@stravica-ai/rcf-schemas 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -4,6 +4,42 @@ All notable changes to `@stravica-ai/rcf-schemas` are documented in this file.
 
 The format roughly follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Pre-1.0 breaking changes are signalled by a minor bump per semver 0.x convention.
 
+## 0.4.2 - 2026-07-31
+
+Additive patch bump: closes the Track B N-5 review finding on the 0.7.0 train. The `testTheatreFinding` shape now expresses "not every finding kind anchors on a test suite" honestly instead of forcing a UI-drift finding to smuggle an FBS id through the `tsId` slot.
+
+### Added
+
+- **`manifest.schema.json`**: new optional `anchorId` (string, `minLength: 1`) on `$defs.testTheatreFinding`, for kinds whose anchor is not a test suite (for example, `uiBaselineDrift`, which anchors on the FBS id or a file path).
+- Fixture: `fixtures/valid/manifest/manifest-007-ui-baseline-drift-anchor.json` proves the new shape (a `uiBaselineDrift` finding without `tsId`, carrying `anchorId`) validates alongside a legacy test-theatre finding on the same record.
+- Tests: `manifest.test.js` covers the new `anchorId` field, the per-kind `tsId` requiredness rule (drift may omit; test-theatre kinds still must supply), the back-compat guarantee (a pre-0.4.2 emitter's `uiBaselineDrift` with `tsId` still validates), the `anchorId` `minLength: 1` guard, and the coexistence of `anchorId` + `tsId` on one finding.
+
+### Changed
+
+- **`$defs.testTheatreFinding`**: top-level `required` list drops `tsId` (now `["kind", "detail", "severity"]`); a new `allOf` clause requires `tsId` for every kind other than `uiBaselineDrift`. Test-theatre kinds (`mockOnlyIntegrationClaim`, `testPointerBroken`, `assertionStrengthWeak`, `acIdsCoverageDrift`, `otherDeclared`) still cannot omit `tsId`.
+- `manifest.schema.json` description names the 0.4.2 addition and restates the back-compat guarantee.
+
+### Notes
+
+- Additive-only: every 0.4.0- or 0.4.1-valid manifest remains valid. The change relaxes a required field on one specific kind and adds an optional field; nothing that previously validated stops validating.
+- Canonical `$id` URLs stay at `v0.4.0`, following the patch-release precedent set at 0.2.1, 0.3.1, and 0.4.1.
+- Consumed by `rcf-build-lite`'s Track B fix pass (PR `Stravica/rcf-lite#75`), which will bump its `@stravica-ai/rcf-schemas` dep to `^0.4.2` and emit `uiBaselineDrift` findings with `anchorId` instead of the legacy `tsId: fbs.fbsId` smuggle.
+
+## 0.4.1 - 2026-07-31
+
+Additive patch bump: closes the verification-integrity B-1 finding on the 0.7.0 train by giving `rcf finalise --ship-without-verified` a durable, greppable manifest record.
+
+### Added
+
+- **`manifest.schema.json`**: new optional `shipWithoutVerified[]` array on the manifest. Each entry carries `id` (pattern `swv-<fbsId>-<n>`), `fbsId`, `ackedAt` timestamp, `declaredAcs[]` (each with `acId`, a `verdict` enum restricted to `MOCK-ONLY-DECLARED` or `BLOCKED-BY-DECLARATION`, and an optional `reason` string), and `reportPath`. New `$defs`: `shipWithoutVerifiedRecord`, `shipWithoutVerifiedDeclaredAc`. Written by build-side `rcf finalise --ship-without-verified` (rcf-build-lite 0.7.0 train, verification-integrity-cluster-spec section 5.2).
+- Fixture: `fixtures/valid/manifest/manifest-006-ship-without-verified.json` proves the new field validates, alongside a fresh pre-0.4.1 back-compat fixture pass.
+- Tests: `manifest.test.js` covers the new field, the id pattern, the verdict enum guard, and back-compat.
+
+### Notes
+
+- Additive-only: pre-0.4.0 and 0.4.0 manifests remain valid unchanged.
+- Canonical `$id` URLs stay at `v0.4.0`, following the patch-release precedent set at 0.2.1 and 0.3.1.
+
 ## 0.4.0 - 2026-07-30
 
