@starci/hfs 4.7.45 → 4.7.46

package/runtime/modules/kernel/removed-vocabulary.yaml

@@ -131,12 +131,6 @@ removed:
     use: '`starci debug digest` (read-only) and `starci debug run <probe>`'
     since: 1.0.0-alpha.6
     match: '(?<![\w-])debug pass\b'
-  - id: config-supervisor-landgate-push
-    kind: config-key
-    name: supervisor.landGate.push
-    use: 'a land fast-forwards local main only and never pushes; the remote main of the runtime moves once per release, through starci release cut'
-    since: 1.0.0-alpha.7
-    match: 'landGate\.push\b'
   - id: flag-land-no-push
     kind: flag
     name: --no-push
@@ -355,7 +349,7 @@ removed:
   - id: verb-test-run
     kind: verb
     name: starci test run
-    use: 'the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, `starci release cut` runs the release rows'
+    use: 'the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, CI runs the release rows'
     since: 1.0.0-alpha.19
     match: '\bstarci test run\b'
   - id: verb-gate-runtime-coverage
@@ -430,3 +424,35 @@ removed:
     use: 'DropdownMenuItem.tone uses neutral or danger; destructive commands use danger'
     since: 1.0.0-alpha.31
     match: 'DropdownMenuItem(?:Tone|\.tone)[^\r\n]*["'']negative["'']'
+
+  - id: code-release-receipt-missing
+    kind: code
+    name: RELEASE_RECEIPT_MISSING
+    use: 'the push of main asks for a fast-forward and a clean secret scan; a release tag asks for no receipt'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-receipt-incomplete
+    kind: code
+    name: RELEASE_RECEIPT_INCOMPLETE
+    use: 'the push of main asks for a fast-forward and a clean secret scan; CI judges the full suite'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-suite-mode
+    kind: code
+    name: RELEASE_SUITE_MODE
+    use: 'release.suite chooses whether the cut also runs the L4 rows; no record or gate reads the mode'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-version-unchanged
+    kind: code
+    name: RELEASE_VERSION_UNCHANGED
+    use: 'main is pushed without a version move; RELEASE_VERSION_NOT_NEXT judges the version of a tag against the v* tags'
+    since: 1.0.0-alpha.31.1
+  - id: code-release-remote-head-unknown
+    kind: code
+    name: RELEASE_REMOTE_HEAD_UNKNOWN
+    use: 'a release tag is judged against the v* tags, not against the remote main head'
+    since: 1.0.0-alpha.31.1
+  - id: config-release-candidate-blocking
+    kind: config-key
+    name: candidate.blocking
+    use: 'the runtime cut has no candidate step; the ci, examples and sonar workflows judge each push to main (suite.ci.workflows)'
+    since: 1.0.0-alpha.31.1
+    match: 'candidate\.blocking\b'

