genesis-stack 1.1.6 → 1.2.1

package/README.md

@@ -56,10 +56,10 @@ own schema changes and preservation of existing data during adoption.
 
 ## Resource-estimate proposals
 
-JSKIT proposes Vibe64's optional `Resource estimates` section for its concrete
+JSKIT proposes a host's optional `Resource estimates` section for its concrete
 `app` output and Workspace setup. The startup, running and preparation values
 are initial planning estimates, not measured minima, reservations or memory
-limits. Vibe64 owns the grammar and a host owns admission, learned consumption
+limits. The consuming host owns the grammar, admission, learned consumption
 and owner settings; Genesis only materializes and transports the exact text.
 
 Node and Vue contribute adoption guidance without competing section proposals.
@@ -69,18 +69,42 @@ Projects with different output ids or commands must review the proposal during
 preparation. A project can omit estimates and use its host's generic starting
 policy. Neither the catalog nor the project stores host observations or limits.
 
-## Connected package default
-
-Node proposes Vibe64's opaque `Connected development` section containing only
-`- Default package type: \`npm\``. Vibe64 can inspect this default without treating
-it as a prepared development recipe. The project must add its real source-map,
-preparation and verification declarations before connected development can run;
-no repositories or commands are inferred from selecting Node. A project-owned
-section wins unchanged, including an explicit different default.
-
-For an existing current-format project whose selected Node catalog gains this
+## Connected package defaults
+
+Each package-ecosystem language piece proposes a host's opaque
+`Connected development` section containing only
+`- Default package type: \`<type>\``:
+
+| Piece | Default |
+| --- | --- |
+| `nodejs` | `npm` |
+| `php` | `composer` |
+| `python` | `pip` |
+| `ruby` | `bundler` |
+| `go` | `gomod` |
+| `rust` | `cargo` |
+| `java` | `maven` |
+| `kotlin` | `gradle` |
+| `csharp` | `nuget` |
+| `laravel` | `composer` |
+
+Laravel requires `php` and `nodejs`, so its proposal supersedes theirs; npm
+front-end repositories can still declare an explicit `npm` type per connection.
+`cpp` and `shell` propose no default: their connections use an explicit
+`custom` type with a project script. Selecting several unrelated languages
+leaves the section as a project decision: `genesis stack add` succeeds, reports
+`STACK_SECTION_AMBIGUOUS` with each proposal, and the project authors one
+section choosing its default.
+
+A host can inspect this default without treating it as a prepared development
+recipe; the consuming host owns the grammar. The project must add its real source-map, preparation and verification
+declarations before connected development can run; no repositories or commands
+are inferred from selecting a language. A project-owned section wins unchanged,
+including an explicit different default.
+
+For an existing current-format project whose selected catalog gains this
 proposal, Genesis reports `STACK_PROJECT_CONTRACTS_INCOMPLETE` if the project
 section is missing. Explicitly reconcile the already-selected Stack with
-`genesis stack add nodejs`, then review the materialized contract. Older project
+`genesis stack add <component>`, then review the materialized contract. Older project
 formats use the normal `genesis migrate` workflow. Catalog updates never install
 a hidden runtime default or rewrite an existing project section.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-stack",
-  "version": "1.1.6",
+  "version": "1.2.1",
   "description": "The optional curated technology Stack catalog for Genesis projects.",
   "type": "module",
   "repository": {

package/stacks/pieces/cpp.md

@@ -38,6 +38,19 @@ C and C++ translation-unit, header, callable, ownership, build, and test convent
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- This component has no package-ecosystem default and proposes no
+  `## Connected development` section. A connection it consumes should use an
+  explicit `custom` type with a project-defined script, for example a CMake
+  build that uses the connected source. When a project selects several
+  languages, its own complete `## Connected development` section chooses the
+  one default.
+- A proven custom treatment for CMake FetchContent: the project script
+  configures an untracked build tree with
+  `-DFETCHCONTENT_SOURCE_DIR_<UPPERNAME>=<source root>`, so `CMakeLists.txt`
+  stays unchanged, and verifies from `compile_commands.json` that the
+  dependency's sources come from the connected checkout rather than a
+  `_deps/*-src` download. The project owns the repository-to-dependency name
+  mapping.
 
