@starci/hfs 4.7.31 → 4.7.33

package/runtime/scripts/guards/op-write-scope.mjs

@@ -0,0 +1,27 @@
+// op-write-scope.mjs — where an Op may write: its attempt's owned paths and the runtime temp directory, nothing else. The owned paths
+// are the absolute paths its job guard records at launch (scripts/guards/hook-install.mjs writeJobGuard); a file the Op needs outside
+// them is reported as owed, never written. The PreToolUse guard applies it to Edit, Write and the shell write targets alike
+// (rights.mjs fileWriteVerdict).
+import os from 'node:os';
+import { tempRoot } from '../../engine/temp-root.mjs';
+import { pathKey, sameOrUnder } from '../lib/path-key.mjs';
+
+const inside = (file, dirs) => dirs.some((dir) => sameOrUnder(pathKey(file), pathKey(dir)));
+
+/** Directories every Op may write: the runtime temp root and the OS temp directory. */
+const scratchDirs = (env) => [tempRoot({ env }), os.tmpdir(), env?.TEMP, env?.TMP, env?.TMPDIR].filter(Boolean);
+
+/**
+ * The refusal fields {code, reason, remedy} for an Op write to `file`, or null when it may write there. An Op with no workflow
+ * worktree in its guard (a guard without scope information) is not confined.
+ */
+export function opWriteScopeRefusal({ file, guard, env = process.env }) {
+  if (!guard?.workflowWorktree) return null;
+  if (inside(file, guard.owned ?? [])) return null;
+  if (!inside(file, [guard.workflowWorktree]) && inside(file, scratchDirs(env))) return null;
+  return {
+    code: 'RIGHTS_OP_OUTSIDE_OWNED',
+    reason: 'an Op writes only inside the paths its attempt owns and the runtime temp directory; this file is outside them',
+    remedy: 'put scratch files in the runtime temp directory; a change the work needs outside your owned paths is reported as owed in your report (starci kernel report) for your Kernel to cut',
+  };
+}

package/runtime/scripts/guards/orca-self-lifecycle.mjs

@@ -0,0 +1,39 @@
+// Own-seat lifecycle admission for R223; the policy table owns the verbs, roles, types and options.
+const optionsOf = (args, entry) => {
+  const values = new Set(entry.values ?? []), flags = new Set(entry.flags ?? []);
+  const options = new Map();
+  for (let i = 0; i < args.length; i += 1) {
+    const word = args[i], at = word.indexOf('=');
+    const name = at < 0 ? word : word.slice(0, at);
+    if (options.has(name)) return null; // Ambiguous identities/types never qualify, even if repeated identically.
+    if (flags.has(name) && at < 0) { options.set(name, true); continue; }
+    if (!values.has(name)) return null; // No positionals, terminators or unknown identity-changing options.
+    const value = at < 0 ? args[++i] : word.slice(at + 1);
+    if (value == null || (at < 0 && value.startsWith('--'))) return null;
+    options.set(name, value);
+  }
+  return options;
+};
+
+/** True only for a policy-listed lifecycle call whose explicit identity equals the trusted caller handle. */
+export function orcaSelfLifecycleAllowed({ role, args, handle, policy }) {
+  const lifecycle = policy.orca?.['self-lifecycle'];
+  if (!handle || args[0] !== lifecycle?.group || !lifecycle.roles?.includes(role)) return false;
+  const entry = lifecycle.verbs?.[args[1]];
+  if (!entry || (entry.roles && !entry.roles.includes(role))) return false;
+  const options = optionsOf(args.slice(2), entry);
+  if (!options || options.get(entry.identity) !== handle) return false;
+  const types = entry.typesByRole?.[role] ?? entry.types;
+  return !types || types.includes(options.get('--type'));
+}
+
+/**
+ * The option a role may not use on a policy-listed lifecycle call ('refuse-for' in the policy entry), or null: an Op that names
+ * a recipient (--to) or another Run (--run) addresses someone other than its own Kernel.
+ */
+export function orcaAddressedOption({ role, args, policy }) {
+  const lifecycle = policy.orca?.['self-lifecycle'];
+  if (args[0] !== lifecycle?.group) return null;
+  const refused = lifecycle.verbs?.[args[1]]?.['refuse-for']?.[role] ?? [];
+  return args.slice(2).map((word) => String(word).split('=', 1)[0]).find((name) => refused.includes(name)) ?? null;
+}

