@starci/hfs 4.6.0 → 4.7.1

package/runtime/modules/kernel/failure-codes.yaml

@@ -1701,6 +1701,16 @@ CI_SECRET_SEALED:
   owner: op-retry
   kind: check-finding
 
+CI_STANDARD:
+  title: "A workflow breaks the StarCi CI standard"
+  title_vi: "Workflow vi phạm chuẩn CI của StarCi"
+  meaning_vi: "Workflow CI (của app, của ví dụ hoặc của runtime) không đáp ứng một mục của knowledge/hfs/ci-standard.yaml; mục bị vi phạm được nêu trong ngoặc vuông."
+  causes_vi:
+    - "Vi phạm R301: job shape, lịch sử đầy đủ và STARCI_BASE_REF, heap cho bước nặng, lint Sonar theo từng phía, probe nhà cung cấp tùy chọn, timeout hoặc ghim action theo sha."
+  nextStep_vi: "App: chạy starci app sync --write để render lại CI chuẩn (không sửa tay); runtime: sửa workflow theo mục được nêu."
+  owner: op-retry
+  kind: check-finding
+
 CI_TRIGGERS_RELEASE_ONLY:
   title: "Workflow trigger other than a release tag, a person or the runtime's main"
   title_vi: "Workflow có trigger không phải tag phát hành, người chạy tay hay main của runtime"

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -287,6 +287,25 @@ $defs:
             enum: [public, private]
       secrets: {type: array, items: {$ref: '#/$defs/ciSecret'}}
       vars: {type: array, items: {$ref: '#/$defs/ciVariable'}}
+      jobs:
+        description: >-
+          Per-job settings of the managed CI (the CI standard, knowledge/hfs/ci-standard.yaml defaults): timeoutMinutes per job and the number of unit-run shards.
+          Omitted settings take the standard's defaults; starci app sync renders them.
+        type: object
+        additionalProperties: false
+        properties:
+          fast: {$ref: '#/$defs/ciJob'}
+          lint: {$ref: '#/$defs/ciJob'}
+          test:
+            type: object
+            additionalProperties: false
+            properties:
+              timeoutMinutes: {type: integer, minimum: 5, maximum: 360}
+              shards: {type: integer, minimum: 1, maximum: 20}
+          coverage: {$ref: '#/$defs/ciJob'}
+          build: {$ref: '#/$defs/ciJob'}
+          sonar: {$ref: '#/$defs/ciJob'}
+          db-types: {$ref: '#/$defs/ciJob'}
       dependabot:
         type: object
         additionalProperties: false
@@ -300,6 +319,11 @@ $defs:
               properties:
                 name: {$ref: '#/$defs/ciName'}
                 purpose: {type: string}
+  ciJob:
+    type: object
+    additionalProperties: false
+    properties:
+      timeoutMinutes: {type: integer, minimum: 5, maximum: 360}
   ciSecret:
     anyOf:
       - type: object

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "93fd9007c93fe7430043d8b6682fd46dd0e1d5f9f9b7094fc94ffad2ccdcceeb",
+  "hash": "7cf3ce3c9e0abb27fa139c93abbbf15a2f8cc8aec47ba95f022d946b53d8998f",
   "global": [
     {
       "name": "json",
@@ -177,7 +177,7 @@ export const CATALOG = {
           "runtimeSide": "host"
         },
         "ci": {
-          "summary": "set declared GitHub CI secrets and variables and verify their custody",
+          "summary": "set declared GitHub CI secrets and variables, verify their custody, or run the managed CI locally",
           "owner": "@starci/hfs",
           "positional": [
             {
@@ -185,7 +185,8 @@ export const CATALOG = {
               "enum": [
                 "secret",
                 "var",
-                "verify"
+                "verify",
+                "local"
               ],
               "required": true,
               "variadic": false
@@ -234,12 +235,32 @@ export const CATALOG = {
             {
               "name": "json",
               "type": "boolean",
-              "summary": "print verification findings as JSON"
+              "summary": "print verification findings (or the local plan and results) as JSON"
+            },
+            {
+              "name": "jobs",
+              "type": "string",
+              "summary": "local: the jobs to run, comma separated (default fast,lint,test,coverage,build; sonar and db-types only when named)"
+            },
+            {
+              "name": "parallel",
+              "type": "string",
+              "summary": "local: job instances run at once (default half the CPUs, at most 4)"
+            },
+            {
+              "name": "logs",
+              "type": "string",
+              "summary": "local: the directory the job logs go to (default a new temp directory)"
+            },
+            {
+              "name": "dry-run",
+              "type": "boolean",
+              "summary": "local: print which steps would run and which only GitHub can run"
             }