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "3ac967b6f4bb2136cbc7b29a8da5d28994140c84c3543ef0748a379e4667c443",
+  "hash": "adcf9a8643a12ebae13bca08676226a04b3853b7bbaa22f79ead4d053d6353e6",
   "global": [
     {
       "name": "json",
@@ -1301,8 +1301,8 @@ export const CATALOG = {
             "release.requireCi (default false, owner ruling release-require-ci-per-project) decides whether push waits for CI; every local gate row runs either way",
             "requireCi false: push needs the tag and the green L4 record, runs the dry run, pushes atomically and states CI was not required",
             "requireCi true: push --execute sends HEAD to refs/heads/release/candidate-<version> first and waits for its ci.yml run",
-            "green moves the branch and the tag in one atomic push; red refuses RELEASE_CANDIDATE_CI_RED naming the failing jobs",
-            "no run, or no end in time, refuses RELEASE_CANDIDATE_CI_TIMEOUT; unreadable GitHub refuses RELEASE_CI_UNKNOWN; nothing reaches the branch",
+            "green moves the branch and the tag in one atomic push; red refuses naming the failing jobs",
+            "no run, no end in time or an unreadable GitHub refuses; nothing reaches the branch",
             "a red candidate never passes: there is no override and no --no-ci-check flag",
             "the gate tag is always <release.tagPrefix><package.json version>; a taken tag on another commit is red, never another patch number",
             "gate refuses a dirty tree, HEAD other than --source, a moved HEAD and a tree dirtied by the gates; record and tag only when all gates are green",
@@ -3399,7 +3399,7 @@ export const CATALOG = {
             "land only a tip `starci runtime verify` proved (check, package clean-test, scaffold e2e on that exact commit)",
             "the runtime has no specs of its own (owner ruling no-runtime-specs)",
             "lands are serial and hold the host land lock through the receipt, gate, full check and local merge",
-            "local main is the only destination; a land never pushes, tags or touches origin"
+            "local main is the only destination; a land never pushes, tags or touches origin (starci release push sends main)"
           ],
           "runtimeSide": "host"
         },
@@ -8551,7 +8551,7 @@ export const CATALOG = {
           "runtimeSide": "tree"
         },
         "ci-status": {
-          "summary": "the verdict of the GitHub ci workflow, Codecov and Sonar for a release; red is recorded for Debug",
+          "summary": "the GitHub CI verdict of a pushed commit; red names the next alpha.N.M to cut",
           "owner": "runtime",
           "flags": [
             {
@@ -8562,23 +8562,29 @@ export const CATALOG = {
             {
               "name": "tag",
               "type": "string",
-              "summary": "the release tag v* whose commit is read (default is the newest release tag merged in HEAD)"
+              "summary": "the release tag v* whose commit is read"
+            },
+            {
+              "name": "sha",
+              "type": "string",
+              "summary": "the commit to read (default is HEAD, the commit starci release push sent to main)"
             },
             {
               "name": "wait",
               "type": "boolean",
-              "summary": "poll until the run ends (modules/supervisor/release-cut.yaml suite.ci pollSeconds, waitMinutes)"
+              "summary": "poll until the runs end (modules/supervisor/release-cut.yaml suite.ci pollSeconds, waitMinutes)"
             }
           ],
           "exit": {
-            "0": "the ci workflow of the release commit is green",
-            "1": "it is red (for a release cut under suite ci: recorded once as runtime-defect:release-ci-red-<tag>)",
+            "0": "the ci, examples and sonar workflows of the commit are green",
+            "1": "one is red (recorded once as runtime-defect:ci-red-<id>, and the next alpha.N.M to cut is printed as nextFix)",
             "2": "bad usage",
             "3": "no verdict yet - no run, still running, or GitHub could not be read"
           },
           "json": "flag",
           "examples": [
-            "starci release ci-status --tag v1.0.0-alpha.9 --wait",
+            "starci release ci-status --wait",
+            "starci release ci-status --tag v1.0.0-alpha.31.1 --wait",
             "starci release ci-status --json"
           ],
           "editions": [
@@ -8588,8 +8594,11 @@ export const CATALOG = {
             "script": "scripts/supervisor/release-ci-status-cli.mjs"
           },
           "conventions": [
-            "Under suite ci the full test suite runs only in this workflow, after the push; this verb is how its verdict comes back.",
-            "The state is left beside the release record (starci-release/<sha>.ci.json); starci debug digest and starci reconciler up --check show the last release CI."
+            "Owner ruling push-main-after-scoped-check: main is pushed after a green scoped check and the full suite runs only in these workflows; this verb is how",
+            "their verdict comes back.",
+            "A red verdict never blocks the next push: it opens the next alpha.N.M (the fix is pushed after its own scoped check, then cut) through the defect",
+            "queue of the Supervisor.",
+            "The state is left beside the other release proofs (starci-release/<sha>.ci.json); starci debug digest and starci reconciler up --check show the last CI."
