genesis-stack 1.2.0 → 1.2.1

package/README.md

@@ -56,10 +56,10 @@ own schema changes and preservation of existing data during adoption.
 
 ## Resource-estimate proposals
 
-JSKIT proposes Vibe64's optional `Resource estimates` section for its concrete
+JSKIT proposes a host's optional `Resource estimates` section for its concrete
 `app` output and Workspace setup. The startup, running and preparation values
 are initial planning estimates, not measured minima, reservations or memory
-limits. Vibe64 owns the grammar and a host owns admission, learned consumption
+limits. The consuming host owns the grammar, admission, learned consumption
 and owner settings; Genesis only materializes and transports the exact text.
 
 Node and Vue contribute adoption guidance without competing section proposals.
@@ -71,7 +71,7 @@ policy. Neither the catalog nor the project stores host observations or limits.
 
 ## Connected package defaults
 
-Each package-ecosystem language piece proposes Vibe64's opaque
+Each package-ecosystem language piece proposes a host's opaque
 `Connected development` section containing only
 `- Default package type: \`<type>\``:
 
@@ -96,8 +96,8 @@ leaves the section as a project decision: `genesis stack add` succeeds, reports
 `STACK_SECTION_AMBIGUOUS` with each proposal, and the project authors one
 section choosing its default.
 
-Vibe64 can inspect this default without treating it as a prepared development
-recipe. The project must add its real source-map, preparation and verification
+A host can inspect this default without treating it as a prepared development
+recipe; the consuming host owns the grammar. The project must add its real source-map, preparation and verification
 declarations before connected development can run; no repositories or commands
 are inferred from selecting a language. A project-owned section wins unchanged,
 including an explicit different default.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "genesis-stack",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "The optional curated technology Stack catalog for Genesis projects.",
   "type": "module",
   "repository": {

package/stacks/pieces/csharp.md

@@ -28,8 +28,8 @@ C# namespace, public type, dependency, lifecycle, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `nuget`. It does not declare repositories or
+- The proposed host-owned `## Connected development` section names `nuget` as
+  the default package type. It does not declare repositories or
   executable preparation. When connected development is needed, preserve that
   default in the complete project-owned section and declare the application's
   real Sources file and Prepare/Verify commands. An explicit `custom` connection
@@ -43,6 +43,10 @@ C# namespace, public type, dependency, lifecycle, and test conventions.
   enters a NuGet cache. Do not restore in locked mode while connected. Verify
   that `obj/project.assets.json` resolves each package as a project at its
   source root.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  ASP.NET Core: call `UseForwardedHeaders` with the loopback addresses in
+  `KnownProxies`, and take the listen URL from `ASPNETCORE_URLS` or `--urls`.
 
 ## Connected development
 

package/stacks/pieces/go.md

@@ -28,8 +28,8 @@ Go package, exported callable, interface, concurrency, resource, and test conven
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `gomod`. It does not declare repositories or
+- The proposed host-owned `## Connected development` section names `gomod` as
+  the default package type. It does not declare repositories or
   executable preparation. When connected development is needed, preserve that
   default in the complete project-owned section and declare the application's
   real Sources file and Prepare/Verify commands. An explicit `custom` connection
@@ -41,6 +41,10 @@ Go package, exported callable, interface, concurrency, resource, and test conven
   and `go.sum` stay unchanged. Verify `go env GOWORK` and that
   `go list -deps ./...` loads each connected module from its source root, then
   `go build ./...`. Do not set `-mod=mod` or run `go work sync` while connected.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Take the listen address from an argument or environment variable rather than
+  hard-coding it.
 
 ## Connected development
 

package/stacks/pieces/java.md

@@ -28,8 +28,8 @@ Java package, public type, dependency, lifecycle, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `maven`. It does not declare repositories or
+- The proposed host-owned `## Connected development` section names `maven` as
+  the default package type. It does not declare repositories or
   executable preparation. When connected development is needed, preserve that
   default in the complete project-owned section and declare the application's
   real Sources file and Prepare/Verify commands. An explicit `custom` connection
@@ -44,6 +44,10 @@ Java package, public type, dependency, lifecycle, and test conventions.
   unchanged. Verify resolves the classpath through Maven and requires the jar
   to match the checkout's freshly built one. Run Prepare again after editing
   connected source.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Spring Boot: set `server.address`/`server.port` from the supplied values and
+  `server.forward-headers-strategy=framework`.
 
