@starci/hfs 4.4.0 → 4.5.0

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "757ac9945db2a2b217a5dea8be2cd2c0fcb895230762eb9cd15700b8a44bce49",
+  "hash": "d230745d3aa5cfe65f75cb5fb2872924b935f1b4610c0b72db2f729572386404",
   "global": [
     {
       "name": "json",
@@ -176,8 +176,91 @@ export const CATALOG = {
           "impl": null,
           "runtimeSide": "host"
         },
+        "ci": {
+          "summary": "set declared GitHub CI secrets and variables and verify their custody",
+          "owner": "@starci/hfs",
+          "positional": [
+            {
+              "name": "action",
+              "enum": [
+                "secret",
+                "var",
+                "verify"
+              ],
+              "required": true,
+              "variadic": false
+            },
+            {
+              "name": "operation",
+              "enum": [
+                "set",
+                "sync"
+              ],
+              "required": false,
+              "variadic": false
+            },
+            {
+              "name": "name",
+              "required": false,
+              "variadic": false
+            }
+          ],
+          "flags": [
+            {
+              "name": "env",
+              "type": "string",
+              "summary": "select the declared GitHub environment"
+            },
+            {
+              "name": "dependabot",
+              "type": "boolean",
+              "summary": "select the Dependabot secret store"
+            },
+            {
+              "name": "repo",
+              "type": "string",
+              "summary": "override the app repository with owner/name"
+            },
+            {
+              "name": "value",
+              "type": "string",
+              "summary": "public variable value that must agree with the manifest"
+            },
+            {
+              "name": "execute",
+              "type": "boolean",
+              "summary": "apply the variable sync plan"
+            },
+            {
+              "name": "json",
+              "type": "boolean",
+              "summary": "print verification findings as JSON"
+            }
+          ],
+          "exit": {
+            "0": "action completed or verification clean",
+            "1": "verification findings",
+            "2": "refusal or bad usage"
+          },
+          "json": "flag",
+          "examples": [
+            "starci app ci secret set SONAR_TOKEN",
+            "starci app ci secret set VPS_SSH_KEY --env production",
+            "starci app ci secret set NPM_TOKEN --dependabot",
+            "starci app ci var set SONAR_HOST_URL",
+            "starci app ci var sync",
+            "starci app ci var sync --execute",
+            "starci app ci verify --json"
+          ],
+          "editions": [
+            "full",
+            "lite"
+          ],
+          "impl": null,
+          "runtimeSide": "host"
+        },
         "db": {
-          "summary": "preview or apply a migration baseline, restamp, history migration or post-cutover step",
+          "summary": "preview or apply database migrations, encrypted backups and guarded linked resets",
           "owner": "@starci/hfs",
           "positional": [
             {
@@ -187,13 +270,40 @@ export const CATALOG = {
                 "restamp",
                 "plan",
                 "migrate",
-                "post-cutover"
+                "post-cutover",
+                "dump",
+                "reset"
               ],
               "required": true,
               "variadic": false
             }
           ],
           "flags": [
+            {
+              "name": "out",
+              "type": "string",
+              "summary": "dump: destination outside the app and every Git worktree"
+            },
+            {
+              "name": "schema-only",
+              "type": "boolean",
+              "summary": "dump: omit data parts; this backup cannot authorize reset"
+            },
+            {
+              "name": "auth",
+              "type": "string",
+              "summary": "reset: required keep or drop; drop deletes users and identities"
+            },
+            {
+              "name": "storage",
+              "type": "string",
+              "summary": "reset: required keep or drop; drop empties objects metadata but does not delete backend files"
+            },
+            {
+              "name": "backup",
+              "type": "string",
+              "summary": "reset: existing full encrypted backup receipt for this project, younger than database.reset.backupMaxAgeHours (default 24)"
+            },
             {
               "name": "stamp",
               "type": "string",
@@ -217,17 +327,17 @@ export const CATALOG = {
             {
               "name": "execute",
               "type": "boolean",
-              "summary": "migrate, post-cutover: apply the plan (also needs STARCI_DB_ARMED=1); without it both are read-only"
+              "summary": "migrate, post-cutover, reset: apply the plan (also needs STARCI_DB_ARMED=1); otherwise read-only"
             },
             {
               "name": "linked",
               "type": "boolean",
-              "summary": "migrate, post-cutover: use the project the app is linked to (the default)"
+              "summary": "use the linked project; required explicitly for reset and one of the dump target choices"
             },
             {
               "name": "url-env",
               "type": "string",
-              "summary": "migrate, post-cutover: name of the environment variable that holds the connection string"
+              "summary": "migrate, post-cutover, dump: environment variable holding the connection string"