           ],
           "runtimeSide": "tree"
         },
@@ -8628,7 +8637,7 @@ export const CATALOG = {
           "runtimeSide": "tree"
         },
         "cut": {
-          "summary": "cut the release, the only way the runtime's remote main and a release tag move",
+          "summary": "tag a release on a commit already pushed to main; it runs no suite",
           "owner": "runtime",
           "flags": [
             {
@@ -8649,36 +8658,35 @@ export const CATALOG = {
             {
               "name": "plan",
               "type": "boolean",
-              "summary": "report what the cut would run and require, and stop; it runs nothing"
+              "summary": "report what the cut would do and which rows CI judges instead, and stop; it runs and tags nothing"
             },
             {
               "name": "tag",
               "type": "string",
-              "summary": "the release tag v* to push (default is the one new annotated v* tag on HEAD)"
+              "summary": "the release tag v* to cut (default is the one new annotated v* tag on HEAD)"
             },
             {
               "name": "rows",
               "type": "string",
-              "summary": "re-run only these rows (comma separated, names as --plan lists them) on the SAME commit and complete the record when every other row is already green on it; a row that is not green there refuses the cut"
+              "summary": "suite local only: re-run only these rows (comma separated, names as --plan lists them) on the SAME commit; a row that is not green there refuses the cut"
             },
             {
               "name": "no-reuse",
               "type": "boolean",
-              "summary": "run every row; stand in for none from an earlier commit or an earlier cut of this one"
+              "summary": "suite local only: run every row; stand in for none from an earlier commit"
             }
           ],
           "exit": {
-            "0": "the candidate CI of the release sha was green, then main plus its tag were pushed atomically, or --plan found nothing missing",
-            "1": "refused (RELEASE_CANDIDATE_CI_RED, RELEASE_CANDIDATE_CI_TIMEOUT, RELEASE_CI_UNKNOWN, dirty tree, no or wrong tag, release notes incomplete, version not moved past the remote main, RELEASE_VERSION_NOT_NEXT, suite red, main moved, secret scan) and nothing was pushed",
+            "0": "the annotated tag was created on the pushed head and pushed alone, or --plan found nothing missing",
+            "1": "refused (HEAD is not the head of the remote main, dirty tree, no or wrong tag, release notes incomplete, RELEASE_VERSION_NOT_NEXT, and under suite local a red row) and nothing was pushed",
             "2": "bad usage"
           },
           "json": "flag",
           "examples": [
             "starci release cut",
-            "starci release cut --plan --tag v1.0.0-alpha.9",
+            "starci release cut --plan --tag v1.0.0-alpha.31.1",
             "starci release cut --tag v1.0.0-alpha.31.1",
-            "starci release cut --tag v1.0.0-alpha.9 --rows \"npm run test:e2e,linux-parity\"",
-            "starci release cut --repo <path> --tag v1.0.0-alpha.9 --json"
+            "starci release cut --repo <path> --tag v1.0.0-alpha.31.1 --json"
           ],
           "editions": [
             "full"
@@ -8687,20 +8695,18 @@ export const CATALOG = {
             "script": "scripts/supervisor/release-cut-cli.mjs"
           },
           "conventions": [
+            "Owner ruling push-main-after-scoped-check (2026-10-26): the cut is light. Main was already pushed by starci release push after a green scoped check;",
+            "the cut tags that commit and pushes the tag alone.",
+            "Under config.yaml release.suite: ci (the owner's choice) the plan holds no row: every L4 row is delegated to the ci, examples and sonar workflows on",
+            "the push of main and is listed as delegated, never green.",
+            "Under release.suite: local (the shipped default, an opt-in to a heavy cut) the L4 rows run on this host before the tag, and a red row refuses the cut.",
+            "No push gate depends on it.",
             "Naming (owner ruling release-waves): the next release is alpha.N.M+1 of the highest v* tag (a wave or a fix) or the next line alpha.N+1,",
-            "derived from the v* tags, never guessed (RELEASE_VERSION_NOT_NEXT); without --tag the refusal names both.",
-            "The legacy -fix form is read and never cut.",
-            "OWNER RULING candidate-ci (2026-10-18): never again have main receive a release whose CI is red, with the owner confirming afterwards.",
-            "Before the suite, including --plan, the workflows the candidate CI waits for (release-cut.yaml candidate.workflows) must be readable,",
-            "else RELEASE_CI_UNKNOWN. The latest run on main is no longer read: a red main needs no owner override before the next release.",
-            "After the suite and the secret scan the exact HEAD is pushed to refs/heads/release/candidate-<version>;",
-            "a re-cut of the same version force-moves only that ref, never main.",
-            "The cut waits for every required workflow run of that sha (pollSeconds, graceMinutes, waitMinutes in release-cut.yaml).",
-            "Red refuses RELEASE_CANDIDATE_CI_RED with the run URLs and the failing jobs and steps; nothing reaches main.",