 ## Connected development
 

package/stacks/pieces/jskit.md

@@ -44,6 +44,14 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Keep resource-load and field errors in context, but route transient
   user-command failures through JSKIT's shared non-layout-shifting action
   feedback/snackbar path.
+- When declared, `TEST_DB_NAME` is the exact disposable integration database and
+  `BROWSER_TEST_DB_NAME` is a separate reusable browser-fixture database whose
+  migration ledger survives routine runs. Never reset `DB_NAME`, share these
+  identities, or point a test runner's `DB_NAME` elsewhere to pass safety checks.
+  Routine browser-test startup reuses the isolated test schema, applies only
+  pending migrations and resets fixtures deterministically; it does not drop or
+  rebuild the database or run a production frontend build per check. Keep
+  fresh-schema migration checks separate.
 
 - When application integrations are requested or `integrations.json` exists,
   treat that file as the application-owned configuration used by both editor
@@ -86,15 +94,17 @@ https://mobily-enterprises.github.io/jskit-ai/
 - Inspect existing setup and database preparation for both migration discovery
   and an app-owned idempotent seed. Never infer `db:prepare` from the selected
   component when the script or preparation file does not exist.
-- When authenticated Preview exists, preserve the app-owned Preview identity
-  command, selectors, protocol, environment names, runtime, and timeout in the
-  project's Outputs declaration. A host-saved identity name/value is not a
-  substitute for this application contract.
+- When the project declares an application-owned identity exchange for a host's
+  browser preview, preserve its command, selectors, protocol, environment names,
+  runtime and timeout in the project's existing section.
+  A host-saved identity name/value is not a substitute for this application
+  contract.
 - Treat generator descriptors, receipts, sync commands, legacy service
   locators, and retired tool manifests as migration evidence only. Translate
   live facts into current source/Stack and report remaining port work; do not
   add compatibility readers or claim adoption performed the port.
-- Review the Vibe64-owned Resource estimates proposal against the application's
+- Review the proposed `## Resource estimates` section (a host-owned opaque
+  section whose grammar belongs to the consuming host) against the application's
   actual Outputs target ids and Workspace setup. Its initial Node development
   estimates are planning hints, not measured requirements, hard memory limits,
   or a promise of available capacity. Keep startup/build and ready runtime

package/stacks/pieces/kotlin.md

@@ -28,8 +28,8 @@ Kotlin package, public callable, coroutine, nullability, build, and test convent
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `gradle`. It does not declare repositories or
+- The proposed host-owned `## Connected development` section names `gradle` as
+  the default package type. It does not declare repositories or
   executable preparation. When connected development is needed, preserve that
   default in the complete project-owned section and declare the application's
   real Sources file and Prepare/Verify commands. An explicit `custom` connection
@@ -42,6 +42,10 @@ Kotlin package, public callable, coroutine, nullability, build, and test convent
   the included build from source, so no tracked settings or lockfiles change.
   Verify resolves `runtimeClasspath` and requires each connected artifact to
   come from an included build inside its source root.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Spring Boot: set `server.address`/`server.port` from the supplied values and
+  `server.forward-headers-strategy=framework`.
 
 ## Connected development
 

package/stacks/pieces/laravel-mysql.md

@@ -51,9 +51,10 @@ Laravel MySQL connection, migration, Eloquent, and database environment conventi
 
 ## Guidance
 
-- Use Laravel's application-owned migrations and seeders. Add the exact
-  `php artisan migrate` or production `php artisan migrate --force` operation
-  to the applicable project contract only when that consumer owns executing it.
+- Use Laravel's application-owned migrations and seeders. The laravel piece's
+  proposed setup runs `php artisan migrate`; production deployment runs
+  `php artisan migrate --force` in its migration step. Never use routine
+  `migrate:fresh`.
 - Keep the project Resource contract aligned with `config/database.php` if the
   application deliberately changes Laravel's conventional environment names.
 

