@starci/hfs 4.8.0 → 4.9.1

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 4.9.1 - 2026-10-28
+
+- Changed: the bundled canon pins follow release C (Grammar family 0.15.0, hfs 4.9.1, canon-fe 9.4.0, canon-be 3.6.0, jest-preset 2.4.1, stylelint-canon 2.2.1, tsconfig 2.1.0, prettier-config 1.1.0, and `@starci/ai-router` 0.2.1 pinned), so an app installs the released versions without pin drift.
+
+## 4.9.0 - 2026-10-28
+
+- Removed: 121 bundled runtime scripts that only served the legacy runtime and that no `starci app` verb, package entry or catalogued rule enforcer reaches: `scripts/agent/`, `scripts/reconciler/`, the legacy hook guards of `scripts/guards/` (command, seat, rights, install and launch verdicts), the op gate of `scripts/gates/` (`gate.mjs`, canon pins and digest, type impact), the drawing pipeline of `scripts/work/` other than the DNA judge (`draw-dna*`, `grammar-proposal`, `asset-slot`), the ledger of `engine/db/`, the machine helpers, and the `scripts/api` and `scripts/lib` helpers only they imported; with them the specs that exercised only that code. The `release-push-gate` and `hook-io` cases of `hook-input.spec.mjs` stay.
+- Changed: `starci app` is carried by the harness CLI `starci-harness`, which runs this package in-process; `@starci/cli` is retired. A new app's root devDependencies name `starci-harness` instead of `@starci/cli`, its GraphQL codegen loads the input-bounds plugin from `starci-harness/input-bounds`, the runtime resolves an app's `starci` bin and its @starci/hfs from its installed `starci-harness` (`package-at.mjs`), and HFS_CI_MISSING_CANON accepts `npx starci-harness[@<version>] app lint`, the version being the `starci-harness` pin; the bundled canon pins replace the retired `@starci/cli` with `starci-harness` 1.1.0-alpha.1 (`source: cli/package.json`), the one command line a product installs for `starci app`, and follow the harness packages (Grammar family 0.14.0, hfs 4.9.0, canon-fe 9.3.0, canon-be 3.5.0).
+- Changed: the rendered `sonar-project.properties` takes the jest preset's test patterns as tests: `sonar.tests` names every source folder and `sonar.test.inclusions` those patterns, which `sonar.exclusions` moves out of the sources (Sonar refuses a file indexed as both), beside the build and dependency folders; `supabase/types/**` is no longer excluded, so a lite app's generated row types are analysed. `sonar.coverage.exclusions` sits between the `starci:sonar-scope` markers `starci app sonar --write` writes, so sync and the harness's Sonar scope check agree on one file.
+
 ## 4.8.0 - 2026-10-27
 
 - Removed: the Heritage family from the bundled Grammar catalog.

package/emit/operation-schemas.mjs

@@ -101,6 +101,9 @@ export function operationSchemaReader({ ts, program, repoRoot }) {
       if (!resolved?.endsWith('.schema.ts')) throw new Error(`schema modules may import only zod and *.schema.ts, found ${specifier} in ${file}`);
       return load(resolved);
     };
+    // zod is the app's dependency, not the schema's code: it loads before the timed run, so the 1000 ms budget bounds only the
+    // schema module itself (a cold zod load inside it ran past the budget on a loaded machine).
+    for (const [, specifier] of compiled.matchAll(/require\("(zod(?:\/[^"]*)?)"\)/g)) requireApp(specifier);
     new vm.Script(compiled, { filename: file }).runInNewContext({ module, exports: module.exports, require: requireSchema }, { timeout: 1000 });
     return module.exports;
   }

package/lint/bound-sys.cjs

@@ -4,8 +4,8 @@
 // projectService builds its server host from `tsserver.sys` (typescript/lib/tsserverlibrary) and exposes no host through
 // parserOptions, so without a bound a typed rule reads types from an enclosing repository's node_modules and judges the app
 // greener than its own install allows. Here `sys` of the app's own TypeScript is patched, in place and before ESLint loads
-// the parser, to answer only for paths inside the app root and TypeScript's own lib directory (the same bound the gate's
-// tsc programs use, scripts/gates/gate.mjs boundedSys). realpath is the identity, so an install junctioned inside the app
+// the parser, to answer only for paths inside the app root and TypeScript's own lib directory (the same bound a typed
+// tsc program of the app keeps). realpath is the identity, so an install junctioned inside the app
 // stays inside it. Nothing is patched when STARCI_LINT_BOUND is unset or TypeScript is not installed (nothing typed runs).
 'use strict'
 const path = require('node:path')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.8.0",
+  "version": "4.9.1",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/runtime/engine/admission.mjs

@@ -187,7 +187,7 @@ export const AWAITING_OWNER='awaiting-owner';
  */
 export const AWAITING_OWNER_STATUS='awaiting_owner';
 export const RETRYABLE_JOB_STATUSES=Object.freeze(['failed',AWAITING_OWNER_STATUS]);
-/** Every jobs.status that holds nothing the runtime still needs (mirrors engine/db/ledger.mjs JOB_STATUSES.settled). */
+/** Every jobs.status that holds nothing the runtime still needs. */
 export const SETTLED_JOB_LIST=Object.freeze(['succeeded','failed',AWAITING_OWNER_STATUS,'cancelled']);
 /** The tries of a unit that spent budget: every try but the ones that only waited on the owner. */
 export const spentTries=tries=>tries.filter(job=>job.status!==AWAITING_OWNER_STATUS).length;

