@starci/hfs 4.7.47 → 4.9.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 4.9.0 - 2026-10-28
+
+- Removed: 121 bundled runtime scripts that only served the legacy runtime and that no `starci app` verb, package entry or catalogued rule enforcer reaches: `scripts/agent/`, `scripts/reconciler/`, the legacy hook guards of `scripts/guards/` (command, seat, rights, install and launch verdicts), the op gate of `scripts/gates/` (`gate.mjs`, canon pins and digest, type impact), the drawing pipeline of `scripts/work/` other than the DNA judge (`draw-dna*`, `grammar-proposal`, `asset-slot`), the ledger of `engine/db/`, the machine helpers, and the `scripts/api` and `scripts/lib` helpers only they imported; with them the specs that exercised only that code. The `release-push-gate` and `hook-io` cases of `hook-input.spec.mjs` stay.
+- Changed: `starci app` is carried by the harness CLI `starci-harness`, which runs this package in-process; `@starci/cli` is retired. A new app's root devDependencies name `starci-harness` instead of `@starci/cli`, its GraphQL codegen loads the input-bounds plugin from `starci-harness/input-bounds`, the runtime resolves an app's `starci` bin and its @starci/hfs from its installed `starci-harness` (`package-at.mjs`), and HFS_CI_MISSING_CANON accepts `npx starci-harness[@<version>] app lint`, the version being the `starci-harness` pin; the bundled canon pins replace the retired `@starci/cli` with `starci-harness` 1.1.0-alpha.1 (`source: cli/package.json`), the one command line a product installs for `starci app`, and follow the harness packages (Grammar family 0.14.0, hfs 4.9.0, canon-fe 9.3.0, canon-be 3.5.0).
+- Changed: the rendered `sonar-project.properties` takes the jest preset's test patterns as tests: `sonar.tests` names every source folder and `sonar.test.inclusions` those patterns, which `sonar.exclusions` moves out of the sources (Sonar refuses a file indexed as both), beside the build and dependency folders; `supabase/types/**` is no longer excluded, so a lite app's generated row types are analysed. `sonar.coverage.exclusions` sits between the `starci:sonar-scope` markers `starci app sonar --write` writes, so sync and the harness's Sonar scope check agree on one file.
+
+## 4.8.0 - 2026-10-27
+
+- Removed: the Heritage family from the bundled Grammar catalog.
+- Changed: the bundled canon pins name each @starci package by its folder in starci-harness (`source: packages/<name>/package.json`) at the versions there; `@starci/cli` is a registry-only pin.
+- Removed: the specs that exercised the legacy runtime's own scripts (css-rules, grammar-knowledge, grammar-union-census, grammar-vendor-repaints, ui-proof-*); that code is not part of this package.
+- Changed: the package lives in github.com/starci183/starci-harness under `packages/` and publishes from there; its bundled `runtime/` is committed source, edited in place (no generator, no `prepack`/`pretest` hook).
+- Changed: owner ruling: the Grammar catalog has exactly two families, `core` and `offset-pop`. `grammarLintFor`,
+  `grammarFamilyFor`, `grammarContractFor`, `resolveGrammarFamily` and the code-pattern family binding
+  (`familyCanons.core`) answer by those ids; `starci app` scaffolds `sides.fe.grammar: core`; the core lint package is
+  `@starci/eslint-grammar-core` with `coreGrammarConfig`, and the knowledge folder is `knowledge/grammars/core`.
+- Removed: `starci` and `starci-core` are not family ids and have no alias; a selection naming them is refused.
+
 ## 4.7.47 - 2026-10-27
 
 - Fixed: the rendered stack escapes every literal dollar once more, so a secret-reading command or healthcheck survives the second interpolation of docker stack deploy.

package/README.md

@@ -192,15 +192,10 @@ The upload authenticates with GitHub's OIDC token: the managed `ci.yml` job has
 