package/runtime/scripts/guards/process-kill-verdict.mjs

@@ -0,0 +1,106 @@
+// process-kill-verdict.mjs - the command guard's process rules: a kill that selects processes by image name or pattern
+// (PROCESS_KILL_BY_NAME), and a kill whose targets come from a process QUERY - Get-CimInstance Win32_Process, Get-Process,
+// ps | grep, pgrep - which ends other lanes' processes by their command line, parent or path (a lane killed other lanes'
+// node test runs that way, 2026-10-02). An agent ends only a PID it started and recorded: `taskkill /PID <pid>`,
+// `kill <pid>`, `Stop-Process -Id <pid>`, or a variable assigned from its own Start-Process or `cmd & pid=$!`.
+// Reads (Get-CimInstance listing, `ps aux | grep node`) and text that only mentions these commands pass: the query rule
+// judges parsed commands, so an echo, a commit message or a heredoc never reaches it.
+// A kill whose variable was set in an EARLIER shell call (`$x = ...` in one call, `Stop-Process -Id $x` or `kill $pid` in the
+// next) is not judged, by design. The guard sees one call's text and keeps no state: a Bash or PowerShell tool call is a
+// fresh shell, so a variable never survives into the next call - what carries a PID across calls is a file, an environment
+// value or the model's own memory of a literal, none of which the guard can trace to its source. Refusing every non-literal
+// target would refuse `Stop-Process -Id (Get-Content run.pid)` and `kill $(cat run.pid)`, the PID file the remedy itself
+// tells an agent to keep; a query stage is the one evidence of a foreign target, and it is judged only where it is visible,
+// in the same call. Tracking provenance across calls would need a ledger of the PIDs an agent started, which no hook can
+// fill soundly; the by-name rule above and the same-call query rule are the sound part.
+import { assignedCommand } from './assigned-command.mjs';
+const TASKKILL_SELECTOR = /^(?:\/\/?|-)(?:im|fi)$/i;
+const NAME_PARAMETER = /^-(?:n|na|nam|name|processname)(?::.*)?$/i;
+const POWERSHELL_STOP = new Set(['stop-process', 'spps']);
+const REMEDY = 'end only a PID you started yourself, the one you recorded when you started it (taskkill /PID <pid>, kill <pid>, Stop-Process -Id <pid>), never one found by a query; a process you did not start is reported, never killed';
+
+/** The refusal for one command that kills by name or pattern, or null. */
+export const nameKillVerdict = (program, args) => {
+  let how = null;
+  if (program === 'taskkill' && args.some((a) => TASKKILL_SELECTOR.test(a))) how = 'taskkill by image name or filter (/IM, /FI)';
+  else if (program === 'pkill' || program === 'killall') how = `${program}, which selects processes by name or pattern`;
+  // PowerShell's kill alias takes the full -Name/-ProcessName; a POSIX `kill -n <signal>` is not a name.
+  else if ((POWERSHELL_STOP.has(program) && args.some((a) => NAME_PARAMETER.test(a))) || (program === 'kill' && args.some((a) => /^-(?:name|processname)(?::.*)?$/i.test(a)))) how = 'Stop-Process -Name';
+  else if (program === 'wmic' && args.some((a) => /^process$/i.test(a)) && args.some((a) => /\bname\s*=|^name$/i.test(a))) how = 'wmic process selected by name';
+  // wmic process where <filter> delete | call terminate, unless the filter is one literal ProcessId.
+  else if (program === 'wmic' && args.some((a) => /^process$/i.test(a)) && args.some((a) => /\b(?:delete|terminate)\b/i.test(a)) && !args.some((a) => /(?<![a-z])(?:process)?id\s*=\s*\d+\s*$/i.test(a))) how = 'wmic process ... delete|terminate selected by a filter';
+  if (!how) return null;
+  return { code: 'PROCESS_KILL_BY_NAME', command: [program, ...args].join(' ').slice(0, 200),
+    reason: `${how} ends every process it matches on the machine, including Orca and other agents' workers (a lane's taskkill of node.exe restarted Orca, 2026-10-01)`,
+    remedy: REMEDY };
+};
+
+const QUERY_PROGRAMS = new Set(['get-process', 'gps', 'ps', 'pgrep', 'pidof', 'tasklist']);
+const CIM_PROGRAMS = new Set(['get-ciminstance', 'gcim', 'get-wmiobject', 'gwmi']);
+const isQuery = (c) => QUERY_PROGRAMS.has(c.program) || (CIM_PROGRAMS.has(c.program) && c.args.some((a) => /win32_process/i.test(a))) || (c.program === 'wmic' && c.args.some((a) => /^process$/i.test(a)));
+const LITERAL = /^\d+(?:,\d+)*$/;
+const OPTION_VALUE = /^-(?:ea|erroraction|wa|warningaction|ev|errorvariable|ov|outvariable|s|n|signal)$/i;
+const TARGET_OPTION = /^-(?:id|inputobject)$/i;
+
+// The targets one kill command names ([] when it names none: its targets come down a pipe or an xargs).
+function targetsOf(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const a = args[i];
+    const inline = /^-(?:id|inputobject):(.*)$/i.exec(a);
+    if (inline) out.push(inline[1]);
+    else if (TARGET_OPTION.test(a)) { if (i + 1 < args.length) { out.push(args[i + 1]); } i += 1; }
+    else if (OPTION_VALUE.test(a)) i += 1;
+    else if (!a.startsWith('-')) out.push(a);
+  }
+  return out;
+}
+
+// 'kill' or 'Stop-Process' when its named targets are not all literal PIDs, else null.
+const killTargetHow = (program, targets) => {
+  if (targets.length && targets.every((t) => LITERAL.test(t))) return null;
+  return program === 'kill' ? 'kill' : 'Stop-Process';
+};
+
+// A kill sink whose target is not one literal PID: how it is spelled, or null.
+function sinkOf(c) {
+  const { program, args } = c;
+  if (POWERSHELL_STOP.has(program) || program === 'kill') {
+    if (args.some((a) => /^-l$/.test(a))) return null;
+    return killTargetHow(program, targetsOf(args));
+  }
+  if (program === 'taskkill') {
+    const at = args.findIndex((a) => /^(?:\/\/?|-)pid$/i.test(a));
+    return at >= 0 && !LITERAL.test(args[at + 1] ?? '') ? 'taskkill /PID' : null;
+  }
+  if (program === 'invoke-cimmethod' && args.some((a) => /^terminate$/i.test(a))) return 'Invoke-CimMethod Terminate';
+  if (/\.(?:terminate|kill)$/.test(program)) return `.${program.split('.').pop()}()`;
+  return null;
+}
+
+// The variables a kill names in the raw text, once per kill: `Stop-Process -Id $p.Id`, `$p | Stop-Process`, `$p.Kill()`,
+// `kill $pid`, `kill $!`. A kill target that is no plain variable (a $(...), a pipe from a query) names none.
+const ROOTS = [
+  new RegExp([
+    String.raw`\b(?:stop-process|spps|kill|taskkill)\b`,
+    String.raw`(?:\s+(?:-(?:id|inputobject)(?::|(?=\s))|(?:\/\/?|-)pid(?=\s)|-\w+(?=\s+\S*\$)))*`,
+    String.raw`\s*"?\$(\w+|!)`,
+  ].join(''), 'gi'),
+  /\$(\w+)\s*\|\s*(?:stop-process|spps)\b/gi,
+  /\$(\w+)\.(?:terminate|kill)\s*\(/gi,
+];
+const OWN_START = (root) => new RegExp(root === '!' ? '$^' : String.raw`(?:\$${root}\s*=\s*\(?\s*(?:start-process|start-job|\[[\w.]+\]::start)\b|(?<![\w$])${root}=\$!)`, 'i');
+
+/** The refusal for a kill whose targets come from a process query, or null. `commands` are the parsed commands, `text` the raw call. */
+export function queryKillVerdict(parsed, text) {
+  const commands = parsed.map(assignedCommand);
+  if (!commands.some(isQuery)) return null;
+  const sinks = commands.map((c) => [c, sinkOf(c)]).filter(([, how]) => how);
+  if (!sinks.length) return null;
+  const roots = ROOTS.flatMap((re) => [...String(text).matchAll(re)].map((m) => m[1]));
+  if (roots.length >= sinks.length && roots.every((r) => r === '!' || OWN_START(r).test(text))) return null;
+  const [c, how] = sinks[0];
+  return { code: 'PROCESS_KILL_BY_NAME', command: [c.program, ...c.args].join(' ').slice(0, 200),
+    reason: `${how} on targets found by a process query (Get-CimInstance Win32_Process, Get-Process, ps, pgrep) ends other lanes' and agents' processes selected by command line, name, path or parent - not a process you started`,
+    remedy: REMEDY };
+}