package/runtime/engine/config.mjs

@@ -288,11 +288,11 @@ const validateSupervisorBlock=(supervisor,profile)=>{
   const interval=supervisor?.pollIntervalMs,repos=supervisor?.repos,stall=supervisor?.stallMinutes;
   if(!plain(supervisor)||Object.keys(supervisor).some(key=>!CONFIG_KEY_TREE.supervisor.includes(key))||!(interval===null||interval===undefined||(Number.isInteger(interval)&&interval>=60000)))
     throw new Error('Invalid config.yaml: supervisor must be {mode?, pollIntervalMs?, repos?, stallMinutes?, kernel?, workers?, landGate?, frozenMinutes?} with an integer of at least 60000 ms, or null.');
-  // mode: where the Supervisor role runs (scripts/machine/home.mjs supervisorMode) - chat (default: the owner's desktop
+  // mode: where the Supervisor role runs - chat (default: the owner's desktop
   // chat session owns channel 'main' and ticks itself) or kernel (the optional [Supervisor] Orca kernel, start-supervisor.mjs).
   if(!(supervisor.mode===undefined||supervisor.mode===null||['chat','kernel'].includes(supervisor.mode)))
     throw new Error('Invalid config.yaml: supervisor.mode must be chat or kernel, or null.');
-  // The [Supervisor] kernel seat (scripts/machine/home.mjs supervisorSettings): kernel {agent?, model?, effort?}
+  // The [Supervisor] kernel seat: kernel {agent?, model?, effort?}
   // pins its agent (default: the kernel pin), workers {base?, max?} its adaptive [Worker] cap (0 to 10; the shipped default is 0 fix workers),
   // landGate {mode?: shared|exclusive, push?: boolean} the land gate (scripts/supervisor/land.mjs); push (default true, owner ruling push-main-after-scoped-check) lets `starci release push` send main to the remote after a green scoped check, false is the owner's lock on the remote.
   const seat=supervisor.kernel,workers=supervisor.workers,gate=supervisor.landGate;

package/runtime/engine/db/machine.mjs

@@ -64,8 +64,7 @@ export const CONTROLLERS = Object.freeze(['job', 'workflow', 'resource', 'host',
 // Paths
 // ---------------------------------------------------------------------------------------------------------------------
 /**
- * Overrides the per-host state base itself (machine.sqlite, projects/, archive/), the one seam starciLocalRoot and
- * engine/db/ledger.mjs (which re-exports starciLocalRoot for its own projectsRootFor) both read. Debug probes and
+ * Overrides the per-host state base itself (machine.sqlite, projects/, archive/), the one seam starciLocalRoot reads. Debug probes and
  * throwaway repos point this at a temp directory so they never touch the real
  * <runtime root>/.runtime and leak fake ledgers/workflows into it (2026-09-30 incident: probe-*, dbg-ask-*, dbg-env*
  * repos left six fake-worker ledgers in the live store). STARCI_PROJECTS_ROOT (ledger-db.mjs) and
@@ -138,7 +137,7 @@ function corruptIncident(file, error, details) {
 
 /**
  * The rev of the runtime this process runs, as its callers know it: '<HEAD committer time, ms, 13 digits>:<short sha>' of
- * the .claude checkout, which scripts/machine/home.mjs runtimeRevOf computes and the caller passes in (`rev`,
+ * the harness checkout, which the caller computes and passes in (`rev`,
  * `writerRev`, `sourceRev`). The db never spawns git: with no rev passed the default is STARCI_RUNTIME_REV, else
  * 'unknown'. The time prefix orders two revs, so a writer can refuse a store row written by a NEWER runtime (MB-15);
  * 'unknown' sorts before every real rev.

package/runtime/engine/invalid-config.mjs

@@ -5,7 +5,7 @@ export const invalid=section=>message=>{throw new Error(`Invalid config.yaml: ${
 
 /** The host roots the owner may relocate (config.yaml `roots`): the archive root, the lanes root and the temp root. */
 export const ROOT_KEYS=Object.freeze(['archive','lanes','temp']);
-/** config.yaml `roots` - {archive?, lanes?, temp?}: absolute directories, or null; an absent key means <starciLocalRoot>/archive and the per-user lanes directory (scripts/machine/home.mjs lanesDefault). */
+/** config.yaml `roots` - {archive?, lanes?, temp?}: absolute directories, or null; an absent key means <starciLocalRoot>/archive and the per-user lanes directory. */
 export function validateRoots(roots){
   if(roots===null)return;
   const bad=invalid('roots');

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -30,61 +30,61 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.13.0
+    version: 0.15.0
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.57
+    version: 3.6.0
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.2.0
+    version: 9.4.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.13.0
+    version: 0.15.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.13.0
+    version: 0.15.0
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.1.0
+    version: 2.2.1
     group: starci
     install: registry
     side: fe
     source: packages/stylelint-canon/package.json
     why: 'the front-end stylelint canon: no-class-selector refuses a compound class selector (`div.card`); the brand layer accepts `--font-sans` and `--font-mono`; status-contrast measures the HeroUI soft pairs per theme; brand-layer-shape reads the shared :root,.light,.dark block and the info soft pair; appTokens come from loadAppTokens(import.meta.url) for the managed one-line stylelint.config.mjs.'
   '@starci/tsconfig':
-    version: 2.0.8
+    version: 2.1.0
     group: starci
     install: registry
     side: both
     source: packages/tsconfig/package.json
   '@starci/prettier-config':
-    version: 1.0.5
+    version: 1.1.0
     group: starci
     install: registry
     side: both
     source: packages/prettier-config/package.json
   '@starci/jest-preset':
-    version: 2.3.7
+    version: 2.4.1
     group: starci
     install: registry
     side: be
@@ -97,19 +97,27 @@ pins:
     side: be
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
-  '@starci/cli':
-    version: 1.7.47
+  '@starci/ai-router':
+    version: 0.2.1
+    group: starci
+    install: registry
+    side: be
+    source: packages/ai-router/package.json
+    why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
+  'starci-harness':
+    version: 1.1.0-alpha.1
     group: starci
     install: registry
     side: both
-    why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
+    source: cli/package.json
+    why: 'the one StarCi command line (bins starci and starci-harness): a product repository installs it for starci app, which it runs in-process through its exact @starci/hfs dependency, and its codegen loads starci-harness/input-bounds.'
   '@starci/hfs':
-    version: 4.8.0
+    version: 4.9.1
     group: starci
     install: registry
     side: both
     source: packages/hfs/package.json
-    why: 'the transitive app implementation used by @starci/cli; it carries the generated runtime slice read by starci app commands.'
+    why: 'the app implementation starci-harness runs for starci app; it carries the generated runtime slice read by starci app commands.'
   # --- tooling
   typescript:
     version: 5.9.3