             },
             {
               "name": "green-at",
@@ -242,16 +352,19 @@ export const CATALOG = {
             {
               "name": "json",
               "type": "boolean",
-              "summary": "plan, migrate, post-cutover: print the result as JSON"
+              "summary": "plan, migrate, post-cutover, dump, reset: print the result as JSON"
             }
           ],
           "exit": {
             "0": "preview or action completed with no drift",
-            "1": "database plan drift",
-            "2": "refusal or bad usage"
+            "1": "database plan drift or failed tool/verification",
+            "2": "refusal or bad usage",
+            "3": "database mutation is not armed"
           },
           "json": "flag",
           "examples": [
+            "starci app db dump --linked --out /var/backups/my-app",
+            "starci app db reset --linked --auth keep --storage keep --backup /var/backups/my-app/backup.receipt.json",
             "starci app db baseline",
             "starci app db baseline --stamp 20261014000000 --apply",
             "starci app db restamp --map restamp.yaml",
@@ -267,6 +380,17 @@ export const CATALOG = {
           ],
           "impl": null,
           "conventions": [
+            "Owner ruling 2026-10-17 alpha.20: \"add a canon DB reset/backup verb design ...",
+            "at least starci app db dump (encrypted, outside repo) and starci app db reset --linked with explicit auth/storage behaviour flags\"",
+            "Owner ruling main 2026-10-17: reset \"must require --backup <receipt> pointing at an existing encrypted dump made in the last N hours,",
+            "and must refuse without explicit --auth/--storage choices\"",
+            "dump requires exactly one target; archives roles, schema, auth/storage schema, data and rowcounts;",
+            "age encrypts to .sops.yaml recipients and deletes plaintext even on failure",
+            "dump verifies age archive header, size and sha256; owner identity is required for a separate decryption proof",
+            "reset is linked only, dry run by default, and requires STARCI_DB_ARMED=1 with --execute; local reset stays npm run db:reset",
+            "reset keep encrypts auth/storage data before reset, proves identity access, restores transactionally and verifies fingerprints and migration head;",
+            "requires Supabase db query --file and SOPS_AGE_KEY or SOPS_AGE_KEY_FILE",
+            "reset keeps encrypted temporary recovery parts after a reset/restore failure and reports their directory; plaintext is always deleted",
             "baseline accepts --stamp; restamp requires --map; both preview without --apply",
             "plan is always read-only and supports --json; it compares migrations, cron, queues and Vault names",
             "migrate and post-cutover read the optional database block of application-stacks.yaml; both are dry runs without --execute",
@@ -355,6 +479,15 @@ export const CATALOG = {
               "type": "string",
               "summary": "one frontend workspace to judge"
             },
+            {
+              "name": "side",
+              "type": "enum",
+              "enum": [
+                "be",
+                "fe"
+              ],
+              "summary": "judge one side (root findings belong to be; not with --sonar)"
+            },
             {
               "name": "fix",
               "type": "boolean",
@@ -467,6 +600,11 @@ export const CATALOG = {
               "type": "string",
               "summary": "gate: release tag prefix (default from release.tagPrefix, v)"
             },
+            {
+              "name": "sonar",
+              "type": "boolean",
+              "summary": "gate: append a local Sonar scan using services.sonar host and the token environment variable named by ci.token (default SONAR_TOKEN)"
+            },
             {
               "name": "remote",
               "type": "string",
@@ -481,12 +619,13 @@ export const CATALOG = {
           "exit": {
             "0": "gate green or push done or nothing to do",
             "1": "a gate is red or the push was refused by the hook",
-            "2": "refusal or bad usage"
+            "2": "refusal or bad usage including RELEASE_CI_RED and RELEASE_SONAR_UNAVAILABLE"
           },
           "json": "flag",
           "examples": [
             "starci app release gate",
             "starci app release gate --execute",
+            "starci app release gate --sonar --execute",
             "starci app release push --remote origin",
             "starci app release push --execute"
           ],
@@ -496,7 +635,16 @@ export const CATALOG = {
           ],
           "impl": null,
           "conventions": [
-            "the gate list is release.gates of application-stacks.yaml (argument arrays), else the app check plus the managed package scripts",
+            "the gate list is release.gates of application-stacks.yaml (argument arrays), else app-check, audit, then the managed package scripts",
+            "audit runs npm audit --omit=dev --audit-level=high by default; services.audit.level and omitDev configure it,",
+            "and an explicit audit.in without release-gate omits it;",
+            "declared release.gates gets audit appended if missing",
+            "--sonar appends @sonar/scan@4.3.0 against services.sonar.host (host.public for a host mapping), plus organization for sonarcloud;",
+            "disabled or unavailable Sonar or an unset token refuses RELEASE_SONAR_UNAVAILABLE",
+            "gate checks the newest completed ci.yml run on the default branch, including reachable push/tag runs;",
