@starci/hfs 4.4.0 → 4.5.0

package/runtime/knowledge/hfs/slots.yaml

@@ -535,7 +535,6 @@ slots:
     profiles: [app]
     exemplifiedBy:
       - packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml
-      - {path: tests/fixtures/hfs-callback-full/.github/workflows/db-deploy.yml, edition: full}
     editionWhy: "ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4): lite manages its Supabase database deploy workflow; full owns an optional provider-specific workflow."
     # The database deploy workflow: workflow_dispatch only (like app.ci-e2e); starci app sync renders it under the managed ci group.
     path: ".github/workflows/db-deploy.yml"
@@ -546,6 +545,7 @@ slots:
     liteManagedBy: ci-workflows-lite
     rules: [HFS_MANAGED_FILE_DRIFT]
     since: 2.1.0
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: app.ci-stack-deploy
     since: 3.3.0
     profiles: [app]
@@ -657,8 +657,6 @@ slots:
   - id: app.scripts.delivery
     since: 3.1.0
     profiles: [app]
-    exemplifiedBy:
-      - {path: tests/fixtures/hfs-delivery-lite/scripts/build-frontend.mjs, edition: lite}
     editionWhy: "Lite splits product delivery tooling from managed codegen; full owns the same files through app.scripts (ruling:R212/case-2 (with the Work boundary amended by ruling:R212/case-4))."
     editions: [lite]
     # Product-owned environment, secret and build tooling, kept apart from lite's managed codegen script.
@@ -669,6 +667,7 @@ slots:
     tier: none
     tests: none
     rules: [HFS_PLAINTEXT_SECRET, HFS_SCRIPT_ONE_OFF, BE_SPEC_PLACEMENT, HFS_REPO_LOCAL_CHECK]
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: app.sides
     since: 3.1.0
     profiles: [app]
@@ -791,7 +790,6 @@ slots:
     profiles: [app]
     exemplifiedBy:
       - packages/hfs/templates/app/skeleton-lite/supabase/
-      - {path: tests/fixtures/hfs-callback-full/supabase/, edition: full}
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): Supabase is required in lite; full enables it only through a declared connection."
     # The one Supabase project directory, at the app root beside be/, fe/ and .starcistacks (never under a side).
     path: "supabase/"
@@ -802,11 +800,11 @@ slots:
     tier: none
     tests: none
     since: 2.1.0
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: app.supabase.config
     profiles: [app]
     exemplifiedBy:
       - packages/hfs/templates/app/skeleton-lite/supabase/config.toml
-      - {path: tests/fixtures/hfs-callback-full/supabase/config.toml, edition: full}
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite requires Supabase configuration; full requires it only when Supabase is declared."
     # The project configuration: auth keys are env(NAME) references, never literals (L08 judges its policy keys).
     path: "supabase/config.toml"
@@ -817,11 +815,11 @@ slots:
     tier: none
     tests: none
     since: 2.1.0
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: app.supabase.migrations
     profiles: [app]
     exemplifiedBy:
       - packages/hfs/templates/app/skeleton-lite/supabase/migrations/__timestamp___baseline.sql
-      - {path: tests/fixtures/hfs-callback-full/supabase/migrations/20261014100000_baseline.sql, edition: full}
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite uses Supabase schema authority and requires a migration; full opts into that provider."
     # The schema authority of an app on Supabase: forward-only SQL migrations named <timestamp14>_<kebab-name>.sql,
     # one file per change, immutable once on origin/main (L02-L08 judge them).
@@ -834,6 +832,7 @@ slots:
     tier: none
     tests: none
     since: 2.1.0
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: app.supabase.migrations.archive
     profiles: [app]
     # The migrations an existing app retired at its cutover (owner ruling 2026-10-13, migration baseline policy): the live schema is
@@ -858,8 +857,6 @@ slots:
   - id: app.supabase.types
     profiles: [app]
     templateNa: "Database row types are generated from the app's Supabase schema by contract:emit; a hand-authored scaffold template would invent the schema contract."
-    exemplifiedBy:
-      - {path: tests/fixtures/hfs-callback-full/supabase/types/database.types.ts, edition: full}
