@stravica-ai/rcf-schemas 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -4,6 +4,60 @@ All notable changes to `@stravica-ai/rcf-schemas` are documented in this file.
 
 The format roughly follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Pre-1.0 breaking changes are signalled by a minor bump per semver 0.x convention.
 
+## 0.4.4 - 2026-08-18
+
+Additive patch bump for the blueprint-library mechanism landing in `rcf-build-lite`. Unblocks Phase 1 of the blueprint programme (`w-2026-08-18-016`) by adding the schema seams the mechanism keys to. Every change is additive: every 0.4.3-valid document remains valid, and every existing id continues to validate byte-for-byte.
+
+### Added
+
+- **`common.schema.json`**: new `$defs.blueprintSlug` and `$defs.standardSlug`, both `^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$`. Shared shape for blueprint and standards-pack slugs; referenced from `manifest.blueprints[]`, `manifest.standards[]`, and `fbs.contextRequirements.standardIds`.
+- **`manifest.schema.json`**: new optional `blueprints[]` at top level, items `$defs.appliedBlueprintRecord` (slug, version, appliedAt, source, optional namespace, optional contributions[] listing every doc id + path the blueprint contributed). Written by the `rcf blueprint` verb family (`add` on clean apply, `upgrade` on re-apply, `remove` deletes the entry). Composition (multiple applied blueprints) is expressed by multiple entries.
+- **`manifest.schema.json`**: new optional `standards[]` at top level, items `$defs.standardsPackRecord` (id `^std-<slug>$`, slug, sourcePath, optional copyPath, tags[], optional summary, `testsProvidedBy` = `standard | agent | none`, `provenance` = `personal | corporate`). Records standards-pack registrations from `rcf init` and `rcf standards add`. `copyPath` is present only when the source lived outside the project root at registration time.
+- **`fbs.schema.json`**: new optional `contextRequirements.standardIds[]`, items reference `common.standardSlug`. Host for the bundle assembler's agentic selective-retrieval step; an operator-authored value overrides the agentic selection.
+- Fixtures (valid): `fixtures/valid/manifest/manifest-008-blueprints-registered.json` (two applied blueprints, one with contributions[]), `fixtures/valid/manifest/manifest-009-standards-in-repo.json` (in-repo standards pack, no copyPath), `fixtures/valid/manifest/manifest-010-standards-copied-in.json` (out-of-root pack with copyPath), `fixtures/valid/fbs/fbs-007-standard-ids.json` (FBS with agentically-populated standardIds), `fixtures/valid/req/req-002-slug-prefix.json`, `fixtures/valid/user-story/us-005-slug-prefix.json`, `fixtures/valid/prd/prd-002-slug-prefix.json`, `fixtures/valid/build-sequence/bs-002-slug-prefix.json`, `fixtures/valid/tad/tad-002-slug-prefix.json`, `fixtures/valid/test-suite/ts-005-slug-prefix.json`, plus `fixtures/valid/manifest/manifest-011-preblueprint-chain-frozen.json` (frozen pre-0.4.3 chain snapshot used by the byte-for-byte back-compat test).
+- Fixtures (invalid): `fixtures/invalid/manifest/manifest-018-blueprint-bad-slug.json`, `fixtures/invalid/manifest/manifest-019-standards-bad-id.json`, `fixtures/invalid/fbs/fbs-013-standard-ids-non-slug.json`, `fixtures/invalid/req/req-003-slug-prefix-uppercase.json`, `fixtures/invalid/user-story/us-005-slug-prefix-trailing-hyphen.json`.
+- Tests: prefix-id cases added to `req.test.js`, `user-story.test.js`, `prd.test.js`, `build-sequence.test.js`, `tad.test.js`, `test-suite.test.js`; blueprints[] and standards[] cases added to `manifest.test.js`; contextRequirements.standardIds cases added to `fbs.test.js`; new `back-compat-freeze.test.js` asserts the frozen pre-0.4.3 chain snapshot validates byte-for-byte (sha256 pin).
