@starci/hfs 4.4.1 → 4.5.1

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "65c712b99fc864f4135df840b2f870d54bf783fc7762eab2232b37557690e9bc",
+  "hash": "d230745d3aa5cfe65f75cb5fb2872924b935f1b4610c0b72db2f729572386404",
   "global": [
     {
       "name": "json",
@@ -176,8 +176,91 @@ export const CATALOG = {
           "impl": null,
           "runtimeSide": "host"
         },
+        "ci": {
+          "summary": "set declared GitHub CI secrets and variables and verify their custody",
+          "owner": "@starci/hfs",
+          "positional": [
+            {
+              "name": "action",
+              "enum": [
+                "secret",
+                "var",
+                "verify"
+              ],
+              "required": true,
+              "variadic": false
+            },
+            {
+              "name": "operation",
+              "enum": [
+                "set",
+                "sync"
+              ],
+              "required": false,
+              "variadic": false
+            },
+            {
+              "name": "name",
+              "required": false,
+              "variadic": false
+            }
+          ],
+          "flags": [
+            {
+              "name": "env",
+              "type": "string",
+              "summary": "select the declared GitHub environment"
+            },
+            {
+              "name": "dependabot",
+              "type": "boolean",
+              "summary": "select the Dependabot secret store"
+            },
+            {
+              "name": "repo",
+              "type": "string",
+              "summary": "override the app repository with owner/name"
+            },
+            {
+              "name": "value",
+              "type": "string",
+              "summary": "public variable value that must agree with the manifest"
+            },
+            {
+              "name": "execute",
+              "type": "boolean",
+              "summary": "apply the variable sync plan"
+            },
+            {
+              "name": "json",
+              "type": "boolean",
+              "summary": "print verification findings as JSON"
+            }
+          ],
+          "exit": {
+            "0": "action completed or verification clean",
+            "1": "verification findings",
+            "2": "refusal or bad usage"
+          },
+          "json": "flag",
+          "examples": [
+            "starci app ci secret set SONAR_TOKEN",
+            "starci app ci secret set VPS_SSH_KEY --env production",
+            "starci app ci secret set NPM_TOKEN --dependabot",
+            "starci app ci var set SONAR_HOST_URL",
+            "starci app ci var sync",
+            "starci app ci var sync --execute",
+            "starci app ci verify --json"
+          ],
+          "editions": [
+            "full",
+            "lite"
+          ],
+          "impl": null,
+          "runtimeSide": "host"
+        },
         "db": {
-          "summary": "preview or apply a migration baseline, restamp, history migration or post-cutover step",
+          "summary": "preview or apply database migrations, encrypted backups and guarded linked resets",
           "owner": "@starci/hfs",
           "positional": [
             {
@@ -187,13 +270,40 @@ export const CATALOG = {
                 "restamp",
                 "plan",
                 "migrate",
-                "post-cutover"
+                "post-cutover",
+                "dump",
+                "reset"
               ],
               "required": true,
               "variadic": false
             }
           ],
           "flags": [
+            {
+              "name": "out",
+              "type": "string",
+              "summary": "dump: destination outside the app and every Git worktree"
+            },
+            {
+              "name": "schema-only",
+              "type": "boolean",
+              "summary": "dump: omit data parts; this backup cannot authorize reset"
+            },
+            {
+              "name": "auth",
+              "type": "string",
+              "summary": "reset: required keep or drop; drop deletes users and identities"
+            },
+            {
+              "name": "storage",
+              "type": "string",
+              "summary": "reset: required keep or drop; drop empties objects metadata but does not delete backend files"
+            },
+            {
+              "name": "backup",
+              "type": "string",
+              "summary": "reset: existing full encrypted backup receipt for this project, younger than database.reset.backupMaxAgeHours (default 24)"
+            },
             {
               "name": "stamp",
               "type": "string",