-            "No run within the grace, or no end within the wait, refuses RELEASE_CANDIDATE_CI_TIMEOUT.",
-            "A red candidate keeps its ref for diagnosis; after a cut the candidate ref is left on the remote, naming the released sha.",
-            "Only on green is the annotated tag created and main plus the tag pushed atomically; the release record logs the candidate verdict.",
-            "There is no override: a red candidate never passes."
+            "derived from the v* tags, never guessed (RELEASE_VERSION_NOT_NEXT); without --tag the refusal names both. The legacy -fix form is read and never cut.",
+            "The tag message is the CHANGELOG section of the version (R222); the CI record of the commit is left pending and starci release ci-status --tag <tag>",
+            "--wait reads the verdict.",
+            "Publication is a separate verb, starci release publish, run as soon as a package branch is done (owner ruling publish-as-soon-as-done); the cut",
+            "happens on the last publish."
           ],
           "runtimeSide": "tree"
         },
@@ -8945,6 +8951,53 @@ export const CATALOG = {
           ],
           "runtimeSide": "tree"
         },
+        "push": {
+          "summary": "push the runtime main right after a green scoped check; CI is the critic",
+          "owner": "runtime",
+          "flags": [
+            {
+              "name": "repo",
+              "type": "string",
+              "summary": "the repository to push (default: the runtime this command runs from, not the directory it is started in)"
+            },
+            {
+              "name": "remote",
+              "type": "string",
+              "summary": "the remote to push to (default origin)"
+            },
+            {
+              "name": "branch",
+              "type": "string",
+              "summary": "the branch to push (default main)"
+            }
+          ],
+          "exit": {
+            "0": "main was pushed (or the remote already has this commit)",
+            "1": "refused (push closed by supervisor.landGate.push false, not on main, dirty tree, not a fast-forward, secret scan, a red hook) and nothing moved",
+            "2": "bad usage"
+          },
+          "json": "flag",
+          "examples": [
+            "starci release push",
+            "starci release push --json"
+          ],
+          "editions": [
+            "full"
+          ],
+          "impl": {
+            "script": "scripts/supervisor/release-push-cli.mjs"
+          },
+          "conventions": [
+            "Owner ruling push-main-after-scoped-check: main is pushed right after a green scoped check, even for a small fix; the check is the agent's, written as",
+            "a scope decision first.",
+            "The verb asks the very judgments of the pre-push hook (scripts/guards/release-push-gate.mjs) first, then runs git push WITH the hooks: never",
+            "--no-verify, never a raw push, never a force.",
+            "The gate asks for a fast-forward and a clean secret scan of the pushed range. No release record and no L4 row.",
+            "The full suite is CI's verdict on the push (ci, examples, sonar): starci release ci-status --sha <head> --wait. A red CI opens the next alpha.N.M at",
+            "once and never blocks the next push."
+          ],
+          "runtimeSide": "tree"
+        },
         "scaffold-e2e": {
           "summary": "run the scaffold end-to-end proof (full and lite scaffolds installed, built and run for real)",
           "owner": "runtime",
@@ -11685,7 +11738,7 @@ export const CATALOG = {
           "runtimeSide": "host"
         },
         "land": {
-          "summary": "run the in-runtime land gate; it fast-forwards local main and never pushes",
+          "summary": "run the in-runtime land gate; it fast-forwards local main (release push sends it)",
           "owner": "runtime",
           "flags": [
             {
@@ -15857,7 +15910,7 @@ export const CATALOG = {
     "starci guard input": "starci guard input is removed (the reference-transaction hook reads prepared ref updates directly in its shell loop)",
     "starci debug pass": "debug pass is removed (`starci debug digest` (read-only) and `starci debug run <probe>`)",
     "starci test affected": "starci test affected is removed (the runtime has no specs of its own (owner ruling no-runtime-specs): `starci runtime verify` runs the check, `starci release clean-test --base <ref>` and `starci release scaffold-e2e`)",
-    "starci test run": "starci test run is removed (the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, `starci release cut` runs the release rows)",
+    "starci test run": "starci test run is removed (the L1 to L4 spec ladder is gone with the runtime specs; `starci runtime verify` proves a change, CI runs the release rows)",
     "starci gate runtime-coverage": "starci gate runtime-coverage is removed (the runtime measures no coverage of its own; the example apps keep their Codecov flags)",
     "starci release env-test": "starci release env-test is removed (the release rows are the package clean-test (`starci release clean-test`), the scaffold e2e (`starci release scaffold-e2e`) and the runtime check)",
     "starci runtime benchmark-snapshot": "starci runtime benchmark-snapshot is removed (routing evidence is read live from the ledgers: `starci machine op-metrics --by op` and the ledger view v_model_scorecard (modules/models/registry.yaml costPolicy))"