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite requires generated Supabase row types; full enables them with the provider."
     # The generated Database types (database.types.ts) contract:emit writes from the migrations; both sides read it
     # (sides.<side>.reads supabase/types/); drift against regeneration is L09.
@@ -871,6 +868,7 @@ slots:
     tier: none
     tests: none
     since: 2.1.0
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: app.supabase.templates
     profiles: [app]
     path: "supabase/templates/*.html"
@@ -1006,10 +1004,8 @@ slots:
     tier: none
     tests: none
     coverage: none
-    exemplifiedBy:
-      - {path: tests/fixtures/hfs-i18n-ledger/fe/i18n-dynamic-keys.yaml, editions: [lite, full]}
-      - {path: tests/fixtures/hfs-i18n-ledger/be/i18n-dynamic-keys.yaml, editions: [lite, full]}
     rules: [HFS_UNUSED_SYMBOL]
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: repo.packages
     since: 3.1.0
     profiles: [be, fe]
@@ -1401,8 +1397,6 @@ slots:
     since: 1.0.0
   - id: be.feature.realtime
     profiles: [be]
-    exemplifiedBy:
-      - {path: tests/fixtures/hfs-lite-slots/be/src/features/realtime/order-status/, edition: lite}
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite runs socket.io in the api process, one instance without Redis; full may scale its gateway."
     path: "src/features/realtime/<channel>/"
     presence: opt-in              # a push channel: reads and pushes only (a socket gateway or a GraphQL subscription), no domain write
@@ -1422,6 +1416,7 @@ slots:
     coverage: none
     rules: [BE_KIND_ISOLATION, BE_FEATURE_IMPORTS_FEATURE, BE_FEATURE_NOT_COMPOSED]
     since: 1.0.0
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: be.feature.realtime.graphql
     profiles: [be]
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite uses only the in-process socket.io gateway; the GraphQL subscription door remains full-only."
@@ -1607,8 +1602,6 @@ slots:
   - id: be.platform.event-bus
     since: 3.1.0
     profiles: [be]
-    exemplifiedBy:
-      - {path: tests/fixtures/hfs-lite-slots/be/src/modules/platform/event-bus/, edition: lite}
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite implements the event ports with outbox and pgmq; full uses its Kafka adapter."
     path: "src/modules/platform/event-bus/"
     presence: opt-in
@@ -1627,6 +1620,7 @@ slots:
     coverage: required
     budget: {indexExports: 60}
     rules: [BE_TIER_DIRECTION, ARCH_OWNER_CYCLE, BE_MODULE_SHAPE, BE_INFRA_OWNER]
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: be.platform.queue
     since: 3.1.0
     profiles: [be]
@@ -1750,8 +1744,6 @@ slots:
   - id: be.projections
     since: 3.1.0
     profiles: [be]
-    exemplifiedBy:
-      - {path: tests/fixtures/hfs-lite-slots/be/src/modules/projections/order-summary/, edition: lite}
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite projection tables live in Supabase migrations; full keeps the TypeORM projection entity beside its projection."
     path: "src/modules/projections/<name>/"
     presence: opt-in
@@ -1767,6 +1759,7 @@ slots:
     tests: unit-beside            # a measured slot: <name>.projection.spec.ts beside its projection is legal (the file owes 100 per file; a spec of its own is optional)
     coverage: required
     rules: [BE_PROJECTION_WRITE_OWNER, BE_PROJECTION_SHAPE, BE_TIER_DIRECTION, BE_CONTEXT_COUPLING]
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: be.integrations
     since: 3.1.0
     profiles: [be]
@@ -1796,7 +1789,6 @@ slots:
     profiles: [be]
     exemplifiedBy:
       - packages/hfs/templates/be/skeleton-lite/src/modules/integrations/supabase/
-      - {path: tests/fixtures/hfs-callback-full/be/src/modules/integrations/supabase/, edition: full}
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite requires the Supabase Auth and Storage integration; full opts in through a connection."
     # The only be import of @supabase/* (L10): the Auth admin and Storage admin client, plus the JWKS-based verification of
     # the Supabase access token the guard chain reads (L16). The connection itself is ordinary Postgres (the shared
@@ -1814,6 +1806,7 @@ slots:
     rules: [BE_TIER_DIRECTION, BE_ERROR_HOME, BE_SECRET_DEFAULT]
     coverage: required
     since: 2.1.0
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
 
