@stravica-ai/rcf-schemas 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -4,6 +4,55 @@ All notable changes to `@stravica-ai/rcf-schemas` are documented in this file.
 
 The format roughly follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Pre-1.0 breaking changes are signalled by a minor bump per semver 0.x convention.
 
+## 0.4.3 - 2026-08-12
+
+Additive patch bump: car 1 of the `rcf-lite` 0.8.0 slug-train. Widens four id patterns to accept an optional kebab-case slug tail (per the slug design ratified on `w-2026-07-28-012`), widens the TS and TC id patterns to drop the 999 cap, adds a shared scope-tag vocabulary in `common.schema.json`, and exposes an optional `scope` field on ACs and TCs. Every change is additive; every existing id and every existing document continues to validate.
+
+### Added
+
+- **`common.schema.json`**: new `$defs.scopeTag` enum (`library | runtime | deployed | unclassified`), shared between `user-story.acceptanceCriteria[].scope` and `test-suite.testCases[].scope`. `unclassified` is the migration state; the schema does not distinguish gate-passing values, ruleset-enforcing consumers do.
+- **`user-story.schema.json`**: new optional `scope` on `$defs.acceptanceCriterion`, referencing `common.scopeTag`. Names the scope at which the AC is observable and governs which test scopes count as coverage.
+- **`test-suite.schema.json`**: new optional `scope` on `$defs.testCase`, referencing `common.scopeTag`. Ruleset-enforcing consumers may require the TC scope to be equal to or wider than the covered AC's scope.
+- Fixtures: `fixtures/valid/fbs/fbs-006-slugged-id.json`, `fixtures/valid/cn/cn-003-slugged-id.json`, `fixtures/valid/adr/adr-004-slugged-id.json`, `fixtures/valid/tac/tac-003-slugged-id.json`, `fixtures/valid/test-suite/ts-004-widened-tsId.json` (four-digit TS with two scope-tagged TCs), `fixtures/valid/user-story/us-004-ac-scope-tags.json` (three ACs, one per scope value). Invalid coverage: `fixtures/invalid/fbs/fbs-012-uppercase-slug.json`, `fixtures/invalid/test-suite/ts-007-bad-tc-scope.json`, `fixtures/invalid/user-story/us-004-bad-ac-scope.json`.
+- Tests: slug-id cases added to `fbs.test.js`, `cn.test.js`, `adr.test.js`, `tac.test.js`; widened TS/TC id cases and TC scope cases added to `test-suite.test.js`; AC scope cases added to `user-story.test.js`; composite FBS-embedded id cases added to `manifest.test.js` (`reviewAudit.id`, `browserVerification.id`, `shipWithoutVerified.id`).
+
+### Changed
+
+- **`common.schema.json`**: `fbsId`, `cnId`, `adrId`, `tacId` patterns widened to accept an optional kebab-case slug tail, `^<PREFIX>-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$`. Numeric-only ids continue to validate unchanged. Slug segments must be lowercase alphanumeric joined by single hyphens; leading, trailing, and double hyphens are rejected. Kebab is enforced (well-formed) rather than the looser `[a-z0-9-]+` shape so downstream tools can round-trip slugs without normalisation.
+- **`common.schema.json`**: `tsId` widened from `^TS-\d{3}$` to `^TS-\d{3,}$`; `tcId` widened from `^TC-\d{3}-[a-z0-9-]+$` to `^TC-\d{3,}-[a-z0-9-]+$`. Removes the 999 cap on both, and closes the silent-skip trap in downstream walkers that were coded against the three-digit-exact pattern. TC's slug portion keeps the looser `[a-z0-9-]+` shape (legacy compatibility).
+- **`test-suite.schema.json`**: inline `testCase.id` pattern widened in lockstep with `common.tcId` (`^TC-\d{3,}-[a-z0-9-]+$`).
+- **`manifest.schema.json`**: the three FBS-embedded composite id patterns widened to accept both numeric-only and slugged FBS ids: `reviewAudit.id` (`^ra-FBS-\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\d+$`), `browserVerification.id` (`^bv-FBS-\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\d+$`), and `shipWithoutVerified.id` (`^swv-FBS-\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\d+$`). The trailing `-<n>` counter still parses cleanly against slugged FBS ids because the counter is required and anchored.
