@starci/hfs 5.0.7 → 5.0.8

package/release/lint-report.mjs

@@ -1,5 +1,5 @@
 // lint-report.mjs - the external issues report the release gate's sonar row produces before it runs the scanner.
-// The app declares `sonar.externalIssuesReportPaths=reports/lint.sonar.json`; the managed CI makes it with `lint --side <side> --out reports/lint.<side>.sonar.json`
+// The app declares `sonar.externalIssuesReportPaths=reports/lint.sonar.json`; the managed CI makes it with `app check --gate lint --side <side> --out reports/lint.<side>.sonar.json`
 // per lint matrix side and a "merge Sonar lint reports" step. This module does the same locally, through the same process seam as every gate
 // (an argument array through ctx.spawn, never a shell). The merge below is the one in packages/hfs/sync/ci-commands.mjs (sonarMergeSteps): keep them identical.
 import fs from 'node:fs';
@@ -17,7 +17,7 @@ function mergeSonarReports(reports) {
 /** The sides the app has: a be/ or fe/ folder beside the app root. */
 const sidesOf = (root) => LINT_SIDES.filter((side) => fs.existsSync(path.join(root, side)));
 /**
- * Runs `starci app lint --side <side> --out <file>` for every side the app has, then writes reports/lint.sonar.json.
+ * Runs `starci app check --gate lint --side <side> --out <file>` for every side the app has, then writes reports/lint.sonar.json.
  * `launch` turns an argv into [command, args] for the platform. Returns { pass, text }: the honest log of every lint run and the verdict.
  * A lint that exits non-zero (findings or error) or writes no report fails the row; nothing is skipped.
  */
@@ -30,7 +30,7 @@ export function produceLintReports(ctx, { launch, platform, env }) {
     for (const side of sides) {
         const file = path.join(ctx.cwd, sideReport(side));
         fs.rmSync(file, { force: true });
-        const argv = ['npx', 'starci', 'app', 'lint', '--side', side, '--out', sideReport(side)];
+        const argv = ['npx', 'starci', 'app', 'check', '--gate', 'lint', '--side', side, '--out', sideReport(side)];
         const [command, args] = launch(argv, platform);
         out.push(`$ ${argv.join(' ')}\n`);
         const run = tool(ctx, command, args, { cwd: ctx.cwd, env });

package/report/sonar.d.mts

@@ -48,7 +48,7 @@ interface CheckFinding {
     line?: number;
 }
 type LinterResult = any;
-/** One document of several (the starci-hfs, eslint and stylelint documents of one app lint): rules by id, issues in the one sort order. */
+/** One document of several (the starci-hfs, eslint and stylelint documents of one app check): rules by id, issues in the one sort order. */
 export declare function mergeReports(reports: readonly SonarDocument[]): SonarDocument;
 /**
  * The Generic Issue Import document of a check's findings (the `findings` of checkRepository, each with the catalog's

package/report/sonar.mjs

@@ -1,10 +1,10 @@
-// Sonar documents of the ONE lint entry `starci app lint`: the building blocks that turn the
+// Sonar documents of the lint gate of `starci app check` (`--out`): the building blocks that turn the
 // findings of the StarCi canon into a Sonar Generic Issue Import document (SonarQube 10.3+ format: `{ rules, issues }`).
 //   sonarReport(findings)        the repository findings of `starci app check`, engineId `starci-hfs`, rule id = the finding code
 //   linterReport(kind, results)  a linter's own json output (`eslint -f json`, `stylelint --formatter json`), engineId `eslint` / `stylelint`,
 //                                rule id = the linter's rule. Sonar's own ESLint import (sonar.eslint.reportPaths) is not used: it drops an
 //                                issue on a file outside sonar.sources, and a stylelint result has no native import at all.
-//   mergeReports(reports)        the documents of one `starci app lint` run as ONE file
+//   mergeReports(reports)        the documents of one `starci app check` run as ONE file
 // One placement rule for every engine: Sonar imports an issue only on a file it indexes (a tracked source or stylesheet under
 // sonar.sources). A finding on any other path (hfs.json, a workflow, a package under an unindexed root, e2e/, a directory) is filed
 // on the first source file of sonar.sources and its message names the real path, so no finding is dropped.
@@ -33,7 +33,7 @@ function document(rules, issues) {
     const used = new Set(sorted.map((issue) => issue.ruleId));
     return { rules: [...rules.values()].filter((rule) => used.has(rule.id)).sort((a, b) => cmp(a.id, b.id)), issues: sorted };
 }
-/** One document of several (the starci-hfs, eslint and stylelint documents of one app lint): rules by id, issues in the one sort order. */
+/** One document of several (the starci-hfs, eslint and stylelint documents of one app check): rules by id, issues in the one sort order. */
 export function mergeReports(reports) {
     const rules = new Map(reports.flatMap((report) => report.rules).map((rule) => [rule.id, rule]));
     return document(rules, reports.flatMap((report) => report.issues));

package/report/stylelint-findings.d.mts

@@ -0,0 +1,23 @@
+/** A stylelint result as the `--formatter json` output carries it: the stylesheet and its warnings. */
+export interface StylelintFileResult {
+    source?: string;
+    warnings?: readonly {
+        rule?: string;
+        text: string;
+        line?: number;
+        column?: number;
+    }[];
+}
+/** One stylelint warning as a check finding. */
+export interface StylelintFinding {
+    engine: 'stylelint';
+    rule: string;
+    code: string;
+    level: 'error';
+    path: string;
+    line: number | null;
+    column: number | null;
+    message: string;
+}
+/** The findings of stylelint results; `appRoot` makes their paths app-relative. */
+export declare function stylelintFindings(results: readonly StylelintFileResult[], appRoot: string): StylelintFinding[];