   # ----- BE: tests (owner test layout 2026-09-30). Unit specs are <name>.service.spec.ts beside their service and nothing else; everything else
   # lives under src/tests/, one folder per kind, and the folder and the file suffix always agree (a file whose suffix does
@@ -1821,8 +1814,6 @@ slots:
   - id: be.tests.world
     since: 3.1.0
     profiles: [be]
-    exemplifiedBy:
-      - {path: tests/fixtures/hfs-lite-slots/be/src/tests/world/, edition: lite}
     editionWhy: "ruling:R212/case-2 (owner:lite-production-swarm) (with the Work boundary amended by ruling:R212/case-4): lite integration proofs use the local Supabase stack and network fakes; full also boots apps and self-hosted services."
     path: "src/tests/world/"
     presence: optional
@@ -1848,6 +1839,7 @@ slots:
       overridden in the DI container. It is the only test location that may import typeorm's DataSource or testcontainers,
       call migrate/runMigrations/synchronize, or write process.env.
     rules: [BE_TEST_TOPOLOGY, BE_TEST_CONSTRAINTS_ON]
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
 
   - id: be.tests.world.kit
     since: 3.1.0
@@ -2015,8 +2007,6 @@ slots:
     rules: [FE_NEXT_CONVENTIONS]
   - id: fe.route.callback
     profiles: [fe]
-    exemplifiedBy:
-      - {path: tests/fixtures/hfs-callback-full/fe/apps/web/src/app/auth/callback/route.ts, edition: full}
     # The auth callback of a Supabase session (the PKCE code exchange), kept only when the auth flow truly needs a server exchange
     # (prefer the client-side PKCE exchange in fe.modules.auth): the one non-health route handler of an app with a Supabase
     # connection; an app without one has no route handler in fe/ (L15).
@@ -2246,8 +2236,7 @@ slots:
     tests: none
     why: the canonical GraphQL client output of codegen is local and never committed; this specific slot overrides the tracked API parent
     rules: [FE_WIRE_GENERATED]
-    exemplifiedBy:
-      - {path: tests/fixtures/hfs-generated-wire/fe/apps/web/src/modules/api/graphql/__generated__/graphql.ts, editions: [lite, full]}
+    exampleNa: "owner:no-runtime-specs (2026-10-17): the only example of this slot in an edition was a deleted runtime fixture; the scaffold e2e exercises the scaffolded slot"
   - id: fe.transport.client
     since: 3.1.0
     profiles: [fe]

package/runtime/modules/kernel/failure-codes.yaml

@@ -1,3 +1,13 @@
+APP_SECRET_IN_CI:
+  title: "App runtime secret appears in CI custody"
+  title_vi: "Bí mật ứng dụng xuất hiện trong CI"
+  meaning_vi: "Khóa cấp cho container ứng dụng cũng được khai báo hoặc tìm thấy trong kho CI."
+  causes_vi:
+    - "Khóa cấp cho container ứng dụng cũng được khai báo hoặc tìm thấy trong kho CI."
+  nextStep_vi: "Giữ khóa ứng dụng trong .enc và xóa khai báo hoặc bản sao CI sau khi kiểm tra nơi dùng."
+  owner: op-retry
+  kind: check-finding
+
 ARCH_COMPILER_FAILURE:
   title: "Compiler failed during architecture check"
   title_vi: "Trình biên dịch lỗi khi kiểm kiến trúc"
@@ -1671,6 +1681,26 @@ BE_WEBHOOK_UNVERIFIED:
   owner: op-retry
   kind: check-finding
 
+CI_DECLARATION_DRIFT:
+  title: "Workflow references drift from CI declarations"
+  title_vi: "Workflow lệch khai báo CI"
+  meaning_vi: "Workflow hoặc liên kết dịch vụ thiếu khai báo đúng lớp, hoặc khai báo bắt buộc không được dùng."
+  causes_vi:
+    - "Workflow hoặc liên kết dịch vụ thiếu khai báo đúng lớp, hoặc khai báo bắt buộc không được dùng."
+  nextStep_vi: "Đối chiếu secrets và vars trong workflow với ci và liên kết dịch vụ; chỉ đánh dấu optional khi phù hợp."
+  owner: op-retry
+  kind: check-finding
+
+CI_SECRET_SEALED:
+  title: "CI name overlaps sealed app custody"
+  title_vi: "Tên CI trùng khóa bí mật đã niêm phong"
+  meaning_vi: "Tên CI hoặc Dependabot cũng là khóa trong thành viên .enc của ứng dụng."
+  causes_vi:
+    - "Tên CI hoặc Dependabot cũng là khóa trong thành viên .enc của ứng dụng."
+  nextStep_vi: "Bỏ khóa ứng dụng khỏi khai báo CI; đưa bí mật CI vào kho GitHub tương ứng."
+  owner: op-retry
+  kind: check-finding
+
 CI_TRIGGERS_RELEASE_ONLY:
   title: "Workflow trigger other than a release tag, a person or the runtime's main"
   title_vi: "Workflow có trigger không phải tag phát hành, người chạy tay hay main của runtime"
@@ -2470,6 +2500,16 @@ FE_PROPS_MUTABLE:
   owner: op-retry
   kind: check-finding
 
