refactor(stack): own composition policy and stack lookup in the package

[jgoux]

Problem

The CLI re-derived policy the package owns:

• It hand-copied the composition's binding table and the eager/lazy rules.
• It passed placeholder URLs for inputs the composition overwrites.
• It found stacks by listing every stack and matching identity fields.
• It ran database initialisation in four places.

Starting a stopped stack with changed configuration was rejected with a suggestion to destroy it.

Change

• find reads one stack by identity or id. CLI target resolution uses it, so an unreadable state file surfaces as an error instead of "not found".
• Composition-bound inputs are optional. Required inputs are validated before a service stops, so an invalid restart leaves it running. Placeholder URLs are gone.
• composition.plan reports, per member, whether a requested configuration is unchanged, changed or incompatible. An eager option replaces the CLI's copy of the activation policy, and stack status reports drift from the plan.
• Starting a stack whose owner is not running applies changed configuration. Only incompatible changes are rejected: endpoints, top-level versions and the database major version.
• One stack database initialisation routine is shared by stack start, db start, db reset and schema shadows.
• The internal artifact entrypoints are merged, the auth mapper's pass-throughs are type-checked, and the composition identity option is renamed to keys.

Stack

Part 7 of 8 of the stack package simplification, based on #6839. Review and merge in order:

1. fix(stack): stop Postgres containers with a fast shutdown #6834 fix(stack): stop Postgres containers with a fast shutdown
2. fix(stack): harden readiness, port claims, and container storage #6835 fix(stack): harden readiness, port claims, and container storage
3. refactor(stack): flatten the owner process layers #6836 refactor(stack): flatten the owner process layers
4. refactor(stack): unify the database snapshot protocol across engines #6837 refactor(stack): unify the database snapshot protocol across engines
5. feat(stack): lease owners with a lock and bind session stacks to creators #6838 feat(stack): lease owners with a lock and bind session stacks to creators
6. feat(stack): ship the functions bootstrap with the package #6839 feat(stack): ship the functions bootstrap with the package
7. refactor(stack): own composition policy and stack lookup in the package #6840 refactor(stack): own composition policy and stack lookup in the package ← this PR
8. feat(stack): add a testing entrypoint and derive the Promise API #6841 feat(stack): add a testing entrypoint and derive the Promise API

🤖 Generated with Claude Code

[github-actions]

🤖 AI Review

Five distinct findings were verified: one major and four minor. The runtime finding holds for schema shadows, but its claim about db dump --local does not. The credential comparison finding holds for the stack package; the cited REST JWKS example is not exposed through CLI configuration.

Findings

Severity	Location	Category	Sources	Claim
🟠 MAJOR	apps/cli/src/commands/experimental/stack/start/start.handler.ts:398	selection	codex	Adding a service fails as ambiguous when one stopped candidate is unchanged and another stopped candidate has changeable settings.
🟡 MINOR	apps/cli/src/command-internal/stack-local-database.ts:106	error-handling	claude	An unreadable project stack state is treated as an absent runtime, allowing schema shadows without an explicit runtime to fall back to the default runtime.
🟡 MINOR	packages/stack/src/composition/Supabase.ts:129	correctness	codex	The composition plan ignores changes to explicit credential-related inputs, including REST JWKS, even when those inputs change the effective service configuration.
🟡 MINOR	apps/cli/src/commands/experimental/stack/status/status.handler.ts:324	error-handling	codex	An unreadable Functions dotenv file makes all configuration drift unavailable even when Functions is absent from the saved composition.
🟡 MINOR	packages/stack/src/effect.ts:905	input-validation	codex	The public find operation does not enforce the exported StackId format for an explicit ID before lookup.

Stats

Claude findings: 1 · Codex findings: 4 · Confirmed: 5 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[jgoux]

AI review triage

Fixed in 0d5f417:

• stack status reads the Functions dotenv only when Functions is a saved member.
  Rejected with evidence: 5 findings (the reasons are in each thread).

Every review thread on this PR has been answered and resolved.

🤖 Addressed by Claude Code