@@ -217,17 +327,17 @@ export const CATALOG = {
             {
               "name": "execute",
               "type": "boolean",
-              "summary": "migrate, post-cutover: apply the plan (also needs STARCI_DB_ARMED=1); without it both are read-only"
+              "summary": "migrate, post-cutover, reset: apply the plan (also needs STARCI_DB_ARMED=1); otherwise read-only"
             },
             {
               "name": "linked",
               "type": "boolean",
-              "summary": "migrate, post-cutover: use the project the app is linked to (the default)"
+              "summary": "use the linked project; required explicitly for reset and one of the dump target choices"
             },
             {
               "name": "url-env",
               "type": "string",
-              "summary": "migrate, post-cutover: name of the environment variable that holds the connection string"
+              "summary": "migrate, post-cutover, dump: environment variable holding the connection string"
             },
             {
               "name": "green-at",
@@ -242,16 +352,19 @@ export const CATALOG = {
             {
               "name": "json",
               "type": "boolean",
-              "summary": "plan, migrate, post-cutover: print the result as JSON"
+              "summary": "plan, migrate, post-cutover, dump, reset: print the result as JSON"
             }
           ],
           "exit": {
             "0": "preview or action completed with no drift",
-            "1": "database plan drift",
-            "2": "refusal or bad usage"
+            "1": "database plan drift or failed tool/verification",
+            "2": "refusal or bad usage",
+            "3": "database mutation is not armed"
           },
           "json": "flag",
           "examples": [
+            "starci app db dump --linked --out /var/backups/my-app",
+            "starci app db reset --linked --auth keep --storage keep --backup /var/backups/my-app/backup.receipt.json",
             "starci app db baseline",
             "starci app db baseline --stamp 20261014000000 --apply",
             "starci app db restamp --map restamp.yaml",
@@ -267,6 +380,17 @@ export const CATALOG = {
           ],
           "impl": null,
           "conventions": [
+            "Owner ruling 2026-10-17 alpha.20: \"add a canon DB reset/backup verb design ...",
+            "at least starci app db dump (encrypted, outside repo) and starci app db reset --linked with explicit auth/storage behaviour flags\"",
+            "Owner ruling main 2026-10-17: reset \"must require --backup <receipt> pointing at an existing encrypted dump made in the last N hours,",
+            "and must refuse without explicit --auth/--storage choices\"",
+            "dump requires exactly one target; archives roles, schema, auth/storage schema, data and rowcounts;",
+            "age encrypts to .sops.yaml recipients and deletes plaintext even on failure",
+            "dump verifies age archive header, size and sha256; owner identity is required for a separate decryption proof",
+            "reset is linked only, dry run by default, and requires STARCI_DB_ARMED=1 with --execute; local reset stays npm run db:reset",
+            "reset keep encrypts auth/storage data before reset, proves identity access, restores transactionally and verifies fingerprints and migration head;",
+            "requires Supabase db query --file and SOPS_AGE_KEY or SOPS_AGE_KEY_FILE",
+            "reset keeps encrypted temporary recovery parts after a reset/restore failure and reports their directory; plaintext is always deleted",
             "baseline accepts --stamp; restamp requires --map; both preview without --apply",
             "plan is always read-only and supports --json; it compares migrations, cron, queues and Vault names",
             "migrate and post-cutover read the optional database block of application-stacks.yaml; both are dry runs without --execute",
@@ -355,6 +479,15 @@ export const CATALOG = {
               "type": "string",
               "summary": "one frontend workspace to judge"
             },
+            {
+              "name": "side",
+              "type": "enum",
+              "enum": [
+                "be",
+                "fe"
+              ],
+              "summary": "judge one side (root findings belong to be; not with --sonar)"
+            },
             {
               "name": "fix",
               "type": "boolean",
@@ -467,6 +600,11 @@ export const CATALOG = {
               "type": "string",
               "summary": "gate: release tag prefix (default from release.tagPrefix, v)"
             },
+            {
+              "name": "sonar",
+              "type": "boolean",