 ## Adoption
 

package/stacks/pieces/csharp.md

@@ -28,6 +28,29 @@ C# namespace, public type, dependency, lifecycle, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed host-owned `## Connected development` section names `nuget` as
+  the default package type. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `nuget` treatment. Do not invent a
+  working recipe from the component name.
+- A proven NuGet treatment: Prepare writes an untracked, Git-excluded
+  `Directory.Build.targets` beside each consuming project that replaces the
+  connected `PackageReference` with a `ProjectReference` to the checkout's
+  project and moves the restore lock under `obj/`, so project files,
+  `nuget.config` and `packages.lock.json` stay unchanged and no shadow package
+  enters a NuGet cache. Do not restore in locked mode while connected. Verify
+  that `obj/project.assets.json` resolves each package as a project at its
+  source root.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  ASP.NET Core: call `UseForwardedHeaders` with the loopback addresses in
+  `KnownProxies`, and take the listen URL from `ASPNETCORE_URLS` or `--urls`.
+
+## Connected development
+
+- Default package type: `nuget`
 
 ## Deslop
 

package/stacks/pieces/go.md

@@ -28,6 +28,27 @@ Go package, exported callable, interface, concurrency, resource, and test conven
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed host-owned `## Connected development` section names `gomod` as
+  the default package type. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `gomod` treatment. Do not invent a
+  working recipe from the component name.
+- A proven Go modules treatment: Prepare writes an untracked, ignored `go.work`
+  at the module root with `use . <source root>...` (also ignore
+  `go.work.sum`). Workspace modules replace the required versions, so `go.mod`
+  and `go.sum` stay unchanged. Verify `go env GOWORK` and that
+  `go list -deps ./...` loads each connected module from its source root, then
+  `go build ./...`. Do not set `-mod=mod` or run `go work sync` while connected.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Take the listen address from an argument or environment variable rather than
+  hard-coding it.
+
+## Connected development
+
+- Default package type: `gomod`
 
 ## Deslop
 

package/stacks/pieces/java.md

@@ -28,6 +28,30 @@ Java package, public type, dependency, lifecycle, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed host-owned `## Connected development` section names `maven` as
+  the default package type. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `maven` treatment. Do not invent a
+  working recipe from the component name.
+- A proven Maven treatment (Maven 3.9.3+): Prepare installs each connected
+  checkout into an untracked project-local repository chained in front of the
+  user's, `mvn -f <source root> install -Dmaven.repo.local=<project
+  repository> -Dmaven.repo.local.tail=<user repository>`, and writes the same
+  two arguments to an ignored `.mvn/maven.config`, so ordinary `mvn` commands
+  resolve the connected build under unchanged coordinates and `pom.xml` stays
+  unchanged. Verify resolves the classpath through Maven and requires the jar
+  to match the checkout's freshly built one. Run Prepare again after editing
+  connected source.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Spring Boot: set `server.address`/`server.port` from the supplied values and
+  `server.forward-headers-strategy=framework`.
+
+## Connected development
+
+- Default package type: `maven`
 
 ## Deslop
 

package/stacks/pieces/jskit.md

@@ -44,6 +44,14 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Keep resource-load and field errors in context, but route transient
   user-command failures through JSKIT's shared non-layout-shifting action
   feedback/snackbar path.
+- When declared, `TEST_DB_NAME` is the exact disposable integration database and
+  `BROWSER_TEST_DB_NAME` is a separate reusable browser-fixture database whose
+  migration ledger survives routine runs. Never reset `DB_NAME`, share these
+  identities, or point a test runner's `DB_NAME` elsewhere to pass safety checks.
+  Routine browser-test startup reuses the isolated test schema, applies only
+  pending migrations and resets fixtures deterministically; it does not drop or
+  rebuild the database or run a production frontend build per check. Keep
+  fresh-schema migration checks separate.
 