+- **`docs/id-conventions.md`**, **`docs/common.md`**, **`docs/test-suite.md`**, **`docs/user-story.md`**: updated to reflect the widened patterns, the optional slug suffix, and the `scopeTag` vocabulary.
+
+### Notes
+
+- Additive-only: every 0.4.0-, 0.4.1-, and 0.4.2-valid document remains valid. Every numeric-only id continues to validate; every existing AC and TC without a `scope` field continues to validate.
+- Canonical `$id` URLs stay at `v0.4.0`, following the patch-release precedent set at 0.2.1, 0.3.1, 0.4.1, and 0.4.2. Per the ratified umbrella exact-pin doctrine, the 0.8.0 slug-train's second and third cars (`rcf-lite-core`, `rcf-build-lite`) pin `@stravica-ai/rcf-schemas` to exactly `0.4.3` (no caret, no range) on merge; the pin review is recorded in the umbrella's release notes.
+- Slug scope (FBS, CN, ADR, TAC) is the ratified set: BS is out of scope by design (Baz ruling 2026-07-28, `w-2026-07-28-012`), and PRD, REQ, US, TAD are per-project singletons where number collisions are not the problem the slug solves.
+- Existing documents are NOT retro-slugged. The design is preferred-with-numeric-fallback; adopting slugs is opt-in per document at authoring time.
+- Downstream landmines called out on `w-2026-07-28-012` (walker.js toUpperCase stem, writer.js nextFlatId parser, hardcoded `\d{3}` in walker.js:696-699, deriveSlug 'tc' leak) live in `rcf-lite` consumers, not in this repo. They are addressed by that repo's train cars, not here.
+
+## 0.4.2 - 2026-07-31
+
+Additive patch bump: closes the Track B N-5 review finding on the 0.7.0 train. The `testTheatreFinding` shape now expresses "not every finding kind anchors on a test suite" honestly instead of forcing a UI-drift finding to smuggle an FBS id through the `tsId` slot.
+
+### Added
+
+- **`manifest.schema.json`**: new optional `anchorId` (string, `minLength: 1`) on `$defs.testTheatreFinding`, for kinds whose anchor is not a test suite (for example, `uiBaselineDrift`, which anchors on the FBS id or a file path).
+- Fixture: `fixtures/valid/manifest/manifest-007-ui-baseline-drift-anchor.json` proves the new shape (a `uiBaselineDrift` finding without `tsId`, carrying `anchorId`) validates alongside a legacy test-theatre finding on the same record.
+- Tests: `manifest.test.js` covers the new `anchorId` field, the per-kind `tsId` requiredness rule (drift may omit; test-theatre kinds still must supply), the back-compat guarantee (a pre-0.4.2 emitter's `uiBaselineDrift` with `tsId` still validates), the `anchorId` `minLength: 1` guard, and the coexistence of `anchorId` + `tsId` on one finding.
+
+### Changed
+
+- **`$defs.testTheatreFinding`**: top-level `required` list drops `tsId` (now `["kind", "detail", "severity"]`); a new `allOf` clause requires `tsId` for every kind other than `uiBaselineDrift`. Test-theatre kinds (`mockOnlyIntegrationClaim`, `testPointerBroken`, `assertionStrengthWeak`, `acIdsCoverageDrift`, `otherDeclared`) still cannot omit `tsId`.
+- `manifest.schema.json` description names the 0.4.2 addition and restates the back-compat guarantee.
+
+### Notes
+
+- Additive-only: every 0.4.0- or 0.4.1-valid manifest remains valid. The change relaxes a required field on one specific kind and adds an optional field; nothing that previously validated stops validating.
+- Canonical `$id` URLs stay at `v0.4.0`, following the patch-release precedent set at 0.2.1, 0.3.1, and 0.4.1.
+- Consumed by `rcf-build-lite`'s Track B fix pass (PR `Stravica/rcf-lite#75`), which will bump its `@stravica-ai/rcf-schemas` dep to `^0.4.2` and emit `uiBaselineDrift` findings with `anchorId` instead of the legacy `tsId: fbs.fbsId` smuggle.
+
 ## 0.4.1 - 2026-07-31
 
 Additive patch bump: closes the verification-integrity B-1 finding on the 0.7.0 train by giving `rcf finalise --ship-without-verified` a durable, greppable manifest record.