package/report/stylelint-findings.mjs

@@ -0,0 +1,9 @@
+// stylelint-findings.mts - the stylelint results of the lint gate of `starci app check` as findings, one per warning, paths app-relative.
+import path from 'node:path';
+/** The findings of stylelint results; `appRoot` makes their paths app-relative. */
+export function stylelintFindings(results, appRoot) {
+    return results.flatMap((result) => (result.warnings ?? []).map((warning) => {
+        const rule = warning.rule || 'stylelint-error';
+        return { engine: 'stylelint', rule, code: rule, level: 'error', path: path.relative(appRoot, result.source ?? '').replace(/\\/g, '/'), line: warning.line ?? null, column: warning.column ?? null, message: warning.text };
+    }));
+}

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -31,42 +31,42 @@ pins:
     source: packages/event-stream/package.json
     why: 'the one server-sent-events client of every front end (fe-stack event-stream, owner:event-stream-package): the transport client layer (modules/api/sse/clients) creates one instance for the app with the bearer token source and the stream operations follow on it; it carries Last-Event-ID resume, the capped doubling backoff, the heartbeat timeout, the single 401 renewal and the useSWRSubscription adapter, so no app keeps a hand-written reader.'
   '@starci/grammar':
-    version: 0.21.11
+    version: 0.21.12
     group: starci
     install: registry
     side: fe
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.11.18
+    version: 3.11.19
     group: starci
     install: registry
     side: be
     source: packages/eslint-canon-be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 9.9.11
+    version: 9.9.12
     group: starci
     install: registry
     side: fe
     source: packages/eslint-canon-fe/package.json
     why: 'the front-end ESLint canon: `loadHfs(import.meta.url)` of fe/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the fe side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; the front end has no tests (FE_NO_TESTS R97 in hfs) and no-vietnamese-in-source (R91) applies.'
   '@starci/eslint-grammar-core':
-    version: 0.21.11
+    version: 0.21.12
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-core/package.json
     why: 'the StarCi Grammar component API lint, versioned with @starci/grammar; front ends compose this family package with the universal FE canon.'
   '@starci/eslint-grammar-offset-pop':
-    version: 0.21.11
+    version: 0.21.12
     group: starci
     install: registry
     side: fe
     source: packages/eslint-grammar-offset-pop/package.json
     why: 'the Offset Pop Grammar component API lint, versioned with @starci/grammar; its shared component contract comes from the StarCi family lint without copying rules.'
   '@starci/stylelint-canon':
-    version: 2.5.0
+    version: 2.5.1
     group: starci
     install: registry
     side: fe
@@ -106,7 +106,7 @@ pins:
     source: packages/ai-router/package.json
     why: 'the AI pool router of a back end: a NestJS module that routes OpenAI-compatible chat, stream and embeddings calls across keys, models and providers, with @starci/ai-router/testing for its specs; @starci/jest-preset compiles it as an ESM-only dependency.'
   '@starci/hfs':
-    version: 5.0.7
+    version: 5.0.8
     group: starci
     install: registry
     side: both

package/runtime/knowledge/hfs/ci-standard.yaml

@@ -37,7 +37,7 @@ defaults:
 # The steps that need a raised Node heap on the GitHub runner, matched on their `run` text, and the least heap they must declare in NODE_OPTIONS.
 heap:
   minMiB: 6144
-  steps: ['npm run typecheck', 'npm run lint', 'app lint', 'app coverage verify', 'npm run db:lint']
+  steps: ['npm run typecheck', 'npm run lint', 'app check --gate lint', 'app coverage verify', 'npm run db:lint']
 
 items:
   - id: candidate-trigger
@@ -77,7 +77,7 @@ items:
     check: ci-standard
   - id: sonar-lint-per-side
     title: the Sonar lint runs per side
-    requires: "a lint with a Sonar import (--out) names its side (--side be|fe); the reports are merged into reports/lint.sonar.json afterwards; no combined lint with Sonar"
+    requires: "a lint with a Sonar import (`starci app check --gate lint --out`) names its side (--side be|fe); the reports are merged into reports/lint.sonar.json afterwards; no combined lint with Sonar"
     covers: [app-ci, runtime]
     check: ci-standard
   - id: test-sharding