+
+### Changed
+
+- **`common.schema.json`**: `prdId`, `reqId`, `usId`, `bsId`, `tadId`, `tsId` patterns widened to accept an optional lowercase kebab-slug prefix, `^([a-z][a-z0-9]*(?:-[a-z0-9]+)*-)?<PREFIX>-\d{3,}$`. Numeric-only ids continue to validate unchanged. Slug prefixes are well-formed kebab (leading letter, lowercase alnum segments joined by single hyphens; leading, trailing, and double hyphens are rejected).
+
+### Notes
+
+- Additive-only: every 0.4.3-valid document remains valid byte-for-byte. `back-compat-freeze.test.js` proves this with a hash-pinned fixture read as raw bytes.
+- Id grammar is now mixed across types: **prefix** for REQ/US/PRD/BS/TAD/TS (this bump), **suffix** for ADR/TAC/FBS/CN (already the shape from 0.4.3). This is a minimal-delta choice tonight to unblock the blueprint mechanism without churning the four types whose suffix affordance already namespaces them. Unifying the grammar is a schemas follow-up; the mixed grammar is documented and the working tools accept both.
+- The `acId` and `tcId` patterns are intentionally left unchanged. AC/TC ids are anchored to their parent US/TS chain, whose ids now carry the slug prefix; adding a redundant prefix on ACs and TCs was out of scope for tonight and adds no expressiveness.
+- Canonical `$id` URLs stay at `v0.4.0`, following the patch-release precedent set at 0.2.1, 0.3.1, 0.4.1, 0.4.2, and 0.4.3.
+- Version choice: per repo precedent (every prior additive change since 0.2.0 has bumped as a **patch**: 0.2.1, 0.3.1, 0.4.1, 0.4.2, 0.4.3), this bumps `0.4.3 -> 0.4.4`. Dave's Path A brief allowed for a minor bump if the repo convention read pattern-widening as minor; the repo convention does not: the 0.4.3 pattern-widening bump was itself a patch. Precedent wins.
+
+## 0.4.3 - 2026-08-12
+
+Additive patch bump: car 1 of the `rcf-lite` 0.8.0 slug-train. Widens four id patterns to accept an optional kebab-case slug tail (per the slug design ratified on `w-2026-07-28-012`), widens the TS and TC id patterns to drop the 999 cap, adds a shared scope-tag vocabulary in `common.schema.json`, and exposes an optional `scope` field on ACs and TCs. Every change is additive; every existing id and every existing document continues to validate.
+
+### Added
+
+- **`common.schema.json`**: new `$defs.scopeTag` enum (`library | runtime | deployed | unclassified`), shared between `user-story.acceptanceCriteria[].scope` and `test-suite.testCases[].scope`. `unclassified` is the migration state; the schema does not distinguish gate-passing values, ruleset-enforcing consumers do.
+- **`user-story.schema.json`**: new optional `scope` on `$defs.acceptanceCriterion`, referencing `common.scopeTag`. Names the scope at which the AC is observable and governs which test scopes count as coverage.
+- **`test-suite.schema.json`**: new optional `scope` on `$defs.testCase`, referencing `common.scopeTag`. Ruleset-enforcing consumers may require the TC scope to be equal to or wider than the covered AC's scope.
+- Fixtures: `fixtures/valid/fbs/fbs-006-slugged-id.json`, `fixtures/valid/cn/cn-003-slugged-id.json`, `fixtures/valid/adr/adr-004-slugged-id.json`, `fixtures/valid/tac/tac-003-slugged-id.json`, `fixtures/valid/test-suite/ts-004-widened-tsId.json` (four-digit TS with two scope-tagged TCs), `fixtures/valid/user-story/us-004-ac-scope-tags.json` (three ACs, one per scope value). Invalid coverage: `fixtures/invalid/fbs/fbs-012-uppercase-slug.json`, `fixtures/invalid/test-suite/ts-007-bad-tc-scope.json`, `fixtures/invalid/user-story/us-004-bad-ac-scope.json`.