+            "failure, cancelled or timed_out refuses RELEASE_CI_RED with its URL and SHA;",
+            "unreadable GitHub or no run warns RELEASE_CI_UNKNOWN and continues",
+            "only the owner's starci release ci-override --sha <sha> --reason <text> record can override red CI; there is no --no-ci-check flag",
             "gate refuses a dirty tree, HEAD other than --source, a moved HEAD and a tree dirtied by the gates; record and tag only when all gates are green",
             "a gate with summary jest is red on failed tests and on a coverage threshold miss even when the process exits 0",
             "push needs the annotated tag and L4 record of HEAD, runs git push --dry-run --atomic first and never uses --no-verify"
@@ -2073,35 +2221,6 @@ export const CATALOG = {
           },
           "runtimeSide": "tree"
         },
-        "runtime-coverage": {
-          "summary": "run the runtime spec suite under Node coverage and write coverage/lcov.info",
-          "owner": "runtime",
-          "positional": [
-            {
-              "name": "specs",
-              "required": false,
-              "variadic": true
-            }
-          ],
-          "flags": [],
-          "exit": {
-            "0": "the suite is green",
-            "1": "a spec failed",
-            "2": "bad usage"
-          },
-          "json": "none",
-          "examples": [
-            "starci gate runtime-coverage",
-            "starci gate runtime-coverage tests/cli/catalog.spec.mjs"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "script": "scripts/gates/runtime-coverage.mjs"
-          },
-          "runtimeSide": "tree"
-        },
         "sonar": {
           "summary": "inspect, provision, run and start the local Sonar quality gate",
           "owner": "runtime",
@@ -2230,7 +2349,7 @@ export const CATALOG = {
             {
               "name": "public",
               "type": "boolean",
-              "summary": "up or stop: include the public Cloudflare tunnel (needs CLOUDFLARE_TUNNEL_TOKEN)"
+              "summary": "up or stop: activate profile public; up verifies the tunnel is running (needs CLOUDFLARE_TUNNEL_TOKEN)"
             }
           ],
           "exit": {
@@ -2252,6 +2371,12 @@ export const CATALOG = {
           "impl": {
             "script": "scripts/gates/sonar-local.mjs"
           },
+          "conventions": [
+            "up --public retries the tunnel running check for up to 30 seconds; SONAR_TUNNEL_NOT_RUNNING refuses with container state and the last 20 scrubbed log lines",
+            "SONAR_DB_PASSWORD_MISMATCH: the starci-sonarqube-postgres-data volume has another password than SONARQUBE_DB_PASSWORD in secret.env",
+            "(Compose supplies SONAR_JDBC_PASSWORD and POSTGRES_PASSWORD);",
+            "restore the old password or export a backup before recreating the volume"
+          ],
           "runtimeSide": "tree"
         },
         "starcistacks": {
@@ -2532,16 +2657,6 @@ export const CATALOG = {
             }
           ],
           "flags": [
-            {
-              "name": "verified",
-              "type": "string",
-              "summary": "an earlier verified tip that must be an ancestor of ref"
-            },
-            {
-              "name": "verified-log",
-              "type": "string",
-              "summary": "the earlier verification log whose prior-red specs must rerun"
-            },
             {
               "name": "dry-run",
               "type": "boolean",
@@ -2556,23 +2671,16 @@ export const CATALOG = {
               "name": "kernel-note",
               "type": "string",
               "summary": "one line, what a Kernel must do differently after this land; the land record carries it and the runtime delivers it verbatim with the Kernels' next wake (absent: no line)"
-            },
-            {
-              "name": "concurrency",
-              "type": "number",
-              "default": 4,
-              "summary": "dependent spec file concurrency"
             }
           ],
           "exit": {
             "0": "the verification passed and local main fast-forwarded, or a dry run passed without moving it",
-            "1": "refused at a named gate, check, spec, lock or fast-forward step",
+            "1": "refused at the verify receipt, a named gate, the check, the lock or the fast-forward step",
             "2": "bad usage"
           },
-          "json": "starci/git-land@1",
+          "json": "starci/git-land@2",
           "examples": [
             "starci git land <worktree> <ref>",
-            "starci git land <worktree> <ref> --verified <sha> --verified-log <file> --concurrency 2",
             "starci git land <worktree> <ref> --dry-run --json",
             "starci git land <worktree> <ref> --kernel-note \"settle needs --evidence now\""
           ],
@@ -2589,10 +2697,10 @@ export const CATALOG = {
             "owner"
           ],
           "conventions": [
-            "land only after starci test run --level L2 --against <ref> is green",
-            "lands are serial and hold the host land lock through the gate, check, specs and local merge",
-            "local main is the only destination; a land never pushes, tags or touches origin",
-            "delta lands use --verified with the matching --verified-log and always rerun prior-red spec files"
+            "land only a tip `starci runtime verify` proved (check, package clean-test, scaffold e2e on that exact commit)",
+            "the runtime has no specs of its own (owner ruling no-runtime-specs)",
+            "lands are serial and hold the host land lock through the receipt, gate, full check and local merge",
+            "local main is the only destination; a land never pushes, tags or touches origin"