 ## Maintaining the bundle
 
-`runtime/` is a byte copy of the slot loader files, the pins, and the import closure of `scripts/hfs/check.mjs` and
-`scripts/hfs/architecture.mjs` (computed by `scripts/hfs/sync-runtime.mjs`, so a new import of the machine is bundled without
-editing a list), plus the catalog slice of every code `starci app check` can emit: its own and the machine's (`ARCHITECTURE_RULE_IDS`,
-derived from the machine's rule id lists). After changing any of those files, `knowledge/hfs/slots.yaml`,
-`knowledge/hfs/canon-pins.yaml`, `knowledge/patterns/fe/folder.yaml` or the catalog entries of those codes, run `starci release sync-runtime`;
-`starci release sync-runtime --check` fails on a stale copy. Bump `version` here and in the pin when the behaviour changes.
-
-The examples workflow (`.github/workflows/examples.yml`) runs `starci app lint` of this CLI at the root of every `examples/*`
-app with an `hfs.json` (each `examples/<app>` root) and fails on any finding or any tool that could not run. This includes the ESLint canons and repository checks also run by `starci app check`, plus stylelint over the frontend stylesheets.
+`runtime/` holds the slot loader files, the pins, the import closure of `scripts/hfs/check.mjs` and
+`scripts/hfs/architecture.mjs`, and the catalog slice of every code `starci app check` can emit. It is committed source of
+this package, edited in place ([packages/README.md](../README.md) says how the bundled copies move together). Bump
+`version` here and in the pin when the behaviour changes.
 
 ## Serving knowledge to other packages
 

package/emit/operation-schemas.mjs

@@ -101,6 +101,9 @@ export function operationSchemaReader({ ts, program, repoRoot }) {
       if (!resolved?.endsWith('.schema.ts')) throw new Error(`schema modules may import only zod and *.schema.ts, found ${specifier} in ${file}`);
       return load(resolved);
     };
+    // zod is the app's dependency, not the schema's code: it loads before the timed run, so the 1000 ms budget bounds only the
+    // schema module itself (a cold zod load inside it ran past the budget on a loaded machine).
+    for (const [, specifier] of compiled.matchAll(/require\("(zod(?:\/[^"]*)?)"\)/g)) requireApp(specifier);
     new vm.Script(compiled, { filename: file }).runInNewContext({ module, exports: module.exports, require: requireSchema }, { timeout: 1000 });
     return module.exports;
   }

package/lint/bound-sys.cjs

@@ -4,8 +4,8 @@
 // projectService builds its server host from `tsserver.sys` (typescript/lib/tsserverlibrary) and exposes no host through
 // parserOptions, so without a bound a typed rule reads types from an enclosing repository's node_modules and judges the app
 // greener than its own install allows. Here `sys` of the app's own TypeScript is patched, in place and before ESLint loads
-// the parser, to answer only for paths inside the app root and TypeScript's own lib directory (the same bound the gate's
-// tsc programs use, scripts/gates/gate.mjs boundedSys). realpath is the identity, so an install junctioned inside the app
+// the parser, to answer only for paths inside the app root and TypeScript's own lib directory (the same bound a typed
+// tsc program of the app keeps). realpath is the identity, so an install junctioned inside the app
 // stays inside it. Nothing is patched when STARCI_LINT_BOUND is unset or TypeScript is not installed (nothing typed runs).
 'use strict'
 const path = require('node:path')

package/package.json

@@ -1,9 +1,19 @@
 {
   "name": "@starci/hfs",
-  "version": "4.7.47",
+  "version": "4.9.0",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",
+  "author": "starci183",
+  "homepage": "https://github.com/starci183/starci-harness/tree/main/packages/hfs#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/starci183/starci-harness.git",
+    "directory": "packages/hfs"
+  },
+  "bugs": {
+    "url": "https://github.com/starci183/starci-harness/issues"
+  },
   "private": false,
   "exports": {
     ".": "./src/main.mjs",
@@ -60,10 +70,6 @@
     "access": "public"
   },
   "scripts": {
-    "sync": "node ../../scripts/hfs/sync-runtime.mjs",
-    "sync:check": "node ../../scripts/hfs/sync-runtime.mjs --check",
-    "prepack": "node prep-runtime.mjs",
-    "pretest": "node prep-runtime.mjs",
     "test": "node --test \"src/*.spec.mjs\""
   }
 }

package/runtime/engine/admission.mjs

@@ -187,7 +187,7 @@ export const AWAITING_OWNER='awaiting-owner';
  */
 export const AWAITING_OWNER_STATUS='awaiting_owner';
 export const RETRYABLE_JOB_STATUSES=Object.freeze(['failed',AWAITING_OWNER_STATUS]);
-/** Every jobs.status that holds nothing the runtime still needs (mirrors engine/db/ledger.mjs JOB_STATUSES.settled). */
+/** Every jobs.status that holds nothing the runtime still needs. */
 export const SETTLED_JOB_LIST=Object.freeze(['succeeded','failed',AWAITING_OWNER_STATUS,'cancelled']);
 /** The tries of a unit that spent budget: every try but the ones that only waited on the owner. */
 export const spentTries=tries=>tries.filter(job=>job.status!==AWAITING_OWNER_STATUS).length;