+              "summary": "gate: append a local Sonar scan using services.sonar host and the token environment variable named by ci.token (default SONAR_TOKEN)"
+            },
             {
               "name": "remote",
               "type": "string",
@@ -481,12 +619,13 @@ export const CATALOG = {
           "exit": {
             "0": "gate green or push done or nothing to do",
             "1": "a gate is red or the push was refused by the hook",
-            "2": "refusal or bad usage"
+            "2": "refusal or bad usage including RELEASE_CI_RED and RELEASE_SONAR_UNAVAILABLE"
           },
           "json": "flag",
           "examples": [
             "starci app release gate",
             "starci app release gate --execute",
+            "starci app release gate --sonar --execute",
             "starci app release push --remote origin",
             "starci app release push --execute"
           ],
@@ -496,7 +635,16 @@ export const CATALOG = {
           ],
           "impl": null,
           "conventions": [
-            "the gate list is release.gates of application-stacks.yaml (argument arrays), else the app check plus the managed package scripts",
+            "the gate list is release.gates of application-stacks.yaml (argument arrays), else app-check, audit, then the managed package scripts",
+            "audit runs npm audit --omit=dev --audit-level=high by default; services.audit.level and omitDev configure it,",
+            "and an explicit audit.in without release-gate omits it;",
+            "declared release.gates gets audit appended if missing",
+            "--sonar appends @sonar/scan@4.3.0 against services.sonar.host (host.public for a host mapping), plus organization for sonarcloud;",
+            "disabled or unavailable Sonar or an unset token refuses RELEASE_SONAR_UNAVAILABLE",
+            "gate checks the newest completed ci.yml run on the default branch, including reachable push/tag runs;",
+            "failure, cancelled or timed_out refuses RELEASE_CI_RED with its URL and SHA;",
+            "unreadable GitHub or no run warns RELEASE_CI_UNKNOWN and continues",
+            "only the owner's starci release ci-override --sha <sha> --reason <text> record can override red CI; there is no --no-ci-check flag",
             "gate refuses a dirty tree, HEAD other than --source, a moved HEAD and a tree dirtied by the gates; record and tag only when all gates are green",
             "a gate with summary jest is red on failed tests and on a coverage threshold miss even when the process exits 0",
             "push needs the annotated tag and L4 record of HEAD, runs git push --dry-run --atomic first and never uses --no-verify"
@@ -2201,7 +2349,7 @@ export const CATALOG = {
             {
               "name": "public",
               "type": "boolean",
-              "summary": "up or stop: include the public Cloudflare tunnel (needs CLOUDFLARE_TUNNEL_TOKEN)"
+              "summary": "up or stop: activate profile public; up verifies the tunnel is running (needs CLOUDFLARE_TUNNEL_TOKEN)"
             }
           ],
           "exit": {
@@ -2223,6 +2371,12 @@ export const CATALOG = {
           "impl": {
             "script": "scripts/gates/sonar-local.mjs"
           },
+          "conventions": [
+            "up --public retries the tunnel running check for up to 30 seconds; SONAR_TUNNEL_NOT_RUNNING refuses with container state and the last 20 scrubbed log lines",
+            "SONAR_DB_PASSWORD_MISMATCH: the starci-sonarqube-postgres-data volume has another password than SONARQUBE_DB_PASSWORD in secret.env",
+            "(Compose supplies SONAR_JDBC_PASSWORD and POSTGRES_PASSWORD);",
+            "restore the old password or export a backup before recreating the volume"
+          ],
           "runtimeSide": "tree"
         },
         "starcistacks": {
@@ -7150,12 +7304,12 @@ export const CATALOG = {
           "runtimeSide": "host"
         },
         "install": {
-          "summary": "add exact dependencies from canon pins under the host lock",
+          "summary": "install exact dependencies and move StarCi pins with the target CLI",
           "owner": "runtime",
           "positional": [
             {
               "name": "package",
-              "required": true,
+              "required": false,
               "variadic": true
             }
           ],
@@ -7164,17 +7318,24 @@ export const CATALOG = {
               "name": "dev",
               "type": "boolean",
               "summary": "save the packages as development dependencies"
+            },
+            {
+              "name": "canon",
+              "type": "boolean",
+              "summary": "install the target CLI and all of its exact StarCi canon pins"