           ],
           "runtimeSide": "host"
         },
@@ -7196,12 +7304,12 @@ export const CATALOG = {
           "runtimeSide": "host"
         },
         "install": {
-          "summary": "add exact dependencies from canon pins under the host lock",
+          "summary": "install exact dependencies and move StarCi pins with the target CLI",
           "owner": "runtime",
           "positional": [
             {
               "name": "package",
-              "required": true,
+              "required": false,
               "variadic": true
             }
           ],
@@ -7210,17 +7318,24 @@ export const CATALOG = {
               "name": "dev",
               "type": "boolean",
               "summary": "save the packages as development dependencies"
+            },
+            {
+              "name": "canon",
+              "type": "boolean",
+              "summary": "install the target CLI and all of its exact StarCi canon pins"
             }
           ],
           "exit": {
-            "0": "exact dependencies were installed",
-            "1": "npm, Git or the host lock failed",
-            "2": "the package or worktree was refused"
+            "0": "exact dependencies and any requested canon pins were installed",
+            "1": "npm, Git, target canon loading or the host lock failed",
+            "2": "the package, target pin or worktree was refused"
           },
           "json": "starci/npm-install@1",
           "examples": [
             "starci npm install typescript",
-            "starci npm install left-pad@1.3.0 --dev"
+            "starci npm install left-pad@1.3.0 --dev",
+            "starci npm install @starci/cli --dev",
+            "starci npm install --canon --dev"
           ],
           "editions": [
             "full"
@@ -7236,7 +7351,12 @@ export const CATALOG = {
           ],
           "conventions": [
             "bare package names resolve only from knowledge/hfs/canon-pins.yaml and never through a registry lookup",
-            "explicit versions use exact x.y.z form and must agree with the canon pin when one exists",
+            "explicit versions use exact x.y.z form and must agree with the canon pin when one exists, except the target CLI version on a canon upgrade",
+            "naming @starci/cli or passing --canon installs the exact target CLI first,",
+            "then reads its installed HFS runtime canon-pins.yaml and installs every pinned @starci package in the same host lock",
+            "--canon without a CLI positional uses the running runtime's exact CLI pin as the target",
+            "target pins never fall back to the running runtime when the target pin file is missing or inconsistent",
+            "each target StarCi pin is reported as moved or refused with a reason; a failed canon phase exits nonzero even when the first CLI install succeeded",
             "installs always use --save-exact and report the package.json and package-lock.json diff stat"
           ],
           "runtimeSide": "host"
@@ -7655,6 +7775,53 @@ export const CATALOG = {
           },
           "runtimeSide": "tree"
         },
+        "ci-override": {
+          "summary": "the owner accepts red CI for one SHA and records who and why",
+          "owner": "runtime",
+          "flags": [
+            {
+              "name": "sha",
+              "type": "string",
+              "summary": "required full 40 lowercase hex SHA of the red CI run"
+            },
+            {
+              "name": "reason",
+              "type": "string",
+              "summary": "required nonempty owner reason, recorded verbatim after trimming"
+            },
+            {
+              "name": "repo",
+              "type": "string",
+              "summary": "repository receiving the override (default current directory)"
+            }
+          ],
+          "exit": {
+            "0": "the override record and runtime owner ruling were written",
+            "2": "RIGHTS_OWNER_ONLY (a bound role or non-TTY stdin), bad usage, confirmation mismatch, or write failure"
+          },
+          "json": "none",
+          "examples": [
+            "starci release ci-override --sha 0123456789abcdef0123456789abcdef01234567 --reason \"Owner accepts this CI failure for the release\"",
+            "starci release ci-override --repo ../my-app --sha 0123456789abcdef0123456789abcdef01234567 --reason \"Owner accepts the failed run\""
+          ],
+          "editions": [
+            "full"
+          ],
+          "impl": {
+            "script": "scripts/supervisor/release-ci-override-cli.mjs"
+          },
+          "conventions": [
+            "OWNER RULING 2026-10-17 (chat to main, relayed): alpha.20 \"cut refuses when the latest CI on main is red, with a documented owner override verb\";",
+            "the override is owner-only, records who and why in the owner rulings, and agents cannot run it.",
+            "Every bound role is refused by the command guard and by this script. The owner must use a terminal and type the first 12 SHA characters exactly.",
+            "Writes <git-common-dir>/starci-release/<sha>.ci-override.json, schema starci/ci-override@1,",
+            "with sha, reason, by (git user.name and OS user), at, and runUrl (empty if GitHub is unavailable).",
+            "For the runtime, appends ci-override-<sha12> under rulings before the top-level supersedes key in modules/kernel/owner-rulings.yaml.",
+            "Commit that entry into the tree being cut. App repositories receive only the record.",
+            "An override applies only to its exact SHA. It does not permit a cut when CI is unknown. Existing ruling IDs with another reason refuse."