package/runtime/knowledge/hfs/rules.yaml

@@ -5664,3 +5664,26 @@ rules:
         source: owner
         quote: "The size of the buttons and controls is uneven; the teacher thinks height = 40px (h-10) should be fixed for every button, switch, input, tabs and so on, what do you think? (translated from Vietnamese)"
         ruling: "One 40px control height is the default of every standalone control (owner ruling control-height-40): Grammar draws it, an app omits size, sm is for a nested item or dense toolbar row, lg only for a landing hero call to action, and controls of one row share one size."
+  - id: R322
+    code: "FE_CHIP_LABEL_CASE"
+    law: "The label of a status chip (a StatusDot with text, a Badge) starts with an uppercase letter, so every chip of an app reads in one vocabulary."
+    kinds: [lint, codemod]
+    gates: [pre-commit, settle, land, ci]
+    failureCodes: ["FE_CHIP_LABEL_CASE"]
+    enforcers:
+      - {kind: eslint-grammar-core, id: chip-label-starts-uppercase}
+    editions: [lite, full]
+    docs: [knowledge/patterns/fe/index.yaml#FE-RULE-OWNERSHIP]
+    templateNa: "A template states no chip label; the words are the app's."
+    proves:
+      - packages/eslint/grammar-core/chip-label.spec.mjs
+    exemplifiedBy:
+      - {path: packages/eslint/grammar-core/chip-label.spec.mjs, editions: [lite, full], codes: [FE_CHIP_LABEL_CASE]}
+    witness:
+      - {path: packages/eslint/grammar-core/chip-label.spec.mjs, editions: [lite, full], codes: [FE_CHIP_LABEL_CASE]}
+    cases:
+      - id: case-1
+        date: "2026-10-27"
+        source: owner
+        quote: "A chip label starts uppercase."
+        ruling: "The label of a status chip starts with an uppercase letter (owner ruling chip-label-uppercase); StatusDot capitalises a text label it renders, and the lint refuses a lowercase literal label at its source."

package/runtime/modules/kernel/failure-codes.yaml

@@ -2284,6 +2284,16 @@ FE_CONSOLE_CALL:
   owner: op-retry
   kind: check-finding
 
+FE_CHIP_LABEL_CASE:
+  title: "A status chip label starts with a lowercase letter"
+  title_vi: "Nhãn chip trạng thái bắt đầu bằng chữ thường"
+  meaning_vi: "Nhãn chữ của một StatusDot hoặc Badge tại <file> bắt đầu bằng chữ cái thường, nên các chip trong cùng một màn hình đọc thành hai lối viết."
+  causes_vi:
+    - "Viết nhãn chip như `running` thay vì `Running`."
+  nextStep_vi: "Viết hoa chữ cái đầu của nhãn chip; luật tự sửa nhãn viết thẳng trong mã (quy định chip-label-uppercase)."
+  owner: op-retry
+  kind: check-finding
+
 FE_CONTROL_HEIGHT:
   title: "A control picks a larger size or mixes sizes in one row"
   title_vi: "Điều khiển chọn cỡ lớn hơn hoặc trộn nhiều cỡ trong một hàng"

package/runtime/scripts/guards/git-policy.mjs

@@ -1,7 +1,6 @@
 // git-policy.mjs — which git commands an op worker may run in a checkout it
-// shares with other workflows. Pure: argv in, verdict out; scripts/guards/command-guard.mjs
-// (a PreToolUse hook) applies it to the agent's shell command before it runs, and the
-// reference-transaction hook git itself runs backs it (scripts/guards/hook-install.mjs).
+// shares with other workflows. Pure: argv in, verdict out; a caller applies it to a
+// shell command before it runs.
 //
 // Several workflows of one product ledger build in ONE checkout on ONE branch.
 // Their workers damaged each other with commands that are harmless alone:

package/runtime/scripts/hfs/rules/pipeline.mjs

@@ -1,7 +1,7 @@
 // pipeline.mjs - HFS_CI_MISSING_CANON (R13): CI runs the pinned `starci app lint`.
 //   .github/workflows/ci.yml   a `run:` step that runs the one lint entry: `starci app lint`,
-//                              `npx @starci/cli[@<version>] app lint`, or `npm run <script>` whose command runs `starci app lint`
-//                              (`npm run lint`, arguments after `--` allowed); a version named in the step is the @starci/cli pin of
+//                              `npx starci-harness[@<version>] app lint`, or `npm run <script>` whose command runs `starci app lint`
+//                              (`npm run lint`, arguments after `--` allowed); a version named in the step is the starci-harness pin of
 //                              canon-pins.yaml (an installed one is pinned by the pin check, R15)
 //   (the push hook is no lint or typecheck step: it checks the release gate, scripts/hfs/runtime-rules/hook-shape.mjs keeps its shape)
 // A missing file is the slot manifest's finding (HFS_SLOT_REQUIRED_MISSING); a file that is present and lacks the step is this rule's.
@@ -11,10 +11,10 @@ import { isRuntimeExampleApp } from '../../lib/runtime-example.mjs';
 