package/stacks/pieces/laravel-postgresql.md

@@ -51,9 +51,10 @@ Laravel PostgreSQL connection, migration, Eloquent, and database environment con
 
 ## Guidance
 
-- Use Laravel's application-owned migrations and seeders. Add the exact
-  `php artisan migrate` or production `php artisan migrate --force` operation
-  to the applicable project contract only when that consumer owns executing it.
+- Use Laravel's application-owned migrations and seeders. The laravel piece's
+  proposed setup runs `php artisan migrate`; production deployment runs
+  `php artisan migrate --force` in its migration step. Never use routine
+  `migrate:fresh`.
 - Keep the project Resource contract aligned with `config/database.php` if the
   application deliberately changes Laravel's conventional environment names.
 

package/stacks/pieces/laravel-sqlite.md

@@ -42,11 +42,14 @@ Laravel SQLite connection, migration, and database filename conventions.
   with any application-specific names. Laravel expects an absolute filename;
   preserve a host-supplied value. For standalone setup, create the selected file
   only if absent and configure its absolute path before migration.
-- Verify the selected PHP runtime includes `pdo_sqlite`. Use the application's
-  migrations and seeders, and declare their exact commands in the project setup
-  and deployment contracts. Repeated setup must preserve records, the migration
-  ledger, and the existing application key; do not use `migrate:fresh` or
-  regenerate keys as routine preparation.
+- Verify the selected PHP runtime includes `pdo_sqlite`. Use Laravel's
+  application-owned migrations and seeders. The laravel piece's proposed setup
+  runs `php artisan migrate`; production deployment runs
+  `php artisan migrate --force` in its migration step. Never use routine
+  `migrate:fresh`. `migrate --no-interaction` creates a missing SQLite file at
+  the configured absolute path. Repeated setup must preserve records, the
+  migration ledger, and the application key supplied through the environment
+  (see laravel); do not regenerate keys as routine preparation.
 - Consult the installed Laravel version's SQLite configuration documentation at
   `https://laravel.com/docs/database#sqlite-configuration`.
 

package/stacks/pieces/laravel.md

@@ -20,6 +20,27 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
   values and secrets outside Git.
 - Use Laravel's built-in `/up` health route unless the application deliberately
   changes it and updates its project Outputs contract.
+- `APP_KEY` is required. Generate it once with
+  `php artisan key:generate --show` and supply it through the environment
+  facility as a secret. Never commit it, and never run `key:generate` without
+  `--show` against a generated or shared environment file. Rotating it
+  invalidates sessions and encrypted data.
+- The proposed Workspace setup runs `php artisan migrate --force` after Composer
+  installation. Setup never uses `migrate:fresh`; development sets
+  `APP_ENV=local`.
+- A production deployment runs, in order:
+  `composer install --no-dev --optimize-autoloader --no-interaction`,
+  `npm ci` and `npm run build`, optionally `php artisan config:cache` and
+  `php artisan route:cache`, then `php artisan migrate --force`, then serves the
+  application on the listen address the host supplies. Readiness is `/up`;
+  `vendor` and `node_modules` are recreated rather than restored.
+- Behind a local reverse proxy, trust only its loopback address (Laravel 11+:
+  `$middleware->trustProxies(at: ['127.0.0.1', '::1'])` in
+  `bootstrap/app.php`; older versions: `TrustProxies::$proxies`) so `url()`,
+  `asset()` and redirects use the forwarded scheme, host and port. Set
+  `APP_URL` for console-generated URLs. A stale `public/hot` makes `@vite`
+  point at a stopped development server: delete it when `npm run dev` is not
+  running.
 