             }
           ],
           "exit": {
-            "0": "exact dependencies were installed",
-            "1": "npm, Git or the host lock failed",
-            "2": "the package or worktree was refused"
+            "0": "exact dependencies and any requested canon pins were installed",
+            "1": "npm, Git, target canon loading or the host lock failed",
+            "2": "the package, target pin or worktree was refused"
           },
           "json": "starci/npm-install@1",
           "examples": [
             "starci npm install typescript",
-            "starci npm install left-pad@1.3.0 --dev"
+            "starci npm install left-pad@1.3.0 --dev",
+            "starci npm install @starci/cli --dev",
+            "starci npm install --canon --dev"
           ],
           "editions": [
             "full"
@@ -7190,7 +7351,12 @@ export const CATALOG = {
           ],
           "conventions": [
             "bare package names resolve only from knowledge/hfs/canon-pins.yaml and never through a registry lookup",
-            "explicit versions use exact x.y.z form and must agree with the canon pin when one exists",
+            "explicit versions use exact x.y.z form and must agree with the canon pin when one exists, except the target CLI version on a canon upgrade",
+            "naming @starci/cli or passing --canon installs the exact target CLI first,",
+            "then reads its installed HFS runtime canon-pins.yaml and installs every pinned @starci package in the same host lock",
+            "--canon without a CLI positional uses the running runtime's exact CLI pin as the target",
+            "target pins never fall back to the running runtime when the target pin file is missing or inconsistent",
+            "each target StarCi pin is reported as moved or refused with a reason; a failed canon phase exits nonzero even when the first CLI install succeeded",
             "installs always use --save-exact and report the package.json and package-lock.json diff stat"
           ],
           "runtimeSide": "host"
@@ -7609,6 +7775,53 @@ export const CATALOG = {
           },
           "runtimeSide": "tree"
         },
+        "ci-override": {
+          "summary": "the owner accepts red CI for one SHA and records who and why",
+          "owner": "runtime",
+          "flags": [
+            {
+              "name": "sha",
+              "type": "string",
+              "summary": "required full 40 lowercase hex SHA of the red CI run"
+            },
+            {
+              "name": "reason",
+              "type": "string",
+              "summary": "required nonempty owner reason, recorded verbatim after trimming"
+            },
+            {
+              "name": "repo",
+              "type": "string",
+              "summary": "repository receiving the override (default current directory)"
+            }
+          ],
+          "exit": {
+            "0": "the override record and runtime owner ruling were written",
+            "2": "RIGHTS_OWNER_ONLY (a bound role or non-TTY stdin), bad usage, confirmation mismatch, or write failure"
+          },
+          "json": "none",
+          "examples": [
+            "starci release ci-override --sha 0123456789abcdef0123456789abcdef01234567 --reason \"Owner accepts this CI failure for the release\"",
+            "starci release ci-override --repo ../my-app --sha 0123456789abcdef0123456789abcdef01234567 --reason \"Owner accepts the failed run\""
+          ],
+          "editions": [
+            "full"
+          ],
+          "impl": {
+            "script": "scripts/supervisor/release-ci-override-cli.mjs"
+          },
+          "conventions": [
+            "OWNER RULING 2026-10-17 (chat to main, relayed): alpha.20 \"cut refuses when the latest CI on main is red, with a documented owner override verb\";",
+            "the override is owner-only, records who and why in the owner rulings, and agents cannot run it.",
+            "Every bound role is refused by the command guard and by this script. The owner must use a terminal and type the first 12 SHA characters exactly.",
+            "Writes <git-common-dir>/starci-release/<sha>.ci-override.json, schema starci/ci-override@1,",
+            "with sha, reason, by (git user.name and OS user), at, and runUrl (empty if GitHub is unavailable).",
+            "For the runtime, appends ci-override-<sha12> under rulings before the top-level supersedes key in modules/kernel/owner-rulings.yaml.",
+            "Commit that entry into the tree being cut. App repositories receive only the record.",
+            "An override applies only to its exact SHA. It does not permit a cut when CI is unknown. Existing ruling IDs with another reason refuse."