package/runtime/scripts/guards/protected-zone.mjs

@@ -0,0 +1,56 @@
+// protected-zone.mjs - the reader of modules/kernel/protected-zone.yaml, the ONE declaration of the protected zone
+// (rule R224 RIGHTS_PROTECTED_ZONE), and the question the command guard asks of it: is this path inside a runtime checkout,
+// and does it fall in a zone or on a protected catalog entry?
+//
+// A runtime checkout is found by rights.mjs runtimeRootOf (any directory tree holding knowledge/hfs/runtime-slots.yaml: the live
+// .claude, a lane worktree of it, a staging checkout), so every worktree of the runtime is judged by the same declaration
+// without asking git. Pure fs and one YAML read, loaded only when a role that can be
+// refused writes a file (the guard's common path never loads it).
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { parseYaml } from '../../engine/yaml.mjs';
+import { globExpression } from '../lib/glob.mjs';
+import { pathKey, posixPath } from '../lib/path-key.mjs';
+import { runtimeRootOf } from './rights.mjs';
+
+const SKILL_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const PROTECTED_ZONE_FILE = 'modules/kernel/protected-zone.yaml';
+
+const cache = new Map();
+
+/** {zones: [{id, why, matchers}], catalog: [{file, ids, codes}]} parsed from the declaration of `root`, or an empty zone when unreadable. */
+function loadProtectedZone({ root = SKILL_ROOT, read = (file) => fs.readFileSync(file, 'utf8') } = {}) {
+  const key = pathKey(root);
+  if (cache.has(key)) return cache.get(key);
+  let parsed = null;
+  try { parsed = parseYaml(read(path.join(root, PROTECTED_ZONE_FILE))); } catch { parsed = null; }
+  const zone = {
+    zones: (parsed?.zones ?? []).map((z) => ({ id: String(z.id), why: String(z.why ?? ''), matchers: (z.paths ?? []).map((p) => globExpression(String(p))) })),
+    catalog: (parsed?.catalogEntries ?? []).map((c) => ({ file: posixPath(String(c.file)), ids: (c.ids ?? []).map(String), codes: (c.codes ?? []).map(String) })),
+  };
+  cache.set(key, zone);
+  return zone;
+}
+
+/**
+ * Where `file` stands against the zone: {runtimeRoot, rel, zone: {id, why} | null, catalog: entry | null}. runtimeRoot is
+ * null when the path is outside every runtime checkout (then nothing here applies).
+ */
+export function zoneOfPath(file, { declaration = loadProtectedZone(), exists = fs.existsSync } = {}) {
+  const runtimeRoot = runtimeRootOf(file, { exists });
+  if (!runtimeRoot) return { runtimeRoot: null, rel: null, zone: null, catalog: null };
+  const rel = posixPath(path.relative(runtimeRoot, path.resolve(file)));
+  const zone = declaration.zones.find((z) => z.matchers.some((m) => m.test(rel))) ?? null;
+  const catalog = declaration.catalog.find((c) => c.file === rel) ?? null;
+  return { runtimeRoot, rel, zone: zone ? { id: zone.id, why: zone.why } : null, catalog };
+}
+
+/** The ids or codes of a catalog entry that `text` names (a rule id as a whole token, a code as a substring), or []. */
+export function catalogNames(entry, text) {
+  const body = String(text ?? '');
+  const hits = [];
+  for (const id of entry.ids) if (new RegExp(`(?:^|[^A-Za-z0-9])${id}(?![0-9])`).test(body)) hits.push(id);
+  for (const code of entry.codes) if (body.includes(code)) hits.push(code);
+  return hits;
+}