package/runtime/engine/config.mjs

@@ -288,11 +288,11 @@ const validateSupervisorBlock=(supervisor,profile)=>{
   const interval=supervisor?.pollIntervalMs,repos=supervisor?.repos,stall=supervisor?.stallMinutes;
   if(!plain(supervisor)||Object.keys(supervisor).some(key=>!CONFIG_KEY_TREE.supervisor.includes(key))||!(interval===null||interval===undefined||(Number.isInteger(interval)&&interval>=60000)))
     throw new Error('Invalid config.yaml: supervisor must be {mode?, pollIntervalMs?, repos?, stallMinutes?, kernel?, workers?, landGate?, frozenMinutes?} with an integer of at least 60000 ms, or null.');
-  // mode: where the Supervisor role runs (scripts/machine/home.mjs supervisorMode) - chat (default: the owner's desktop
+  // mode: where the Supervisor role runs - chat (default: the owner's desktop
   // chat session owns channel 'main' and ticks itself) or kernel (the optional [Supervisor] Orca kernel, start-supervisor.mjs).
   if(!(supervisor.mode===undefined||supervisor.mode===null||['chat','kernel'].includes(supervisor.mode)))
     throw new Error('Invalid config.yaml: supervisor.mode must be chat or kernel, or null.');
-  // The [Supervisor] kernel seat (scripts/machine/home.mjs supervisorSettings): kernel {agent?, model?, effort?}
+  // The [Supervisor] kernel seat: kernel {agent?, model?, effort?}
   // pins its agent (default: the kernel pin), workers {base?, max?} its adaptive [Worker] cap (0 to 10; the shipped default is 0 fix workers),
   // landGate {mode?: shared|exclusive, push?: boolean} the land gate (scripts/supervisor/land.mjs); push (default true, owner ruling push-main-after-scoped-check) lets `starci release push` send main to the remote after a green scoped check, false is the owner's lock on the remote.
   const seat=supervisor.kernel,workers=supervisor.workers,gate=supervisor.landGate;

package/runtime/engine/db/machine.mjs

@@ -64,8 +64,7 @@ export const CONTROLLERS = Object.freeze(['job', 'workflow', 'resource', 'host',
 // Paths
 // ---------------------------------------------------------------------------------------------------------------------
 /**
- * Overrides the per-host state base itself (machine.sqlite, projects/, archive/), the one seam starciLocalRoot and
- * engine/db/ledger.mjs (which re-exports starciLocalRoot for its own projectsRootFor) both read. Debug probes and
+ * Overrides the per-host state base itself (machine.sqlite, projects/, archive/), the one seam starciLocalRoot reads. Debug probes and
  * throwaway repos point this at a temp directory so they never touch the real
  * <runtime root>/.runtime and leak fake ledgers/workflows into it (2026-09-30 incident: probe-*, dbg-ask-*, dbg-env*
  * repos left six fake-worker ledgers in the live store). STARCI_PROJECTS_ROOT (ledger-db.mjs) and
@@ -138,7 +137,7 @@ function corruptIncident(file, error, details) {
 
 /**
  * The rev of the runtime this process runs, as its callers know it: '<HEAD committer time, ms, 13 digits>:<short sha>' of
- * the .claude checkout, which scripts/machine/home.mjs runtimeRevOf computes and the caller passes in (`rev`,
+ * the harness checkout, which the caller computes and passes in (`rev`,
  * `writerRev`, `sourceRev`). The db never spawns git: with no rev passed the default is STARCI_RUNTIME_REV, else
  * 'unknown'. The time prefix orders two revs, so a writer can refuse a store row written by a NEWER runtime (MB-15);
  * 'unknown' sorts before every real rev.

package/runtime/engine/invalid-config.mjs

@@ -5,7 +5,7 @@ export const invalid=section=>message=>{throw new Error(`Invalid config.yaml: ${
 