package/runtime/knowledge/hfs/rules.yaml

@@ -21,9 +21,9 @@ version: 3.1.0
 gates:
   pre-commit: the managed L0 hook runs app check --staged, managed-file drift, ESLint per side and stylelint on staged source, and prettier on staged files; typecheck and targeted specs belong to the op gate under R225
   pre-push: the managed app hook invokes the bundled push policy under R225; it starts no source check, build or test
-  settle: the op gate `starci gate run` over the op's changed files (merge guard, starci app lint --changed, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
+  settle: the op gate `starci gate run` over the op's changed files (merge guard, starci app check, codegen, tsc, the slice's specs; only findings new against the workflow's previous checkpoint block), re-read at starci kernel settle, which refuses a red done; a green settle commits the op's checkpoint on wf-<workflowId>
   land: the workflow's finish, the only time main is touched - gate.mjs over the whole workflow branch against its merge-base with main, the merge guard, review.verify of the exact head that lands, the branch rebased onto main, then main fast-forwarded and pushed
-  ci: GitHub Actions runs the same pinned starci app lint, format:check, typecheck, unit with the per-file coverage threshold, build:be and build:fe, then the Sonar scan and gate
+  ci: GitHub Actions runs the same pinned starci app check --gate lint, format:check, typecheck, unit with the per-file coverage threshold, build:be and build:fe, then the Sonar scan and gate
   sonar: Sonar quality gate (knowledge/sonar-gate.yaml) - the imported lint findings, duplication, cognitive complexity and the coverage of the logic of be/src/modules at 100
   runtime: "`starci runtime check` (npm run check) of the StarCi runtime repository itself: scripts/checks/check-runtime.mjs runs node --check, scripts/hfs/runtime-check.mjs with knowledge/hfs/runtime-slots.yaml, and the retained self-checks"
 enforcerKinds:
@@ -229,7 +229,7 @@ rules:
     editions: [lite, full]
     docs: [docs/hfs-legacy-tooling.md#ci-and-hooks]
     code: "HFS_CI_MISSING_CANON"
-    law: "CI runs the pinned `starci app lint` (`npm run lint`), a clone never redirects `core.hooksPath` away from husky, and the folder a set `core.hooksPath` names holds the installed hooks in every checkout (husky's dispatcher in `.husky/_`), so no commit lands without the pre-commit gate."
+    law: "CI runs the pinned `starci app check --gate lint` (`npm run lint`), a clone never redirects `core.hooksPath` away from husky, and the folder a set `core.hooksPath` names holds the installed hooks in every checkout (husky's dispatcher in `.husky/_`), so no commit lands without the pre-commit gate."
     kinds: [check, codemod]
     gates: [land, ci]
     failureCodes: ["HFS_CI_MISSING_CANON", "HFS_HOOKS_PATH_REDIRECTED", "HFS_HOOKS_NOT_INSTALLED"]
@@ -2503,7 +2503,7 @@ rules:
       - {path: packages/hfs/src/legacy-monorepo-coverage.spec.mjs, edition: full, codes: [HFS_MONO_WORKSPACES]}
   - id: R144
     code: "HFS_MONO_FE_WORKSPACE"
-    law: "Every fe app `fe/apps/<app>` is an npm workspace: its `package.json` is named `@<project>/<app>`, is private, declares its own runtime dependencies and has exactly the scripts `build: next build`, `dev: next dev`, `lint: starci app lint --workspace .`, `start: next start` and `typecheck: tsc --noEmit`; every fe package `fe/packages/<pkg>` is private with `build`, `typecheck` and the same workspace `lint` script."
+    law: "Every fe app `fe/apps/<app>` is an npm workspace: its `package.json` is named `@<project>/<app>`, is private, declares its own runtime dependencies and has exactly the scripts `build: next build`, `dev: next dev`, `start: next start` and `typecheck: tsc --noEmit`; every fe package `fe/packages/<pkg>` is private with `build` and `typecheck`; no workspace has a `lint` script, the app is linted once from the root with `starci app check --gate lint`."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_MONO_FE_WORKSPACE"]

package/runtime/knowledge/hfs/slots.yaml

@@ -1037,7 +1037,7 @@ slots:
     rules: [HFS_MANAGED_FILE_DRIFT]
   - id: app.starcistacks.cache
     profiles: [app]
-    # The committed result cache of `starci app check` and `starci app lint` (ruling app-check-cache, contexts/project/check-cache.md): JSON Lines records keyed by
+    # The committed result cache of `starci app check` (ruling app-check-cache, contexts/project/check-cache.md): JSON Lines records keyed by
     # content, one folder per family. App-owned and written only by the CLI; sync never renders, overwrites or judges it. Both editions.
     path: ".starcistacks/cache/"
     presence: optional

package/runtime/knowledge/sonar-gate.yaml

@@ -40,11 +40,11 @@ newCode:
     metric: new_security_hotspots_reviewed
     minReviewedPercent: 100
     unreviewedMax: 0
-# The whole code, not only the new code. Every finding of the HFS canon reaches Sonar through ONE entry, `starci app lint`
+# The whole code, not only the new code. Every finding of the HFS canon reaches Sonar through ONE entry, `starci app check --gate lint --out`
 # (packages/hfs, contract changes hfs-sonar-import and hfs-lint-entry). CI runs it per side with --side and --out,
 # then merges rules by id and joins issues into ONE file, reports/lint.sonar.json, named by sonar.externalIssuesReportPaths; the gate holds the open-issue count of
 # the whole project at zero. The file carries three engines:
-#   starci-hfs   the repository findings of `starci app check` (managed files, tree, pins, CI, contracts; the rule id is the finding code)
+#   starci-hfs   the repository findings of the gates a run selects (managed files, tree, pins, CI, contracts; the rule id is the finding code)
 #   eslint       ESLint's json over the repository (the BE and FE canon plugins alike, per-file and project-graph rules)
 #   stylelint    stylelint's json over the style glob (front ends)
 # The engines share ONE placement rule (a finding on a file Sonar does not index is filed on the first source file); Sonar's own