package/docs/common.md

@@ -15,19 +15,21 @@ Shared `$defs` referenced via `$ref` from every other RCF schema. ID patterns, s
 | `usId` | string, `^US-\d{3,}$` | `user-story`, `test-suite` |
 | `acId` | string, `^AC-\d{3,}(-\d+)?$` | `user-story.acceptanceCriteria[].id`, `fbs.acIds[]`, `test-suite.acId` |
 | `tadId` | string, `^TAD-\d{3,}$` | `tad`, `tac`, `adr` |
-| `tacId` | string, `^TAC-\d{3,}$` | `tac`, `fbs.contextRequirements.tacIds[]` |
-| `adrId` | string, `^ADR-\d{3,}$` | `adr`, `fbs.contextRequirements.adrIds[]` |
+| `tacId` | string, `^TAC-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$` | `tac`, `fbs.contextRequirements.tacIds[]` |
+| `adrId` | string, `^ADR-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$` | `adr`, `fbs.contextRequirements.adrIds[]` |
 | `bsId` | string, `^BS-\d{3,}$` | `build-sequence`, `fbs.bsId` |
-| `fbsId` | string, `^FBS-\d{3,}$` | `fbs.fbsId`, `fbs.dependsOnFbsIds[]` |
-| `tsId` | string, `^TS-\d{3}$` | `test-suite.id` |
-| `tcId` | string, `^TC-\d{3}-[a-z0-9-]+$` | `test-suite.testCases[].id` |
-| `cnId` | string, `^CN-\d{3,}$` | `cn.cnId`, `cn.dependencies[]` |
+| `fbsId` | string, `^FBS-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$` | `fbs.fbsId`, `fbs.dependsOnFbsIds[]` |
+| `tsId` | string, `^TS-\d{3,}$` | `test-suite.id` |
+| `tcId` | string, `^TC-\d{3,}-[a-z0-9-]+$` | `test-suite.testCases[].id` |
+| `cnId` | string, `^CN-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$` | `cn.cnId`, `cn.dependencies[]` |
 | `version` | string, `^\d+\.\d+\.\d+$` | every doc-type schema |
 | `timestamp` | string, format `date-time` | every doc-type schema |
 | `authoringStatus` | enum: `draft`, `review`, `needsRevision`, `approved`, `superseded` | PRD, REQ, US, TAD, TAC, BS |
 | `adrStatus` | enum: `draft`, `proposed`, `accepted`, `superseded`, `deprecated` | ADR |
 | `executionStatus` | enum: `notStarted`, `inProgress`, `complete`, `verified` | FBS doc + BS slot |
 | `cnStatus` | enum: `draft`, `approved`, `deprecated` | CN |
+| `attestationMode` | enum: `live`, `sandboxed`, `mocked`, `declaredMockOnly`, `notShipped` | `fbs.dependsOnServices[]`, manifest `preFlightConfig.servicesInScope[]` |
+| `scopeTag` | enum: `library`, `runtime`, `deployed`, `unclassified` | `user-story.acceptanceCriteria[].scope`, `test-suite.testCases[].scope` |
 | `docRef` | object `{ id, path }` | manifest `prd`, `tad`, `bs` |
 
 ## Why these are shared

package/docs/id-conventions.md

@@ -1,6 +1,6 @@
 # ID conventions
 
-The pattern, the prefix table, the AC sub-id form, and the file/nested asymmetry.
+The pattern, the prefix table, the AC sub-id form, the optional slug suffix, and the file/nested asymmetry.
 
 ## The pattern
 
@@ -10,7 +10,21 @@ The pattern, the prefix table, the AC sub-id form, and the file/nested asymmetry
 
 Three-digit minimum, unbounded above. `PRD-001` through `PRD-999` use the clean visual; `PRD-1000+` works without a schema migration. A single digit (`PRD-1`) is rejected.
 