 const CI_MISSING_CANON = 'HFS_CI_MISSING_CANON';
 const CI_FILE = '.github/workflows/ci.yml';
-const hfsPackage = '@starci/cli';
+const hfsPackage = 'starci-harness';
 const RUN_PREFIX = /^\s*(?:-\s+)?run:/;
 const NPX_PREFIX = /^npx\s+(?:(?:--no-install|-y)\s+)?/;
-const LINT_COMMAND = /^(?:@starci\/cli(?:@(\S+))?|starci)\s+app\s+lint/;
+const LINT_COMMAND = /^(?:starci-harness(?:@(\S+))?|starci)\s+app\s+lint/;
 const NPM_RUN_PREFIX = 'npm run ';
 const EXAMPLE_RUN_PREFIX = 'node node_modules/@starci/hfs/runtime/scripts/hfs/example-secrets.mjs --run . -- ';
 const SCRIPT_NAME = /^[\w:.-]+/;
@@ -57,7 +57,7 @@ function parseNpmRun(command) {
   return args !== null && !LINE_TERMINATOR.test(args) ? { script, args } : null;
 }
 
-/** { version } of a `starci app lint` command (`version` undefined when no @starci/cli version is named), else null. */
+/** { version } of a `starci app lint` command (`version` undefined when no starci-harness version is named), else null. */
 function lintCommandOf(command) {
   const rest = command.replace(NPX_PREFIX, '');
   const match = LINT_COMMAND.exec(rest);

package/runtime/scripts/lib/package-at.mjs

@@ -13,9 +13,9 @@ export const packageAt = (dir, name) => {
 /** This runtime's own `starci` bin (packages/cli is the only package that declares one). */
 const RUNTIME_STARCI_BIN = path.join(skillRoot, 'packages', 'cli', 'bin', 'starci.mjs');
 
-/** The `starci` bin of the @starci/cli that `dir` installs (a product runs its own pinned CLI), else this runtime's own. */
+/** The `starci` bin of the starci-harness that `dir` installs (a product runs its own pinned CLI), else this runtime's own. */
 function starciBin(dir) {
-  const packageFile = packageAt(dir, '@starci/cli');
+  const packageFile = packageAt(dir, 'starci-harness');
   if (packageFile) {
     try {
       const { bin } = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
@@ -50,13 +50,12 @@ export const loadTypescript = (...dirs) => {
 };
 
 /**
- * The app's command line and the app implementation behind it: `bin` the `starci` bin of the app's installed @starci/cli, else
+ * The app's command line and the app implementation behind it: `bin` the `starci` bin of the app's installed starci-harness, else
  * this runtime's packages/cli/bin/starci.mjs (starciBin); `dir` the @starci/hfs that answers
- * `starci app` - the app's own install, else the one beside its @starci/cli, else this runtime's packages/hfs - whose runtime
- * slice the gate's base lint (scripts/gates/gate.mjs) and the READ digest (scripts/gates/read-digest.mjs) load in-process.
+ * `starci app` - the app's own install, else the one beside its starci-harness, else this runtime's packages/hfs.
  */
 export function hfsEntry(root) {
-  const cli = packageAt(root, '@starci/cli');
+  const cli = packageAt(root, 'starci-harness');
   const manifest = packageAt(root, '@starci/hfs') ?? (cli && packageAt(path.dirname(cli), '@starci/hfs'));
   return { dir: manifest ? path.dirname(manifest) : path.join(skillRoot, 'packages', 'hfs'), bin: starciBin(root) };
 }

package/runtime/scripts/lib/roots.mjs

@@ -11,8 +11,8 @@
 //   product trees      treesInOrder       the workflow tree first, then the product's main checkout
 //   Work records       workRecordPath     the first tree that holds the record, else the main checkout's path
 //   tool lookups       toolSearchDirs     the tree the work happens in first, the runtime's own install last
-// The workflow tree itself, a job's placement and the Critic directory are registry facts: scripts/machine/workflow-tree.mjs,
-// placement-rebound.mjs and the worktree registry resolve them, and a caller hands the result in as `tree`.
+// The workflow tree itself, a job's placement and the Critic directory are registry facts: the worktree registry resolves
+// them, and a caller hands the result in as `tree`.
 // The `root-adhoc` self-check (scripts/checks/check-root-adhoc.mjs, rule R240) refuses a new path built from the process working
 // directory or from the Work directory name outside this module.
 import fs from 'node:fs';

package/runtime/scripts/work/draw/draw-dna-findings.mjs

@@ -12,7 +12,7 @@ export function appendDnaFindings({ all, dna, proposals, label, assetRequests, t
   alertFindings(all, dna, rules, add, helpers);
   meterTrackFindings(all, rules, add, helpers);
   artworkFindings(all, assetRequests, add, helpers);
-  badgeDotFindings(all, rules, add, helpers);
+  statusDotFindings(all, rules, add, helpers);
   return groupedFindings(groups, label);
 }
 