+FE_PUBLIC_BUILD_ARG_MISSING:
+  title: "Required public front-end build arguments are missing"
+  title_vi: "Thiếu tham số build công khai bắt buộc của front end"
+  meaning_vi: "Dockerfile thiếu giá trị mặc định ARG và ảnh triển khai thiếu tên NEXT_PUBLIC bắt buộc trong môi trường được báo."
+  causes_vi:
+    - "Vi phạm R300: mã nguồn, cấu hình hoặc schema yêu cầu giá trị công khai nhưng ảnh triển khai không cung cấp tên đó."
+  nextStep_vi: "Thêm giá trị mặc định ARG trong Dockerfile hoặc buildArgs.values hay buildArgs.sealed.keys cho ảnh trong mọi môi trường triển khai; chỉ kiểm tra tên, không mở giá trị mã hóa."
+  owner: op-retry
+  kind: check-finding
+
 FE_PURE_REACHES_DATA:
   title: "Pure component reaches hooks or API"
   title_vi: "Thành phần thuần chạm tới hook hoặc API"
@@ -3308,6 +3348,16 @@ HFS_EDITION_INVALID:
   owner: op-retry
   kind: check-finding
 
+HFS_EMIT_DB_TYPES_STALE:
+  title: "Database types require current migration history"
+  title_vi: "Lịch sử migration chưa khớp để sinh kiểu"
+  meaning_vi: "Tập phiên bản đã áp dụng trong DB cục bộ khác dấu thời gian tệp supabase/migrations."
+  causes_vi:
+    - "Tập phiên bản đã áp dụng trong DB cục bộ khác dấu thời gian tệp supabase/migrations."
+  nextStep_vi: "Chạy npm run db:reset rồi starci app emit; kiểm tra cả phiên bản thiếu và phiên bản thừa."
+  owner: op-retry
+  kind: verb-refusal
+
 HFS_EMPTY_DIR:
   title: "No empty directory outside an `ignored` slot"
   title_vi: "Thư mục rỗng còn sót lại"
@@ -4109,6 +4159,16 @@ HFS_UNUSED_SYMBOL:
   owner: op-retry
   kind: check-finding
 
+HFS_WORKFLOW_CONTEXT:
+  title: "Workflow expressions use contexts available at their key"
+  title_vi: "Biểu thức workflow dùng ngữ cảnh không được phép"
+  meaning_vi: "Biểu thức tại file:line và đường dẫn khóa dùng ngữ cảnh chưa có tại khóa đó."
+  causes_vi:
+    - "Vi phạm R299: env cấp job đọc runner, job, steps hoặc env trước khi ngữ cảnh sẵn sàng."
+  nextStep_vi: "Chuyển env phụ thuộc runner vào env của bước sử dụng, hoặc dùng RUNNER_TEMP trong shell; kiểm tra file:line và đường dẫn khóa được báo."
+  owner: op-retry
+  kind: check-finding
+
 HFS_WORKFLOW_PIN:
   title: "Remote workflow actions use immutable commit SHAs"
   title_vi: "Action của workflow chưa được ghim SHA"
@@ -4886,28 +4946,6 @@ RT_SOURCE_NAME:
   owner: supervisor
   kind: check-finding
 