-Two families deviate from the family default and are documented alongside their prefix below: `TS-\d{3}` (exactly three digits) and `TC-\d{3}-<slug>` (three-digit TS suffix plus a lowercase alphanumeric slug).
+One family layers the same three-digit-minimum tail onto a slug: `TC-\d{3,}-<slug>` (TS-suffix, three-digit minimum, unbounded above, joined to a lowercase alphanumeric slug).
+
+## Optional slug suffix (0.4.3)
+
+Four families accept an optional kebab-case slug tail: `FBS`, `CN`, `ADR`, `TAC`. The full pattern is:
+
+```
+^<PREFIX>-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$
+```
+
+The slug is derived from the document title (kebab-case, lowercase alphanumeric segments joined by single hyphens). Leading hyphens, trailing hyphens, double hyphens, uppercase letters, and underscores are rejected.
+
+Both forms remain valid: `FBS-004` and `FBS-004-user-login` both validate. Existing numeric-only ids continue to validate; there is no forcing function. Consumers that address documents by id treat the slug as part of the id string, not a separately parseable field.
+
+Rationale: parallel authoring on branches can allocate the same number for different titles. The slug makes those distinct addresses at the filesystem and id layer, converting an add/add merge conflict into a clean co-existence. See the `rcf-lite` slug-train design for the full argument.
 
 ## Prefix table
 
@@ -42,11 +56,11 @@ Pick per project; the schema does not enforce either form. The published `Stravi
 
 ## TS ids
 
-`^TS-\d{3}$`. Sequential, not parent-grouped: a US may have multiple TSs across levels (unit, integration, e2e, ...) and a parent-grouped id would collide. Recommended path: `rcf/test-suites/ts-001.json`.
+`^TS-\d{3,}$`. Sequential, not parent-grouped: a US may have multiple TSs across levels (unit, integration, e2e, ...) and a parent-grouped id would collide. Recommended path: `rcf/test-suites/ts-001.json`.
 
 ## TC ids
 
-`^TC-\d{3}-[a-z0-9-]+$`. TCs are nested in their parent TS's `testCases[]`. The pattern is `TC-<TS-suffix>-<slug>` where slug is a lowercase alphanumeric identifier chosen by the author (hyphens allowed). Examples: `TC-001-happy-path`, `TC-001-rejects-empty`, `TC-042-integration-boundary`. Slug uniqueness is within-TS, not global.
+`^TC-\d{3,}-[a-z0-9-]+$`. TCs are nested in their parent TS's `testCases[]`. The pattern is `TC-<TS-suffix>-<slug>` where slug is a lowercase alphanumeric identifier chosen by the author (hyphens allowed). Examples: `TC-001-happy-path`, `TC-001-rejects-empty`, `TC-042-integration-boundary`. Slug uniqueness is within-TS, not global.
 
 Rationale: sequential numbering for TCs is brittle if you renumber; slug-based ids give readable pointers in test-suite bodies and traceability queries.
 

package/docs/test-suite.md

@@ -20,7 +20,7 @@ Recommended path under the RCF tree: `rcf/test-suites/ts-001.json`. The schema v
 
 | Field | Type | Notes |
 |---|---|---|
-| `id` | `^TS-\d{3}$` | Test Suite identifier. Sequential, not parent-grouped (a US can have multiple TSs across levels). |
+| `id` | `^TS-\d{3,}$` | Test Suite identifier. Sequential, not parent-grouped (a US can have multiple TSs across levels). Three-digit minimum, unbounded above (widened in 0.4.3). |
 | `usId` | `^US-\d{3,}$` | Parent User Story. Mandatory back-reference. |
 | `title` | string, min 1 | Human-readable suite title. |
 | `purpose` | string, min 1 | One-paragraph "what this suite is testing and why". |
@@ -36,11 +36,12 @@ Each entry in `testCases[]`:
 
 | Field | Type | Required | Purpose |
 |---|---|---|---|
-| `id` | `^TC-\d{3}-[a-z0-9-]+$` | yes | TC identifier. `TC-<TS-suffix>-<slug>`; slug is a lowercase alphanumeric identifier (hyphens allowed). Slug uniqueness is within-TS, not global. |
+| `id` | `^TC-\d{3,}-[a-z0-9-]+$` | yes | TC identifier. `TC-<TS-suffix>-<slug>`; slug is a lowercase alphanumeric identifier (hyphens allowed). Slug uniqueness is within-TS, not global. TS-suffix widened to three-digit minimum, unbounded above (0.4.3). |
 | `acId` | `^AC-\d{3,}(-\d+)?$` | yes | Which AC on the parent US this TC verifies. |
 | `description` | string, min 1 | yes | What the TC covers. |
 | `testPointer` | string | no | Pointer to the executable test, `filePath::testName` format. |
 | `status` | enum | yes | `pending`, `passing`, `failing`, `skipped`. Authored in 0.2.0; derived from real test runs in Phase 6+. |
+| `scope` | `scopeTag` enum | no | `library`, `runtime`, `deployed`, `unclassified`. Optional at schema level (0.4.3). Ruleset-enforcing consumers may require the TC scope to be equal to or wider than the covered AC's scope. |
 