package/runtime/scripts/guards/command-policy.mjs

@@ -166,7 +166,7 @@ const npmReadAllowed = (args, words, verb, p) => p.npmRead.has(verb)
   || (verb === 'pack' && args.includes('--dry-run'));
 
 const npmPublishVerdict = (role, text, policy) => {
-  const denied = policy.npm?.deny?.publish, use = useOf(denied, 'starci release cut');
+  const denied = policy.npm?.deny?.publish, use = useOf(denied, 'starci release publish');
   return refusal(codeOf(denied, 'RIGHTS_NPM_PUBLISH'), text, `the ${role} role does not publish a package because packages are published once per release from the release commit`, use);
 };
 
@@ -174,7 +174,7 @@ const npmSuiteVerdict = ({ role, args, p, policy, guard, text, words, verb }) =>
   if (!suiteScript(words) || afterDashDash(args).length) return undefined;
   if (p.suiteOps.has(String(guard?.op ?? ''))) return null;
   const use = useOf(policy.npm?.deny?.[verb === 'run' || verb === 'run-script' ? verb : 'test'], 'starci gate unit --root <app>');
-  return refusal('RIGHTS_SUITE_RUN', text, `the ${role} role does not run a whole suite because full suites run only in the release cut or the requested verify ops`, use);
+  return refusal('RIGHTS_SUITE_RUN', text, `the ${role} role does not run a whole suite because full suites run in CI or the requested verify ops`, use);
 };
 
 const npmCleanInstallVerdict = ({ args, policy, handle, lockOwner, text, verb }) => {
@@ -212,7 +212,7 @@ const nodePolicyVerdict = ({ role, args, p, policy, guard, text }) => {
   if (args.includes('--test')) {
     if (nodeWholeSuite(args)) {
       if (p.suiteOps.has(String(guard?.op ?? ''))) return null;
-      return refusal('RIGHTS_SUITE_RUN', text, `the ${role} role does not run a whole suite because full suites run only in the release cut or the requested verify ops`, 'starci runtime verify in the runtime (the check, package clean-test and scaffold e2e), or one explicit spec file');
+      return refusal('RIGHTS_SUITE_RUN', text, `the ${role} role does not run a whole suite because full suites run in CI or the requested verify ops`, 'starci runtime verify in the runtime (the check, package clean-test and scaffold e2e), or one explicit spec file');
     }
     const targets = nodeOperands(args).filter((value) => value !== 'test');
     if (p.nodeTest.has(role) && targets.length && targets.every((value) => /\.(?:spec|test)\.[cm]?js$/i.test(value))) return null;
@@ -293,7 +293,7 @@ export function policyVerdict({ role, command, guard = null, handle = null, lock
 