 - When application integrations are requested or `integrations.json` exists,
   read the application-owned file and the selected provider's supplied static
@@ -46,8 +67,8 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
   never accept an administrator flag from JSON. Keep commands usable from an
   ordinary CLI outside the editor. Verify with native tests and controlled
   provider fixtures; no Node or JSKIT runtime is required for integrations.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `composer`; because Laravel requires `php` and
+- The proposed host-owned `## Connected development` section names `composer` as
+  the default package type; because Laravel requires `php` and
   `nodejs`, it supersedes their proposals. It does not declare repositories or
   executable preparation. When connected development is needed, preserve that
   default in the complete project-owned section and declare the application's
@@ -81,6 +102,7 @@ conventions. Authoritative framework documentation: https://laravel.com/docs/
 ## Workspace setup
 
 - Prepare `Install PHP dependencies` with `php` when `composer.json` exists: `composer` `install` `--no-interaction`
+- Prepare `Migrate database` with `php` when `artisan` exists: `php` `artisan` `migrate` `--force` `--no-interaction`
 - Prepare `Install frontend dependencies` with `nodejs` when `package.json` exists: `npm` `install`
 - Prepare `Build frontend assets` with `nodejs` when `package.json` exists: `npm` `run` `build`
 

package/stacks/pieces/nodejs.md

@@ -28,8 +28,8 @@ Node.js package, command, module, dependency, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `npm`. It does not declare repositories or executable
+- The proposed host-owned `## Connected development` section names `npm` as
+  the default package type. It does not declare repositories or executable
   preparation. When connected development is needed, preserve that default in
   the complete project-owned section and declare the application's real source
   map, preparation and verification commands. An explicit `custom` connection
@@ -41,6 +41,9 @@ Node.js package, command, module, dependency, and test conventions.
   `package.json` and `package-lock.json` stay unchanged; Verify resolves each
   package from the application root and fails unless it resolves to its
   connected source root. An ordinary `npm ci` restores the published packages.
+- Long-running web processes accept their listen host and port from arguments
+  or the environment rather than hard-coding them, and fail if the port is
+  taken instead of silently choosing another.
 
 ## Adoption
 
@@ -64,7 +67,8 @@ Node.js package, command, module, dependency, and test conventions.
   `npm test`, or `npm start` exists merely because a current foundation uses it.
 - Identify every long-running process, its workdir, host/port handling,
   readiness signal, and shutdown ownership before declaring Outputs.
-- For Vibe64's optional Resource estimates, distinguish dependency preparation,
+- For a host's optional `## Resource estimates` section (an opaque section
+  whose grammar belongs to that host), distinguish dependency preparation,
   startup/build, and the ready runtime of each real declared output. For an
   unmeasured Node web development target, initial planning candidates are
   startup 1024 MiB typical / 1536 MiB high and running 768 MiB typical / 1536 MiB

package/stacks/pieces/php.md

@@ -28,8 +28,8 @@ PHP package, namespace, callable, dependency, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `composer`. It does not declare repositories or
+- The proposed host-owned `## Connected development` section names `composer` as
+  the default package type. It does not declare repositories or
   executable preparation. When connected development is needed, preserve that
   default in the complete project-owned section and declare the application's
   real Sources file and Prepare/Verify commands. An explicit `custom` connection
@@ -42,6 +42,9 @@ PHP package, namespace, callable, dependency, and test conventions.
   `COMPOSER=<derived manifest> composer update <connected packages>`. The
   tracked `composer.json` and `composer.lock` stay unchanged. Verify checks
   `InstalledVersions::getInstallPath()` against each source root.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment. The
+  built-in server is `php -S <host>:<port> -t public` for development only.
 
 ## Connected development
 

package/stacks/pieces/python.md

@@ -28,8 +28,8 @@ Python package, module, callable, dependency, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `pip`. It does not declare repositories or executable
+- The proposed host-owned `## Connected development` section names `pip` as
+  the default package type. It does not declare repositories or executable
   preparation. When connected development is needed, preserve that default in
   the complete project-owned section and declare the application's real Sources
   file and Prepare/Verify commands. An explicit `custom` connection uses its
@@ -42,6 +42,13 @@ Python package, module, callable, dependency, and test conventions.
   PEP 610 `direct_url.json` is editable with the source root's `file:` URL and
   that its modules import from there. Do not use `uv sync`, which needs tracked
   `[tool.uv.sources]` and lockfile changes.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Django: set `ALLOWED_HOSTS` and `CSRF_TRUSTED_ORIGINS` for the served origin
+  (`ALLOWED_HOSTS` also lists the loopback host the proxy connects to),
+  `SECURE_PROXY_SSL_HEADER` and `USE_X_FORWARDED_HOST` only behind that trusted
+  proxy, and read `SECRET_KEY` from the environment. Flask uses Werkzeug's
+  `ProxyFix`; Uvicorn uses `--proxy-headers --forwarded-allow-ips 127.0.0.1`.
 