package/runtime/modules/kernel/failure-codes.yaml

@@ -3305,11 +3305,11 @@ HFS_CANON_PIN_DRIFT:
   kind: check-finding
 
 HFS_CI_MISSING_CANON:
-  title: "CI runs the pinned `starci app lint`; pre-push runs typecheck and lint"
+  title: "CI runs the pinned `starci app check --gate lint`; pre-push runs typecheck and lint"
   title_vi: "CI thiếu bước canon"
   meaning_vi: "Workflow/husky thiếu bước `<step>`. Cấu trúc chỉ được kiểm khi agent chạy — CI phải tự kiểm."
   causes_vi:
-    - "Vi phạm luật R13: CI phải chạy `starci app lint`; pre-push phải có `typecheck` + `lint`."
+    - "Vi phạm luật R13: CI phải chạy `starci app check --gate lint`; pre-push phải có `typecheck` + `lint`."
   nextStep_vi: "Op vừa tạo ra bản này sẽ được chạy lại để sửa theo lời nhắn của bộ kiểm tra (nợ hàng loạt có codemod của HFS); không cần ai can thiệp thêm."
   owner: op-retry
   kind: check-finding
@@ -3698,7 +3698,7 @@ HFS_CHECK_CACHE_MISSING:
 HFS_FORMAT:
   title: "Prettier is the only formatter"
   title_vi: "Chưa format bằng Prettier"
-  meaning_vi: "`<file>` chưa được format. Chạy `starci app lint --fix`."
+  meaning_vi: "`<file>` chưa được format. Chạy `npm run format`."
   causes_vi:
     - "Vi phạm luật R19: Prettier (config `@starci/prettier-config`) là formatter duy nhất; ESLint không còn luật định dạng."
   nextStep_vi: "Op vừa tạo ra bản này sẽ được chạy lại để sửa theo lời nhắn của bộ kiểm tra (nợ hàng loạt có codemod của HFS); không cần ai can thiệp thêm."
@@ -3899,7 +3899,7 @@ HFS_MODULE_TIER_INVALID:
 HFS_MONO_FE_WORKSPACE:
   title: "An fe workspace manifest breaks the workspace shape"
   title_vi: "Manifest của một workspace fe sai hình dạng"
-  meaning_vi: "Mỗi app fe `fe/apps/<app>` là workspace `@<project>/<app>`, private, có đúng các script build, dev, lint (`starci app lint --workspace .`), start và typecheck; mỗi gói `fe/packages/<pkg>` là private và có build, typecheck cùng script lint của workspace."
+  meaning_vi: "Mỗi app fe `fe/apps/<app>` là workspace `@<project>/<app>`, private, có đúng các script build, dev, start và typecheck; mỗi gói `fe/packages/<pkg>` là private và có build, typecheck; workspace không có script lint, lint chạy một lần từ gốc bằng `starci app check --gate lint`."
   causes_vi:
     - "Vi phạm luật R144: turbo chạy các task theo script của từng workspace; tên, script hoặc cờ private sai khiến build, lint hoặc typecheck của app bị bỏ qua hoặc chạy khác chuẩn."
   nextStep_vi: "Op vừa tạo ra bản này sẽ được chạy lại để sửa theo lời nhắn của bộ kiểm tra: đặt tên `@<project>/<app>`, `\"private\": true` và đúng bộ script trong `package.json` của workspace đó."

package/runtime/scripts/api/node/run-node.d.mts

@@ -8,6 +8,11 @@ export interface HeavyNodeRequest {
     /** When supplied, this is the entire child environment, not an overlay. */
     readonly env?: NodeJS.ProcessEnv | undefined;
     readonly timeoutMs?: number | undefined;
+    /**
+     * The number of source files the child judges, when it is a whole-program lint of them. The CLI scales the liveness budget of the kind with it
+     * (ops/liveness.yaml heavy.timeoutMinutesPer1000Files): a larger side legitimately runs longer, and the budget still ends a hung child.
+     */
+    readonly files?: number | undefined;
     readonly maxBuffer: number;
 }
 /** Normal red exits are measurements; an interrupted child is not one. */

package/runtime/scripts/hfs/check.d.mts

@@ -1,5 +1,6 @@
-import { type SlotManifest } from './slots.mjs';
+import { type RepoView, type Resolver, type SlotManifest } from './slots.mjs';
 import { type Finding, type Summary, type Why } from './check-results.mjs';
+import { type FileRule } from './rule-memo.mjs';
 import type { Surface } from './architecture/index.mjs';
 export { REFUSAL_CODES } from './refusal-codes.mjs';
 export { checkDatabase } from './rules/database.mjs';
@@ -65,10 +66,24 @@ export interface RepositoryResult extends CheckResult {
     [key: string]: unknown;
 }
 type CheckManifest = SlotManifest;
+type CheckRepo = RepoView;
+type CheckResolver = Resolver;
 /** {code: {title, title_vi, meaning_vi, nextStep_vi}} for the codes asked for, read from the failure-code catalog under `root`. */
 export declare function readWhy(root?: string, codes?: readonly string[]): Record<string, Why>;
 /** Repository-relative tracked paths (git ls-files, posix separators; what the index holds, whatever the work tree shows). A directory that is not a Git work tree is a refusal. */
 export declare function trackedFiles(repoRoot: string): string[];
+/**
+ * The rules whose findings for a file depend on that file alone (and the files `deps` names), so the result cache keeps them per file by content hash
+ * (contexts/project/check-cache.md "Which step reuses what"): the plaintext secrets (R06 and the lite custody L17), the bypass markers (R303) and, in a side, the soft file size.
+ * Each rule's findings carry the path of the file they judge; `check-cache-structure-rules.spec.mts` proves that and the declared `deps` under a file-system recorder.
+ */
+export declare function perFileRules({ repoRoot, repo, resolver, inScope, isRoot }: {
+    repoRoot: string;
+    repo: CheckRepo;
+    resolver: CheckResolver;
+    inScope: (file: string) => boolean;
+    isRoot: boolean;
+}): FileRule[];
 /**
  * The check of one app. `repoRoot` is the app root (a side folder is checked as that side alone). `harness` ({ version }) is the CLI
  * that runs the check, whose version is the app's starci-harness pin (canon-pins.mjs). `declaration` overrides hfs.json