 - When application integrations are requested or `integrations.json` exists,
   treat that file as the application-owned configuration used by both editor
@@ -86,15 +94,17 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Inspect existing setup and database preparation for both migration discovery
   and an app-owned idempotent seed. Never infer `db:prepare` from the selected
   component when the script or preparation file does not exist.
-- When authenticated Preview exists, preserve the app-owned Preview identity
-  command, selectors, protocol, environment names, runtime, and timeout in the
-  project's Outputs declaration. A host-saved identity name/value is not a
-  substitute for this application contract.
+- When the project declares an application-owned identity exchange for a host's
+  browser preview, preserve its command, selectors, protocol, environment names,
+  runtime and timeout in the project's existing section.
+  A host-saved identity name/value is not a substitute for this application
+  contract.
 - Treat generator descriptors, receipts, sync commands, legacy service
   locators, and retired tool manifests as migration evidence only. Translate
   live facts into current source/Stack and report remaining port work; do not
   add compatibility readers or claim adoption performed the port.
-- Review the Vibe64-owned Resource estimates proposal against the application's
+- Review the proposed `## Resource estimates` section (a host-owned opaque
+  section whose grammar belongs to the consuming host) against the application's
   actual Outputs target ids and Workspace setup. Its initial Node development
   estimates are planning hints, not measured requirements, hard memory limits,
   or a promise of available capacity. Keep startup/build and ready runtime

package/stacks/pieces/kotlin.md

@@ -28,6 +28,28 @@ Kotlin package, public callable, coroutine, nullability, build, and test convent
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed host-owned `## Connected development` section names `gradle` as
+  the default package type. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `gradle` treatment. Do not invent a
+  working recipe from the component name.
+- A proven Gradle treatment: Prepare writes an ignored init script, such as
+  `.development/connected.init.gradle.kts`, containing
+  `settingsEvaluated { includeBuild("<source root>") }`, and connected launches
+  pass `-I <init script>`; Gradle substitutes the matching `group:name` with
+  the included build from source, so no tracked settings or lockfiles change.
+  Verify resolves `runtimeClasspath` and requires each connected artifact to
+  come from an included build inside its source root.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Spring Boot: set `server.address`/`server.port` from the supplied values and
+  `server.forward-headers-strategy=framework`.
+
+## Connected development
+
+- Default package type: `gradle`
 
 ## Deslop
 

package/stacks/pieces/laravel-mysql.md

@@ -51,9 +51,10 @@ Laravel MySQL connection, migration, Eloquent, and database environment conventi
 
 ## Guidance
 
-- Use Laravel's application-owned migrations and seeders. Add the exact
-  `php artisan migrate` or production `php artisan migrate --force` operation
-  to the applicable project contract only when that consumer owns executing it.
+- Use Laravel's application-owned migrations and seeders. The laravel piece's
+  proposed setup runs `php artisan migrate`; production deployment runs
+  `php artisan migrate --force` in its migration step. Never use routine
+  `migrate:fresh`.
 - Keep the project Resource contract aligned with `config/database.php` if the
   application deliberately changes Laravel's conventional environment names.
 

package/stacks/pieces/laravel-postgresql.md

@@ -51,9 +51,10 @@ Laravel PostgreSQL connection, migration, Eloquent, and database environment con
 
 ## Guidance
 
-- Use Laravel's application-owned migrations and seeders. Add the exact
-  `php artisan migrate` or production `php artisan migrate --force` operation
-  to the applicable project contract only when that consumer owns executing it.
+- Use Laravel's application-owned migrations and seeders. The laravel piece's
+  proposed setup runs `php artisan migrate`; production deployment runs
+  `php artisan migrate --force` in its migration step. Never use routine
+  `migrate:fresh`.
 - Keep the project Resource contract aligned with `config/database.php` if the
   application deliberately changes Laravel's conventional environment names.
 

package/stacks/pieces/laravel-sqlite.md

@@ -42,11 +42,14 @@ Laravel SQLite connection, migration, and database filename conventions.
   with any application-specific names. Laravel expects an absolute filename;
   preserve a host-supplied value. For standalone setup, create the selected file
   only if absent and configure its absolute path before migration.
-- Verify the selected PHP runtime includes `pdo_sqlite`. Use the application's
-  migrations and seeders, and declare their exact commands in the project setup
-  and deployment contracts. Repeated setup must preserve records, the migration
-  ledger, and the existing application key; do not use `migrate:fresh` or
-  regenerate keys as routine preparation.
+- Verify the selected PHP runtime includes `pdo_sqlite`. Use Laravel's
+  application-owned migrations and seeders. The laravel piece's proposed setup
+  runs `php artisan migrate`; production deployment runs
+  `php artisan migrate --force` in its migration step. Never use routine
+  `migrate:fresh`. `migrate --no-interaction` creates a missing SQLite file at
+  the configured absolute path. Repeated setup must preserve records, the
+  migration ledger, and the application key supplied through the environment
+  (see laravel); do not regenerate keys as routine preparation.
 - Consult the installed Laravel version's SQLite configuration documentation at
   `https://laravel.com/docs/database#sqlite-configuration`.
 