+          ],
+          "runtimeSide": "tree"
+        },
         "ci-status": {
           "summary": "the verdict of the GitHub ci workflow, Codecov and Sonar for a release; red is recorded for Debug",
           "owner": "runtime",
@@ -7728,7 +7941,7 @@ export const CATALOG = {
           ],
           "exit": {
             "0": "the release was cut and main plus its tag were pushed atomically, or --plan found nothing missing",
-            "1": "refused (dirty tree, no or wrong tag, release notes incomplete, version not moved past the remote main, suite red, main moved, secret scan) and nothing was pushed",
+            "1": "refused (RELEASE_CI_RED, RELEASE_CI_UNKNOWN, dirty tree, no or wrong tag, release notes incomplete, version not moved past the remote main, suite red, main moved, secret scan) and nothing was pushed",
             "2": "bad usage"
           },
           "json": "flag",
@@ -7744,6 +7957,16 @@ export const CATALOG = {
           "impl": {
             "script": "scripts/supervisor/release-cut-cli.mjs"
           },
+          "conventions": [
+            "OWNER RULING 2026-10-17 (chat to main, relayed): alpha.20 \"cut refuses when the latest CI on main is red, with a documented owner override verb\";",
+            "the override is owner-only, records who and why in the owner rulings, and agents cannot run it.",
+            "Before the suite, including --plan, read the newest completed CI workflow run on main.",
+            "Only success continues; every other conclusion refuses RELEASE_CI_RED and names the run URL and headSha.",
+            "Unreadable GitHub or no completed run refuses RELEASE_CI_UNKNOWN: a cut must not proceed blind, including under suite ci.",
+            "The owner may run starci release ci-override --sha <headSha> --reason <text>.",
+            "A red run requires both starci-release/<headSha>.ci-override.json in the git common dir and ci-override-<sha12>",
+            "in modules/kernel/owner-rulings.yaml of the tree being cut. Commit the ruling before cutting."
+          ],
           "runtimeSide": "tree"
         },
         "images": {

package/runtime/scripts/hfs/ci-declaration.mjs

@@ -0,0 +1,102 @@
+import path from 'node:path';
+import { list } from '../lib/list.mjs';
+import { parseYaml } from '../../engine/yaml.mjs';
+
+const nameOf = (item) => typeof item === 'string' ? item : item?.name;
+
+/** Each CI name belongs to one class and scope; declarations contain names and public configuration only. */
+export function readCiDeclaration(doc) {
+  const problems = [], seen = new Set();
+  const invalid = (at, message) => problems.push({ code: 'CI_DECLARATION_INVALID', at, message });
+  const normalize = (entries, at, dependabot = false, variable = false) => list(entries).map((item, index) => {
+    const where = `${at}[${index}]`, name = item?.name;
+    if (seen.has(name)) invalid(`${where}.name`, 'a name must appear once across all CI classes');
+    seen.add(name);
+    if (typeof name !== 'string' || !/^[A-Z][A-Z0-9_]*$/.test(name) || name.startsWith('GITHUB_')) invalid(`${where}.name`, 'use an uppercase CI name outside the reserved GITHUB_ namespace');
+    const scope = dependabot ? 'repository' : item?.scope;
+    if (!['repository', 'environment'].includes(scope)) invalid(`${where}.scope`, 'scope must be repository or environment');
+    if (scope === 'environment' && (typeof item?.environment !== 'string' || !/^[a-z][a-z0-9-]*$/.test(item.environment))) invalid(`${where}.environment`, 'environment scope requires an environment name');
+    if ((dependabot || scope !== 'environment') && item && Object.hasOwn(item, 'environment')) invalid(`${where}.environment`, 'only environment scope may name an environment');
+    return { name, scope, environment: item?.environment ?? null, purpose: item?.purpose ?? null,