package/runtime/scripts/hfs/check.mjs

@@ -84,7 +84,8 @@ import { lintSuppressionFindings } from './rules/lint-suppression.mjs';
 import { bypassMarkerFindings } from './rules/bypass-markers.mjs';
 import { repoLocalCheckFindings } from './rules/repo-local-checks.mjs';
 import { liteSecretFindings } from './rules/lite-secrets.mjs';
-import { untrackedSecretFindings } from './rules/secrets.mjs';
+import { readmeManifestOf, untrackedSecretFindings } from './rules/secrets.mjs';
+import { memoFiles } from './rule-memo.mjs';
 import { liteStarciworkFinding, pathFindings } from './path-findings.mjs';
 import { onLintSurface } from './architecture/surface.mjs';
 import { checkAppRoot, trackedTreeView } from './architecture/hfs.mjs';
@@ -207,15 +208,26 @@ function minimumInstanceFindings(resolver, required, instances) {
     }
     return findings;
 }
-function contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, appSide, editionDeclaration, manifest, phase }) {
+/**
+ * The rules whose findings for a file depend on that file alone (and the files `deps` names), so the result cache keeps them per file by content hash
+ * (contexts/project/check-cache.md "Which step reuses what"): the plaintext secrets (R06 and the lite custody L17), the bypass markers (R303) and, in a side, the soft file size.
+ * Each rule's findings carry the path of the file they judge; `check-cache-structure-rules.spec.mts` proves that and the declared `deps` under a file-system recorder.
+ */
+export function perFileRules({ repoRoot, repo, resolver, inScope, isRoot }) {
+    return [
+        { id: 'secret', run: (list) => liteSecretFindings({ repoRoot, files: list.filter((file) => inScope(file)), resolver, repo }), deps: (file) => readmeManifestOf(file) ?? [] },
+        { id: 'bypass-marker', run: (list) => bypassMarkerFindings({ repoRoot, files: list.filter((file) => inScope(file)) }) },
+        ...(isRoot ? [] : [{ id: 'size-soft', run: (list) => sizeSoftFindings({ repoRoot, resolver, files: list, inScope }) }]),
+    ];
+}
+function contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, fileFindings, inScope, isRoot, appSide, editionDeclaration, manifest, phase }) {
     const findings = [
         ...pinFindings({ repoRoot, files, profile: repo.profile, pins, only: scoped }),
-        ...liteSecretFindings({ repoRoot, files: files.filter((file) => inScope(file)), resolver, repo }),
+        ...fileFindings,
         ...editionFindings({ repoRoot, files: files.filter((file) => inScope(file)), repo, resolver, manifest, withDeclaration: editionDeclaration }),
         ...feStackFindings({ repoRoot, files: files.filter((file) => inScope(file)), repo, manifest }),
         ...repoLocalCheckFindings({ repoRoot, files }),
         ...lintSuppressionFindings({ repoRoot, files }),
-        ...bypassMarkerFindings({ repoRoot, files: files.filter((file) => inScope(file)) }),
         ...a15Findings({ repoRoot, files, all, repo, resolver, manifest, isRoot, appSide, inScope }),
     ];
     findings.push(...trackedStacksGateFindings({ repoRoot, files, all, repo, resolver, manifest, isRoot, inScope, existingFindings: findings }));
@@ -262,9 +274,8 @@ function scopeFindings({ repoRoot, root, harness, repo, resolver, files, all = f
     if (repo.kind === RUNTIME_KIND)
         return findings;
     const pins = canonPins({ root, ...(harness ? { harness } : {}) });
-    findings.push(...contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, inScope, isRoot, appSide, editionDeclaration, manifest, phase }));
-    if (!isRoot)
-        findings.push(...sizeSoftFindings({ repoRoot, resolver, files, inScope }));
+    const fileFindings = memoFiles(repoRoot, files, perFileRules({ repoRoot, repo, resolver, inScope, isRoot }));
+    findings.push(...contentRuleFindings({ repoRoot, repo, resolver, files, all, scoped, pins, fileFindings, inScope, isRoot, appSide, editionDeclaration, manifest, phase }));
     return findings;
 }
 export function checkRepo({ repoRoot, root = skillRoot, harness, declaration, files, only, extraFindings = [], tree = files === undefined, manifest = loadSlotManifest({ root }), surface = 'all', phase = 'workspace' }) {

package/runtime/scripts/hfs/gate-threshold.mjs

@@ -1,4 +1,4 @@
-// gate-threshold.mjs - the verdict of `starci app check` and `starci app lint` (owner ruling gate-threshold-20, 2026-10-30): green
+// gate-threshold.mjs - the verdict of `starci app check` (owner ruling gate-threshold-20, 2026-10-30): green
 // while fewer than GATE_ERROR_LIMIT error findings remain and none of them is a hard blocker, so a release is not held back finding
 // by finding (5, 4, 3, ...) by the last few structural nits. A plaintext secret, a failed boot proof, a forged check cache record and a broken migration block at
 // any count. Every finding is still printed; only the exit code changes. Typecheck, build and the tests are not judged here.