           ],
           "exit": {
-            "0": "action completed or verification clean",
-            "1": "verification findings",
+            "0": "action completed, verification clean or every local job green",
+            "1": "verification findings or a local job red",
             "2": "refusal or bad usage"
           },
           "json": "flag",
@@ -250,13 +271,71 @@ export const CATALOG = {
             "starci app ci var set SONAR_HOST_URL",
             "starci app ci var sync",
             "starci app ci var sync --execute",
-            "starci app ci verify --json"
+            "starci app ci verify --json",
+            "starci app ci local --dry-run",
+            "starci app ci local --jobs lint,test --parallel 4"
+          ],
+          "editions": [
+            "full",
+            "lite"
+          ],
+          "impl": null,
+          "conventions": [
+            "local reads .github/workflows/ci.yml and runs every job instance (matrix values substituted) on this machine, in parallel, a job after its needs",
+            "it skips what only GitHub runs (uses: actions, npm ci, the lint baseline, a step whose if: needs a Sonar token, a tag ref or step outputs) and lists it",
+            "the unit shards write be/coverage/shards/shard-<i>, which the coverage job merges; each instance logs to a temp directory"
+          ],
+          "runtimeSide": "host"
+        },
+        "coverage": {
+          "summary": "merge the lcov reports of the sharded unit run into one report",
+          "owner": "@starci/hfs",
+          "positional": [
+            {
+              "name": "action",
+              "enum": [
+                "merge"
+              ],
+              "required": true,
+              "variadic": false
+            },
+            {
+              "name": "paths",
+              "required": true,
+              "variadic": true
+            }
+          ],
+          "flags": [
+            {
+              "name": "out",
+              "type": "string",
+              "summary": "the merged lcov to write (the managed CI writes be/coverage/lcov.info)"
+            },
+            {
+              "name": "cwd",
+              "type": "string",
+              "summary": "the app root (default the current directory)"
+            }
+          ],
+          "exit": {
+            "0": "merged",
+            "2": "bad usage or no report found"
+          },
+          "json": "none",
+          "examples": [
+            "starci app coverage merge --out be/coverage/lcov.info be/coverage/shards"
           ],
           "editions": [
             "full",
             "lite"
           ],
           "impl": null,
+          "conventions": [
+            "the CI standard shards the unit run (npm test -- --shard=i/N); each shard writes an lcov over the whole coverage scope",
+            "merge sums every line, function and branch hit by identity across the reports and writes one record per source file",
+            "a path is an lcov file or a directory searched for every lcov.info below it; no report found refuses (exit 2), never an empty report",
+            "the coverage proof (starci app check --coverage-from), the Codecov upload and the Sonar import read the merged report"
+          ],
           "runtimeSide": "host"
         },
         "db": {
@@ -618,8 +697,8 @@ export const CATALOG = {
           ],
           "exit": {
             "0": "gate green or push done or nothing to do",
-            "1": "a gate is red or the push was refused by the hook",
-            "2": "refusal or bad usage including RELEASE_CI_RED and RELEASE_SONAR_UNAVAILABLE"
+            "1": "a gate is red, the candidate CI of the sha is not green, or the push was refused by the hook",
+            "2": "refusal or bad usage including RELEASE_SONAR_UNAVAILABLE"
           },
           "json": "flag",
           "examples": [
@@ -641,10 +720,11 @@ export const CATALOG = {
             "declared release.gates gets audit appended if missing",
             "--sonar appends @sonar/scan@4.3.0 against services.sonar.host (host.public for a host mapping), plus organization for sonarcloud;",
             "disabled or unavailable Sonar or an unset token refuses RELEASE_SONAR_UNAVAILABLE",
-            "gate checks the newest completed ci.yml run on the default branch, including reachable push/tag runs;",
-            "failure, cancelled or timed_out refuses RELEASE_CI_RED with its URL and SHA;",
-            "unreadable GitHub or no run warns RELEASE_CI_UNKNOWN and continues",