package/stacks/pieces/laravel.md

@@ -20,6 +20,27 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
   values and secrets outside Git.
 - Use Laravel's built-in `/up` health route unless the application deliberately
   changes it and updates its project Outputs contract.
+- `APP_KEY` is required. Generate it once with
+  `php artisan key:generate --show` and supply it through the environment
+  facility as a secret. Never commit it, and never run `key:generate` without
+  `--show` against a generated or shared environment file. Rotating it
+  invalidates sessions and encrypted data.
+- The proposed Workspace setup runs `php artisan migrate --force` after Composer
+  installation. Setup never uses `migrate:fresh`; development sets
+  `APP_ENV=local`.
+- A production deployment runs, in order:
+  `composer install --no-dev --optimize-autoloader --no-interaction`,
+  `npm ci` and `npm run build`, optionally `php artisan config:cache` and
+  `php artisan route:cache`, then `php artisan migrate --force`, then serves the
+  application on the listen address the host supplies. Readiness is `/up`;
+  `vendor` and `node_modules` are recreated rather than restored.
+- Behind a local reverse proxy, trust only its loopback address (Laravel 11+:
+  `$middleware->trustProxies(at: ['127.0.0.1', '::1'])` in
+  `bootstrap/app.php`; older versions: `TrustProxies::$proxies`) so `url()`,
+  `asset()` and redirects use the forwarded scheme, host and port. Set
+  `APP_URL` for console-generated URLs. A stale `public/hot` makes `@vite`
+  point at a stopped development server: delete it when `npm run dev` is not
+  running.
 
 - When application integrations are requested or `integrations.json` exists,
   read the application-owned file and the selected provider's supplied static
@@ -46,6 +67,22 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
   never accept an administrator flag from JSON. Keep commands usable from an
   ordinary CLI outside the editor. Verify with native tests and controlled
   provider fixtures; no Node or JSKIT runtime is required for integrations.
+- The proposed host-owned `## Connected development` section names `composer` as
+  the default package type; because Laravel requires `php` and
+  `nodejs`, it supersedes their proposals. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An npm front-end repository can
+  set an explicit `npm` type for its connection, and an explicit `custom`
+  connection uses its project-defined script. Do not invent a working recipe
+  from the component name.
+- A proven Composer treatment: Prepare writes an untracked derived manifest,
+  such as `composer.connected.json`, that adds a first `path` repository
+  (`symlink: true`, locked version pinned) for each connected source, copies
+  `composer.lock` to the matching derived lock and runs
+  `COMPOSER=<derived manifest> composer update <connected packages>`. The
+  tracked `composer.json` and `composer.lock` stay unchanged. Verify checks
+  `InstalledVersions::getInstallPath()` against each source root.
 
 ## Adoption
 
@@ -65,6 +102,7 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
 ## Workspace setup
 
 - Prepare `Install PHP dependencies` with `php` when `composer.json` exists: `composer` `install` `--no-interaction`
+- Prepare `Migrate database` with `php` when `artisan` exists: `php` `artisan` `migrate` `--force` `--no-interaction`
 - Prepare `Install frontend dependencies` with `nodejs` when `package.json` exists: `npm` `install`
 - Prepare `Build frontend assets` with `nodejs` when `package.json` exists: `npm` `run` `build`
 