-RT_SPEC_BUDGET_STALE:
-  title: "A recorded spec duration names a missing file"
-  title_vi: "Một thời lượng spec đã ghi trỏ tới tệp không còn tồn tại"
-  meaning_vi: "Một hàng trong modules/kernel/spec-durations.yaml đặt tên tệp spec không còn tồn tại, nên bản ghi thời lượng của lần land đã cũ và không thể dùng làm ngân sách hiện hành."
-  causes_vi:
-    - "Tệp spec được đổi tên hoặc xóa sau lần làm mới bản ghi gần nhất"
-    - "Bản ghi thời lượng được chép từ một revision khác"
-  nextStep_vi: "Người giám sát làm mới bản ghi từ kết quả land của revision hiện tại để mỗi hàng trỏ tới một tệp spec đang tồn tại."
-  owner: supervisor
-  kind: check-finding
-
-RT_SPEC_OVER_BUDGET:
-  title: "A spec exceeds the land duration budget"
-  title_vi: "Một tệp spec vượt quá ngân sách thời gian của lần land"
-  meaning_vi: "Thời lượng đã ghi của một tệp spec còn tồn tại vượt quá giới hạn chung trong modules/kernel/spec-durations.yaml. Tệp chậm làm kéo dài lần land và phải giảm chi phí thiết lập mà vẫn giữ nguyên từng test, assertion và đường vào production."
-  causes_vi:
-    - "Mỗi test lặp lại việc cài đặt, khởi động tiến trình hoặc dựng fixture nặng"
-    - "Test chờ đồng hồ thật thay vì dùng đồng hồ được tiêm vào"
-  nextStep_vi: "Người giám sát làm theo speed.md: dùng fixture dùng chung trong một tiến trình spec, bỏ cài đặt hoặc khởi động theo từng test, tiêm đồng hồ và không tăng timeout; sau lần land cuối thì làm mới bản ghi thời lượng."
-  owner: supervisor
-  kind: check-finding
-
 RT_SPEC_PLACEMENT:
   title: "Runtime spec out of place"
   title_vi: "Spec của runtime đặt sai chỗ"

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -309,3 +309,33 @@ removed:
     name: anonymousActions
     use: 'the front end holds no Server Action (R243 FE_SERVER_ACTION_FORBIDDEN), so no slot lists anonymous ones'
     since: 1.0.0-alpha.13
+  - id: verb-test-affected
+    kind: verb
+    name: starci test affected
+    use: 'the runtime has no specs of its own (owner ruling no-runtime-specs): `starci runtime verify` runs the check, `starci release clean-test --base <ref>` and `starci release scaffold-e2e`'
+    since: 1.0.0-alpha.19
+    match: '\bstarci test affected\b'
+  - id: verb-test-run
+    kind: verb
+    name: starci test run
+    use: 'the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, `starci release cut` runs the release rows'
+    since: 1.0.0-alpha.19
+    match: '\bstarci test run\b'
+  - id: verb-gate-runtime-coverage
+    kind: verb
+    name: starci gate runtime-coverage
+    use: 'the runtime measures no coverage of its own; the example apps keep their Codecov flags'
+    since: 1.0.0-alpha.19
+    match: '\bgate runtime-coverage\b'
+  - id: verb-release-env-test
+    kind: verb
+    name: starci release env-test
+    use: 'the release rows are the package clean-test (`starci release clean-test`), the scaffold e2e (`starci release scaffold-e2e`) and the runtime check'
+    since: 1.0.0-alpha.19
+    match: '\brelease env-test\b'
+  - id: config-specs-harness
+    kind: config-key
+    name: specs.harness
+    use: 'the runtime has no specs of its own (owner ruling no-runtime-specs); specs.unit and specs.e2e switch the product workflow tests'
+    since: 1.0.0-alpha.19
+    match: '\bspecs\.harness\b'