 ## What changed in 0.2.0
 

package/docs/user-story.md

@@ -40,6 +40,7 @@ Each AC inside `acceptanceCriteria[]`:
 | `when` | string | no | Trigger. |
 | `then` | string | no | Observable outcome. |
 | `testable` | boolean | yes | Author declares the AC is testable. |
+| `scope` | `scopeTag` enum | no | `library`, `runtime`, `deployed`, `unclassified`. Optional at schema level (0.4.3). Names the scope at which the AC is observable; governs which test scopes count as coverage. |
 
 The Given/When/Then triple is optional at the schema level so non-Gherkin teams aren't forced into it; the `testable` boolean is required to make authors stop and confirm the AC can actually be tested.
 

package/fixtures/invalid/fbs/fbs-012-uppercase-slug.json

@@ -0,0 +1,13 @@
+{
+  "fbsId": "FBS-004-UserLogin",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 4,
+  "executionStatus": "notStarted",
+  "title": "x",
+  "summary": "y",
+  "acIds": ["AC-001"],
+  "dependsOnFbsIds": [],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/invalid/test-suite/ts-007-bad-tc-scope.json

@@ -0,0 +1,20 @@
+{
+  "id": "TS-001",
+  "usId": "US-001",
+  "title": "x",
+  "purpose": "y",
+  "testLevel": "unit",
+  "acIds": ["AC-001"],
+  "testCases": [
+    {
+      "id": "TC-001-a",
+      "acId": "AC-001",
+      "description": "TC scope is not one of the ratified vocabulary values.",
+      "status": "pending",
+      "scope": "production"
+    }
+  ],
+  "status": "draft",
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-01-01T00:00:00Z"
+}

package/fixtures/invalid/user-story/us-004-bad-ac-scope.json

@@ -0,0 +1,21 @@
+{
+  "usId": "US-001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "x",
+  "asA": "y",
+  "iWant": "z",
+  "soThat": "w",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-001",
+      "description": "AC scope is not one of the ratified vocabulary values.",
+      "testable": true,
+      "scope": "production"
+    }
+  ],
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-01-01T00:00:00Z"
+}

package/fixtures/valid/adr/adr-004-slugged-id.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-012-choose-postgres",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Choose PostgreSQL for the primary datastore",
+  "context": "The service needs a relational store with strong consistency and mature JSON support.",
+  "decision": "Adopt PostgreSQL 16 as the primary datastore.",
+  "consequences": "Introduces PostgreSQL as a runtime dependency; simplifies query semantics.",
+  "relatedAdrs": ["ADR-005-alignment-policy"],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/cn/cn-003-slugged-id.json

@@ -0,0 +1,10 @@
+{
+  "cnId": "CN-042-store-validator",
+  "path": "src/store/validator.js#getAjv",
+  "implementsAcIds": ["AC-102-1"],
+  "dependencies": ["CN-001", "CN-002-user-notifier"],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/fbs/fbs-006-slugged-id.json

@@ -0,0 +1,13 @@
+{
+  "fbsId": "FBS-004-user-login",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 4,
+  "executionStatus": "notStarted",
+  "title": "User login",
+  "summary": "HTML login page and session cookie on submit.",
+  "acIds": ["AC-004-1"],
+  "dependsOnFbsIds": ["FBS-001", "FBS-002-persist-notes"],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/manifest/manifest-007-ui-baseline-drift-anchor.json