package/runtime/scripts/hfs/rule-memo.d.mts

@@ -0,0 +1,30 @@
+import type { CheckFinding } from './check.mjs';
+/** A rule whose findings for one file depend on that file alone (and the files `deps` names), so the cache reuses them per file. */
+export interface FileRule {
+    /** Names the rule in its record and in the spec that proves its declaration. */
+    readonly id: string;
+    /** The findings over `files` (scope-relative tracked paths); every finding's `path` is one of `files`. */
+    run(files: string[]): CheckFinding[];
+    /** Other scope-relative files whose content the findings for `file` read. */
+    deps?(file: string): string[];
+}
+/** What the cache gives the rule runner. */
+export interface RuleMemo {
+    /** The findings of `rules` over the tracked `files` of the scope at `scopeRoot` (absolute), reusing what the cache holds per file. */
+    files(scopeRoot: string, files: readonly string[], rules: readonly FileRule[]): CheckFinding[];
+    /** The findings of the cross-file rule `id` of the scope at `scopeRoot`, reused while every file it read and the tracked path list are unchanged. */
+    keyed(scopeRoot: string, id: string, run: () => CheckFinding[]): CheckFinding[];
+    /**
+     * The value `compute` yields for `file` (scope-relative) of the scope at `scopeRoot`, reused while the file's bytes and `extra` (every other input the value
+     * depends on, as text) are unchanged. `compute` reads only that file; the value is plain JSON; `empty` is the value a file with nothing to say yields.
+     */
+    unit<T>(scopeRoot: string, id: string, file: string, extra: string, empty: T, compute: () => T): T;
+}
+/** Runs `run` with `memo` serving the per-file and cross-file rules of every checkRepo inside it. */
+export declare function withRuleMemo<T>(memo: RuleMemo, run: () => T): T;
+/** The findings of per-file `rules` over `files`, from the cache when one is installed. Rules run in order, each over the files it must judge. */
+export declare function memoFiles(scopeRoot: string, files: readonly string[], rules: readonly FileRule[]): CheckFinding[];
+/** The value of a per-file unit of a cross-file rule, from the cache when one is installed (see `RuleMemo.unit`). */
+export declare function memoUnit<T>(scopeRoot: string, id: string, file: string, extra: string, empty: T, compute: () => T): T;
+/** The findings of a cross-file rule, from the cache when one is installed. */
+export declare function memoKeyed(scopeRoot: string, id: string, run: () => CheckFinding[]): CheckFinding[];

package/runtime/scripts/hfs/rule-memo.mjs

@@ -0,0 +1,24 @@
+let active = null;
+/** Runs `run` with `memo` serving the per-file and cross-file rules of every checkRepo inside it. */
+export function withRuleMemo(memo, run) {
+    const before = active;
+    active = memo;
+    try {
+        return run();
+    }
+    finally {
+        active = before;
+    }
+}
+/** The findings of per-file `rules` over `files`, from the cache when one is installed. Rules run in order, each over the files it must judge. */
+export function memoFiles(scopeRoot, files, rules) {
+    return active ? active.files(scopeRoot, files, rules) : rules.flatMap((rule) => rule.run([...files]));
+}
+/** The value of a per-file unit of a cross-file rule, from the cache when one is installed (see `RuleMemo.unit`). */
+export function memoUnit(scopeRoot, id, file, extra, empty, compute) {
+    return active ? active.unit(scopeRoot, id, file, extra, empty, compute) : compute();
+}
+/** The findings of a cross-file rule, from the cache when one is installed. */
+export function memoKeyed(scopeRoot, id, run) {
+    return active ? active.keyed(scopeRoot, id, run) : run();
+}

package/runtime/scripts/hfs/rules/a15-findings.d.mts

@@ -14,5 +14,11 @@ import type { Parsed } from './rule-types.mjs';
 /** The failure codes the finders above emit, so `starci app check` ships their labels (check.mjs adds them to CHECK_CODES). Append-only; the coordinator regenerates it at merge time. */
 export declare const A15_CODES: string[];
 export declare const FINDERS: (typeof feBuildArgsFindings | typeof featureFileFindings | typeof assetsFindings | typeof unusedSymbolFindings | typeof databaseBaselineFindings | typeof databaseConfigFindings | typeof docFreshFindings | typeof releaseProvenanceFindings | typeof secretCustodyOnlyFindings | typeof scriptHygieneFindings | typeof supplyChainFindings | typeof liteProofLaneFindings)[];
+/**
+ * The finders the result cache keeps by the files they read: each reads the tracked tree only through `readText` / `readJson` (rules/read.mts) and the tracked
+ * path lists it is given, so its findings are a function of those. `check-cache-structure-rules.spec.mts` proves every member under a file-system recorder
+ * and fails on a read it does not go through the gateway. A finder that stats, lists or walks the work tree (stacks-release, the stacks gate) is not a member.
+ */
+export declare const KEYED_FINDERS: ReadonlySet<(context: Parsed) => Parsed>;
 /** Findings of every alpha.15 content rule over one repository. */
 export declare function a15Findings(context: Parsed): any[];