   if (releaseCall(program, args, policy)) {
     const use = useOf(policy.release, 'starci release cut');
-    return refusal('RIGHTS_RELEASE_CUT', text, `the ${role} role does not cut or publish a release because the release cut is owner-approved and runs once per release`, use);
+    return refusal('RIGHTS_RELEASE_CUT', text, `the ${role} role does not cut or publish a release because tagging a release and publishing packages are owner-approved`, use);
   }
   const seat = seatVerdict({ role, guard, handle, policy, program, args, text });
   if (seat !== undefined) return seat;

package/runtime/scripts/guards/push-scan.mjs

@@ -0,0 +1,128 @@
+// push-scan.mjs - the secret scan of an outgoing range, shared by the Supervisor's push of the product repositories (push-mains.mjs) and the push gate of the runtime
+// repository (scripts/guards/release-push-gate.mjs, `starci release push`). Findings name the file, line and pattern, never the value. Its imports stay light on purpose: the
+// runtime push hook is bundled with the hfs package (scripts/hfs/sync-runtime.mjs) and must not drag the supervisor in.
+import path from 'node:path';
+import { safeRemove } from '../api/fs/safe-remove.mjs';
+import { makeTempDir } from '../api/fs/make-temp-dir.mjs';
+import { diff as gitDiff } from '../api/git/diff.mjs';
+import { show as gitShow } from '../api/git/show.mjs';
+import { artifactHoldReason } from '../machine/artifact-hold.mjs';
+import { FORBIDDEN_FILES, secretHits, secretHitsInFile } from '../lib/secret-patterns.mjs';
+import { slash } from '../lib/path-key.mjs';
+import { isSopsEnvelope, setCommand } from '../lib/sops-envelope.mjs';
+import { forEachFileLine } from '../lib/read-text.mjs';
+
+const SCAN_GIT = { diff: gitDiff, show: gitShow };
+/** The scan's git runner: `args[0]` names the scripts/api/git call file it runs, in `cwd`: {ok, stdout, stderr, error}. */
+function git([verb, ...args], { cwd }) {
+  const r = SCAN_GIT[verb](args, { cwd, timeout: 300_000, maxBuffer: 64 * 1024 * 1024 });
+  return { ok: r.status === 0, stdout: String(r.stdout ?? '').trim(), stderr: String(r.stderr ?? '').trim(), error: r.error?.message ?? null };
+}
+
+/**
+ * Scan a unified diff (added lines only) and its file list. Returns [{file, line, pattern}] - never the value.
+ * `files` are the changed paths (status A/M/R); deleted paths are not scanned.
+ */
+export function scanDiff({ diff = '', files = [] } = {}) {
+  const scanner = diffScanner(files);
+  for (const raw of String(diff).split(/\r?\n/)) scanner.line(raw);
+  return scanner.findings;
+}
+
+/** scanDiff one line at a time: feed each diff line to `line(raw)`; `findings` accumulates.
+ *  A `*.enc` file is held back until its diff ends and passes only when it is a sops-encrypted file with no
+ *  plaintext value (scripts/lib/sops-envelope.mjs isSopsEnvelope) - judged on the whole file at the pushed commit
+ *  when `encText(file)` can read it (a --unified=0 diff of an edited sops YAML holds only its changed lines), else
+ *  on its added lines. Anything else in a `.enc` file is scanned like any other file, and a `.enc` under
+ *  `.starcistacks/` that is not a sops envelope refuses the push by itself (sops-not-envelope). */
+function diffScanner(files = [], { encText = null, keepHit = null } = {}) {
+  const findings = [];
+  for (const file of files) for (const rule of FORBIDDEN_FILES) if (rule.test(slash(file))) findings.push({ file, line: null, pattern: rule.name });
+  let file = null, line = 0, enc = null;
+  const flushEnc = () => {
+    if (enc && !isSopsEnvelope((encText ? encText(enc.file) : null) ?? enc.added.join('\n'))) {
+      findings.push(...enc.findings);
+      // .starcistacks holds sops twins only: anything else there (a JSON key the value rules cannot see, a
+      // plaintext value next to the sops block) refuses the push by itself.
+      if (/(^|\/)\.starcistacks\//i.test(enc.file)) findings.push({ file: enc.file, line: enc.line, pattern: 'sops-not-envelope' });
+    }
+    enc = null;
+  };
+  return {
+    get findings() { flushEnc(); return findings; },
+    line(raw) {
+      if (raw.startsWith('+++ ')) {
+        flushEnc();
+        file = raw.slice(4).replace(/^b\//, '');
+        if (/\.enc$/i.test(file)) enc = { file, line: null, added: [], findings: [] };
+        return;
+      }
+      const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
+      if (hunk) { line = Number(hunk[1]); return; }
+      if (raw.startsWith('+')) {
+        const text = raw.slice(1);
+        if (enc) { enc.added.push(text); enc.line ??= line; }
+        (enc ? enc.findings : findings).push(...addedLineFindings(file, line, text, keepHit));
+        line += 1;
+      } else if (!raw.startsWith('-')) line += 1;
+    },
+  };
+}
+
+/** Every added line is scanned first; an optional whole-file judgement can then retain or drop its hits. */
+function addedLineFindings(file, line, text, keepHit) {
+  const patterns = secretHits(file?.replace(/\.tpl$/, ''), text);
+  if (!patterns.length || (keepHit && !keepHit(file, line))) return [];
+  return patterns.map(pattern => ({ file, line, pattern }));
+}
+
+/** Only badge-bearing paths use cached post-images; an unreadable post-image keeps every diff hit. */
+function badgeHitFilter(readText) {
+  const linesByFile = new Map();
+  return (file, line) => {
+    if (!/(?:^|\/)(?:README\.md|\.starcistacks\/application-stacks\.yaml)$/.test(file)) return true;
+    if (!linesByFile.has(file)) {
+      const text = readText(file);
+      const manifestText = /(?:^|\/)README\.md$/.test(file) ? readText(path.posix.join(path.posix.dirname(file), '.starcistacks/application-stacks.yaml')) ?? undefined : undefined;
+      linesByFile.set(file, text === null ? null : new Set(secretHitsInFile(file, text, { manifestText }).map(hit => hit.line)));
+    }
+    const lines = linesByFile.get(file);
+    return lines === null || lines.has(line);
+  };
+}
+
+/** Read each committed post-image once; a NUL commit prefix protects its leading whitespace from the git runner's trim. */
+function postImageReader(cwd, to) {
+  const texts = new Map();
+  return file => {
+    if (!texts.has(file)) {
+      const result = git(['show', '--format=%x00', '--no-patch', to, `${to}:${file}`], { cwd });
+      const readable = result.ok && result.stdout.startsWith('\0\n');
+      texts.set(file, readable ? result.stdout.slice(2) : null);
+    }
+    return texts.get(file);
+  };
+}
+
+/** The one fix a refused plaintext test credential gets (owner ruling push-scan-test-secrets-encrypted): the product
+ *  repository's own .starcistacks + sops convention, or a value generated per run. */
+const TEST_SECRET_HINT = `move it to .starcistacks/<stack>/secrets/test/<name> and encrypt it with the repository's own command (${setCommand('<name>', '<stack>')}; commit only the .enc, read it with testSecret() from scripts/uat/test-secret.mjs) or generate it per run; never a plaintext literal`;
+export const scanHint = (findings = []) => (findings.some((f) => f.pattern === 'assigned-secret') ? TEST_SECRET_HINT : null);
+
+/** Scan the range `from..to` of `cwd`: {ok, findings, files}. The diff is written to a temp file and read
+ *  in chunks, never held whole in a spawn buffer (a 64 MB overflow read as `scan failed: git diff failed`). */
+export function scanRange({ cwd, from, to }) {
+  const names = git(['diff', '--name-only', '--diff-filter=ACMR', `${from}..${to}`], { cwd });
+  if (!names.ok) return { ok: false, error: names.stderr || names.error || 'git diff failed', findings: [] };
+  const files = names.stdout.split(/\r?\n/).filter(Boolean);
+  const dir = makeTempDir('starci-push-scan-');
+  const out = path.join(dir, 'range.diff');
+  try {
+    const diff = git(['diff', '--no-color', '--unified=0', '--diff-filter=ACMR', `--output=${out}`, `${from}..${to}`], { cwd });
+    if (!diff.ok) return { ok: false, error: diff.stderr || diff.error || 'git diff failed', findings: [] };
+    const encText = (f) => { const r = git(['show', `${to}:${f}`], { cwd }); return r.ok ? r.stdout : null; };
+    const scanner = diffScanner(files, { encText, keepHit: badgeHitFilter(postImageReader(cwd, to)) });
+    forEachFileLine(out, (l) => scanner.line(l));
+    return { ok: scanner.findings.length === 0, findings: scanner.findings, files };
+  } finally { safeRemove(dir, { hold: artifactHoldReason }); }
+}