+          ],
+          "runtimeSide": "tree"
+        },
         "ci-status": {
           "summary": "the verdict of the GitHub ci workflow, Codecov and Sonar for a release; red is recorded for Debug",
           "owner": "runtime",
@@ -7774,14 +7941,14 @@ export const CATALOG = {
           ],
           "exit": {
             "0": "the release was cut and main plus its tag were pushed atomically, or --plan found nothing missing",
-            "1": "refused (dirty tree, no or wrong tag, release notes incomplete, version not moved past the remote main, suite red, main moved, secret scan) and nothing was pushed",
+            "1": "refused (RELEASE_CI_RED, RELEASE_CI_UNKNOWN, dirty tree, no or wrong tag, release notes incomplete, version not moved past the remote main, suite red, main moved, secret scan) and nothing was pushed",
             "2": "bad usage"
           },
           "json": "flag",
           "examples": [
             "starci release cut",
             "starci release cut --plan --tag v1.0.0-alpha.9",
-            "starci release cut --tag v1.0.0-alpha.9 --rows \"npm test,linux-parity\"",
+            "starci release cut --tag v1.0.0-alpha.9 --rows \"npm run test:e2e,linux-parity\"",
             "starci release cut --repo <path> --tag v1.0.0-alpha.9 --json"
           ],
           "editions": [
@@ -7790,42 +7957,15 @@ export const CATALOG = {
           "impl": {
             "script": "scripts/supervisor/release-cut-cli.mjs"
           },
-          "runtimeSide": "tree"
-        },
-        "env-test": {
-          "summary": "run the runtime spec suite under the release cut's own conditions",
-          "owner": "runtime",
-          "flags": [
-            {
-              "name": "lane",
-              "type": "boolean",
-              "summary": "a lane clone is no Orca terminal: leave out STARCI_REQUIRE_ORCA_LIVE and the host check, keep everything else of the cut"
-            },
-            {
-              "name": "reuse-installs",
-              "type": "boolean",
-              "summary": "keep an example app whose node_modules exists instead of a fresh npm ci"
-            }
-          ],
-          "exit": {
-            "0": "the suite is green and no skip fails the evidence rule",
-            "1": "a step is red or a skipped test ran in no leg",
-            "2": "the host lacks a prerequisite of the cut, or bad usage"
-          },
-          "json": "none",
-          "examples": [
-            "starci release env-test",
-            "starci release env-test --lane --reuse-installs"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "script": "scripts/supervisor/release-env-test.mjs"
-          },
           "conventions": [
-            "the suite is the cut's own spec leg, so a red the cut would find shows here first; it takes minutes to an hour and writes each step to a log",
-            "without --lane it refuses (exit 2) unless the host has an Orca terminal, a reachable Orca and a Docker daemon, the same prerequisites the cut refuses on"
+            "OWNER RULING 2026-10-17 (chat to main, relayed): alpha.20 \"cut refuses when the latest CI on main is red, with a documented owner override verb\";",
+            "the override is owner-only, records who and why in the owner rulings, and agents cannot run it.",
+            "Before the suite, including --plan, read the newest completed CI workflow run on main.",
+            "Only success continues; every other conclusion refuses RELEASE_CI_RED and names the run URL and headSha.",
+            "Unreadable GitHub or no completed run refuses RELEASE_CI_UNKNOWN: a cut must not proceed blind, including under suite ci.",
+            "The owner may run starci release ci-override --sha <headSha> --reason <text>.",
+            "A red run requires both starci-release/<headSha>.ci-override.json in the git common dir and ci-override-<sha12>",
+            "in modules/kernel/owner-rulings.yaml of the tree being cut. Commit the ruling before cutting."