package/runtime/scripts/hfs/rules/a15-findings.mjs

@@ -38,6 +38,7 @@ import { ciCustodyFindings } from './ci-custody.mjs';
 import { workflowContextsFindings } from './workflow-contexts.mjs';
 import { ciStandardAppFindings } from './ci-standard.mjs';
 import { feBuildArgsFindings } from './fe-build-args.mjs';
+import { memoKeyed } from '../rule-memo.mjs';
 // finders-import-end
 /** The failure codes the finders above emit, so `starci app check` ships their labels (check.mjs adds them to CHECK_CODES). Append-only; the coordinator regenerates it at merge time. */
 export const A15_CODES = [
@@ -90,15 +91,23 @@ export const FINDERS = [
     ciCustodyFindings,
     // finders-end
 ];
+/**
+ * The finders the result cache keeps by the files they read: each reads the tracked tree only through `readText` / `readJson` (rules/read.mts) and the tracked
+ * path lists it is given, so its findings are a function of those. `check-cache-structure-rules.spec.mts` proves every member under a file-system recorder
+ * and fails on a read it does not go through the gateway. A finder that stats, lists or walks the work tree (stacks-release, the stacks gate) is not a member.
+ */
+export const KEYED_FINDERS = new Set([docFreshFindings, scriptHygieneFindings, databaseConfigFindings, feBuildArgsFindings]);
 /** Findings of every alpha.15 content rule over one repository. */
 export function a15Findings(context) {
     // `starci app check` always passes the full context; a partial one (a finder spec driving the registry with only the fields its rule reads) must not crash the finders of other rules.
     const full = Boolean(context.repoRoot && context.repo && context.resolver && context.manifest);
     return FINDERS.flatMap((finder) => {
+        const run = () => finder(context);
+        const once = KEYED_FINDERS.has(finder) && full ? () => memoKeyed(context.repoRoot, finder.name, run) : run;
         if (full)
-            return finder(context);
+            return once();
         try {
-            return finder(context);
+            return once();
         }
         catch {
             return [];

package/runtime/scripts/hfs/rules/ci-standard.mjs

@@ -149,7 +149,7 @@ function fullHistory(doc, say) {
     for (const [id, job] of jobsOf(doc)) {
         const steps = stepsOf(job);
         const base = steps.findIndex((step) => /STARCI_BASE_REF=.*>>\s*"?\$GITHUB_ENV"?/.test(runOf(step)));
-        const lint = steps.findIndex((step) => /\bnpm run lint\b|\bstarci app lint\b/.test(runOf(step)));
+        const lint = steps.findIndex((step) => /\bnpm run lint\b|\bapp check\b[^\n]*--gate[ =]lint\b/.test(runOf(step)));
         if (lint >= 0 && (base < 0 || base > lint))
             out.push(say('full-history-base-ref', `job ${id} must write STARCI_BASE_REF to GITHUB_ENV before its first lint step`));
     }
@@ -174,7 +174,7 @@ function sonarLintPerSide(doc, say) {
     for (const [id, job] of jobsOf(doc)) {
         for (const step of stepsOf(job)) {
             const run = runOf(step);
-            if (/\b(?:npm run lint|starci(?:\.mjs)?["']?\s+app lint|app lint)\b/.test(run) && /\s--out\b/.test(run) && !/\s--side\s+(?:be\b|fe\b|\$\{\{\s*matrix\.side\s*\}\})/.test(run)) {
+            if (/\b(?:npm run lint|app check)\b/.test(run) && /\s--out\b/.test(run) && !/\s--side\s+(?:be\b|fe\b|\$\{\{\s*matrix\.side\s*\}\})/.test(run)) {
                 out.push(say('sonar-lint-per-side', `job ${id}, step ${step.name ?? 'lint'}: a lint with a Sonar import must name its side (--side be|fe) and the reports are merged afterwards; a combined lint with Sonar breaks the standard`));
             }
         }

package/runtime/scripts/hfs/rules/monorepo.d.mts

@@ -1,9 +1,7 @@
 import type { Parsed, Repo } from './rule-types.mjs';
 /** The npm workspaces of every app, in this order. */
 export declare const WORKSPACES: readonly string[];
-/** The lint script of every fe workspace: the one lint of the app, scoped to the workspace. */
-export declare const WORKSPACE_LINT = "starci app lint --workspace .";
-/** The scripts of every fe app workspace, exactly: turbo runs build, dev, lint and typecheck; start serves a build. */
+/** The scripts of every fe app workspace, exactly: turbo runs build, dev and typecheck; start serves a build. The lint is the root's (`starci app check --gate lint`), never a workspace script. */
 export declare const FE_APP_SCRIPTS: Readonly<Record<string, string>>;
 /** The package manager every app root declares (turbo reads it to parse the lockfile); the starci app scaffold writes it. */
 export declare const PACKAGE_MANAGER = "npm@11.6.2";