@@ -221,29 +221,40 @@ function artworkFindingFor(el, assetRequests, add, h) {
   if (assetRequests && !assetRequests.has(id)) add(h.DRAW_ASSET_SLOT_UNDECLARED, 'asset slot without a request', slotEl, `${h.ASSET_SLOT_ATTR}="${id}" has no entry in the drawing's asset-request.md`);
 }
 
-function badgeDotFindings(all, rules, add, h) {
-  for (const el of all) badgeDotFindingFor(el, rules, add, h);
+function statusDotFindings(all, rules, add, h) {
+  for (const el of all) statusDotFindingFor(el, rules, add, h);
 }
 
-function badgeDotFindingFor(el, rules, add, h) {
+/** The nearest declaration of the dot-size token on the element or an ancestor, in px; null when none is declared. */
+function statusDotTokenPx(el, rules, h) {
+  for (const node of [el, ...h.ancestorsOf(el)]) {
+    const px = h.declaredPx(node, h.STATUS_DOT_SIZE_PROPERTY, rules);
+    if (px != null) return px;
+  }
+  return null;
+}
+
+function statusDotFindingFor(el, rules, add, h) {
   if (h.insideSvg(el)) return;
   const part = (el.attrs[h.PART_ATTR] ?? '').trim();
+  const slot = (el.attrs['data-slot'] ?? '').trim();
   const cls = h.classesOf(el);
-  const dotLike = /(^|-)dot$/.test(part) || cls.some((c) => h.DOT_CLASS.test(c));
+  const inDotComponent = h.inComponent(el, h.COMPONENTS_WITH_DOT);
+  if (inDotComponent && (h.STATUS_DOT_ANATOMY.test(part) || cls.some((c) => h.STATUS_DOT_ANATOMY.test(c)))) return;
+  const dotLike = /(^|-)dot(-mark)?$/.test(part) || cls.some((c) => h.DOT_CLASS.test(c));
   if (!dotLike) return;
-  const dnaDot = ['badge-dot', 'dot'].includes(part) || cls.includes(h.BADGE_DOT_CLASS);
-  const inBadge = h.inComponent(el, ['Badge']);
-  if (!dnaDot || !inBadge) {
-    add(h.DRAW_OFF_GRAMMAR_COMPONENT, 'hand-made status dot', el, `a status dot is DNA Badge isDot (data-grammar-part="badge-dot" / ${h.BADGE_DOT_CLASS} inside a Badge), never a hand-drawn dot`);
+  const dnaDot = [part, slot].includes(h.STATUS_DOT_MARK_PART) || cls.includes(h.STATUS_DOT_MARK_CLASS);
+  if (!dnaDot || !inDotComponent) {
+    add(h.DRAW_OFF_GRAMMAR_COMPONENT, 'hand-made status dot', el, `a status dot is the DNA StatusDot mark (data-grammar-part="${h.STATUS_DOT_MARK_PART}" / ${h.STATUS_DOT_MARK_CLASS} inside a StatusDot or a Badge isDot), never a hand-drawn dot`);
     return;
   }
   const inline = h.declsOf(el.attrs.style);
   const ruled = rules.filter((r) => h.selectorMatches(r.selector, el)).map((r) => r.decls);
   const ring = [inline, ...ruled].some((d) => ['box-shadow', 'outline', 'border'].some((key) => d[key] && !/^(none|0|0px)$/i.test(d[key].trim())))
     || cls.some((c) => /^(ring|shadow|outline)(-|$)/.test(c) && !/^(ring|shadow|outline)-none$/.test(c));
-  if (ring) add(h.DRAW_OFF_GRAMMAR_COMPONENT, 'Badge dot with a halo', el, 'the Badge dot is a plain 6px solid circle in the tone colour: no box-shadow, ring, outline or border halo');
-  const px = Math.max(h.declaredPx(el, 'width', rules) ?? 0, h.declaredPx(el, 'height', rules) ?? 0, Number(el.attrs.width) || 0, Number(el.attrs.height) || 0);
-  if (px && Math.abs(px - h.BADGE_DOT_PX) > 0.5) add(h.DRAW_OFF_GRAMMAR_COMPONENT, 'Badge dot off its size', el, `the dot declares ${px}px: the Badge dot is ${h.BADGE_DOT_PX}px (<CircleFill width={6} />), no size variants`);
+  if (ring) add(h.DRAW_OFF_GRAMMAR_COMPONENT, 'status dot with a halo', el, `the status dot is a plain ${h.STATUS_DOT_PX}px solid circle in the tone colour: no box-shadow, ring, outline or border halo (the echo ring is the StatusDot's own)`);
+  const px = Math.max(h.declaredPx(el, 'width', rules) ?? 0, h.declaredPx(el, 'height', rules) ?? 0, Number(el.attrs.width) || 0, Number(el.attrs.height) || 0, statusDotTokenPx(el, rules, h) ?? 0);
+  if (px && Math.abs(px - h.STATUS_DOT_PX) > 0.5) add(h.DRAW_OFF_GRAMMAR_COMPONENT, 'status dot off its size', el, `the dot declares ${px}px: the status dot is ${h.STATUS_DOT_PX}px, read from ${h.STATUS_DOT_SIZE_PROPERTY}, no size variants`);
 }
 