@@ -0,0 +1,29 @@
+{
+  "version": "2.0.0",
+  "projectName": "uiBaselineDrift anchor coverage",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "reviewAudit": [
+    {
+      "id": "ra-FBS-016-1",
+      "fbsId": "FBS-016",
+      "createdAt": "2026-07-31T15:10:00Z",
+      "testTheatreFindings": [
+        {
+          "anchorId": "FBS-016",
+          "kind": "uiBaselineDrift",
+          "detail": "hex literal #ff0000 detected in src/ui/dashboard.ts (baseline defaults.noHexInViewFiles: true).",
+          "severity": "block"
+        },
+        {
+          "tsId": "TS-016",
+          "kind": "mockOnlyIntegrationClaim",
+          "detail": "testLevel=integration but runtimeProvenance.profile=mock",
+          "severity": "block"
+        }
+      ],
+      "verdict": "block"
+    }
+  ]
+}

package/fixtures/valid/tac/tac-003-slugged-id.json

@@ -0,0 +1,18 @@
+{
+  "tacId": "TAC-004-payment-gateway",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Payment gateway",
+  "purpose": "Server-side integration with the third-party payment provider.",
+  "responsibilities": [
+    "Issue authorization requests",
+    "Reconcile capture events"
+  ],
+  "dependencies": [
+    { "name": "Notes store", "kind": "tac", "tacId": "TAC-002-notes-store" }
+  ],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/test-suite/ts-004-widened-tsId.json

@@ -0,0 +1,27 @@
+{
+  "id": "TS-1000",
+  "usId": "US-1001",
+  "title": "Boot integration smoke",
+  "purpose": "Cover the boot-integration observable for AC-1001-1 on a real host.",
+  "testLevel": "integration",
+  "acIds": ["AC-1001-1"],
+  "testCases": [
+    {
+      "id": "TC-1000-startup-loads-config",
+      "acId": "AC-1001-1",
+      "description": "On boot, the config loader wires and dispatches the first tick.",
+      "status": "passing",
+      "scope": "runtime"
+    },
+    {
+      "id": "TC-1000-deployed-smoke",
+      "acId": "AC-1001-1",
+      "description": "On the deployed instance, the first probe fires against a real target.",
+      "status": "passing",
+      "scope": "deployed"
+    }
+  ],
+  "status": "approved",
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/user-story/us-004-ac-scope-tags.json

@@ -0,0 +1,33 @@
+{
+  "usId": "US-1001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-010",
+  "version": "0.1.0",
+  "status": "approved",
+  "title": "Signed-in owner sees the dashboard on boot",
+  "asA": "signed-in owner",
+  "iWant": "to land on the dashboard after logging in",
+  "soThat": "I can see every monitor's status at a glance",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1001-1",
+      "description": "on startup, the loader wires the config file and the first probe fires",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1001-2",
+      "description": "on the deployed instance, the first probe hits the real target within 60s of boot",
+      "testable": true,
+      "scope": "deployed"
+    },
+    {
+      "id": "AC-1001-3",
+      "description": "parseConfig rejects an empty configuration document",
+      "testable": true,
+      "scope": "library"
+    }
+  ],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/rcf-schemas",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "type": "module",
   "description": "JSON Schemas for the Requirements Confidence Framework (RCF). Language-neutral. The contract every RCF tool keys to.",
   "license": "Apache-2.0",