package/runtime/scripts/guards/refusals.mjs

@@ -0,0 +1,27 @@
+// refusals.mjs — how an op guard refuses: the lines the agent reads and the <guards root>/refusals.jsonl record.
+// Shared by the agent command guard (command-guard.mjs, a PreToolUse hook) and the history hook's commit check
+// (verify-commit.mjs).
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { guardsRoot } from './guards-root.mjs';
+
+const skillRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+
+/** The refusal as the agent reads it: what was refused and why, the remedy, and the shared-checkout rule. */
+export function refusalLines(tool, verdict) {
+  return [
+    `starci guard: refused \`${tool} ${verdict.command ?? ''}\` [${verdict.code}] — ${verdict.reason}.`,
+    ...(verdict.remedy ? [`starci guard: instead: ${verdict.remedy}.`] : []),
+    'starci guard: this checkout is shared with other workflows (modules/ops/_common.yaml "Evidence, completion and commits"). Report a real need in your report; never work around this guard.',
+  ];
+}
+
+/** Append one refusal to <guards root>/refusals.jsonl; the refusal stands without its log line. */
+export function logRefusal(entry, { root = skillRoot } = {}) {
+  try {
+    const dir = guardsRoot(root);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.appendFileSync(path.join(dir, 'refusals.jsonl'), `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`);
+  } catch { /* the refusal stands without its log line */ }
+}