           ],
           "runtimeSide": "tree"
         },
@@ -7891,75 +8031,6 @@ export const CATALOG = {
           ],
           "runtimeSide": "tree"
         },
-        "launch-smoke": {
-          "summary": "prove live nested-agent launch paths on an Orca host",
-          "owner": "runtime",
-          "positional": [
-            {
-              "name": "action",
-              "enum": [
-                "stage",
-                "mark"
-              ],
-              "required": false,
-              "variadic": false
-            }
-          ],
-          "flags": [
-            {
-              "name": "app-repo",
-              "type": "string",
-              "summary": "scratch app main checkout registered in Orca"
-            },
-            {
-              "name": "entry",
-              "type": "string",
-              "summary": "plain entry terminal for the smoke"
-            },
-            {
-              "name": "timeout-ms",
-              "type": "number",
-              "summary": "smoke deadline in milliseconds"
-            },
-            {
-              "name": "out",
-              "type": "string",
-              "summary": "write the smoke result to this file"
-            },
-            {
-              "name": "as",
-              "type": "enum",
-              "enum": [
-                "supervisor",
-                "worker",
-                "kernel",
-                "op",
-                "opFe",
-                "opFail",
-                "critic"
-              ],
-              "summary": "internal smoke role for stage or mark"
-            }
-          ],
-          "exit": {
-            "0": "smoke or role action passed",
-            "1": "smoke or role action failed",
-            "2": "bad usage or no entry terminal"
-          },
-          "json": "always",
-          "examples": [
-            "starci release launch-smoke --app-repo <scratch-app>",
-            "starci release launch-smoke stage --as kernel",
-            "starci release launch-smoke mark --as op"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "script": "scripts/kernel/launch-smoke.mjs"
-          },
-          "runtimeSide": "tree"
-        },
         "notes": {
           "summary": "print or write the release notes of a tag, its CHANGELOG section",
           "owner": "runtime",
@@ -8136,6 +8207,32 @@ export const CATALOG = {
           ],
           "runtimeSide": "tree"
         },
+        "scaffold-e2e": {
+          "summary": "run the scaffold end-to-end proof (full and lite scaffolds installed, built and run for real)",
+          "owner": "runtime",
+          "flags": [],
+          "exit": {
+            "0": "every scaffold e2e test ran and passed",
+            "1": "a scaffold e2e test failed, was cancelled or was skipped",
+            "2": "the run could not start or bad usage"
+          },
+          "json": "none",
+          "examples": [
+            "starci release scaffold-e2e"
+          ],
+          "editions": [
+            "full"
+          ],
+          "impl": {
+            "script": "scripts/gates/scaffold-e2e.mjs"
+          },
+          "conventions": [
+            "With release clean-test, the real test proof of the runtime (owner ruling no-runtime-specs): the runtime has no specs.",
+            "A skipped test is red: every scaffold test must run (Docker, npm and the source canon registry are prerequisites).",
+            "Builds the grammar and heroicons dist first when they are stale, from their own lockfiles: a fresh lane needs no build step."
+          ],
+          "runtimeSide": "tree"
+        },
         "sync-runtime": {
           "summary": "refresh or check package runtime copies and optionally prepare grammar",
           "owner": "runtime",
@@ -8440,7 +8537,7 @@ export const CATALOG = {
             "owner"
           ],
           "conventions": [
-            "refuses unless the source is clean, a fast-forward of the host and its check and affected specs are proven by a receipt on that commit",
+            "refuses unless the source is clean, a fast-forward of the host and its check, package clean-test and scaffold e2e are proven by a receipt on that commit",
             "refuses while a release cut holds the host lock; waits for settles, Critic runs and prepared decisions in flight, stops none",
             "several commits are one revision change, with one fast-forward, installed artefacts migrated, one engine restart, then verified",
             "journals one runtime-deployed event; --plan prints every step and refusal and changes nothing",
@@ -9074,7 +9171,7 @@ export const CATALOG = {
           "runtimeSide": "tree"
         },
         "verify": {
-          "summary": "verify a committed revision - the check AND the affected specs on one commit, one receipt",
+          "summary": "verify a commit - the check, package clean-test and scaffold e2e on one commit, one receipt",
           "owner": "runtime",
           "positional": [],
           "flags": [
@@ -9090,12 +9187,11 @@ export const CATALOG = {
             }
           ],
           "exit": {
-            "0": "verified: check and every affected spec passed on the exact commit, receipt written",
-            "1": "NOT VERIFIED: dirty tree, no base, red check, or a red spec file",
-            "2": "bad usage",
-            "3": "PARTIAL: nothing red, the lane's own specs ran, some were not started inside the budget (fit to land, not to deploy)"
+            "0": "verified: check, package clean-test and scaffold e2e passed on the exact commit, receipt written",
+            "1": "NOT VERIFIED: dirty tree, no base, red check, a red or unrun package, or a failed or skipped scaffold e2e test",
+            "2": "bad usage"
           },
-          "json": "starci/runtime-verify@1",
+          "json": "starci/runtime-verify@2",
           "examples": [
             "starci runtime verify --base <tip>",
             "starci runtime verify --json"
@@ -9116,11 +9212,11 @@ export const CATALOG = {
             "owner"
           ],
           "conventions": [
-            "A branch is verified only by this receipt: check N of N and affected specs N of N for base..tip, on the exact commit.",
-            "A fix lane reports the last line of this verb, not the line of starci runtime check (which never runs a spec).",
+            "A branch is verified only by this receipt: check N of N, the clean-test of every package base..tip touches, the scaffold e2e.",
+            "The runtime has no specs of its own (owner ruling no-runtime-specs): package specs and the scaffold e2e decide.",
+            "A fix lane reports the last line of this verb, not the line of starci runtime check (which runs no test).",
             "Refuses a tree with uncommitted or untracked changes; the receipt binds a commit.",
-            "starci git land accepts a partial receipt (0 failed, the lane's changed specs ran, not-started counted); deploy and release need all of them.",
-            "A spec whose inputs are unchanged since a proven green run is reused; the receipt counts the reused files."
