/srv/{{project}}/releases/<digest>`. Retain the last accepted record in `.starcistacks/production/infra/swarm/releases/previous.yaml`, then move the current pointer and update `.starcistacks/production/infra/swarm/releases/current.yaml` after verification. |
+| Rollback | Retain the previous model and images, redeploy that model if convergence or health fails, and record the resulting convergence receipt. Database changes follow an expand/contract sequence. |
+| Backup | Provision the manifest's seven days of database PITR and thirty daily encrypted off-host database exports and ingress-volume snapshots. Record the actual destination and encryption custody in `.starcistacks/production/infra/swarm/recovery/restore-proof.md`; the production operator owns both components. |
+| Restore proof | Perform a restore into isolated infrastructure, verify the restored database and ingress state, and attach a dated receipt with artifact digests to `.starcistacks/production/infra/swarm/recovery/restore-proof.md`. Its initial record is pending; no restore has been run by scaffolding. |
+
+No host scheduler is installed. Scheduled application work belongs to the back-end scheduler or an explicitly declared replicated job.

package/templates/app/skeleton-lite/.starcistacks/production/environment.json

@@ -0,0 +1,6 @@
+{
+  "environment": "production",
+  "provider": "supabase",
+  "project": "{{project}}",
+  "runtime": "docker-swarm"
+}

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/Caddyfile

@@ -0,0 +1,11 @@
+{
+    admin 127.0.0.1:2019
+}
+
+{{project}}.example.invalid {
+    reverse_proxy web:3000
+}
+
+api.{{project}}.example.invalid {
+    reverse_proxy api:3001
+}

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/owner-actions.md

@@ -0,0 +1,11 @@
+# Production prerequisite record
+
+Status: pending owner execution. This record states intended configuration and contains no completed operational receipt.
+
+## DNS
+
+The production operator replaces `{{project}}.example.invalid` and `api.{{project}}.example.invalid` with owned public names, updates the manifest, Caddyfile and public configuration together, and publishes address records for the intended Swarm node. Record the provider, zone, actual hosts and dated DNS receipt here.
+
+## TLS
+
+The production operator provisions the external ingress volumes on the declared node and owns Caddy certificate issuance and renewal. After real DNS resolves, record a dated issuance receipt, persistent certificate custody and HTTPS verification for both public hosts here.

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/recovery/restore-proof.md

@@ -0,0 +1,7 @@
+# Production recovery record
+
+Status: pending owner execution. No backup or restore has been run by scaffolding.
+
+The production operator owns recovery of the managed Supabase database and both external ingress volumes, `{{project}}-production-ingress-data` and `{{project}}-production-ingress-config-data`. Provision seven days of provider PITR and thirty daily encrypted off-host database exports. Retain thirty daily encrypted off-host snapshots for both ingress volumes.
+
+Before relying on the backup policy, restore the provider database backup and both volume snapshots into isolated infrastructure. Record the actual off-host destination, encryption custody, backup artifact digests, restoration time and operator. Verify database connectivity and the API readiness endpoint, then verify the restored TLS and ingress configuration. Attach the dated result here without credentials.

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/releases/current.yaml

@@ -0,0 +1,6 @@
+schema: starci/release-pointer@1
+environment: production
+status: pending-owner-release
+release: null
+verification: null
+# Write a real /srv/{{project}}/releases/<digest> reference and dated health receipt only after verification.

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/releases/images.lock.yaml

@@ -0,0 +1,8 @@
+# Illustrative inventory only. Replace application digests with verified published images.
+schema: starci/images-lock@1
+environment: production
+status: pending-owner-release
+images:
+  api: "{{project}}/api:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  web: "{{project}}/web:v0.0.0@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+  ingress: caddy:2.10.2@sha256:c3d7ee5d2b11f9dc54f947f68a734c84e9c9666c92c88a7f30b9cba5da182adb

package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/releases/previous.yaml

@@ -0,0 +1,6 @@
+schema: starci/release-pointer@1
+environment: production
+status: no-previous-release
+release: null
+verification: null
+# Before moving current, retain the last accepted release here for rollback.