package/runtime/scripts/guards/release-definition.mjs

@@ -0,0 +1,185 @@
+// release-definition.mjs - what makes a commit of the runtime repository a RELEASE commit, the one definition shared by the
+// pre-push hook (scripts/guards/release-push-gate.mjs) and the release cut (scripts/supervisor/release-cut.mjs). The remote
+// main of the runtime moves exactly when a release is cut, so a push of main or of a v* tag is judged against this list:
+//   RELEASE_VERSION_UNCHANGED   package.json `version` at the pushed commit differs from the version at the remote main's head
+//   RELEASE_TAG_VERSION         the release tag is v<version> of the pushed commit
+//   RELEASE_CHANGELOG_SECTION   CHANGELOG.md holds `## [<version>] - <date>` (a dated heading) with no unfinished marker (R222)
+//   RELEASE_TAG_MISSING         an ANNOTATED tag v<version> points at the pushed commit
+//   RELEASE_RECEIPT_MISSING     the L4 record of exactly this commit (scripts/guards/release-record.mjs, written by the cut) names this tag
+//   RELEASE_RECEIPT_INCOMPLETE  that record holds a green row for each of RECEIPT_STEPS (the package clean-test, the scaffold e2e and the checks) (RAN on this commit or reused from another with the identical input digest, the record's `reusedFrom` names it; owner ruling speed-flow, 2026-10-25)
+//   RELEASE_SUITE_MODE          the record says `suite: ci` (the Linux parity delegated to CI) while the checked-out config says `local`, or it lists no delegated linux-parity: a record never claims the mode by
+//                               itself (scripts/guards/release-suite-mode.mjs); both modes ask for the same root rows, the runtime has no spec suite to delegate (owner ruling no-runtime-specs)
+// Each finding names what is missing and the command that produces it. Pure over the git reads; no bypass.
+import { catFile } from '../api/git/cat-file.mjs';
+import { revParseQuery } from '../api/git/rev-parse-query.mjs';
+import { show } from '../api/git/show.mjs';
+import { tag as gitTag } from '../api/git/tag.mjs';
+import { mergeBaseQuery } from '../api/git/merge-base-query.mjs';
+import { pathKey, realPath } from '../lib/path-key.mjs';
+import { changelogSection, releaseNotesFindings } from '../hfs/runtime-rules/release-notes.mjs';
+import { readL4Record } from './release-record.mjs';
+import { suiteModeOf } from './release-suite-mode.mjs';
+
+/** The rows the L4 record must hold green, run on the commit or reused from an identical-digest row of another, in either suite mode: the package clean-test, the scaffold e2e and the checks (the runtime's real tests). */
+export const RECEIPT_STEPS = Object.freeze(['npm run test:packages', 'npm run test:e2e', 'npm run check']);
+const CUT_COMMAND = (tag) => `starci release cut --tag ${tag}`;
+const REGEX_SPECIALS = /[.*+?^$()|[\]{}\\]/g;
+const HEADING_HEAD = String.raw`^## \[`;
+const DATED_HEADING_TAIL = String.raw`\] — \d{4}-\d{2}-\d{2}\s*$`;
+const DATED_HEADING = (version) => new RegExp([HEADING_HEAD, version.replaceAll(REGEX_SPECIALS, String.raw`\$&`), DATED_HEADING_TAIL].join(''), 'mu');
+
+const finding = (code, missing, fix) => ({ code, missing, fix });
+const gitText = (verb, args, cwd) => {
+  const r = verb(args, { cwd, timeout: 60_000 });
+  return r.status === 0 ? String(r.stdout ?? '') : null;
+};
+
+/** The package.json version of `commit`, or null when the commit or its manifest cannot be read. */
+export function versionAt(cwd, commit) {
+  const text = gitText(show, [`${commit}:package.json`], cwd);
+  try { return text === null ? null : JSON.parse(text).version ?? null; } catch { return null; }
+}
+
+const releaseUnknown = (why) => ({ ok: false, status: 'unknown', why });
+const ineligibleRelease = (explicit, why) => explicit ? releaseUnknown(why) : { ok: true, candidate: null };
+
+/** A runtime Git root's nearest annotated, manifest-bound release; enclosing application history is inapplicable. */
+export function releaseTagOf({ repo, tag = null, excludeHead = false }) {
+  const history = runtimeGitHistory(repo);
+  if (!history.ok) return history;
+  const listed = tag === null ? gitText(gitTag, ['--merged', 'HEAD', '--list', 'v*'], repo) : tag;
+  if (listed === null) return releaseUnknown('release tags are unreadable');
+  const candidates = [];
+  for (const named of listed.split(/\r?\n/).filter(Boolean)) {
+    const result = releaseCandidate({ repo, named, current: history.head, explicit: tag !== null, excludeHead });
+    if (!result.ok) return result;
+    if (result.candidate) candidates.push(result.candidate);
+  }
+  return nearestRelease(repo, candidates);
+}
+
+/** Runtime history exists only at its own Git top-level with a readable HEAD and full ancestry. */
+function runtimeGitHistory(repo) {
+  const top = revParseQuery(['--show-toplevel'], { cwd: repo });
+  if (top.status !== 0) {
+    if (/not a git repository/i.test(String(top.stderr ?? ''))) return { ok: false, status: 'no-repository', why: 'release history requires a Git repository' };
+    return releaseUnknown('release repository identity is unreadable');
+  }
+  const gitRoot = String(top.stdout ?? '').trim();
+  if (!gitRoot) return releaseUnknown('release repository root is unreadable');
+  if (pathKey(realPath(gitRoot)) !== pathKey(realPath(repo))) return { ok: false, status: 'no-runtime-repository', why: 'the runtime copy is inside an enclosing Git repository; its history belongs to that repository' };
+  const head = gitText(revParseQuery, ['HEAD'], repo)?.trim();
+  if (!head) return releaseUnknown('release history HEAD is unreadable');
+  if (gitText(revParseQuery, ['--is-shallow-repository'], repo)?.trim() !== 'false') return releaseUnknown('release history is shallow or unreadable; fetch complete release history');
+  return { ok: true, head };
+}
+
+/** A candidate binds annotation, peeled commit, manifest spelling and ancestry; default discovery omits ineligible tags. */
+function releaseCandidate({ repo, named, current, explicit, excludeHead }) {
+  const kind = gitText(catFile, ['-t', `refs/tags/${named}`], repo)?.trim();
+  const head = gitText(revParseQuery, [`refs/tags/${named}^{commit}`], repo)?.trim();
+  if (!kind || !head) return releaseUnknown(`release tag ${named} is unreadable`);
+  if (kind !== 'tag') return ineligibleRelease(explicit, `release tag ${named} is not annotated`);
+  const version = versionAt(repo, head);
+  if (!version) return releaseUnknown(`release manifest of ${named} is unreadable`);
+  if (named !== `v${version}`) return ineligibleRelease(explicit, `release tag ${named} differs from its manifest version ${version}`);
+  const reachable = releaseAncestor(repo, head, current);
+  if (reachable === null) return releaseUnknown(`release ancestry of ${named} is unreadable`);