package/runtime/scripts/hfs/rules/monorepo.mjs

@@ -22,12 +22,10 @@ const MONO_NEST_PROJECTS = 'HFS_MONO_NEST_PROJECTS';
 const MONO_WORKSPACE_DEP = 'HFS_MONO_WORKSPACE_DEP';
 /** The npm workspaces of every app, in this order. */
 export const WORKSPACES = Object.freeze(['fe/apps/*', 'fe/packages/*']);
-/** The lint script of every fe workspace: the one lint of the app, scoped to the workspace. */
-export const WORKSPACE_LINT = 'starci app lint --workspace .';
-/** The scripts of every fe app workspace, exactly: turbo runs build, dev, lint and typecheck; start serves a build. */
-export const FE_APP_SCRIPTS = Object.freeze({ build: 'next build', dev: 'next dev', lint: WORKSPACE_LINT, start: 'next start', typecheck: 'tsc --noEmit' });
-/** The scripts every fe package workspace has (its build and typecheck commands are its own; its lint is the workspace lint). */
-const FE_PACKAGE_SCRIPTS = Object.freeze(['build', 'typecheck', 'lint']);
+/** The scripts of every fe app workspace, exactly: turbo runs build, dev and typecheck; start serves a build. The lint is the root's (`starci app check --gate lint`), never a workspace script. */
+export const FE_APP_SCRIPTS = Object.freeze({ build: 'next build', dev: 'next dev', start: 'next start', typecheck: 'tsc --noEmit' });
+/** The scripts every fe package workspace has (its build and typecheck commands are its own); it has no lint script. */
+const FE_PACKAGE_SCRIPTS = Object.freeze(['build', 'typecheck']);
 /** The package manager every app root declares (turbo reads it to parse the lockfile); the starci app scaffold writes it. */
 export const PACKAGE_MANAGER = 'npm@11.6.2';
 /** The npm name of an fe app workspace. */
@@ -61,7 +59,7 @@ function rootFindings(repoRoot) {
     if (!PACKAGE_MANAGER_FORM.test(String(pkg.packageManager ?? '')))
         findings.push(found(MONO_WORKSPACES, MANIFEST, `${MANIFEST} declares packageManager ${JSON.stringify(pkg.packageManager ?? null)}; turbo needs \`npm@<exact version>\` there.`, { packageManager: pkg.packageManager ?? null }));
     if (typeof pkg.devDependencies?.turbo !== 'string')
-        findings.push(found(MONO_WORKSPACES, MANIFEST, `${MANIFEST} does not declare turbo in its devDependencies; the turbo task graph (turbo.json) runs build, dev, lint and typecheck over the fe workspaces.`, { missing: 'turbo' }));
+        findings.push(found(MONO_WORKSPACES, MANIFEST, `${MANIFEST} does not declare turbo in its devDependencies; the turbo task graph (turbo.json) runs build, dev and typecheck over the fe workspaces.`, { missing: 'turbo' }));
     return findings;
 }
 /** R144: the manifest of each fe workspace. */
@@ -73,16 +71,16 @@ function appWorkspaceScriptFindings(file, project, name, pkg, scripts) {
     const want = Object.keys(FE_APP_SCRIPTS).sort(byCodeUnit);
     const off = [...new Set([...want, ...Object.keys(scripts)])].sort(byCodeUnit).filter((key) => scripts[key] !== FE_APP_SCRIPTS[key]);
     if (off.length)
-        findings.push(found(MONO_FE_WORKSPACE, file, `${file} has scripts ${JSON.stringify(scripts)}; an fe app workspace has exactly ${JSON.stringify(FE_APP_SCRIPTS)} (turbo runs build, dev, lint and typecheck; differs at ${off.join(', ')}).`, { scripts: off }));
+        findings.push(found(MONO_FE_WORKSPACE, file, `${file} has scripts ${JSON.stringify(scripts)}; an fe app workspace has exactly ${JSON.stringify(FE_APP_SCRIPTS)} (turbo runs build, dev and typecheck; the lint is the root's, \`starci app check --gate lint\`; differs at ${off.join(', ')}).`, { scripts: off }));
     return findings;
 }
 function packageWorkspaceScriptFindings(file, scripts) {
     const findings = [];
     const missing = FE_PACKAGE_SCRIPTS.filter((key) => typeof scripts[key] !== 'string' || !scripts[key]);
     if (missing.length)
-        findings.push(found(MONO_FE_WORKSPACE, file, `${file} has no ${missing.join(', ')} script; an fe package workspace builds, type-checks and lints (turbo builds it before the apps that import it).`, { scripts: missing }));
-    else if (scripts.lint !== WORKSPACE_LINT)
-        findings.push(found(MONO_FE_WORKSPACE, file, `${file} lints with ${JSON.stringify(scripts.lint)}; a workspace lints with ${JSON.stringify(WORKSPACE_LINT)}, the one lint of the app scoped to it.`, { scripts: ['lint'] }));
+        findings.push(found(MONO_FE_WORKSPACE, file, `${file} has no ${missing.join(', ')} script; an fe package workspace builds and type-checks (turbo builds it before the apps that import it).`, { scripts: missing }));
+    if (scripts.lint !== undefined)
+        findings.push(found(MONO_FE_WORKSPACE, file, `${file} has a lint script; a workspace has none, the app is linted once from the root with \`starci app check --gate lint\`.`, { scripts: ['lint'] }));
     return findings;
 }
 function workspaceManifestFindings(repoRoot, project, workspaces) {