 function groupedFindings(groups, label) {

package/runtime/scripts/work/draw/draw-dna.mjs

@@ -17,9 +17,10 @@
 //                               inherits its parent's; an svg's inner shapes inherit the svg's); a component name DNA
 //                               does not publish; a part none of the enclosing components publishes; a closed prop
 //                               value outside its DNA values; a proposal with no entry in a grammar-proposal file;
-//                               a status dot that is not the DNA Badge isDot dot (grammar 0.5.3: HeroUI's
-//                               <CircleFill width={6} />, part badge-dot / class starci-core-badge-dot inside a Badge) -
-//                               a hand-made dot span, a dot with a box-shadow/ring/outline halo, or a dot not 6px;
+//                               a status dot that is not the DNA StatusDot mark (grammar 0.14: class
+//                               starci-core-status-dot-mark / part status-dot-mark inside a StatusDot or a Badge isDot,
+//                               sized by --starci-core-status-dot-size, 6px) - a hand-made dot span, a dot with a
+//                               box-shadow/ring/outline halo, or a dot (or a redefined size token) not 6px;
 //   DRAW_NOTICE_NOT_ALERT       a notice that is not DNA `Alert` with a tone: an Alert without a tone in the
 //                               PresentationState vocabulary, or a container (SurfaceCard, a bare div ...) posing as a
 //                               notice - role alert/status or aria-live, notice/callout/banner vocabulary in its
@@ -67,9 +68,14 @@ export { anatomyFindings } from './draw-dna-anatomy.mjs';
 export const DRAW_OFF_GRAMMAR_COMPONENT = 'DRAW_OFF_GRAMMAR_COMPONENT';
 export const DRAW_NOTICE_NOT_ALERT = 'DRAW_NOTICE_NOT_ALERT';
 export const DRAW_RATIO_NOT_METER = 'DRAW_RATIO_NOT_METER';
-/** Grammar 0.5.3 Badge isDot: the dot's class and its one size (HeroUI's <CircleFill width={6} />). */
-const BADGE_DOT_CLASS = 'starci-core-badge-dot';
-const BADGE_DOT_PX = 6;
+/** Grammar 0.14 StatusDot (also behind Badge isDot): the dot's class, part, size custom property and its one value. */
+const STATUS_DOT_MARK_CLASS = 'starci-core-status-dot-mark';
+const STATUS_DOT_MARK_PART = 'status-dot-mark';
+const STATUS_DOT_SIZE_PROPERTY = '--starci-core-status-dot-size';
+const STATUS_DOT_PX = 6;
+/** The StatusDot's own anatomy around the mark (root, chip, label): parts of the component, never a dot. */
+const STATUS_DOT_ANATOMY = /^(starci-core-)?status-dot(-chip|-label)?$/;
+const COMPONENTS_WITH_DOT = ['StatusDot', 'Badge'];
 const DOT_CLASS = /(?:^|[-_])(dot|status-dot|dot-indicator)(?:$|[-_])/i;
 /**
  * The grammar Alert's action Button variant for a PresentationState tone (@starci/grammar 0.5.3 Alert, after HeroUI v3's
@@ -425,8 +431,8 @@ function isArtwork(el) {
  * its asset-request.md requests (null: not judged).
  */
 const DNA_FINDING_HELPERS = {
-  ACTION_COMPONENTS, ALERT_INDICATOR_MAX_PX, ASSET_SLOT_ATTR, BADGE_DOT_CLASS, BADGE_DOT_PX, BAR_CLASS, CONTAINERS,
-  DOT_CLASS, DRAW_ALERT_ANATOMY, DRAW_ASSET_SLOT_UNDECLARED, DRAW_METER_TRACK, DRAW_NOTICE_NOT_ALERT, DRAW_OFF_GRAMMAR_COMPONENT, DRAW_RATIO_NOT_METER,
+  ACTION_COMPONENTS, ALERT_INDICATOR_MAX_PX, ASSET_SLOT_ATTR, BAR_CLASS, COMPONENTS_WITH_DOT, CONTAINERS,
+  DOT_CLASS, STATUS_DOT_ANATOMY, STATUS_DOT_MARK_CLASS, STATUS_DOT_MARK_PART, STATUS_DOT_PX, STATUS_DOT_SIZE_PROPERTY, DRAW_ALERT_ANATOMY, DRAW_ASSET_SLOT_UNDECLARED, DRAW_METER_TRACK, DRAW_NOTICE_NOT_ALERT, DRAW_OFF_GRAMMAR_COMPONENT, DRAW_RATIO_NOT_METER,
   METER_FULL_WIDTH_SHARE, METER_SEGMENTED_TRACK_PX, METER_SEGMENTS_PROPOSAL, METER_TRACK_PX, METER_SEGMENT_GAP_MAX_PX, NOTICE_CLASS, OUTCOME_STATES,
   PART_ATTR, PROPOSAL_ATTR, RATIO_RX, alertActionVariantFor, ancestorsOf, classesOf, componentNameOf, componentRootOf,
   declaredBackgroundsOf, declaredPx, declsOf, describe, dnaSegment, inComponent, insideSvg, isAction, isArtwork, kebab,