+  if (!reachable) return ineligibleRelease(explicit, `release tag ${named} is not merged in HEAD`);
+  if (excludeHead && head === current) return { ok: true, candidate: null };
+  return { ok: true, candidate: { tag: named, head } };
+}
+
+/** Only one unsuperseded release ancestor proves a boundary; incomparable releases hold. */
+function nearestRelease(repo, candidates) {
+  if (!candidates.length) return releaseUnknown('no eligible annotated, manifest-bound release tag is merged in HEAD');
+  const nearest = [];
+  for (const candidate of candidates) {
+    const superseded = candidateSuperseded(repo, candidate, candidates);
+    if (superseded === null) return releaseUnknown('release ancestry between tags is unreadable');
+    if (!superseded) nearest.push(candidate);
+  }
+  if (nearest.length !== 1) return releaseUnknown(`release history is ambiguous: ${nearest.map((entry) => entry.tag).join(', ')}`);
+  return { ok: true, ...nearest[0] };
+}
+
+/** A release loses its boundary only to a proven descendant release, never to a date or version sort. */
+function candidateSuperseded(repo, candidate, candidates) {
+  for (const other of candidates) {
+    if (candidate.head === other.head) continue;
+    const older = releaseAncestor(repo, candidate.head, other.head);
+    if (older === null) return null;
+    if (older) return true;
+  }
+  return false;
+}
+
+/** Missing Git proof is distinct from a proven non-ancestor. */
+function releaseAncestor(repo, before, after) {
+  const result = mergeBaseQuery(['--is-ancestor', before, after], { cwd: repo });
+  if (result.status === 0) return true;
+  if (result.status === 1) return false;
+  return null;
+}
+
+function versionFindings({ cwd, commit, remoteCommit, version }) {
+  if (!remoteCommit) return [];
+  const remoteVersion = versionAt(cwd, remoteCommit);
+  if (remoteVersion === null) return [finding('RELEASE_REMOTE_HEAD_UNKNOWN', `the remote main head ${remoteCommit.slice(0, 9)} is not in this repository, so its version cannot be compared`, 'git fetch origin main')];
+  if (remoteVersion === version) return [finding('RELEASE_VERSION_UNCHANGED', `package.json version ${version} is the version the remote main already carries`, `bump package.json version, move the CHANGELOG section to the new version, commit, then ${CUT_COMMAND('v<new version>')}`)];
+  return [];
+}
+
+function changelogFindings({ cwd, commit, version, tag }) {
+  const changelog = gitText(show, [`${commit}:CHANGELOG.md`], cwd);
+  if (changelog === null) return [finding('RELEASE_CHANGELOG_SECTION', 'CHANGELOG.md is not readable at the pushed commit', 'restore CHANGELOG.md')];
+  const notes = releaseNotesFindings({ tags: [tag], changelog });
+  if (notes.length) return notes.map((n) => finding('RELEASE_CHANGELOG_SECTION', n.message, 'finish the CHANGELOG section of the release (no in-preparation mark, no open marker), commit'));
+  if (!changelogSection(changelog, version).found || !DATED_HEADING(version).test(changelog)) return [finding('RELEASE_CHANGELOG_SECTION', `CHANGELOG.md has no dated heading "## [${version}] — YYYY-MM-DD"`, `date the heading of the ${version} section, commit`)];
+  return [];
+}
+
+function tagFindings({ cwd, commit, tag }) {
+  const kind = gitText(catFile, ['-t', `refs/tags/${tag}`], cwd)?.trim();
+  const target = gitText(revParseQuery, [`refs/tags/${tag}^{commit}`], cwd)?.trim();
+  if (kind === 'tag' && target === commit) return [];
+  return [finding('RELEASE_TAG_MISSING', `no annotated tag ${tag} points at ${commit.slice(0, 9)}`, CUT_COMMAND(tag))];
+}
+
+/** The finding of a record that claims the delegated mode without the checked-out config saying so (or without naming the delegated linux-parity row), else null. */
+function suiteModeFinding({ record, cwd, commit, tag }) {
+  if (record.suite !== 'ci') return null;
+  if (suiteModeOf(cwd) !== 'ci') return finding('RELEASE_SUITE_MODE', `the release record of ${commit.slice(0, 9)} says suite: ci, but this checkout's config.yaml release.suite is not ci: a record does not choose the mode`, `set release.suite: ci in config.yaml (the owner's choice), or ${CUT_COMMAND(tag)} under suite: local`);
+  if (!(record.delegated ?? []).some((row) => row?.name === 'linux-parity')) return finding('RELEASE_SUITE_MODE', `the suite: ci record of ${commit.slice(0, 9)} does not list linux-parity as delegated`, CUT_COMMAND(tag));
+  return null;
+}
+
+function receiptFindings({ cwd, commit, tag }) {
+  const record = readL4Record({ repo: cwd, head: commit, tag });
+  if (!record) return [finding('RELEASE_RECEIPT_MISSING', `no release record for exactly ${commit.slice(0, 9)} and ${tag}: the package clean-test, the scaffold e2e and the check did not run green on this commit`, CUT_COMMAND(tag))];
+  const mode = suiteModeFinding({ record, cwd, commit, tag });
+  if (mode) return [mode];
+  // A row reused from another commit (reusedFrom) counts: the cut reuses a row only when its input digest is identical (owner ruling speed-flow, 2026-10-25), and the record names the commit it came from.
+  const green = new Set((record.logs ?? []).filter((row) => row?.ok === true).map((row) => row.name));
+  const absent = RECEIPT_STEPS.filter((name) => !green.has(name));
+  return absent.length ? [finding('RELEASE_RECEIPT_INCOMPLETE', `the release record of ${commit.slice(0, 9)} has no green row for: ${absent.join(', ')}`, CUT_COMMAND(tag))] : [];
+}
+
+/**
+ * The findings that keep `commit` from being a release commit of the repository at `cwd`: [{code, missing, fix}], [] when it is one.
+ * `remoteCommit` is the remote main's head being replaced (null for a tag push or a first push); `tag` the release tag (default v<version>);
+ * `needTag` / `needReceipt` are false only for the cut's early look, before it has created the tag and run the suite.
+ */
+export function releaseFindings({ cwd, commit, remoteCommit = null, tag = null, needTag = true, needReceipt = true }) {
+  const version = versionAt(cwd, commit);
+  if (!version) return [finding('RELEASE_VERSION_UNREADABLE', `package.json at ${commit.slice(0, 9)} has no readable version`, 'restore package.json')];
+  const expected = `v${version}`;
+  const named = tag ?? expected;
+  if (named !== expected) return [finding('RELEASE_TAG_VERSION', `the tag ${named} is not v${version}, the version of ${commit.slice(0, 9)}`, `tag v${version}, or set package.json version to ${named.replace(/^v/, '')}`)];
+  return [
+    ...versionFindings({ cwd, commit, remoteCommit, version }),
+    ...changelogFindings({ cwd, commit, version, tag: named }),
+    ...(needTag ? tagFindings({ cwd, commit, tag: named }) : []),
+    ...(needReceipt ? receiptFindings({ cwd, commit, tag: named }) : []),
+  ];
+}