package/runtime/modules/models/runtimes.yaml

@@ -199,9 +199,8 @@ allocation:
   # revision still differs from the live one that long past minIntervalMs + checkMs + handoverMs is a drift row (scripts/reconciler/drift.mjs).
   selfReload: {minIntervalMs: 300000, handoverMs: 30000, checkMs: 60000, driftGraceMs: 120000}
   # deploy (scripts/reconciler/runtime-deploy.mjs): a deploy waits up to waitMs, polling every pollMs, for the settles, Critic runs and prepared
-  # decisions in flight to finish; after the engine restart it waits up to verifyMs for the new leader's fresh heartbeat on the new revision. The affected-spec child
-  # may run its declared budget (modules/supervisor/affected-tests.yaml) plus affectedMarginMs before the deploy stops it.
-  deploy: {waitMs: 1800000, pollMs: 5000, verifyMs: 120000, affectedMarginMs: 300000}
+  # decisions in flight to finish; after the engine restart it waits up to verifyMs for the new leader's fresh heartbeat on the new revision.
+  deploy: {waitMs: 1800000, pollMs: 5000, verifyMs: 120000}
   # dispatchRefusal (scripts/kernel/dispatch-refusal-memo.mjs): a ready job whose dispatch is refused for the same cause is tried again after baseMs, then twice as long each time (the one retry budget), up to capMs; a change of
   # the cause's fingerprint (runtime revision, a ruling, a resource the refusal names) tries it at once.
   dispatchRefusal: {baseMs: 60000, capMs: 900000}
@@ -210,9 +209,8 @@ allocation:
   footprint: {everyMs: 600000, lockStaleMs: 60000}
   # jobGuard (scripts/guards/hook-install.mjs): a guard file older than ttlMs is pruned.
   jobGuard: {ttlMs: 604800000}
-  # landGate (scripts/supervisor/land.mjs): a land waits waitMs for its turn at the gate; its spec run may take
-  # specsBaseMs plus perSpecMs for every spec it runs, specConcurrency spec files at a time.
-  landGate: {waitMs: 1800000, specsBaseMs: 600000, perSpecMs: 60000, specConcurrency: 6, cliVerbs: 12}
+  # landGate (scripts/supervisor/land.mjs): a land waits waitMs for its turn at the gate.
+  landGate: {waitMs: 1800000}
   # workerClose (scripts/machine/worker-close.mjs; owner rule: a finished worker is closed COMPLETELY): after worker-release and the terminal
   # close the runtime waits verifyMs for every process of that terminal's shell tree to end (polled every pollMs); a survivor proven to belong
   # to the tree is stopped and given stopVerifyMs to end before the finding is raised.