package/scaffold/app.mjs

@@ -161,8 +161,8 @@ const STARTER_DEPENDENCIES = Object.freeze({
     'class-transformer': null, 'class-validator': null, 'reflect-metadata': null, rxjs: null, tslib: null, typeorm: null, zod: null,
   },
   devDependencies: {
-    turbo: null, '@nestjs/testing': null, '@starci/cli': null, '@starci/eslint-canon-be': null, '@starci/eslint-canon-fe': null, '@starci/jest-preset': null,
-    '@starci/prettier-config': null, '@starci/stylelint-canon': null, '@starci/test-world': null, '@starci/tsconfig': null, '@tailwindcss/postcss': null, '@types/express': null,
+    turbo: null, '@nestjs/testing': null, '@starci/eslint-canon-be': null, '@starci/eslint-canon-fe': null, '@starci/jest-preset': null,
+    '@starci/prettier-config': null, '@starci/stylelint-canon': null, '@starci/test-world': null, '@starci/tsconfig': null, 'starci-harness': null, '@tailwindcss/postcss': null, '@types/express': null,
     '@types/jest': null, '@types/node': null, '@types/react': null, '@types/react-dom': null, eslint: null, 'eslint-plugin-react-hooks': null,
     husky: null, jest: null, 'postcss-value-parser': null, prettier: null, stylelint: null, tailwindcss: null, 'ts-jest': null,
     'ts-node-dev': null, 'tsc-alias': null, 'tsconfig-paths': null, typescript: null,
@@ -182,8 +182,8 @@ const LITE_STARTER_DEPENDENCIES = Object.freeze({
     'reflect-metadata': null, rxjs: null, tslib: null, typeorm: null, zod: null,
   },
   devDependencies: {
-    turbo: null, '@nestjs/testing': null, '@starci/eslint-canon-be': null, '@starci/eslint-canon-fe': null, '@starci/cli': null,
-    '@starci/jest-preset': null, '@starci/prettier-config': null, '@starci/stylelint-canon': null, '@starci/tsconfig': null, '@tailwindcss/postcss': null,
+    turbo: null, '@nestjs/testing': null, '@starci/eslint-canon-be': null, '@starci/eslint-canon-fe': null,
+    '@starci/jest-preset': null, '@starci/prettier-config': null, '@starci/stylelint-canon': null, '@starci/tsconfig': null, 'starci-harness': null, '@tailwindcss/postcss': null,
     '@types/express': null, '@types/jest': null, '@types/node': null, '@types/react': null, '@types/react-dom': null,
     eslint: null, 'eslint-plugin-react-hooks': null, husky: null, jest: null, 'postcss-value-parser': null, prettier: null,
     stylelint: null, supabase: null, tailwindcss: null, 'ts-jest': null, 'ts-node-dev': null, 'tsc-alias': null,

package/src/main.mjs

@@ -136,7 +136,7 @@ starci app hygiene [--cwd <dir>]
 starci app coverage merge --out <lcov> <lcov-or-dir>... [--cwd <dir>]
 `;
 const PER_CODE_LIMIT = 25;
-const VALUE_FLAGS = new Set(['--base', '--inject', '--into', '--event', '--from', '--service', '--connection', '--owner', '--failed', '--done', '--coverage-from', '--registry-visibility']);
+const VALUE_FLAGS = new Set(['--base', '--inject', '--into', '--event', '--from', '--service', '--connection', '--owner', '--failed', '--done', '--coverage-from', '--registry-visibility', '--shapes', '--read', '--app']);
 /** Flags that may repeat: their values are collected in order. */
 const LIST_FLAGS = new Set(['--inject']);
 const BOOL_FLAGS = new Set(['--json', '--fast', '--fe', '--no-types', '--db-types', '--wiring']);
@@ -293,7 +293,7 @@ async function lintMain(argv, { cwd, stdout, presets, prettier, runLinter, check
 
 /**
  * The jest preset a new app renders its Sonar exclusions from: the copy this @starci/hfs ships (bundledPresets), the same version the
- * scaffold pins, so `npx @starci/cli app scaffold` works before any dependency of the app is installed.
+ * scaffold pins, so `npx starci-harness app scaffold` works before any dependency of the app is installed.
  */
 const scaffoldPresets = () => bundledPresets();
 
@@ -390,7 +390,7 @@ function newMain(opts, { cwd: repoRoot, stdout: out }) {
 function addMain(opts, { cwd: repoRoot, stdout: out }) {
   const [noun, name, ...extra] = opts.positional;
   if (!noun || !name || extra.length) throw new Error('starci app add takes `<noun> <name>` and the options of the noun');
-  const { created, registered } = addKind({ repoRoot, noun, name, options: { event: opts.event, from: opts.from, service: opts.service, connection: opts.connection, owner: opts.owner, failed: opts.failed, done: opts.done, fe: opts.fe, noTypes: opts['no-types'] } });
+  const { created, registered } = addKind({ repoRoot, noun, name, options: { event: opts.event, from: opts.from, service: opts.service, connection: opts.connection, owner: opts.owner, failed: opts.failed, done: opts.done, fe: opts.fe, noTypes: opts['no-types'], shapes: opts.shapes, read: opts.read, app: opts.app } });
   for (const file of created) out(`created ${file}\n`);
   const kinds = registered.kinds.length ? `; kinds ${registered.kinds.join(', ')}` : '';
   out(`starci app add ${noun}: registered patterns ${registered.patterns.join(', ')}${kinds}\n`);

package/sync/index.mjs

@@ -200,6 +200,18 @@ const LCOV_REPORT = 'be/coverage/lcov.info';
  */
 export const SONAR_CPD_EXCLUSIONS = Object.freeze(['**/messages/*.messages.ts', '**/messages/*.json']);
 
+/**
+ * The Sonar scope of the jest preset's exclusions (presets.sonarExclusions): its file patterns are the tests, which
+ * `sonar.test.inclusions` takes and `sonar.exclusions` moves out of the sources (`sonar.tests` names every source folder, so the
+ * two sets stay disjoint and each test is analysed as a test, never dropped); its folder patterns (`/**`) and the front end's
+ * build and dependency folders are no source at all. Nothing else is excluded: a generated file is analysed like any other.
+ */
+export function sonarScope(presets) {
+  const preset = String(presets?.sonarExclusions ?? '').split(',').map(glob => glob.trim()).filter(Boolean);
+  const tests = preset.filter(glob => !glob.endsWith('/**'));
+  return { tests, exclusions: [...new Set([...preset, '**/.next/**', '**/node_modules/**'])] };
+}
+
 const SOURCE_FILE = /\.[cm]?ts$/;
 const SOURCE_SKIPPED = new Set(['node_modules', 'dist', 'coverage']);
 