+- Tests: slug-id cases added to `fbs.test.js`, `cn.test.js`, `adr.test.js`, `tac.test.js`; widened TS/TC id cases and TC scope cases added to `test-suite.test.js`; AC scope cases added to `user-story.test.js`; composite FBS-embedded id cases added to `manifest.test.js` (`reviewAudit.id`, `browserVerification.id`, `shipWithoutVerified.id`).
+
+### Changed
+
+- **`common.schema.json`**: `fbsId`, `cnId`, `adrId`, `tacId` patterns widened to accept an optional kebab-case slug tail, `^<PREFIX>-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$`. Numeric-only ids continue to validate unchanged. Slug segments must be lowercase alphanumeric joined by single hyphens; leading, trailing, and double hyphens are rejected. Kebab is enforced (well-formed) rather than the looser `[a-z0-9-]+` shape so downstream tools can round-trip slugs without normalisation.
+- **`common.schema.json`**: `tsId` widened from `^TS-\d{3}$` to `^TS-\d{3,}$`; `tcId` widened from `^TC-\d{3}-[a-z0-9-]+$` to `^TC-\d{3,}-[a-z0-9-]+$`. Removes the 999 cap on both, and closes the silent-skip trap in downstream walkers that were coded against the three-digit-exact pattern. TC's slug portion keeps the looser `[a-z0-9-]+` shape (legacy compatibility).
+- **`test-suite.schema.json`**: inline `testCase.id` pattern widened in lockstep with `common.tcId` (`^TC-\d{3,}-[a-z0-9-]+$`).
+- **`manifest.schema.json`**: the three FBS-embedded composite id patterns widened to accept both numeric-only and slugged FBS ids: `reviewAudit.id` (`^ra-FBS-\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\d+$`), `browserVerification.id` (`^bv-FBS-\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\d+$`), and `shipWithoutVerified.id` (`^swv-FBS-\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\d+$`). The trailing `-<n>` counter still parses cleanly against slugged FBS ids because the counter is required and anchored.
+- **`docs/id-conventions.md`**, **`docs/common.md`**, **`docs/test-suite.md`**, **`docs/user-story.md`**: updated to reflect the widened patterns, the optional slug suffix, and the `scopeTag` vocabulary.
+
+### Notes
+
+- Additive-only: every 0.4.0-, 0.4.1-, and 0.4.2-valid document remains valid. Every numeric-only id continues to validate; every existing AC and TC without a `scope` field continues to validate.
+- Canonical `$id` URLs stay at `v0.4.0`, following the patch-release precedent set at 0.2.1, 0.3.1, 0.4.1, and 0.4.2. Per the ratified umbrella exact-pin doctrine, the 0.8.0 slug-train's second and third cars (`rcf-lite-core`, `rcf-build-lite`) pin `@stravica-ai/rcf-schemas` to exactly `0.4.3` (no caret, no range) on merge; the pin review is recorded in the umbrella's release notes.
+- Slug scope (FBS, CN, ADR, TAC) is the ratified set: BS is out of scope by design (Baz ruling 2026-07-28, `w-2026-07-28-012`), and PRD, REQ, US, TAD are per-project singletons where number collisions are not the problem the slug solves.
+- Existing documents are NOT retro-slugged. The design is preferred-with-numeric-fallback; adopting slugs is opt-in per document at authoring time.
+- Downstream landmines called out on `w-2026-07-28-012` (walker.js toUpperCase stem, writer.js nextFlatId parser, hardcoded `\d{3}` in walker.js:696-699, deriveSlug 'tc' leak) live in `rcf-lite` consumers, not in this repo. They are addressed by that repo's train cars, not here.
+
 ## 0.4.2 - 2026-07-31
 