 /** The host roots the owner may relocate (config.yaml `roots`): the archive root, the lanes root and the temp root. */
 export const ROOT_KEYS=Object.freeze(['archive','lanes','temp']);
-/** config.yaml `roots` - {archive?, lanes?, temp?}: absolute directories, or null; an absent key means <starciLocalRoot>/archive and the per-user lanes directory (scripts/machine/home.mjs lanesDefault). */
+/** config.yaml `roots` - {archive?, lanes?, temp?}: absolute directories, or null; an absent key means <starciLocalRoot>/archive and the per-user lanes directory. */
 export function validateRoots(roots){
   if(roots===null)return;
   const bad=invalid('roots');

package/runtime/knowledge/grammars/{starci → core}/playbook.yaml

@@ -1,5 +1,5 @@
 schema: starci/knowledge-source@1
-id: grammar.starci.playbook
+id: grammar.core.playbook
 title: StarCi Core — playbook
 purpose: |
   Which idioms a business shape asks for, and what a supplied reference is allowed to contribute to
@@ -12,7 +12,7 @@ purpose: |
   has yet shown them twice; `guidance` holds the rules every Core app built on them follows.
 appliesTo:
   - grammar
-family: starci
+family: core
 provenance:
   publicEntry: "@starci/grammar/common"
   package: "@starci/grammar"
@@ -269,7 +269,7 @@ shapes:
           by presentation.groupIdentity.
     notes: |
       FE-RULE-OWNERSHIP in knowledge/patterns/fe/index.yaml separates universal app-shell semantics
-      from these family APIs, values, shapes and effects. @starci/eslint-grammar-starci owns their
+      from these family APIs, values, shapes and effects. @starci/eslint-grammar-core owns their
       code checks. Inspect installed Grammar exports and the running shell when proving the recipe.
 
 readingSteps:

package/runtime/knowledge/grammars/index.yaml

@@ -24,7 +24,7 @@ guidance:
       Do not treat this catalog as selecting a default Grammar family. Family choice belongs to the
       current design specification and its explicit sides.fe.grammar declaration.
     rationale: |
-      Silent fallback to StarCi would invent product direction and override an absent/ambiguous design.
+      Silent fallback to a family would invent product direction and override an absent/ambiguous design.
   - id: verify-before-use
     requirement: |
       Before applying snapshot APIs or recorded gaps, inspect the selected repository's package
@@ -47,11 +47,11 @@ topics:
       Generated DNA snapshot of the `@starci/grammar/common` public entry: custom properties,
       the 110 renderers of its registry, their classes, stamped rule ids and recorded gaps. The DNA owns the observed package
       version and source inventory. Common supplies anatomy, not colour. The snapshot is drift-checked.
-  - id: starci
-    path: starci/index.yaml
-    title: StarCi Core Grammar
+  - id: core
+    path: core/index.yaml
+    title: Core Grammar
     summary: |
-      Historical snapshot of the StarCi Core family — DNA, idioms, playbook (including composing the
+      Historical snapshot of the core family — DNA, idioms, playbook (including composing the
       0.5.0 forms, overlays and navigation chrome) and family boundaries.
   - id: offset-pop
     path: offset-pop/index.yaml
@@ -61,16 +61,7 @@ topics:
       shadow, one pink decision accent with a text-safe accent for text — with DNA, idioms, a
       mobile-first playbook for playful learning or consumer apps, and family boundaries including two
       decisions flagged for the family owner.
-  - id: heritage
-    path: heritage/DNA.yaml
-    title: Heritage Grammar
-    summary: |
-      Generated snapshot of the Heritage family's parity declaration, arrangement, scoped tokens and Common renderers.
 families:
-  - id: heritage
-    title: heritage
-    contractRef: common
-    packageSnapshot: heritage/DNA.yaml
   - id: common
     title: common
     componentContract:
@@ -85,18 +76,18 @@ families:
       (`defineGrammarFamily`), not a family that ships a palette, so `authority`, `reusableStyle`,
       `productComposition` and `index` have nothing to name here. Universal semantics, renderer anatomy,
       state and accessibility remain owned by knowledge/ui.
-  - id: starci
-    title: starci
+  - id: core
+    title: core
     contractRef: common
     lint:
-      package: '@starci/eslint-grammar-starci'
-      factory: starciGrammarConfig
+      package: '@starci/eslint-grammar-core'
+      factory: coreGrammarConfig
       prefix: starci-grammar
-    authority: starci/family.yaml
-    packageSnapshot: starci/DNA.yaml
-    reusableStyle: starci/idioms.yaml
-    productComposition: starci/playbook.yaml
-    index: starci/index.yaml
+    authority: core/family.yaml
+    packageSnapshot: core/DNA.yaml
+    reusableStyle: core/idioms.yaml
+    productComposition: core/playbook.yaml
+    index: core/index.yaml
   - id: offset-pop
     title: offset-pop
     contractRef: common

package/runtime/knowledge/grammars/offset-pop/playbook.yaml

@@ -289,14 +289,14 @@ guidance:
 presentation:
   font:
     ownership: FE-RULE-OWNERSHIP
-    inherits: starci
+    inherits: core
     contract: |
       Offset Pop keeps Common typography renderers and props. Its font proof reads the shared Common
       rank-to-renderer recipes in the StarCi playbook; the Offset Pop stylesheet owns its family palette
       and display treatment.
   padding:
     ownership: FE-RULE-OWNERSHIP
-    inherits: starci
+    inherits: core
     contract: |
       Offset Pop keeps the same Common spacing and component geometry. Its padding proof reads the
       shared Common recipes declared in the StarCi playbook; it supplies no replacement inset scale.