-            "only the owner's starci release ci-override --sha <sha> --reason <text> record can override red CI; there is no --no-ci-check flag",
+            "OWNER RULING candidate-ci (2026-10-18): the gate no longer reads the default-branch CI; the verdict is the candidate run of the sha",
+            "push --execute sends HEAD to refs/heads/release/candidate-<version> first and waits for its ci.yml run (it triggers on release/candidate-*)",
+            "green moves the branch and the tag in one atomic push; red refuses RELEASE_CANDIDATE_CI_RED naming the failing jobs",
+            "no run, or no end in time, refuses RELEASE_CANDIDATE_CI_TIMEOUT; unreadable GitHub refuses RELEASE_CI_UNKNOWN; nothing reaches the branch",
+            "only the owner's starci release ci-override --sha <sha> --reason <text> record lets a red candidate through; there is no --no-ci-check flag",
             "gate refuses a dirty tree, HEAD other than --source, a moved HEAD and a tree dirtied by the gates; record and tag only when all gates are green",
             "a gate with summary jest is red on failed tests and on a coverage threshold miss even when the process exits 0",
             "push needs the annotated tag and L4 record of HEAD, runs git push --dry-run --atomic first and never uses --no-verify"
@@ -7723,6 +7803,11 @@ export const CATALOG = {
               "name": "keep",
               "type": "boolean",
               "summary": "keep and print the temporary application path"
+            },
+            {
+              "name": "source",
+              "type": "boolean",
+              "summary": "scaffold with this checkout and install the @starci scope from its packed tarballs (the pre-publish form release scaffold-e2e runs)"
             }
           ],
           "exit": {
@@ -7733,7 +7818,8 @@ export const CATALOG = {
           "json": "none",
           "examples": [
             "starci release app-installs",
-            "starci release app-installs --keep"
+            "starci release app-installs --keep",
+            "starci release app-installs --source"
           ],
           "editions": [
             "full"
@@ -7778,7 +7864,7 @@ export const CATALOG = {
           "runtimeSide": "tree"
         },
         "ci-override": {
-          "summary": "the owner accepts red CI for one SHA and records who and why",
+          "summary": "the owner accepts a red candidate CI for one SHA (emergency path) and records who and why",
           "owner": "runtime",
           "flags": [
             {
@@ -7813,14 +7899,17 @@ export const CATALOG = {
             "script": "scripts/supervisor/release-ci-override-cli.mjs"
           },
           "conventions": [
-            "OWNER RULING 2026-10-17 (chat to main, relayed): alpha.20 \"cut refuses when the latest CI on main is red, with a documented owner override verb\";",
-            "the override is owner-only, records who and why in the owner rulings, and agents cannot run it.",
+            "OWNER RULING candidate-ci (2026-10-18): a release reaches main only when the candidate CI of its own sha is green;",
+            "this verb is the one documented EMERGENCY path for a red candidate.",
+            "The override is owner-only, records who and why, and agents cannot run it (OWNER RULING alpha20-ci-override-owner-only).",
             "Every bound role is refused by the command guard and by this script. The owner must use a terminal and type the first 12 SHA characters exactly.",
             "Writes <git-common-dir>/starci-release/<sha>.ci-override.json, schema starci/ci-override@1,",
             "with sha, reason, by (git user.name and OS user), at, and runUrl (empty if GitHub is unavailable).",
-            "For the runtime, appends ci-override-<sha12> under rulings before the top-level supersedes key in modules/kernel/owner-rulings.yaml.",
-            "Commit that entry into the tree being cut. App repositories receive only the record.",
-            "An override applies only to its exact SHA. It does not permit a cut when CI is unknown. Existing ruling IDs with another reason refuse."
+            "release cut and app release push read that record for the exact candidate sha only; the release record logs its use.",
+            "For the runtime it also appends ci-override-<sha12> under rulings in modules/kernel/owner-rulings.yaml as the audit trail.",
+            "App repositories receive only the record.",
+            "An override applies only to its exact SHA. It never permits a release whose CI is unknown or timed out.",
+            "Existing ruling IDs with another reason refuse."