 Additive patch bump: closes the Track B N-5 review finding on the 0.7.0 train. The `testTheatreFinding` shape now expresses "not every finding kind anchors on a test suite" honestly instead of forcing a UI-drift finding to smuggle an FBS id through the `tsId` slot.

package/docs/common.md

@@ -15,19 +15,21 @@ Shared `$defs` referenced via `$ref` from every other RCF schema. ID patterns, s
 | `usId` | string, `^US-\d{3,}$` | `user-story`, `test-suite` |
 | `acId` | string, `^AC-\d{3,}(-\d+)?$` | `user-story.acceptanceCriteria[].id`, `fbs.acIds[]`, `test-suite.acId` |
 | `tadId` | string, `^TAD-\d{3,}$` | `tad`, `tac`, `adr` |
-| `tacId` | string, `^TAC-\d{3,}$` | `tac`, `fbs.contextRequirements.tacIds[]` |
-| `adrId` | string, `^ADR-\d{3,}$` | `adr`, `fbs.contextRequirements.adrIds[]` |
+| `tacId` | string, `^TAC-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$` | `tac`, `fbs.contextRequirements.tacIds[]` |
+| `adrId` | string, `^ADR-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$` | `adr`, `fbs.contextRequirements.adrIds[]` |
 | `bsId` | string, `^BS-\d{3,}$` | `build-sequence`, `fbs.bsId` |
-| `fbsId` | string, `^FBS-\d{3,}$` | `fbs.fbsId`, `fbs.dependsOnFbsIds[]` |
-| `tsId` | string, `^TS-\d{3}$` | `test-suite.id` |
-| `tcId` | string, `^TC-\d{3}-[a-z0-9-]+$` | `test-suite.testCases[].id` |
-| `cnId` | string, `^CN-\d{3,}$` | `cn.cnId`, `cn.dependencies[]` |
+| `fbsId` | string, `^FBS-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$` | `fbs.fbsId`, `fbs.dependsOnFbsIds[]` |
+| `tsId` | string, `^TS-\d{3,}$` | `test-suite.id` |
+| `tcId` | string, `^TC-\d{3,}-[a-z0-9-]+$` | `test-suite.testCases[].id` |
+| `cnId` | string, `^CN-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$` | `cn.cnId`, `cn.dependencies[]` |
 | `version` | string, `^\d+\.\d+\.\d+$` | every doc-type schema |
 | `timestamp` | string, format `date-time` | every doc-type schema |
 | `authoringStatus` | enum: `draft`, `review`, `needsRevision`, `approved`, `superseded` | PRD, REQ, US, TAD, TAC, BS |
 | `adrStatus` | enum: `draft`, `proposed`, `accepted`, `superseded`, `deprecated` | ADR |
 | `executionStatus` | enum: `notStarted`, `inProgress`, `complete`, `verified` | FBS doc + BS slot |
 | `cnStatus` | enum: `draft`, `approved`, `deprecated` | CN |
+| `attestationMode` | enum: `live`, `sandboxed`, `mocked`, `declaredMockOnly`, `notShipped` | `fbs.dependsOnServices[]`, manifest `preFlightConfig.servicesInScope[]` |
+| `scopeTag` | enum: `library`, `runtime`, `deployed`, `unclassified` | `user-story.acceptanceCriteria[].scope`, `test-suite.testCases[].scope` |
 | `docRef` | object `{ id, path }` | manifest `prd`, `tad`, `bs` |
 
 ## Why these are shared

package/docs/id-conventions.md

@@ -1,6 +1,6 @@
 # ID conventions
 
-The pattern, the prefix table, the AC sub-id form, and the file/nested asymmetry.
+The pattern, the prefix table, the AC sub-id form, the optional slug suffix, and the file/nested asymmetry.
 