@@ -88,6 +126,10 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
 
 - Verify `application`: `php` `artisan` `test`
 
+## Connected development
+
+- Default package type: `composer`
+
 ## Deslop
 
 - Preserve Laravel's container, providers, middleware, policies, requests,

package/stacks/pieces/nodejs.md

@@ -28,16 +28,25 @@ Node.js package, command, module, dependency, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-
-## Adoption
-
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `npm`. It does not declare repositories or executable
+- The proposed host-owned `## Connected development` section names `npm` as
+  the default package type. It does not declare repositories or executable
   preparation. When connected development is needed, preserve that default in
   the complete project-owned section and declare the application's real source
   map, preparation and verification commands. An explicit `custom` connection
   uses its project-defined script instead of npm treatment. Do not invent a
   working recipe from the component name.
+- A proven npm treatment: Prepare runs
+  `npm install --no-save --install-links=false <source root>...` for the
+  connected dependencies, which links each checkout into `node_modules` while
+  `package.json` and `package-lock.json` stay unchanged; Verify resolves each
+  package from the application root and fails unless it resolves to its
+  connected source root. An ordinary `npm ci` restores the published packages.
+- Long-running web processes accept their listen host and port from arguments
+  or the environment rather than hard-coding them, and fail if the port is
+  taken instead of silently choosing another.
+
+## Adoption
+
 - Identify the package manager from the lockfile and preserve the existing
   module system, supported Node.js version, package entrypoints, and executable
   commands.
@@ -58,7 +67,8 @@ Node.js package, command, module, dependency, and test conventions.
   `npm test`, or `npm start` exists merely because a current foundation uses it.
 - Identify every long-running process, its workdir, host/port handling,
   readiness signal, and shutdown ownership before declaring Outputs.
-- For Vibe64's optional Resource estimates, distinguish dependency preparation,
+- For a host's optional `## Resource estimates` section (an opaque section
+  whose grammar belongs to that host), distinguish dependency preparation,
   startup/build, and the ready runtime of each real declared output. For an
   unmeasured Node web development target, initial planning candidates are
   startup 1024 MiB typical / 1536 MiB high and running 768 MiB typical / 1536 MiB

package/stacks/pieces/php.md

@@ -28,6 +28,27 @@ PHP package, namespace, callable, dependency, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed host-owned `## Connected development` section names `composer` as
+  the default package type. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `composer` treatment. Do not invent
+  a working recipe from the component name.
+- A proven Composer treatment: Prepare writes an untracked derived manifest,
+  such as `composer.connected.json`, that adds a first `path` repository
+  (`symlink: true`, locked version pinned) for each connected source, copies
+  `composer.lock` to the matching derived lock and runs
+  `COMPOSER=<derived manifest> composer update <connected packages>`. The
+  tracked `composer.json` and `composer.lock` stay unchanged. Verify checks
+  `InstalledVersions::getInstallPath()` against each source root.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment. The
+  built-in server is `php -S <host>:<port> -t public` for development only.
+
+## Connected development
+
+- Default package type: `composer`
 
 ## Deslop
 

package/stacks/pieces/python.md

@@ -28,6 +28,31 @@ Python package, module, callable, dependency, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed host-owned `## Connected development` section names `pip` as
+  the default package type. It does not declare repositories or executable
+  preparation. When connected development is needed, preserve that default in
+  the complete project-owned section and declare the application's real Sources
+  file and Prepare/Verify commands. An explicit `custom` connection uses its
+  project-defined script instead of `pip` treatment. Do not invent a working
+  recipe from the component name.
+- A proven pip treatment: install into an untracked virtual environment in one
+  resolution, `pip install -r <requirements> -e <source root>...` (or uv's
+  `uv pip install --python .venv/bin/python ...`), so each editable checkout
+  satisfies the application's own requirement. Verify that each package's
+  PEP 610 `direct_url.json` is editable with the source root's `file:` URL and
+  that its modules import from there. Do not use `uv sync`, which needs tracked
+  `[tool.uv.sources]` and lockfile changes.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Django: set `ALLOWED_HOSTS` and `CSRF_TRUSTED_ORIGINS` for the served origin
+  (`ALLOWED_HOSTS` also lists the loopback host the proxy connects to),
+  `SECURE_PROXY_SSL_HEADER` and `USE_X_FORWARDED_HOST` only behind that trusted
+  proxy, and read `SECRET_KEY` from the environment. Flask uses Werkzeug's
+  `ProxyFix`; Uvicorn uses `--proxy-headers --forwarded-allow-ips 127.0.0.1`.
+
+## Connected development
+
+- Default package type: `pip`
 