           ],
           "runtimeSide": "tree"
         },
@@ -7942,8 +8031,8 @@ export const CATALOG = {
             }
           ],
           "exit": {
-            "0": "the release was cut and main plus its tag were pushed atomically, or --plan found nothing missing",
-            "1": "refused (RELEASE_CI_RED, RELEASE_CI_UNKNOWN, dirty tree, no or wrong tag, release notes incomplete, version not moved past the remote main, suite red, main moved, secret scan) and nothing was pushed",
+            "0": "the candidate CI of the release sha was green, then main plus its tag were pushed atomically, or --plan found nothing missing",
+            "1": "refused (RELEASE_CANDIDATE_CI_RED, RELEASE_CANDIDATE_CI_TIMEOUT, RELEASE_CI_UNKNOWN, dirty tree, no or wrong tag, release notes incomplete, version not moved past the remote main, suite red, main moved, secret scan) and nothing was pushed",
             "2": "bad usage"
           },
           "json": "flag",
@@ -7960,14 +8049,18 @@ export const CATALOG = {
             "script": "scripts/supervisor/release-cut-cli.mjs"
           },
           "conventions": [
-            "OWNER RULING 2026-10-17 (chat to main, relayed): alpha.20 \"cut refuses when the latest CI on main is red, with a documented owner override verb\";",
-            "the override is owner-only, records who and why in the owner rulings, and agents cannot run it.",
-            "Before the suite, including --plan, read the newest completed CI workflow run on main.",
-            "Only success continues; every other conclusion refuses RELEASE_CI_RED and names the run URL and headSha.",
-            "Unreadable GitHub or no completed run refuses RELEASE_CI_UNKNOWN: a cut must not proceed blind, including under suite ci.",
-            "The owner may run starci release ci-override --sha <headSha> --reason <text>.",
-            "A red run requires both starci-release/<headSha>.ci-override.json in the git common dir and ci-override-<sha12>",
-            "in modules/kernel/owner-rulings.yaml of the tree being cut. Commit the ruling before cutting."
+            "OWNER RULING candidate-ci (2026-10-18): never again have main receive a release whose CI is red, with the owner confirming afterwards.",
+            "Before the suite, including --plan, the workflows the candidate CI waits for (release-cut.yaml candidate.workflows) must be readable,",
+            "else RELEASE_CI_UNKNOWN. The latest run on main is no longer read: a red main needs no owner override before the next release.",
+            "After the suite and the secret scan the exact HEAD is pushed to refs/heads/release/candidate-<version>;",
+            "a re-cut of the same version force-moves only that ref, never main.",
+            "The cut waits for every required workflow run of that sha (pollSeconds, graceMinutes, waitMinutes in release-cut.yaml).",
+            "Red refuses RELEASE_CANDIDATE_CI_RED with the run URLs and the failing jobs and steps; nothing reaches main.",
+            "No run within the grace, or no end within the wait, refuses RELEASE_CANDIDATE_CI_TIMEOUT.",
+            "A red candidate keeps its ref for diagnosis; after a cut the candidate ref is left on the remote, naming the released sha.",
+            "Only on green is the annotated tag created and main plus the tag pushed atomically; the release record logs the candidate verdict.",
+            "Emergency path, owner-only: starci release ci-override --sha <HEAD> --reason <text> lets a red candidate through.",
+            "The release record logs its use."
           ],
           "runtimeSide": "tree"
         },

package/runtime/scripts/hfs/lcov-merge.mjs

@@ -0,0 +1,134 @@
+// lcov-merge.mjs - the lcov reports of the sharded unit run merged into one (`starci app coverage merge`, the coverage job of the managed CI). Each shard of
+// `npm test -- --shard=i/N` writes its own lcov over the whole collectCoverageFrom scope, so the merge sums every line, function and branch hit by its
+// identity across the shards and writes ONE record per source file, with the summaries recomputed.