 ## The pattern
 
@@ -10,7 +10,37 @@ The pattern, the prefix table, the AC sub-id form, and the file/nested asymmetry
 
 Three-digit minimum, unbounded above. `PRD-001` through `PRD-999` use the clean visual; `PRD-1000+` works without a schema migration. A single digit (`PRD-1`) is rejected.
 
-Two families deviate from the family default and are documented alongside their prefix below: `TS-\d{3}` (exactly three digits) and `TC-\d{3}-<slug>` (three-digit TS suffix plus a lowercase alphanumeric slug).
+One family layers the same three-digit-minimum tail onto a slug: `TC-\d{3,}-<slug>` (TS-suffix, three-digit minimum, unbounded above, joined to a lowercase alphanumeric slug).
+
+## Optional slug suffix (0.4.3)
+
+Four families accept an optional kebab-case slug tail: `FBS`, `CN`, `ADR`, `TAC`. The full pattern is:
+
+```
+^<PREFIX>-\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$
+```
+
+The slug is derived from the document title (kebab-case, lowercase alphanumeric segments joined by single hyphens). Leading hyphens, trailing hyphens, double hyphens, uppercase letters, and underscores are rejected.
+
+Both forms remain valid: `FBS-004` and `FBS-004-user-login` both validate. Existing numeric-only ids continue to validate; there is no forcing function. Consumers that address documents by id treat the slug as part of the id string, not a separately parseable field.
+
+Rationale: parallel authoring on branches can allocate the same number for different titles. The slug makes those distinct addresses at the filesystem and id layer, converting an add/add merge conflict into a clean co-existence. See the `rcf-lite` slug-train design for the full argument.
+
+## Optional slug prefix (0.4.4) — blueprint namespacing
+
+Six families accept an optional kebab-case slug **prefix**: `PRD`, `REQ`, `US`, `BS`, `TAD`, `TS`. The full pattern is:
+
+```
+^([a-z][a-z0-9]*(?:-[a-z0-9]+)*-)?<PREFIX>-\d{3,}$
+```
+
+The prefix is a blueprint's slug (or any well-formed kebab slug) followed by a hyphen. Examples: `spa-REQ-001`, `spa-US-101`, `rest-BS-001`, `my-blueprint-TAD-002`. Existing numeric-only ids continue to validate; the prefix is purely opt-in.
+
+This unblocks the blueprint mechanism landing in `rcf-build-lite`: blueprint-contributed docs carry the blueprint's slug as a namespace so multiple applied blueprints cannot collide on ids and every trace query names the provenance visibly.
+
+**Mixed grammar (intentional, minimal-delta):** ADR/TAC/FBS/CN carry the slug in the **suffix** (0.4.3); PRD/REQ/US/BS/TAD/TS carry it in the **prefix** (0.4.4). ADR/TAC/FBS/CN were left untouched at 0.4.4 because their suffix affordance already namespaces blueprint contributions (`TAC-002-spa-tokens`, `ADR-005-rest-versioning`). Unifying the grammar is a schemas follow-up; the mixed grammar is documented and working tools accept both.
+
+**Not extended:** `AC` and `TC` ids keep the numeric-only + AC-hierarchical / TC-slug forms. AC/TC ids are anchored to their parent US/TS chain, whose ids now carry the slug prefix; adding a redundant prefix on ACs and TCs adds no expressiveness.
 
 ## Prefix table
 
@@ -42,11 +72,11 @@ Pick per project; the schema does not enforce either form. The published `Stravi
 
 ## TS ids
 
-`^TS-\d{3}$`. Sequential, not parent-grouped: a US may have multiple TSs across levels (unit, integration, e2e, ...) and a parent-grouped id would collide. Recommended path: `rcf/test-suites/ts-001.json`.
+`^TS-\d{3,}$`. Sequential, not parent-grouped: a US may have multiple TSs across levels (unit, integration, e2e, ...) and a parent-grouped id would collide. Recommended path: `rcf/test-suites/ts-001.json`.
 