 Additive minor bump carrying the 0.7.0 release-train schema surface for `rcf-lite`: three ratified track specs (verification-integrity, UI-design-gate, elicitation-and-playbook-hardening) co-ship every new schema field in one release, resolved through a single `$defs`-uniqueness sweep. Every field is optional at schema level; pre-0.4.0 chains remain valid. The 0.6.0 init-hygiene spec is pure build-side and touches no schemas here.

package/fixtures/valid/manifest/manifest-006-ship-without-verified.json

@@ -0,0 +1,26 @@
+{
+  "version": "2.0.0",
+  "projectName": "Ship-without-verified ack coverage",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "shipWithoutVerified": [
+    {
+      "id": "swv-FBS-011-1",
+      "fbsId": "FBS-011",
+      "ackedAt": "2026-07-31T10:15:00Z",
+      "declaredAcs": [
+        {
+          "acId": "AC-1001-2",
+          "verdict": "MOCK-ONLY-DECLARED",
+          "reason": "no Resend live-path credentials available at ship time"
+        },
+        {
+          "acId": "AC-1001-3",
+          "verdict": "BLOCKED-BY-DECLARATION"
+        }
+      ],
+      "reportPath": ".rcf-verify-report.json"
+    }
+  ]
+}

package/fixtures/valid/manifest/manifest-007-ui-baseline-drift-anchor.json

@@ -0,0 +1,29 @@
+{
+  "version": "2.0.0",
+  "projectName": "uiBaselineDrift anchor coverage",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "reviewAudit": [
+    {
+      "id": "ra-FBS-016-1",
+      "fbsId": "FBS-016",
+      "createdAt": "2026-07-31T15:10:00Z",
+      "testTheatreFindings": [
+        {
+          "anchorId": "FBS-016",
+          "kind": "uiBaselineDrift",
+          "detail": "hex literal #ff0000 detected in src/ui/dashboard.ts (baseline defaults.noHexInViewFiles: true).",
+          "severity": "block"
+        },
+        {
+          "tsId": "TS-016",
+          "kind": "mockOnlyIntegrationClaim",
+          "detail": "testLevel=integration but runtimeProvenance.profile=mock",
+          "severity": "block"
+        }
+      ],
+      "verdict": "block"
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/rcf-schemas",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "type": "module",
   "description": "JSON Schemas for the Requirements Confidence Framework (RCF). Language-neutral. The contract every RCF tool keys to.",
   "license": "Apache-2.0",