 ## Deslop
 

package/stacks/pieces/ruby.md

@@ -28,6 +28,31 @@ Ruby module, class, callable, dependency, lifecycle, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed host-owned `## Connected development` section names `bundler` as
+  the default package type. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `bundler` treatment. Do not invent
+  a working recipe from the component name.
+- A proven Bundler treatment: Prepare writes an untracked `Gemfile.connected`
+  that switches each connected gem to `path: <source root>` and then
+  `eval_gemfile`s the tracked Gemfile, seeds `Gemfile.connected.lock` from
+  `Gemfile.lock`, and selects it with `bundle config set --local gemfile
+  Gemfile.connected`. The tracked `Gemfile` and `Gemfile.lock` stay unchanged.
+  Launch through `bundle exec` or export `BUNDLE_GEMFILE`: a plain
+  `require "bundler/setup"` launch ignores that setting. `local.<gem>` covers
+  only git sources. Verify that each spec loads from its source root.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Rails: allow the served host and the proxy's loopback host in `config.hosts`
+  (Rails honours `X-Forwarded-Host`), read `SECRET_KEY_BASE` from the
+  environment (generate it with `bin/rails secret`), and use
+  `bin/rails db:prepare` for setup.
+
+## Connected development
+
+- Default package type: `bundler`
 
 ## Deslop
 

package/stacks/pieces/rust.md

@@ -28,6 +28,28 @@ Rust module, public item, ownership, error, async, Cargo, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- The proposed host-owned `## Connected development` section names `cargo` as
+  the default package type. It does not declare repositories or
+  executable preparation. When connected development is needed, preserve that
+  default in the complete project-owned section and declare the application's
+  real Sources file and Prepare/Verify commands. An explicit `custom` connection
+  uses its project-defined script instead of `cargo` treatment. Do not invent a
+  working recipe from the component name.
+- A proven Cargo treatment: Prepare writes an untracked, ignored
+  `.cargo/config.toml` with `[patch.crates-io]` (or `[patch."<git url>"]`)
+  `<crate> = { path = "<source root>" }` and `resolver.lockfile-path` pointing
+  at an untracked copy of `Cargo.lock`; a patch otherwise rewrites the tracked
+  lockfile. This requires Cargo 1.97 or later. Verify with
+  `cargo metadata --locked` that each crate resolves from its source root with
+  no registry source, then `cargo build --locked`.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Take the listen address from an argument or environment variable rather than
+  hard-coding it.
+
+## Connected development
+
+- Default package type: `cargo`
 
 ## Deslop
 

package/stacks/pieces/shell.md

@@ -28,6 +28,11 @@ Shell script function, process, environment, portability, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
+- This component has no package-ecosystem default and proposes no
+  `## Connected development` section. A connection it consumes should use an
+  explicit `custom` type with a project-defined script. When a project selects
+  several languages, its own complete `## Connected development` section
+  chooses the one default.
 
 ## Deslop
 

package/stacks/pieces/vue.md

@@ -29,6 +29,12 @@ conventions. Authoritative framework documentation: https://vuejs.org/
   the subject and verifies webhooks. A successful browser redirect is not proof
   of payment. Preserve drafts, focus, pending/error states and selected accounts
   across responsive changes; use the project's established resource composables.
+- Start the Vite development server on the supplied address with
+  `--host <host> --port <port> --strictPort`. Behind a proxy that rewrites Host
+  to loopback, keep Vite's default `allowedHosts` and HMR client settings; the
+  HMR client connects through the page's own origin. Do not set
+  `allowedHosts: true` or hard-code `server.hmr.host`, `clientPort` or `origin`
+  unless that proxy requires it.
 
 ### Reactive state hydration
 
@@ -48,5 +54,5 @@ conventions. Authoritative framework documentation: https://vuejs.org/
   working host-managed browser contract during adoption.
 - Attribute a Vue build/dev server's memory to its actual Node output target.
   Vue selection does not create a second service or another memory charge.
-  Review any Vibe64 Resource estimates in the project's existing complete
+  Review any host-owned Resource estimates in the project's existing complete
   section; this piece does not propose a competing section alongside a framework.