+// A record of zeros (no line, function or branch hit) is the placeholder a shard writes for a file none of its tests loaded: jest instruments it on its own
+// (babel-istanbul), so its function names and branch ids are not the ones of the shard that ran it (v8), and summing them would add phantom uncovered
+// entries. Such a placeholder is dropped whenever another report holds a record of the file with a hit; a file that is a placeholder everywhere keeps one,
+// so it stays uncovered and the proof refuses it. Branch ids are not stable either: the v8 provider numbers a file's blocks in the order it met them, and a
+// shard that ran fewer functions numbers them differently. A branch is therefore keyed by its line and its ordinal among the blocks of that line (BRDA
+// <line>,<ordinal>,<branch>), and a record that loaded the file without calling any of its functions brings its lines and functions but not its branches
+// when another report called them. The coverage proof (`starci app check --coverage-from`), the Codecov upload and the Sonar import then read
+// the one be/coverage/lcov.info they always read. Pure over the texts; the file walk is lcovFilesUnder.
+import fs from 'node:fs';
+import path from 'node:path';
+import { byCodeUnit } from '../lib/list.mjs';
+import { addHits as add } from './rules/coverage-below.mjs';
+
+const BOM = String.fromCodePoint(0xfeff);
+const count = (value) => (/^\d+$/.test(value) ? Number(value) : 0);
+
+function recordOf(records, source) {
+  if (!records.has(source)) records.set(source, { lines: new Map(), fnLines: new Map(), fnHits: new Map(), branches: new Map(), rawBranches: [] });
+  return records.get(source);
+}
+
+/** Function data: FN:<line>[,<end>],<name> declares, FNDA:<hits>,<name> counts (a name may hold commas). */
+function functionLine(record, tag, value) {
+  const at = value.indexOf(',');
+  if (at < 0) return;
+  if (tag === 'FN') {
+    let name = value.slice(at + 1);
+    let line = value.slice(0, at);
+    if (/^\d+,/.test(name)) { line = `${line},${name.slice(0, name.indexOf(','))}`; name = name.slice(name.indexOf(',') + 1); }
+    if (!record.fnLines.has(name)) record.fnLines.set(name, line);
+    if (!record.fnHits.has(name)) record.fnHits.set(name, 0);
+  } else add(record.fnHits, value.slice(at + 1), count(value.slice(0, at)));
+}
+
+function dataLine(record, tag, value) {
+  if (tag === 'DA') {
+    const [line, hits] = value.split(',');
+    add(record.lines, Number(line), count(hits ?? ''));
+  } else if (tag === 'FN' || tag === 'FNDA') functionLine(record, tag, value);
+  else if (tag === 'BRDA') {
+    const parts = value.split(',');
+    if (parts.length === 4) record.rawBranches.push({ line: Number(parts[0]), block: Number(parts[1]), branch: Number(parts[2]), hits: parts[3] === '-' ? 0 : count(parts[3]) });
+  }
+}
+
+/** The branches of a record keyed by line and the ordinal of their block on that line: stable across shards that numbered blocks differently. */
+function keyBranches(record) {
+  const blocksByLine = new Map();
+  for (const entry of [...record.rawBranches].sort((a, b) => a.block - b.block || a.branch - b.branch)) {
+    const blocks = blocksByLine.get(entry.line) ?? [];
+    if (!blocks.includes(entry.block)) blocks.push(entry.block);
+    blocksByLine.set(entry.line, blocks);
+    add(record.branches, `${entry.line},${blocks.indexOf(entry.block)},${entry.branch}`, entry.hits);
+  }
+  return record;
+}
+
+/** The records of one text by source file (a source repeated inside one text merges into one record). */
+function recordsOfText(text) {
+  const records = new Map();
+  let current = null;
+  const body = String(text).startsWith(BOM) ? String(text).slice(1) : String(text);
+  for (const raw of body.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (line === 'end_of_record') { current = null; continue; }
+    const colon = line.indexOf(':');
+    if (colon < 0) continue;
+    const tag = line.slice(0, colon);
+    const value = line.slice(colon + 1);
+    if (tag === 'SF') current = recordOf(records, value);
+    else if (current) dataLine(current, tag, value);
+  }
+  for (const record of records.values()) keyBranches(record);
+  return records;
+}
+
+const anyHit = (map) => [...map.values()].some((hits) => hits > 0);
+/** A record no test touched: no line, function or branch hit (the placeholder of a shard that never loaded the file). */
+const placeholder = (record) => !anyHit(record.lines) && !anyHit(record.fnHits) && !anyHit(record.branches);
+
+function mergeInto(target, record, { branches = true } = {}) {
+  for (const [line, hits] of record.lines) add(target.lines, line, hits);
+  for (const [name, line] of record.fnLines) if (!target.fnLines.has(name)) target.fnLines.set(name, line);
+  for (const [name, hits] of record.fnHits) add(target.fnHits, name, hits);
+  if (branches) for (const [branch, hits] of record.branches) add(target.branches, branch, hits);
+}
+
+/** Every record of every text merged by source file (SF) and identity; a placeholder counts only when no report touched the file. */
+function parseAll(texts) {
+  const bySource = new Map();
+  for (const text of texts) for (const [source, record] of recordsOfText(text)) bySource.set(source, [...(bySource.get(source) ?? []), record]);
+  const records = new Map();
+  for (const [source, list] of bySource) {
+    const touched = list.filter((record) => !placeholder(record));
+    const target = recordOf(records, source);
+    const called = touched.some((record) => anyHit(record.fnHits));
+    // A record that loaded the file but called none of its functions keeps only its lines and functions when another record called them.