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -70,7 +70,7 @@ properties:
     description: Release gates of the app (starci app release gate and push); packages/hfs/release/gate.mjs is the authority for the fields.
     type: object
   database:
-    description: Database cutover data (starci app db migrate and post-cutover); packages/hfs/db/migrate.mjs is the authority for the fields.
+    description: 'Database cutover data (starci app db migrate and post-cutover); packages/hfs/db/migrate.mjs is the authority for the fields. reset: optional mapping with only backupMaxAgeHours (finite positive number; default 24 hours).'
     type: object
   jobs:
     description: Application-owned schedules, bound to their back-end CLI commands.
@@ -104,6 +104,7 @@ properties:
     properties:
       status: {enum: [deferred, supported]}
       reason: {type: string, minLength: 1}
+  ci: {$ref: '#/$defs/ciDeclaration'}
   services:
     description: >-
       The delivery, quality and platform services this repository's code and CI use - NOT Compose
@@ -119,6 +120,9 @@ properties:
     additionalProperties: false
     properties:
       sonar: {$ref: '#/$defs/service'}
+      codecov: {$ref: '#/$defs/service'}
+      dependabot: {$ref: '#/$defs/serviceOptionalCi'}
+      audit: {$ref: '#/$defs/serviceOptionalCi'}
       container-registry: {$ref: '#/$defs/service'}
       analytics: {$ref: '#/$defs/service'}
       error-tracking: {$ref: '#/$defs/service'}
@@ -140,6 +144,31 @@ $defs:
           local - a server a stack runs (stack and host.local required); hosted - a SaaS or remote
           server (host.public required); disabled - not used (reason required, CI must not call it).
         enum: [local, hosted, disabled]
+      organization: {type: string, minLength: 1}
+      flag: {type: string, minLength: 1}
+      target: {type: number, minimum: 0, maximum: 100}
+      components: {enum: [auto]}
+      required: {type: boolean}
+      ecosystems: {type: array, items: {enum: [npm, docker, github-actions]}}
+      schedule:
+        type: object
+        additionalProperties: false
+        required: [interval]
+        properties:
+          interval: {enum: [daily, weekly, monthly]}
+          day: {enum: [monday, tuesday, wednesday, thursday, friday, saturday, sunday]}
+          time: {type: string, pattern: '^(?:[01][0-9]|2[0-3]):[0-5][0-9]$'}
+      groups:
+        type: object
+        additionalProperties: false
+        properties:
+          minorPatch: {enum: [grouped]}
+          major: {enum: [per-package]}
+      ignore: {type: array, items: {type: string}}
+      security: {enum: [immediate]}
+      level: {enum: [low, moderate, high, critical]}
+      omitDev: {type: boolean}
+      in: {type: array, items: {enum: [release-gate, ci]}}
       purpose: {type: string, minLength: 1}
       reason: {type: string, minLength: 1}
       qualityGate:
@@ -200,6 +229,104 @@ $defs:
             properties:
               needed: {type: string, minLength: 1}
               reason: {type: string, minLength: 1}
+  serviceOptionalCi:
+    type: object
+    additionalProperties: false
+    required: [provider, mode, ownerAction]
+    properties:
+      provider: {$ref: '#/$defs/service/properties/provider'}
+      mode: {$ref: '#/$defs/service/properties/mode'}
+      organization: {$ref: '#/$defs/service/properties/organization'}
+      target: {$ref: '#/$defs/service/properties/target'}
+      components: {$ref: '#/$defs/service/properties/components'}
+      required: {$ref: '#/$defs/service/properties/required'}
+      ecosystems: {$ref: '#/$defs/service/properties/ecosystems'}
+      schedule: {$ref: '#/$defs/service/properties/schedule'}
+      groups: {$ref: '#/$defs/service/properties/groups'}
+      ignore: {$ref: '#/$defs/service/properties/ignore'}
+      security: {$ref: '#/$defs/service/properties/security'}
+      level: {$ref: '#/$defs/service/properties/level'}
+      omitDev: {$ref: '#/$defs/service/properties/omitDev'}
+      in: {$ref: '#/$defs/service/properties/in'}
+      purpose: {$ref: '#/$defs/service/properties/purpose'}
+      reason: {$ref: '#/$defs/service/properties/reason'}
+      qualityGate: {$ref: '#/$defs/service/properties/qualityGate'}
+      host: {$ref: '#/$defs/service/properties/host'}
+      stack: {$ref: '#/$defs/service/properties/stack'}
+      auth: {$ref: '#/$defs/service/properties/auth'}
+      projects: {$ref: '#/$defs/service/properties/projects'}
+      credentials: {$ref: '#/$defs/service/properties/credentials'}
+      runtimeSecrets: {$ref: '#/$defs/service/properties/runtimeSecrets'}
+      ci: {$ref: '#/$defs/service/properties/ci'}
+      ownerAction: {$ref: '#/$defs/service/properties/ownerAction'}
+  ciName: {type: string, pattern: '^[A-Z][A-Z0-9_]*$'}
+  ciDeclaration:
+    type: object
+    additionalProperties: false
+    properties:
+      github:
+        type: object
+        additionalProperties: false
+        required: [repository]
+        properties:
+          repository: {type: string, pattern: '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'}
+          defaultBranch: {type: string, minLength: 1, default: main}
+          workflow: {type: string, pattern: '^[A-Za-z0-9_.-]+\.ya?ml$', default: ci.yml}
+      secrets: {type: array, items: {$ref: '#/$defs/ciSecret'}}
+      vars: {type: array, items: {$ref: '#/$defs/ciVariable'}}
+      dependabot:
+        type: object
+        additionalProperties: false
+        properties:
+          secrets:
+            type: array
+            items:
+              type: object
+              additionalProperties: false
+              required: [name]
+              properties:
+                name: {$ref: '#/$defs/ciName'}
+                purpose: {type: string}
+  ciSecret:
+    anyOf:
+      - type: object
+        additionalProperties: false
+        required: [name, scope]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: repository}
+          purpose: {type: string}
+          optional: {type: boolean}
+      - type: object
+        additionalProperties: false
+        required: [name, scope, environment]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: environment}
+          environment: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+          purpose: {type: string}
+          optional: {type: boolean}
+  ciVariable:
+    anyOf:
+      - type: object
+        additionalProperties: false
+        required: [name, scope, value]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: repository}
+          value: {type: string}
+          purpose: {type: string}
+          optional: {type: boolean}
+      - type: object
+        additionalProperties: false
+        required: [name, scope, value, environment]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: environment}
+          environment: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+          value: {type: string}
+          purpose: {type: string}
+          optional: {type: boolean}
   serviceStack:
     description: >-
       Which stack defines a local service - either a project-owned .starcistacks stack
@@ -269,6 +396,9 @@ $defs:
     additionalProperties: false
     required: [wiring]
     properties:
+      token: {$ref: '#/$defs/ciName'}
+      hostVar: {$ref: '#/$defs/ciName'}
+      organizationVar: {$ref: '#/$defs/ciName'}
       wiring: {enum: [required, optional-follow-up, not-used]}
       workflow: {type: string, minLength: 1}
       permissions: {type: array, items: {type: string, minLength: 1}}