+      optional: item?.optional === true, ...(variable ? { value: item?.value } : {}) };
+  });
+  const ci = doc?.ci;
+  const secrets = normalize(ci?.secrets, 'ci.secrets');
+  const vars = normalize(ci?.vars, 'ci.vars', false, true);
+  const dependabotSecrets = normalize(ci?.dependabot?.secrets, 'ci.dependabot.secrets', true);
+  return { secrets, vars, dependabotSecrets, problems };
+}
+
+/** Missing quality blocks preserve the existing rendered defaults; disabled services remain explicitly disabled. */
+export function qualityServices(doc, { example = false } = {}) {
+  const services = doc?.services ?? {}, sonar = services.sonar, codecov = services.codecov ?? {};
+  const dependabot = services.dependabot ?? {}, audit = services.audit ?? {};
+  return {
+    sonar: !sonar || sonar.mode === 'disabled' ? null : {
+      provider: sonar.provider, mode: sonar.mode, optional: sonar.optional ?? sonar.provider === 'sonarqube', host: sonar.host?.public || sonar.host?.local || null,
+      organization: sonar.organization ?? null,
+      organizationVar: sonar.ci?.organizationVar ?? (sonar.provider === 'sonarcloud' && (example || list(sonar.runtimeSecrets).length > 0) && !list(sonar.credentials).length ? 'SONAR_ORGANIZATION' : null), projectKey: sonar.projects?.[0]?.key ?? null,
+      qualityGate: sonar.qualityGate ?? (example ? 'starci-quality-lite' : 'starci-quality'), wiring: sonar.ci?.wiring ?? 'required',
+      token: sonar.ci?.token || nameOf(sonar.ci?.secrets?.[0]) || 'SONAR_TOKEN', hostVar: sonar.ci?.hostVar || 'SONAR_HOST_URL',
+    },
+    codecov: { optional: codecov.optional ?? false, enabled: codecov.mode !== 'disabled', auth: codecov.auth ?? 'oidc', token: codecov.ci?.token ?? null,
+      flag: codecov.flag ?? null, target: codecov.target ?? 100, components: codecov.components ?? 'auto', required: codecov.required ?? true, wiring: codecov.ci?.wiring ?? 'required' },
+    dependabot: { ecosystems: [...(dependabot.ecosystems ?? ['npm', 'github-actions', 'docker'])],
+      schedule: { interval: 'weekly', ...dependabot.schedule }, groups: { minorPatch: 'grouped', major: 'per-package', ...dependabot.groups },
+      ignore: [...(dependabot.ignore ?? ['@starci/*'])], security: dependabot.security ?? 'immediate' },
+    audit: { level: audit.level ?? 'high', omitDev: audit.omitDev ?? true, in: [...(audit.in ?? ['release-gate', 'ci'])] },
+  };
+}
+
+/** Enumerate a missing directory as empty; all filesystem access uses the caller's injected synchronous seam. */
+function entries(dir, fs) {
+  try { return fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name)); }
+  catch (error) { if (error.code === 'ENOENT') return []; throw error; }
+}
+
+/** Read only encrypted envelope key names, never decrypting or returning any sealed value. */
+export function sealedKeyNames(root, { fs }) {
+  const out = [], base = path.join(root, '.starcistacks');
+  for (const env of entries(base, fs).filter((entry) => entry.isDirectory())) {
+    for (const member of entries(path.join(base, env.name, 'secrets'), fs).filter((entry) => entry.isFile() && entry.name.endsWith('.enc'))) {
+      const file = `.starcistacks/${env.name}/secrets/${member.name}`;
+      const source = fs.readFileSync(path.join(root, file), 'utf8');
+      const dotenv = [...source.matchAll(/^([A-Za-z_][A-Za-z0-9_]*)=ENC\[/gm)].map((match) => match[1]).filter((key) => !key.startsWith('sops_'));
+      let keys = dotenv;
+      if (!dotenv.length) {
+        const doc = parseYaml(source);
+        keys = doc && typeof doc === 'object' && !Array.isArray(doc) ? Object.keys(doc).filter((key) => key !== 'sops' && !key.startsWith('sops_')) : [];
+      }
+      for (const key of keys) out.push({ env: env.name, member: member.name.slice(0, -4), key, file });
+    }
+  }
+  return out;
+}
+