+    for (const record of touched.length ? touched : list.slice(0, 1)) mergeInto(target, record, { branches: !called || anyHit(record.fnHits) });
+  }
+  return records;
+}
+
+const branchOrder = (a, b) => a.split(',').map(Number).reduce((order, part, index) => order || part - Number(b.split(',')[index]), 0);
+
+function serialize(source, record) {
+  const out = ['TN:', `SF:${source}`];
+  const functions = [...record.fnLines.keys()].sort((a, b) => Number(record.fnLines.get(a).split(',')[0]) - Number(record.fnLines.get(b).split(',')[0]) || byCodeUnit(a, b));
+  for (const name of functions) out.push(`FN:${record.fnLines.get(name)},${name}`);
+  for (const name of functions) out.push(`FNDA:${record.fnHits.get(name) ?? 0},${name}`);
+  out.push(`FNF:${functions.length}`, `FNH:${functions.filter((name) => (record.fnHits.get(name) ?? 0) > 0).length}`);
+  const lines = [...record.lines.keys()].sort((a, b) => a - b);
+  for (const line of lines) out.push(`DA:${line},${record.lines.get(line)}`);
+  out.push(`LF:${lines.length}`, `LH:${lines.filter((line) => record.lines.get(line) > 0).length}`);
+  const branches = [...record.branches.keys()].sort(branchOrder);
+  for (const branch of branches) out.push(`BRDA:${branch},${record.branches.get(branch)}`);
+  out.push(`BRF:${branches.length}`, `BRH:${branches.filter((branch) => record.branches.get(branch) > 0).length}`, 'end_of_record');
+  return out.join('\n');
+}
+
+/** One lcov text of the merged `texts`: a record per source file, sorted by path, hits summed by line, function name and branch identity. */
+export function mergeLcov(texts) {
+  const records = parseAll(texts);
+  return [...records.keys()].sort(byCodeUnit).map((source) => serialize(source, records.get(source))).join('\n') + (records.size ? '\n' : '');
+}
+
+/** The lcov files a path names: the file itself, or every `lcov.info` below a directory (sorted). */
+export function lcovFilesUnder(target) {
+  if (!fs.statSync(target).isDirectory()) return [target];
+  return fs.readdirSync(target, { recursive: true, withFileTypes: true }).filter((entry) => entry.isFile() && entry.name === 'lcov.info')
+    .map((entry) => path.join(entry.parentPath ?? entry.path, entry.name)).sort(byCodeUnit);
+}

package/runtime/scripts/hfs/rules/a15-findings.mjs

@@ -34,6 +34,7 @@ import { stackToolingFindings } from './stack-tooling.mjs';
 import { stacksDeployFindings } from './stacks-deploy.mjs';
 import { ciCustodyFindings } from './ci-custody.mjs';