 ## Connected development
 

package/stacks/pieces/ruby.md

@@ -28,8 +28,8 @@ Ruby module, class, callable, dependency, lifecycle, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `bundler`. It does not declare repositories or
+- The proposed host-owned `## Connected development` section names `bundler` as
+  the default package type. It does not declare repositories or
   executable preparation. When connected development is needed, preserve that
   default in the complete project-owned section and declare the application's
   real Sources file and Prepare/Verify commands. An explicit `custom` connection
@@ -43,6 +43,12 @@ Ruby module, class, callable, dependency, lifecycle, and test conventions.
   Launch through `bundle exec` or export `BUNDLE_GEMFILE`: a plain
   `require "bundler/setup"` launch ignores that setting. `local.<gem>` covers
   only git sources. Verify that each spec loads from its source root.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Rails: allow the served host and the proxy's loopback host in `config.hosts`
+  (Rails honours `X-Forwarded-Host`), read `SECRET_KEY_BASE` from the
+  environment (generate it with `bin/rails secret`), and use
+  `bin/rails db:prepare` for setup.
 
 ## Connected development
 

package/stacks/pieces/rust.md

@@ -28,8 +28,8 @@ Rust module, public item, ownership, error, async, Cargo, and test conventions.
   supplied `extensions.payments` semantics and verify signatures, deduplication,
   entitlement transitions and transactional credits using controlled fixtures.
   Native implementation remains required; guidance is not a working connector.
-- The proposed `## Connected development` section declares Vibe64's default
-  connected package type, `cargo`. It does not declare repositories or
+- The proposed host-owned `## Connected development` section names `cargo` as
+  the default package type. It does not declare repositories or
   executable preparation. When connected development is needed, preserve that
   default in the complete project-owned section and declare the application's
   real Sources file and Prepare/Verify commands. An explicit `custom` connection
@@ -42,6 +42,10 @@ Rust module, public item, ownership, error, async, Cargo, and test conventions.
   lockfile. This requires Cargo 1.97 or later. Verify with
   `cargo metadata --locked` that each crate resolves from its source root with
   no registry source, then `cargo build --locked`.
+- Running a web process: bind the supplied listen host and port, trust forwarded
+  headers only from a loopback proxy, and read secrets from the environment.
+  Take the listen address from an argument or environment variable rather than
+  hard-coding it.
 
 ## Connected development
 

package/stacks/pieces/vue.md

@@ -29,6 +29,12 @@ conventions. Authoritative framework documentation: https://vuejs.org/
   the subject and verifies webhooks. A successful browser redirect is not proof
   of payment. Preserve drafts, focus, pending/error states and selected accounts
   across responsive changes; use the project's established resource composables.
+- Start the Vite development server on the supplied address with
+  `--host <host> --port <port> --strictPort`. Behind a proxy that rewrites Host
+  to loopback, keep Vite's default `allowedHosts` and HMR client settings; the
+  HMR client connects through the page's own origin. Do not set
+  `allowedHosts: true` or hard-code `server.hmr.host`, `clientPort` or `origin`
+  unless that proxy requires it.
 
 ### Reactive state hydration
 
@@ -48,5 +54,5 @@ conventions. Authoritative framework documentation: https://vuejs.org/
   working host-managed browser contract during adoption.
 - Attribute a Vue build/dev server's memory to its actual Node output target.
   Vue selection does not create a second service or another memory charge.
-  Review any Vibe64 Resource estimates in the project's existing complete
+  Review any host-owned Resource estimates in the project's existing complete
   section; this piece does not propose a competing section alongside a framework.