package/runtime/scripts/guards/release-push-gate.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+// release-push-gate.mjs - the body of the runtime repository's pre-push hook (scripts/guards/git-hooks.mjs). Git hands the hook one line
+// per ref on stdin: <local ref> <local sha> <remote ref> <remote sha>. The remote main and the v* tags of the runtime move only with a
+// release, so those refs are judged against the release definition (scripts/guards/release-definition.mjs), the same code `starci release cut` runs:
+//   refs/heads/main   not deleted, a fast-forward of the remote main, and the pushed head is a release commit
+//   refs/tags/v*      annotated, named v<version> of the commit it points at, and that commit is a release commit
+//   refs/heads/release/candidate-*   allowed, force and delete included: the release candidate ref `starci release cut` pushes the release sha to and waits on
+//                     (scripts/supervisor/release-candidate.mjs, OWNER RULING candidate-ci 2026-10-18); its CI is the release verdict, so it must stay open
+//   any other ref     allowed (a lane branch, refs/backup/*, a tag that is not a release tag)
+// A refusal prints `RIGHTS_PUSH_NOT_RELEASE: <ref> is closed: <what is missing> (<command that produces it>)` per ref and exits 1.
+// There is no switch that opens it: a release is made by `starci release cut`, which pushes main and its tag together.
+import { catFile } from '../api/git/cat-file.mjs';
+import { isAncestor } from '../api/git/is-ancestor.mjs';
+import { revParseQuery } from '../api/git/rev-parse-query.mjs';
+import { isMain } from '../lib/is-main.mjs';
+import { invocationDir } from '../lib/roots.mjs';
+import { releaseFindings } from './release-definition.mjs';
+import { hookErrorMessage, readInput, writeHookOutput } from './hook-io.mjs';
+
+export const REFUSAL_CODE = 'RIGHTS_PUSH_NOT_RELEASE';
+const ZERO = /^0+$/;
+const RELEASE_TAG_REF = /^refs\/tags\/v\d/;
+/** The release candidate refs (modules/supervisor/release-cut.yaml candidate.refPrefix): named so a later narrowing of "any other ref" never closes them. */
+const CANDIDATE_REF = /^refs\/heads\/release\/candidate-[0-9A-Za-z][0-9A-Za-z.+-]*$/;
+
+const parseLines = (text) => String(text ?? '').split(/\r?\n/).map((line) => line.trim().split(/\s+/)).filter((parts) => parts.length === 4)
+  .map(([localRef, localSha, remoteRef, remoteSha]) => ({ localRef, localSha, remoteRef, remoteSha }));
+const describe = (findings) => findings.map((f) => `${f.missing} (${f.fix})`).join('; ');
+const refuse = (ref, why) => `${REFUSAL_CODE}: ${ref} is closed: ${why}`;
+
+function mainRefusal(cwd, { remoteRef, localSha, remoteSha }) {
+  if (ZERO.test(localSha)) return refuse(remoteRef, 'a push never deletes the runtime main');
+  const known = !ZERO.test(remoteSha);
+  if (known && !isAncestor(cwd, remoteSha, localSha)) return refuse(remoteRef, 'it is not a fast-forward of the remote main (fetch it first; a force push rewrites main)');
+  const findings = releaseFindings({ cwd, commit: localSha, remoteCommit: known ? remoteSha : null });
+  return findings.length ? refuse(remoteRef, `the pushed head is not a release commit: ${describe(findings)}`) : null;
+}
+
+function tagRefusal(cwd, { remoteRef, localSha }) {
+  if (ZERO.test(localSha)) return refuse(remoteRef, 'a push never deletes a release tag');
+  const kind = catFile(['-t', localSha], { cwd, timeout: 60_000 }).stdout?.trim();
+  if (kind !== 'tag') return refuse(remoteRef, 'a release tag is annotated: its message is the release notes');
+  const commit = revParseQuery([`${localSha}^{commit}`], { cwd, timeout: 60_000 }).stdout?.trim();
+  const findings = releaseFindings({ cwd, commit, tag: remoteRef.slice('refs/tags/'.length) });
+  return findings.length ? refuse(remoteRef, `the tagged commit is not a release commit: ${describe(findings)}`) : null;
+}
+
+/** The refusal lines for the pushed refs `text` (git's pre-push stdin) of the repository at `cwd`: [] when every ref may move. */
+function pushRefusals({ text, cwd }) {
+  return parseLines(text).flatMap((ref) => {
+    let line = null;
+    if (!CANDIDATE_REF.test(ref.remoteRef)) {
+      if (ref.remoteRef === 'refs/heads/main') line = mainRefusal(cwd, ref);
+      else if (RELEASE_TAG_REF.test(ref.remoteRef)) line = tagRefusal(cwd, ref);
+    }
+    return line ? [line] : [];
+  });
+}
+
+/** Read a bounded Git ref list; unavailable input cannot authorize a release push. */
+export async function main({ stdin = process.stdin, stderr = process.stderr, cwd = invocationDir() } = {}) {
+  try {
+    const refusals = pushRefusals({ text: await readInput(stdin), cwd });
+    if (refusals.length) await writeHookOutput(stderr, `${refusals.join('\n')}\n`);
+    return refusals.length ? 1 : 0;
+  } catch (error) {
+    await writeHookOutput(stderr, `starci guard: push input error (${hookErrorMessage(error)}); refusing the push\n`);
+    return 1;
+  }
+}
+
+if (isMain(import.meta.url)) process.exit(await main());