 import { workflowContextsFindings } from './workflow-contexts.mjs';
+import { ciStandardAppFindings } from './ci-standard.mjs';
 import { feBuildArgsFindings } from './fe-build-args.mjs';
 // finders-import-end
 
@@ -42,6 +43,7 @@ export const A15_CODES = [
   // codes-begin
   'FE_PUBLIC_BUILD_ARG_MISSING',
   'HFS_WORKFLOW_CONTEXT',
+  'CI_STANDARD',
   'CI_SECRET_SEALED', 'APP_SECRET_IN_CI', 'CI_DECLARATION_DRIFT',
   'BACKUP_PROOF_MISSING', 'BACKUP_UNDECLARED', 'BE_APP_BOOT_PROOF_MISSING', 'BE_APP_ENV_REQUIRED', 'BE_APP_MODULE_LIST_INLINE', 'BE_LITE_PROOF_LANE_MISSING', 'DB_API_EXPOSED', 'DB_ARCHIVE_MUTATED', 'DB_BASELINE_SHAPE', 'DB_CRON_OWNED', 'DB_EXTENSION_ALLOWED', 'DB_MIGRATION_DESTRUCTIVE', 'DB_PGMQ_DECLARED', 'DB_VAULT_WRITE', 'ENV_DUPLICATE', 'ENV_EXAMPLE_DRIFT', 'ENV_PUBLIC_SEALED', 'ENV_REQUIRED_UNSET', 'ENV_SEALED_UNREAD', 'ENV_VALUE_SHAPE', 'FE_STACK_CORE_MISSING', 'FE_STACK_UNLISTED', 'HFS_AGE_KEY_CUSTODY', 'HFS_APP_LEXICON', 'HFS_APP_WORKFLOW_TRIGGER', 'HFS_ASSET_KIND', 'HFS_ASSET_OVERSIZE', 'HFS_AUDIT_STEP_MISSING', 'HFS_CANON_COPY_DRIFT', 'HFS_CI_TOOL_INSTALL', 'HFS_COVERAGE_BELOW', 'HFS_DB_DEPLOY_UNGUARDED', 'HFS_DEPENDABOT_MISSING', 'HFS_DEPLOY_COMPOSE_ON_VPS', 'HFS_DEPLOY_NO_LOGIC', 'HFS_DEPLOY_SCHEDULER', 'HFS_DEPLOY_WORKFLOW', 'HFS_DOC_COMMAND_UNKNOWN', 'HFS_DOC_ENV_UNKNOWN', 'HFS_DOC_PATH_MISSING', 'HFS_DOC_RULE_UNKNOWN', 'HFS_FEATURE_FILE_BUDGET', 'HFS_HOST_CRON', 'HFS_RELEASE_TAG_MISMATCH', 'HFS_SBOM_MISSING', 'HFS_SCHEDULE_UNDECLARED', 'HFS_SCRIPT_PLAINTEXT_LOAD', 'HFS_SCRIPT_XTRACE', 'HFS_SECRET_OUTSIDE_ENC', 'HFS_SECRET_PLAINTEXT_FILE', 'HFS_SEED_PII', 'HFS_SERVICE_ROLE_SCOPE', 'HFS_UNUSED_SYMBOL', 'HFS_WORKFLOW_PIN', 'STACKS_DEPLOY_CONFIG_INVALID', 'STACKS_DNS_UNDECLARED', 'STACKS_HEALTHCHECK_MISSING', 'STACKS_HOST_UNROUTED', 'STACKS_INGRESS_UNDECLARED', 'STACKS_INGRESS_UNKNOWN', 'STACKS_LITE_SELFHOSTED_DB', 'STACKS_MODEL_UNAVAILABLE', 'STACKS_PLACEMENT_MISSING', 'STACKS_PORT_PUBLISHED', 'STACKS_REALTIME_SCALED', 'STACKS_RELEASE_UNDECLARED', 'STACKS_SECOND_INGRESS', 'STACKS_SECRET_ENV_LITERAL', 'STACKS_SECRET_NOT_EXTERNAL', 'STACKS_SECRET_UNVERSIONED', 'STACKS_SIDECAR_DB_UNSUPPORTED', 'STACKS_SIDECAR_VOLUME_UNDECLARED', 'STACKS_TLS_UNDECLARED', 'STACKS_UPDATE_POLICY_MISSING', 'STACK_TOOLING_REIMPLEMENTED',
   // codes-end
@@ -51,6 +53,7 @@ const FINDERS = [
   // finders-begin
   feBuildArgsFindings,
   workflowContextsFindings,
+  ciStandardAppFindings,
   featureFileFindings,
   lexiconFindings,
   assetsFindings,