package/runtime/scripts/guards/release-push-gate.mjs

@@ -1,63 +1,65 @@
 #!/usr/bin/env node
 // release-push-gate.mjs - the body of the runtime repository's pre-push hook (scripts/guards/git-hooks.mjs). Git hands the hook one line
-// per ref on stdin: <local ref> <local sha> <remote ref> <remote sha>. The remote main and the v* tags of the runtime move only with a
-// release, so those refs are judged against the release definition (scripts/guards/release-definition.mjs), the same code `starci release cut` runs:
-//   refs/heads/main   not deleted, a fast-forward of the remote main, and the pushed head is a release commit
-//   refs/tags/v*      annotated, named v<version> of the commit it points at, and that commit is a release commit
-//   refs/heads/release/candidate-*   allowed, force and delete included: the release candidate ref `starci release cut` pushes the release sha to and waits on
-//                     (scripts/supervisor/release-candidate.mjs, OWNER RULING candidate-ci 2026-10-18); its CI is the release verdict, so it must stay open
+// per ref on stdin: <local ref> <local sha> <remote ref> <remote sha>. Owner ruling push-main-after-scoped-check: the push is light and CI is the critic, so a push of main
+// or of a tag passes when the hook runs clean and the secret scan of the pushed range finds nothing:
+//   refs/heads/main   not deleted, a fast-forward of the remote main, and the pushed range passes the secret scan (scripts/guards/push-scan.mjs)
+//   refs/tags/v*      not deleted and annotated (its message is the release notes); the release definition is judged by `starci release cut`, which makes the tag
 //   any other ref     allowed (a lane branch, refs/backup/*, a tag that is not a release tag)
-// A refusal prints `RIGHTS_PUSH_NOT_RELEASE: <ref> is closed: <what is missing> (<command that produces it>)` per ref and exits 1.
-// There is no switch that opens it: a release is made by `starci release cut`, which pushes main and its tag together.
+// No release record and no L4 row is asked for. A refusal prints `RIGHTS_PUSH_NOT_RELEASE: <ref> is closed: <why>` per ref and exits 1 (the code keeps its name: the hfs rules and the
+// failure-code catalogue cite it; its meaning is "the pre-push gate refused the push"). There is no switch that opens it and no --no-verify.
 import { catFile } from '../api/git/cat-file.mjs';
 import { isAncestor } from '../api/git/is-ancestor.mjs';
-import { revParseQuery } from '../api/git/rev-parse-query.mjs';
 import { isMain } from '../lib/is-main.mjs';
 import { invocationDir } from '../lib/roots.mjs';
-import { releaseFindings } from './release-definition.mjs';
+import { scanRange } from './push-scan.mjs';
 import { hookErrorMessage, readInput, writeHookOutput } from './hook-io.mjs';
 
 export const REFUSAL_CODE = 'RIGHTS_PUSH_NOT_RELEASE';
 const ZERO = /^0+$/;
 const RELEASE_TAG_REF = /^refs\/tags\/v\d/;
-/** The release candidate refs (modules/supervisor/release-cut.yaml candidate.refPrefix): named so a later narrowing of "any other ref" never closes them. */
-const CANDIDATE_REF = /^refs\/heads\/release\/candidate-[0-9A-Za-z][0-9A-Za-z.+-]*$/;
+/** git's empty tree: the range base of a first push, so the whole tree is scanned. */
+const EMPTY_TREE = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';
+const LISTED = 8;
 
 const parseLines = (text) => String(text ?? '').split(/\r?\n/).map((line) => line.trim().split(/\s+/)).filter((parts) => parts.length === 4)
   .map(([localRef, localSha, remoteRef, remoteSha]) => ({ localRef, localSha, remoteRef, remoteSha }));
-const describe = (findings) => findings.map((f) => `${f.missing} (${f.fix})`).join('; ');
 const refuse = (ref, why) => `${REFUSAL_CODE}: ${ref} is closed: ${why}`;
 
-function mainRefusal(cwd, { remoteRef, localSha, remoteSha }) {
+/** The secret-scan refusal of the pushed range, or null when it is clean. A finding names the file, line and pattern, never the value. */
+function scanRefusal(cwd, { localSha, remoteSha }, scan) {
+  const result = scan({ cwd, from: ZERO.test(remoteSha) ? EMPTY_TREE : remoteSha, to: localSha });
+  if (result.ok) return null;
+  if (result.error) return `the secret scan of the pushed range could not run (${result.error}), so it cannot be called clean`;
+  const where = (f) => [f.line ? `${f.file}:${f.line}` : f.file, f.pattern].join(' ');
+  const found = result.findings.slice(0, LISTED).map(where).join('; ');
+  const more = result.findings.length > LISTED ? '; ...' : '';
+  return `the secret scan found ${result.findings.length} candidate(s) in the pushed range: ${found}${more} (remove or encrypt them, then commit again)`;
+}
+
+function mainRefusal(cwd, { remoteRef, localSha, remoteSha }, scan) {
   if (ZERO.test(localSha)) return refuse(remoteRef, 'a push never deletes the runtime main');
-  const known = !ZERO.test(remoteSha);
-  if (known && !isAncestor(cwd, remoteSha, localSha)) return refuse(remoteRef, 'it is not a fast-forward of the remote main (fetch it first; a force push rewrites main)');
-  const findings = releaseFindings({ cwd, commit: localSha, remoteCommit: known ? remoteSha : null });
-  return findings.length ? refuse(remoteRef, `the pushed head is not a release commit: ${describe(findings)}`) : null;
+  if (!ZERO.test(remoteSha) && !isAncestor(cwd, remoteSha, localSha)) return refuse(remoteRef, 'it is not a fast-forward of the remote main (fetch it first; a force push rewrites main)');
+  const scanned = scanRefusal(cwd, { localSha, remoteSha }, scan);
+  return scanned ? refuse(remoteRef, scanned) : null;
 }
 