package/schemas/common.schema.json

@@ -31,13 +31,13 @@
     },
     "tacId": {
       "type": "string",
-      "pattern": "^TAC-\\d{3,}$",
-      "description": "Technical Architecture Component identifier."
+      "pattern": "^TAC-\\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$",
+      "description": "Technical Architecture Component identifier. Three-digit minimum, unbounded above. An optional kebab-case slug suffix (for example, TAC-004-payment-gateway) is permitted; existing numeric-only ids remain valid."
     },
     "adrId": {
       "type": "string",
-      "pattern": "^ADR-\\d{3,}$",
-      "description": "Architectural Decision Record identifier."
+      "pattern": "^ADR-\\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$",
+      "description": "Architectural Decision Record identifier. Three-digit minimum, unbounded above. An optional kebab-case slug suffix (for example, ADR-012-choose-postgres) is permitted; existing numeric-only ids remain valid."
     },
     "bsId": {
       "type": "string",
@@ -46,23 +46,23 @@
     },
     "fbsId": {
       "type": "string",
-      "pattern": "^FBS-\\d{3,}$",
-      "description": "Functional Build Specification identifier."
+      "pattern": "^FBS-\\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$",
+      "description": "Functional Build Specification identifier. Three-digit minimum, unbounded above. An optional kebab-case slug suffix (for example, FBS-004-user-login) is permitted; existing numeric-only ids remain valid."
     },
     "tsId": {
       "type": "string",
-      "pattern": "^TS-\\d{3}$",
-      "description": "Test Suite identifier."
+      "pattern": "^TS-\\d{3,}$",
+      "description": "Test Suite identifier. Three-digit minimum, unbounded above."
     },
     "tcId": {
       "type": "string",
-      "pattern": "^TC-\\d{3}-[a-z0-9-]+$",
-      "description": "Test Case identifier. TS suffix (three digits) joined to a lowercase alphanumeric slug."
+      "pattern": "^TC-\\d{3,}-[a-z0-9-]+$",
+      "description": "Test Case identifier. TS suffix (three-digit minimum, unbounded above) joined to a lowercase alphanumeric slug."
     },
     "cnId": {
       "type": "string",
-      "pattern": "^CN-\\d{3,}$",
-      "description": "Code Node identifier. Three-digit minimum, unbounded above."
+      "pattern": "^CN-\\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$",
+      "description": "Code Node identifier. Three-digit minimum, unbounded above. An optional kebab-case slug suffix (for example, CN-042-store-validator) is permitted; existing numeric-only ids remain valid."
     },
     "version": {
       "type": "string",
@@ -94,6 +94,10 @@
       "enum": ["live", "sandboxed", "mocked", "declaredMockOnly", "notShipped"],
       "description": "How a third-party service dependency is attested by tests. Shared between fbs.dependsOnServices[] and manifest.preFlightConfig.servicesInScope[]. live: tests hit the live provider with real credentials. sandboxed: tests hit a provider-run sandbox. mocked: local fixtures or stubs; not ship-authoritative on its own. declaredMockOnly: operator has explicitly declared the FBS ships mock-only for this service. notShipped: the service is used only in local development."
     },
+    "scopeTag": {
+      "enum": ["library", "runtime", "deployed", "unclassified"],
+      "description": "Scope tag classifying where a behaviour is observable. Shared between user-story.acceptanceCriteria[].scope and test-suite.testCases[].scope. library: observable in an isolated library or fixture. runtime: observable in the running product against local integration. deployed: observable on a booted artefact against real config and real network. unclassified: migration state for chains authored before the scope-tag vocabulary shipped; ruleset-enforcing consumers decide whether unclassified is currently accepted."
+    },
     "docRef": {
       "type": "object",
       "additionalProperties": false,