package/schemas/manifest.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.stravica.io/rcf/v0.4.0/manifest.schema.json",
   "title": "RCF Project Manifest",
-  "description": "Project manifest. Roots-only shape: declares prd, tad, bs. Children are owned by their parents and discovered by walking from the roots. From 0.4.0 the manifest also carries optional records for pre-flight configuration, review audits, UI baselines, browser verification, baseline-AC opt-outs, intake classification, register-regression canaries, and the review-surface state. Every added field is optional; pre-0.4.0 manifests remain valid.",
+  "description": "Project manifest. Roots-only shape: declares prd, tad, bs. Children are owned by their parents and discovered by walking from the roots. From 0.4.0 the manifest also carries optional records for pre-flight configuration, review audits, UI baselines, browser verification, baseline-AC opt-outs, intake classification, register-regression canaries, and the review-surface state. From 0.4.1 the manifest additionally carries optional shipWithoutVerified acknowledgements written by rcf finalise --ship-without-verified. From 0.4.2 the testTheatreFinding shape carries an optional anchorId and drops tsId from its required list when kind is uiBaselineDrift (the drift finding is not anchored on a test suite); every other kind still requires tsId, and any 0.4.0- or 0.4.1-valid record remains valid. Every added field is optional; pre-0.4.0 manifests remain valid.",
   "type": "object",
   "additionalProperties": false,
   "required": ["version", "projectName", "prd", "tad", "bs"],
@@ -50,7 +50,12 @@
       "items": { "$ref": "#/$defs/registerCanaryRecord" },
       "description": "Register-regression canary records. One entry per canary run at release preparation."
     },
-    "reviewSurface": { "$ref": "#/$defs/reviewSurfaceRecord" }
+    "reviewSurface": { "$ref": "#/$defs/reviewSurfaceRecord" },
+    "shipWithoutVerified": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/shipWithoutVerifiedRecord" },
+      "description": "Operator acknowledgements recorded when rcf finalise --ship-without-verified acknowledges a MOCK-ONLY-DECLARED or BLOCKED-BY-DECLARATION verdict on the verify report and ships the FBS at complete without promoting to verified. One entry per acknowledgement (verification-integrity-cluster-spec section 5.2). The ack is durable and greppable at ship time."
+    }
   },
   "$defs": {
     "preFlightConfigRecord": {
@@ -173,10 +178,15 @@
     "testTheatreFinding": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["tsId", "kind", "detail", "severity"],
+      "required": ["kind", "detail", "severity"],
       "properties": {
         "tsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/tsId" },
         "tcId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/tcId" },
+        "anchorId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Free-form anchor for findings whose kind does not map to a test suite (for example, uiBaselineDrift, which anchors on the FBS id or a file path). Optional; test-theatre kinds keep tsId as the anchor."
+        },
         "kind": {
           "enum": [
             "mockOnlyIntegrationClaim",
@@ -202,7 +212,19 @@
           "enum": ["advisory", "warn", "block"],
           "description": "Severity of the finding. Only block severities force a block verdict on the audit."
         }
-      }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "kind": { "const": "uiBaselineDrift" } }, "required": ["kind"] },
+          "then": {},
+          "else": {
+            "properties": {
+              "tsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/tsId" }
+            },
+            "required": ["tsId"]
+          }
+        }
+      ]
     },
     "mutationSamplingRecord": {
       "type": "object",
@@ -700,6 +722,48 @@
         "lastHeartbeatAt": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" },
         "operatorRequestedPersistUntil": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" }
       }
+    },
+    "shipWithoutVerifiedRecord": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "fbsId", "ackedAt", "declaredAcs", "reportPath"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^swv-FBS-\\d{3,}-\\d+$",
+          "description": "Ship-without-verified acknowledgement id. Format: swv-<fbsId>-<n>; the trailing integer increments per acknowledgement of the same FBS."
+        },
+        "fbsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/fbsId" },
+        "ackedAt": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" },
+        "declaredAcs": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/shipWithoutVerifiedDeclaredAc" },
+          "description": "The per-AC verdicts on the verify report that the operator acknowledged. At least one entry, otherwise there is nothing to acknowledge."
+        },
+        "reportPath": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Path (repo-relative or absolute as recorded by finalise) to the verify report file that carried the acknowledged verdicts."
+        }
+      },
+      "description": "Operator acknowledgement recorded on rcf finalise --ship-without-verified. Records the FBS, the verify verdicts acknowledged, and the report they came from, so the ack is durable and greppable at ship time."
+    },
+    "shipWithoutVerifiedDeclaredAc": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["acId", "verdict"],
+      "properties": {
+        "acId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/acId" },
+        "verdict": {
+          "enum": ["MOCK-ONLY-DECLARED", "BLOCKED-BY-DECLARATION"],
+          "description": "The verify per-AC verdict class the operator acknowledged. Only these two verdict classes are legitimately acknowledgeable via --ship-without-verified."
+        },
+        "reason": {
+          "type": "string",
+          "description": "Optional verify-supplied reason string carried through from the report entry."
+        }
+      }
     }
   }
 }