+/** Collect every static secrets and vars reference inside workflow expressions, excluding the automatic GitHub token. */
+export function workflowReferences(root, { fs }) {
+  const out = [], dir = path.join(root, '.github', 'workflows');
+  for (const entry of entries(dir, fs).filter((item) => item.isFile() && /\.ya?ml$/i.test(item.name))) {
+    const file = `.github/workflows/${entry.name}`, source = fs.readFileSync(path.join(root, file), 'utf8');
+    for (const expression of source.matchAll(/\$\{\{([^}]*)/g)) {
+      for (const match of expression[1].matchAll(/\b(secrets|vars)\.([A-Z][A-Z0-9_]*)/g)) {
+        if (match[2] !== 'GITHUB_TOKEN') out.push({ file, kind: match[1], name: match[2] });
+      }
+    }
+  }
+  return out;
+}
+
+/** Service CI bindings name the shared declaration classes, including the readable legacy lists. */
+export function ciNamesOfServices(doc) {
+  const out = [];
+  for (const [service, entry] of Object.entries(doc?.services ?? {})) {
+    const ci = entry?.ci ?? {};
+    if (ci.token) out.push({ service, name: ci.token, kind: 'secret' });
+    if (ci.hostVar) out.push({ service, name: ci.hostVar, kind: 'var' });
+    if (ci.organizationVar) out.push({ service, name: ci.organizationVar, kind: 'var' });
+    for (const item of list(ci.secrets)) out.push({ service, name: nameOf(item), kind: 'secret' });
+    for (const item of list(ci.vars)) out.push({ service, name: nameOf(item), kind: 'var' });
+  }
+  return out;
+}

package/runtime/scripts/hfs/rules/a15-findings.mjs

@@ -32,17 +32,25 @@ import { stacksIngressFindings } from './stacks-ingress.mjs';
 import { stacksLiteBackingFindings } from './stacks-lite-backing.mjs';
 import { stackToolingFindings } from './stack-tooling.mjs';
 import { stacksDeployFindings } from './stacks-deploy.mjs';
+import { ciCustodyFindings } from './ci-custody.mjs';
+import { workflowContextsFindings } from './workflow-contexts.mjs';
+import { feBuildArgsFindings } from './fe-build-args.mjs';
 // finders-import-end
 
 /** The failure codes the finders above emit, so `starci app check` ships their labels (check.mjs adds them to CHECK_CODES). Append-only; the coordinator regenerates it at merge time. */
 export const A15_CODES = [
   // codes-begin
+  'FE_PUBLIC_BUILD_ARG_MISSING',
+  'HFS_WORKFLOW_CONTEXT',
+  'CI_SECRET_SEALED', 'APP_SECRET_IN_CI', 'CI_DECLARATION_DRIFT',
   'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_API_EXPOSED', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_CRON_OWNED', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_SERVICE_ROLE_SCOPE', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
   // codes-end
 ];
 
 const FINDERS = [
   // finders-begin
+  feBuildArgsFindings,
+  workflowContextsFindings,
   featureFileFindings,
   lexiconFindings,
   assetsFindings,
@@ -72,6 +80,7 @@ const FINDERS = [
   stacksLiteBackingFindings,
   stackToolingFindings,
   stacksDeployFindings,
+  ciCustodyFindings,
   // finders-end
 ];
 

package/runtime/scripts/hfs/rules/app-workflow-findings.mjs

@@ -0,0 +1,10 @@
+// app-workflow-findings.mjs - app-root workflow scope shared by deployment and expression-context rules.
+import { workflowFindings } from '../runtime-rules/workflow-source.mjs';
+import { readText } from './read.mjs';
+
+/** Judge tracked workflows only at full/lite app roots, preserving each caller's duplicate-file policy. */
+export function appWorkflowFindings({ repoRoot, files, all = files, repo, isRoot, inScope = () => true }, perWorkflow, { dedupe = false } = {}) {
+  if (isRoot === false || repo?.kind !== 'app' || !['lite', 'full'].includes(repo.edition)) return [];
+  const selected = dedupe ? [...new Set(all)] : all;
+  return workflowFindings({ files: selected.filter((file) => inScope(file)), read: (file) => readText(repoRoot, file) }, perWorkflow);
+}