+            "starci git land, starci runtime deploy and the release read the same receipt: every proof passed."
           ],
           "runtimeSide": "tree"
         },
@@ -9864,21 +9960,6 @@ export const CATALOG = {
               "type": "string",
               "summary": "comma-separated commit shas to land"
             },
-            {
-              "name": "specs",
-              "type": "string",
-              "summary": "spec files or touching, direct, all, or none"
-            },
-            {
-              "name": "reason",
-              "type": "string",
-              "summary": "reason required when no spec applies"
-            },
-            {
-              "name": "full-by-push-git",
-              "type": "boolean",
-              "summary": "authorize the full suite from the push flow"
-            },
             {
               "name": "lane",
               "type": "string",
@@ -9914,7 +9995,7 @@ export const CATALOG = {
           "examples": [
             "starci supervisor land --status",
             "starci supervisor land --job <job-id>",
-            "starci supervisor land --commit <sha> --specs touching --lane <name>"
+            "starci supervisor land --commit <sha> --lane <name>"
           ],
           "editions": [
             "full"
@@ -9960,20 +10041,10 @@ export const CATALOG = {
               "type": "string",
               "summary": "source lane name"
             },
-            {
-              "name": "specs",
-              "type": "string",
-              "summary": "comma-separated specs for the land gate"
-            },
-            {
-              "name": "wrongly-blocked",
-              "type": "string",
-              "summary": "spec proving the prior gate was wrong"
-            },
             {
               "name": "reason",
               "type": "string",
-              "summary": "reason when no spec applies"
+              "summary": "why the experiment is landed"
             },
             {
               "name": "wait-ms",
@@ -10937,189 +11008,6 @@ export const CATALOG = {
         }
       }
     },
-    "test": {
-      "summary": "run the bounded L1-L4 test ladder without accidental whole-suite work",
-      "owner": "runtime",
-      "verbs": {
-        "affected": {
-          "summary": "the specs related to the changed functions (--by file: every importer); --run runs each once",
-          "owner": "runtime",
-          "positional": [],
-          "flags": [
-            {
-              "name": "base",
-              "type": "string",
-              "summary": "ref to diff against (default: the merge-base with main, else origin/main)"
-            },
-            {
-              "name": "changed",
-              "type": "list",
-              "summary": "explicit changed repository paths instead of the diff"
-            },
-            {
-              "name": "by",
-              "type": "string",
-              "summary": "symbol (default: the specs related to the changed functions) or file (every spec importing a changed file)"
-            },
-            {
-              "name": "run",
-              "type": "boolean",
-              "summary": "run the selected spec files, one per process, inside the time budget"
-            },
-            {
-              "name": "plan",
-              "type": "boolean",
-              "summary": "print the selected files with the reason each is in the set; run nothing"
-            },
-            {
-              "name": "receipt-file",
-              "type": "string",
-              "summary": "with --run, write the receipt to this file; the answer carries its path (a gate reads the file, not the output)"
-            },
-            {
-              "name": "no-cache",
-              "type": "boolean",
-              "summary": "run every selected file; ignore the per-spec result cache"
-            },
-            {
-              "name": "concurrency",
-              "type": "number",
-              "summary": "override automatic file concurrency with a positive integer"
-            },
-            {
-              "name": "root",
-              "type": "string",
-              "summary": "repository root (default: the command cwd)"
-            }
-          ],
-          "exit": {
-            "0": "selection printed, or every selected file passed",
-            "1": "a selected spec file was red",
-            "2": "no base to diff against, or the time budget ended before every selected file started"
-          },
-          "json": "starci/test-affected@1",
-          "examples": [
-            "starci test affected",
-            "starci test affected --run",
-            "starci test affected --changed scripts/machine/ladder-test.mjs --run"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "module": "scripts/supervisor/affected-test.mjs",
-            "export": "testAffected"
-          },
-          "effect": "host",
-          "roles": [
-            "worker",
-            "lead",
-            "coordinator",