package/runtime/scripts/guards/release-record.mjs

@@ -0,0 +1,58 @@
+// release-record.mjs - the L4 record of a release: proof that the release cut ran the full suite for ONE commit. The git hooks
+// (the app and runtime pre-push, scripts/guards/git-hooks.mjs) let a push of main or a v* tag through only when HEAD carries
+// an annotated release tag AND this record exists for HEAD and names that tag, so a push that did not come out of the
+// release cut is refused without running a single test.
+//
+// The record lives in the git common dir (never in the tree: it is not tracked, never dirties a checkout and is shared by
+// every worktree of the repository): <git common dir>/starci-release/<head sha>.l4.json
+//   {schema: 'starci/l4-record@1', head, tag, suite: 'local'|'ci', delegated: [{name, why}], logs: [{name, ok, log, ms}], at}
+// `suite: ci` (the owner's choice, config.yaml release.suite) lists the rows CI judges as `delegated`, never as logs: a delegated row is not green, it did not run here.
+// The release cut (scripts/supervisor/release-cut.mjs, GOVERNANCE lane) calls writeL4Record after its full suite and check
+// passed and before the atomic push. Pure fs over the common dir path; the git call is injected (seam `commonDir`).
+import path from 'node:path';
+import { revParseQuery } from '../api/git/rev-parse-query.mjs';
+import { RELEASE_DEFAULTS } from '../../engine/release-config.mjs';
+import { proofFileOf, readProofFile, writeProofFile } from '../gates/commit-proof.mjs';
+
+const L4_SCHEMA = 'starci/l4-record@1';
+const RELEASE_TAG = /^v\d[\w.+-]*$/;
+const SHA = /^[0-9a-f]{40,64}$/;
+
+/** The absolute git common dir of `repo`, or null. */
+export function gitCommonDir(repo, { run = revParseQuery } = {}) {
+  const r = run(['--path-format=absolute', '--git-common-dir'], { cwd: repo });
+  const out = String(r.stdout ?? '').trim();
+  return r.status === 0 && out ? path.resolve(out) : null;
+}
+
+/** The record file of `head` under `commonDir`. */
+const l4RecordPath = ({ commonDir, head }) => proofFileOf({ commonDir, sha: head, kind: 'l4' });
+
+/**
+ * Write the L4 record of `head` for release tag `tag`. {ok, file} or {ok:false, reason}: a head that is not a full sha, a tag
+ * that is not v<version>, a failed suite step or an unreadable common dir writes nothing.
+ */
+export function writeL4Record({ repo, head, tag, logs = [], suite = RELEASE_DEFAULTS.suite, delegated = [], candidate = null, commonDir = null, now = () => new Date(), run = revParseQuery } = {}) {
+  if (!SHA.test(String(head))) return { ok: false, reason: 'the head is not a full sha' };
+  if (!RELEASE_TAG.test(String(tag))) return { ok: false, reason: 'the tag is not a release tag v<version>' };
+  if (logs.some((step) => step?.ok !== true)) return { ok: false, reason: 'a suite step is not green' };
+  if (!['local', 'ci'].includes(suite)) return { ok: false, reason: 'the suite mode is local or ci' };
+  if (suite === 'ci' && !delegated.length) return { ok: false, reason: 'a suite: ci record lists the delegated rows' };
+  if (suite === 'local' && delegated.length) return { ok: false, reason: 'a suite: local record delegates nothing' };
+  const dir = commonDir ?? gitCommonDir(repo, { run });
+  if (!dir) return { ok: false, reason: 'the repository has no git common dir' };
+  const file = l4RecordPath({ commonDir: dir, head });
+  // candidate: the candidate CI verdict of this sha (scripts/supervisor/release-candidate.mjs), with the owner's override when the emergency path was used.
+  writeProofFile(file, { schema: L4_SCHEMA, head, tag, suite, delegated, logs, ...(candidate ? { candidate } : {}), at: now().toISOString() });
+  return { ok: true, file };
+}
+
+/** The L4 record of `head`, or null when there is none or it names another head, tag or schema. */
+export function readL4Record({ repo, head, tag = null, commonDir = null, run = revParseQuery } = {}) {
+  const dir = commonDir ?? gitCommonDir(repo, { run });
+  if (!dir) return null;
+  try {
+    const record = readProofFile(l4RecordPath({ commonDir: dir, head }));
+    return record?.schema === L4_SCHEMA && record.head === head && (tag === null || record.tag === tag) ? record : null;
+  } catch { return null; }
+}

package/runtime/scripts/guards/release-suite-mode.mjs

@@ -0,0 +1,15 @@
+// release-suite-mode.mjs - where the full suite of a release is judged, read from the checked-out owner config (config.yaml `release.suite`, engine/release-config.mjs):
+//   local   the release cut runs the root rows and the Linux parity container (the shipped default)
+//   ci      the owner's recorded choice (modules/kernel/owner-rulings.yaml release-suite-ci): the GitHub workflow runs the Linux parity after the push; the root rows still run locally
+// The mode is read from the checkout the cut or the hook runs in. A release record names the mode it was cut under, but a record never decides it: the gate accepts a record that says `ci` only
+// while this checkout's config says `ci` too. An owner file that is absent, unreadable or invalid reads as `local` (fail closed: the stricter mode).
+import { inspectOwnerConfig } from '../../engine/config.mjs';
+import { releaseSuiteMode } from '../../engine/release-config.mjs';
+
+export { SUITE_MODES } from '../../engine/release-config.mjs';
+
+/** The suite mode of the owner config under `root`: 'local' or 'ci'. */
+export function suiteModeOf(root) {
+  const { config, invalid, error } = inspectOwnerConfig(root);
+  return invalid || error ? releaseSuiteMode(null) : releaseSuiteMode(config);
+}