 function tagRefusal(cwd, { remoteRef, localSha }) {
   if (ZERO.test(localSha)) return refuse(remoteRef, 'a push never deletes a release tag');
   const kind = catFile(['-t', localSha], { cwd, timeout: 60_000 }).stdout?.trim();
-  if (kind !== 'tag') return refuse(remoteRef, 'a release tag is annotated: its message is the release notes');
-  const commit = revParseQuery([`${localSha}^{commit}`], { cwd, timeout: 60_000 }).stdout?.trim();
-  const findings = releaseFindings({ cwd, commit, tag: remoteRef.slice('refs/tags/'.length) });
-  return findings.length ? refuse(remoteRef, `the tagged commit is not a release commit: ${describe(findings)}`) : null;
+  return kind === 'tag' ? null : refuse(remoteRef, 'a release tag is annotated: its message is the release notes');
 }
 
-/** The refusal lines for the pushed refs `text` (git's pre-push stdin) of the repository at `cwd`: [] when every ref may move. */
-function pushRefusals({ text, cwd }) {
+/** The refusal lines for the pushed refs `text` (git's pre-push stdin) of the repository at `cwd`: [] when every ref may move. `scan` is the secret scan (a seam). */
+export function pushRefusals({ text, cwd, scan = scanRange }) {
   return parseLines(text).flatMap((ref) => {
     let line = null;
-    if (!CANDIDATE_REF.test(ref.remoteRef)) {
-      if (ref.remoteRef === 'refs/heads/main') line = mainRefusal(cwd, ref);
-      else if (RELEASE_TAG_REF.test(ref.remoteRef)) line = tagRefusal(cwd, ref);
-    }
+    if (ref.remoteRef === 'refs/heads/main') line = mainRefusal(cwd, ref, scan);
+    else if (RELEASE_TAG_REF.test(ref.remoteRef)) line = tagRefusal(cwd, ref);
     return line ? [line] : [];
   });
 }
 
-/** Read a bounded Git ref list; unavailable input cannot authorize a release push. */
+/** Read a bounded Git ref list; unavailable input cannot authorize a push of main. */
 export async function main({ stdin = process.stdin, stderr = process.stderr, cwd = invocationDir() } = {}) {
   try {
     const refusals = pushRefusals({ text: await readInput(stdin), cwd });

package/runtime/scripts/hfs/example-secrets.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { runProgram } from '../api/process/run-program.mjs';
 import { init as initGit } from '../api/git/init.mjs';
 import { add as addGit } from '../api/git/add.mjs';
-import { runGit } from '../api/git/lib.mjs';
+import { revParseQuery } from '../api/git/rev-parse-query.mjs';
 import { mergeBase } from '../api/git/merge-base.mjs';
 import { writeTree } from '../api/git/write-tree.mjs';
 import { commitTree } from '../api/git/commit-tree.mjs';
@@ -68,9 +68,9 @@ const ok = (r) => !r.error && r.status === 0 && Boolean(String(r.stdout ?? '').t
  */
 function sealedLintBase(repoRoot, source, env) {
   const query = { cwd: source, env };
-  const top = runGit(['rev-parse', '--show-toplevel'], query);
+  const top = revParseQuery(['--show-toplevel'], query);
   if (!ok(top)) return null;
-  const common = runGit(['rev-parse', '--git-common-dir'], query);
+  const common = revParseQuery(['--git-common-dir'], query);
   if (!ok(common)) return null;
   const candidates = [...(env.STARCI_BASE_REF ? [env.STARCI_BASE_REF] : []), 'origin/main', 'main'];
   let baseSha = null;
@@ -80,7 +80,7 @@ function sealedLintBase(repoRoot, source, env) {
   }
   if (!baseSha) throw new Error('sealed lint baseline unavailable: set STARCI_BASE_REF to a source commit sharing history with HEAD, or fetch origin/main or main');
   const relative = path.relative(top.stdout.trim(), path.resolve(source)).split(path.sep).join('/');
-  const tree = runGit(['rev-parse', '--verify', '--quiet', relative && !relative.startsWith('..') ? `${baseSha}:${relative}` : `${baseSha}^{tree}`], query);
+  const tree = revParseQuery(['--verify', '--quiet', relative && !relative.startsWith('..') ? `${baseSha}:${relative}` : `${baseSha}^{tree}`], query);
   const baseTree = ok(tree) ? tree.stdout.trim() : EMPTY_TREE;
   const info = path.join(repoRoot, '.git', 'objects', 'info');
   fs.mkdirSync(info, { recursive: true });