-            "release",
-            "owner"
-          ],
-          "conventions": [
-            "Everyday verification after npm run check; the whole suite is the merged-tree run and the release cut.",
-            "The set is computed - each changed .mjs symbol is followed by name through its importers, callers and CLI verbs.",
-            "What cannot be followed by name (yaml, templates, load-time statements, no base, the depth bound) keeps the file-level rule, named in the report.",
-            "Selection and --plan JSON carry every symbol, its specs and reasons, and file-level fallbacks; the set is never larger than --by file.",
-            "A --run machine answer carries the complete selected set, every result and the receipt; the diagnostic graph remains available through --plan.",
-            "A large set is never refused; it runs in parallel shards inside the printed time budget, and files not started when it ends are listed.",
-            "The --plan flag prints each selected file with the reason it is in the set; a --run answer carries a receipt (base, tip, passed, total) a gate can require.",
-            "A generated output maps to its generator's specs; an append-only change to a data file to the specs that name it or its readers.",
-            "A red file is fixed and run again, then the affected set once; never the whole suite.",
-            "A spec whose key (import closure, data it names, runner) is unchanged since a green run is reused; the receipt counts reused files; --no-cache runs all.",
-            "Each file is its own low-priority node process with the four preloads, at the concurrency of test-concurrency.yaml."
-          ],
-          "runtimeSide": "tree"
-        },
-        "run": {
-          "summary": "run the specs selected for one local ladder level",
-          "owner": "runtime",
-          "positional": [],
-          "flags": [
-            {
-              "name": "level",
-              "type": "enum",
-              "enum": [
-                "L1",
-                "L2",
-                "L3",
-                "L4"
-              ],
-              "required": true,
-              "summary": "bounded local test level"
-            },
-            {
-              "name": "changed",
-              "type": "list",
-              "summary": "changed repository paths used for L1 selection"
-            },
-            {
-              "name": "against",
-              "type": "string",
-              "default": "main",
-              "summary": "local main ref used for L2 and L3 selection"
-            },
-            {
-              "name": "spec",
-              "type": "list",
-              "summary": "explicit spec files at L1 only"
-            },
-            {
-              "name": "concurrency",
-              "type": "number",
-              "summary": "override automatic CPU/RAM file concurrency with a positive integer"
-            },
-            {
-              "name": "root",
-              "type": "string",
-              "summary": "repository root (default is the command cwd)"
-            },
-            {
-              "name": "release-cut",
-              "type": "boolean",
-              "summary": "confirm an owner or release-role L4 release-cut run"
-            }
-          ],
-          "exit": {
-            "0": "selected specs passed",
-            "1": "a check or spec was red",
-            "2": "usage or ladder policy refusal"
-          },
-          "json": "starci/test-run@1",
-          "examples": [
-            "starci test run --level L1 --changed scripts/machine/ladder-test.mjs",
-            "starci test run --level L2 --against main --json",
-            "starci test run --level L3 --against main"
-          ],
-          "editions": [
-            "full"
-          ],
-          "impl": {
-            "module": "scripts/machine/ladder-test.mjs",
-            "export": "testRun"
-          },
-          "effect": "host",
-          "roles": [
-            "worker",
-            "lead",
-            "coordinator",
-            "release",
-            "owner"
-          ],
-          "conventions": [
-            "Use L1 while working, L2 before asking for a land, and L3 when an IO slot changed.",
-            "Never run the whole suite outside L4; L4 belongs to starci release cut and L5 belongs to CI.",
-            "L2 and L3 need a clean committed tree, run the full check first, and hold the one host test lock.",
-            "A red L2 or L3 selection is re-run once serially; a green re-run is recorded as a flake, never skipped.",
-            "File concurrency uses fresh idle CPU and free RAM under modules/supervisor/test-concurrency.yaml; --concurrency overrides it.",
-            "The result and spec log retain the concurrency decision and host measurements."
-          ],
-          "runtimeSide": "tree"
-        }
-      }
-    },
     "typecheck": {
       "summary": "typecheck only the projects selected by the test ladder",
       "owner": "runtime",