package/schemas/manifest.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.stravica.io/rcf/v0.4.0/manifest.schema.json",
   "title": "RCF Project Manifest",
-  "description": "Project manifest. Roots-only shape: declares prd, tad, bs. Children are owned by their parents and discovered by walking from the roots. From 0.4.0 the manifest also carries optional records for pre-flight configuration, review audits, UI baselines, browser verification, baseline-AC opt-outs, intake classification, register-regression canaries, and the review-surface state. From 0.4.1 the manifest additionally carries optional shipWithoutVerified acknowledgements written by rcf finalise --ship-without-verified. Every added field is optional; pre-0.4.0 manifests remain valid.",
+  "description": "Project manifest. Roots-only shape: declares prd, tad, bs. Children are owned by their parents and discovered by walking from the roots. From 0.4.0 the manifest also carries optional records for pre-flight configuration, review audits, UI baselines, browser verification, baseline-AC opt-outs, intake classification, register-regression canaries, and the review-surface state. From 0.4.1 the manifest additionally carries optional shipWithoutVerified acknowledgements written by rcf finalise --ship-without-verified. From 0.4.2 the testTheatreFinding shape carries an optional anchorId and drops tsId from its required list when kind is uiBaselineDrift (the drift finding is not anchored on a test suite); every other kind still requires tsId, and any 0.4.0- or 0.4.1-valid record remains valid. Every added field is optional; pre-0.4.0 manifests remain valid.",
   "type": "object",
   "additionalProperties": false,
   "required": ["version", "projectName", "prd", "tad", "bs"],
@@ -154,8 +154,8 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^ra-FBS-\\d{3,}-\\d+$",
-          "description": "Review-audit record id. Format: ra-<fbsId>-<n>; the trailing integer increments per re-audit of the same FBS."
+          "pattern": "^ra-FBS-\\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\\d+$",
+          "description": "Review-audit record id. Format: ra-<fbsId>-<n>; the trailing integer increments per re-audit of the same FBS. Accepts both numeric-only and kebab-slug FBS ids."
         },
         "fbsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/fbsId" },
         "createdAt": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" },
@@ -178,10 +178,15 @@
     "testTheatreFinding": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["tsId", "kind", "detail", "severity"],
+      "required": ["kind", "detail", "severity"],
       "properties": {
         "tsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/tsId" },
         "tcId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/tcId" },
+        "anchorId": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Free-form anchor for findings whose kind does not map to a test suite (for example, uiBaselineDrift, which anchors on the FBS id or a file path). Optional; test-theatre kinds keep tsId as the anchor."
+        },
         "kind": {
           "enum": [
             "mockOnlyIntegrationClaim",
@@ -207,7 +212,19 @@
           "enum": ["advisory", "warn", "block"],
           "description": "Severity of the finding. Only block severities force a block verdict on the audit."
         }
-      }
+      },
+      "allOf": [
+        {
+          "if": { "properties": { "kind": { "const": "uiBaselineDrift" } }, "required": ["kind"] },
+          "then": {},
+          "else": {
+            "properties": {
+              "tsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/tsId" }
+            },
+            "required": ["tsId"]
+          }
+        }
+      ]
     },
     "mutationSamplingRecord": {
       "type": "object",
@@ -372,8 +389,8 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^bv-FBS-\\d{3,}-\\d+$",
-          "description": "Browser-verification record id. Format: bv-<fbsId>-<n>."
+          "pattern": "^bv-FBS-\\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\\d+$",
+          "description": "Browser-verification record id. Format: bv-<fbsId>-<n>. Accepts both numeric-only and kebab-slug FBS ids."
         },
         "fbsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/fbsId" },
         "createdAt": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" },
@@ -713,8 +730,8 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^swv-FBS-\\d{3,}-\\d+$",
-          "description": "Ship-without-verified acknowledgement id. Format: swv-<fbsId>-<n>; the trailing integer increments per acknowledgement of the same FBS."
+          "pattern": "^swv-FBS-\\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\\d+$",
+          "description": "Ship-without-verified acknowledgement id. Format: swv-<fbsId>-<n>; the trailing integer increments per acknowledgement of the same FBS. Accepts both numeric-only and kebab-slug FBS ids."
         },
         "fbsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/fbsId" },
         "ackedAt": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" },

package/schemas/test-suite.schema.json

@@ -45,8 +45,8 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^TC-\\d{3}-[a-z0-9-]+$",
-          "description": "Test Case identifier. TS suffix (three digits) joined to a lowercase alphanumeric slug (hyphens allowed)."
+          "pattern": "^TC-\\d{3,}-[a-z0-9-]+$",
+          "description": "Test Case identifier. TS suffix (three-digit minimum, unbounded above) joined to a lowercase alphanumeric slug (hyphens allowed)."
         },
         "acId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/acId" },
         "description": { "type": "string", "minLength": 1 },
@@ -55,6 +55,10 @@
           "description": "Optional pointer to the executable test, format: filePath::testName."
         },
         "status": { "enum": ["pending", "passing", "failing", "skipped"] },
+        "scope": {
+          "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/scopeTag",
+          "description": "Scope this test case exercises (library, runtime, deployed, unclassified). Optional at schema level; ruleset-enforcing consumers may require the TC scope to be equal to or wider than the covered AC's scope."
+        },
         "runtimeProvenance": { "$ref": "#/$defs/runtimeProvenance" }
       }
     },

package/schemas/user-story.schema.json

@@ -55,6 +55,10 @@
         "when": { "type": "string" },
         "then": { "type": "string" },
         "testable": { "type": "boolean" },
+        "scope": {
+          "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/scopeTag",
+          "description": "Scope at which this acceptance criterion is observable (library, runtime, deployed, unclassified). Optional at schema level; ruleset-enforcing consumers may require it. Governs which test scopes count as coverage for this AC."
+        },
         "provenance": { "$ref": "#/$defs/acProvenance" }
       }
     },