@@ -364,7 +376,8 @@ export function variables(app, scope, presets, sonarKey, manifest = loadSlotMani
     nodeMajor: String(NODE_MAJOR),
     sonarKey: sonarKey ?? app.project,
     sonarHostLine: sonarHostLine(quality.sonar),
-    sonarExclusions: [presets?.sonarExclusions, '**/.next/**', '**/node_modules/**', ...(lite ? ['supabase/types/**'] : [])].filter(Boolean).join(','),
+    sonarExclusions: sonarScope(presets).exclusions.join(','),
+    sonarTestInclusions: sonarScope(presets).tests.join(','),
     sonarSources: ['be/apps', 'be/src', 'fe/apps', ...(packages ? ['fe/packages'] : [])].join(','),
     lcovReport: LCOV_REPORT,
     cpdExclusions: SONAR_CPD_EXCLUSIONS.join(','),

package/sync/managed.mjs

@@ -23,8 +23,9 @@
 //                                 a file that states the coverage scope no longer states what the slot manifest derives (the `coverage` field of
 //                                 knowledge/hfs/slots.yaml through scripts/hfs/coverage-scope.mjs): be/jest.config.js, codecov.yml, or the
 //                                 `sonar.coverage.exclusions` line of sonar-project.properties. The scope is never edited by hand.
-//   HFS_SONAR_CONFIG (R11)        sonar-project.properties differs from its render (the render names no host URL, sources and tests that
-//                                 do not overlap, the `sonar.exclusions` of the jest preset (a back end), the be lcov with the logic of be/src/modules as the coverage scope, the ESLint report and the
+//   HFS_SONAR_CONFIG (R11)        sonar-project.properties differs from its render (the render names no host URL, the source folders as
+//                                 `sonar.tests` too, the jest preset's test patterns as `sonar.test.inclusions` moved out of the sources by
+//                                 `sonar.exclusions` beside the build and dependency folders (sync/index.mjs sonarScope), the be lcov with the logic of be/src/modules as the coverage scope, the ESLint report and the
 //                                 HFS import files Sonar reads), or the stack declaration names a quality gate other than the one
 //                                 gate of knowledge/sonar-gate.yaml (bundled in the runtime copy). One edit is one finding.
 //   HFS_TS_STRICT (R22)           the root tsconfig.json drift (either profile), named by flag (ts-strict.mjs) instead of by hash.

package/templates/app/codegen-graphql.mjs.partial

@@ -28,12 +28,12 @@ const writeFormBounds = (roots, source) => {
 if (schemas.length === 0 || operationRoots.length === 0) {
     process.stdout.write("codegen: no GraphQL contract under be/contracts yet\n")
     if (schemas.length === 0 && operationRoots.length) {
-        const { emptyInputBoundsSource } = await import("@starci/cli/input-bounds")
+        const { emptyInputBoundsSource } = await import("starci-harness/input-bounds")
         writeFormBounds(operationRoots, emptyInputBoundsSource())
     }
 } else {
     const { buildSchema } = await import("graphql")
-    const { assertCompatibleInputBounds } = await import("@starci/cli/input-bounds")
+    const { assertCompatibleInputBounds } = await import("starci-harness/input-bounds")
     assertCompatibleInputBounds(
         Object.fromEntries(schemas.map((file) => [file, buildSchema(fs.readFileSync(file, "utf8"))])),
     )
@@ -49,7 +49,7 @@ if (schemas.length === 0 || operationRoots.length === 0) {
                     config: { useTypeImports: true, enumsAsTypes: true, avoidOptionals: true },
                 },
             ],
-            [`${root}/__generated__/input-bounds.ts`, { plugins: [{ "@starci/cli/input-bounds": {} }] }],
+            [`${root}/__generated__/input-bounds.ts`, { plugins: [{ "starci-harness/input-bounds": {} }] }],
         ]),
     )
     await generate(
@@ -80,7 +80,7 @@ const restRoots = frontendApps
     .filter((dir) => fs.existsSync(dir))
     .map(posix)
 if (restRoots.length) {
-    const { openApiBoundsSource } = await import("@starci/cli/input-bounds")
+    const { openApiBoundsSource } = await import("starci-harness/input-bounds")
     const contracts = Object.fromEntries(
         services
             .map((service) => [service, path.join(CONTRACTS, service, "openapi.json")])

package/templates/app/quality-config/sonar-project.properties

@@ -1,11 +1,13 @@
 {{> app/quality-config/sonar-base.properties}}
 {{sonarHostLine}}
-sonar.tests=be/apps,be/src
+sonar.tests={{sonarSources}}
 sonar.exclusions={{sonarExclusions}}
 sonar.cpd.exclusions={{cpdExclusions}}
-sonar.test.inclusions=**/*.spec.ts
+sonar.test.inclusions={{sonarTestInclusions}}
 sonar.typescript.tsconfigPaths={{tsconfigPaths}}
 sonar.externalIssuesReportPaths=reports/lint.sonar.json
 sonar.javascript.lcov.reportPaths={{lcovReport}}
+# starci:sonar-scope begin (generated by `starci app sonar --write` from contexts/hfs/slots.yaml; do not edit)
 sonar.coverage.exclusions={{coverageExclusions}}
+# starci:sonar-scope end
 sonar.javascript.node.maxspace=6144