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -21,7 +21,7 @@ pins:
     install: registry
     side: fe
     source: packages/heroicons/package.json
-    why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-starci (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
+    why: 'StarCi custom Heroicons-compatible cuts; eslint-grammar-core (icon.mjs) admits @starci/heroicons/24/outline and /16/solid as icon sources, so an app that uses them gets this exact version.'
   '@starci/event-stream':
     version: 0.1.0
     group: starci
@@ -30,61 +30,61 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.12.14
+    version: 0.14.0
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.56
+    version: 3.5.0
     group: starci
     install: registry
     side: be
-    source: packages/eslint/be/package.json
+    source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.1.10
+    version: 9.3.0
     group: starci
     install: registry
     side: fe
-    source: packages/eslint/fe/package.json
+    source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
-  '@starci/eslint-grammar-starci':
-    version: 0.12.14
+  '@starci/eslint-grammar-core':
+    version: 0.14.0
     group: starci
     install: registry
     side: fe
-    source: packages/eslint/grammar-starci/package.json
+    source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.12.14
+    version: 0.14.0
     group: starci
     install: registry
     side: fe
-    source: packages/eslint/grammar-offset-pop/package.json
+    source: packages/eslint-grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.0.13
+    version: 2.1.0
     group: starci
     install: registry
     side: fe
-    source: packages/stylelint/package.json
+    source: packages/stylelint-canon/package.json
     why: 'the front-end stylelint canon: no-class-selector refuses a compound class selector (`div.card`); the brand layer accepts `--font-sans` and `--font-mono`; status-contrast measures the HeroUI soft pairs per theme; brand-layer-shape reads the shared :root,.light,.dark block and the info soft pair; appTokens come from loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.7
+    version: 2.0.8
     group: starci
     install: registry
     side: both
     source: packages/tsconfig/package.json
   '@starci/prettier-config':
-    version: 1.0.4
+    version: 1.0.5
     group: starci
     install: registry
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.3.6
+    version: 2.3.7
     group: starci
     install: registry
     side: be
@@ -97,20 +97,20 @@ pins:
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
-  '@starci/cli':
-    version: 1.7.47
+  'starci-harness':
+    version: 1.1.0-alpha.1
     group: starci
     install: registry
     side: both
-    source: packages/cli/package.json
-    why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
+    source: cli/package.json
+    why: 'the one StarCi command line (bins starci and starci-harness): a product repository installs it for starci app, which it runs in-process through its exact @starci/hfs dependency, and its codegen loads starci-harness/input-bounds.'
   '@starci/hfs':
-    version: 4.7.47
+    version: 4.9.0
     group: starci
     install: registry
     side: both
     source: packages/hfs/package.json
-    why: 'the transitive app implementation used by @starci/cli; it carries the generated runtime slice read by starci app commands.'
+    why: 'the app implementation starci-harness runs for starci app; it carries the generated runtime slice read by starci app commands.'
   # --- tooling
   typescript:
     version: 5.9.3
@@ -406,7 +406,7 @@ pins:
     version: 2.2.0
     group: ui
     side: fe
-    why: 'the base of the one application icon set (fe-stack icons, with @starci/heroicons for the glyphs it lacks); eslint-grammar-starci (icon.mjs) admits @heroicons/react/24/outline and /16/solid.'
+    why: 'the base of the one application icon set (fe-stack icons, with @starci/heroicons for the glyphs it lacks); eslint-grammar-core (icon.mjs) admits @heroicons/react/24/outline and /16/solid.'
   '@dicebear/core':
     version: 10.4.0
     group: ui

package/runtime/knowledge/hfs/fe-stack.yaml

@@ -251,7 +251,7 @@ concerns:
     why: the canon lint and format configuration.
   - id: grammar-lint
     tier: opt
-    packages: ['@starci/eslint-grammar-starci', '@starci/eslint-grammar-offset-pop']
+    packages: ['@starci/eslint-grammar-core', '@starci/eslint-grammar-offset-pop']
     home: [fe.source-root-pinned]
     pattern: FE-RULE-OWNERSHIP
     forbids: []