 ## TC ids
 
-`^TC-\d{3}-[a-z0-9-]+$`. TCs are nested in their parent TS's `testCases[]`. The pattern is `TC-<TS-suffix>-<slug>` where slug is a lowercase alphanumeric identifier chosen by the author (hyphens allowed). Examples: `TC-001-happy-path`, `TC-001-rejects-empty`, `TC-042-integration-boundary`. Slug uniqueness is within-TS, not global.
+`^TC-\d{3,}-[a-z0-9-]+$`. TCs are nested in their parent TS's `testCases[]`. The pattern is `TC-<TS-suffix>-<slug>` where slug is a lowercase alphanumeric identifier chosen by the author (hyphens allowed). Examples: `TC-001-happy-path`, `TC-001-rejects-empty`, `TC-042-integration-boundary`. Slug uniqueness is within-TS, not global.
 
 Rationale: sequential numbering for TCs is brittle if you renumber; slug-based ids give readable pointers in test-suite bodies and traceability queries.
 

package/docs/test-suite.md

@@ -20,7 +20,7 @@ Recommended path under the RCF tree: `rcf/test-suites/ts-001.json`. The schema v
 
 | Field | Type | Notes |
 |---|---|---|
-| `id` | `^TS-\d{3}$` | Test Suite identifier. Sequential, not parent-grouped (a US can have multiple TSs across levels). |
+| `id` | `^TS-\d{3,}$` | Test Suite identifier. Sequential, not parent-grouped (a US can have multiple TSs across levels). Three-digit minimum, unbounded above (widened in 0.4.3). |
 | `usId` | `^US-\d{3,}$` | Parent User Story. Mandatory back-reference. |
 | `title` | string, min 1 | Human-readable suite title. |
 | `purpose` | string, min 1 | One-paragraph "what this suite is testing and why". |
@@ -36,11 +36,12 @@ Each entry in `testCases[]`:
 
 | Field | Type | Required | Purpose |
 |---|---|---|---|
-| `id` | `^TC-\d{3}-[a-z0-9-]+$` | yes | TC identifier. `TC-<TS-suffix>-<slug>`; slug is a lowercase alphanumeric identifier (hyphens allowed). Slug uniqueness is within-TS, not global. |
+| `id` | `^TC-\d{3,}-[a-z0-9-]+$` | yes | TC identifier. `TC-<TS-suffix>-<slug>`; slug is a lowercase alphanumeric identifier (hyphens allowed). Slug uniqueness is within-TS, not global. TS-suffix widened to three-digit minimum, unbounded above (0.4.3). |
 | `acId` | `^AC-\d{3,}(-\d+)?$` | yes | Which AC on the parent US this TC verifies. |
 | `description` | string, min 1 | yes | What the TC covers. |
 | `testPointer` | string | no | Pointer to the executable test, `filePath::testName` format. |
 | `status` | enum | yes | `pending`, `passing`, `failing`, `skipped`. Authored in 0.2.0; derived from real test runs in Phase 6+. |
+| `scope` | `scopeTag` enum | no | `library`, `runtime`, `deployed`, `unclassified`. Optional at schema level (0.4.3). Ruleset-enforcing consumers may require the TC scope to be equal to or wider than the covered AC's scope. |
 
 ## What changed in 0.2.0
 

package/docs/user-story.md

@@ -40,6 +40,7 @@ Each AC inside `acceptanceCriteria[]`:
 | `when` | string | no | Trigger. |
 | `then` | string | no | Observable outcome. |
 | `testable` | boolean | yes | Author declares the AC is testable. |
+| `scope` | `scopeTag` enum | no | `library`, `runtime`, `deployed`, `unclassified`. Optional at schema level (0.4.3). Names the scope at which the AC is observable; governs which test scopes count as coverage. |
 
 The Given/When/Then triple is optional at the schema level so non-Gherkin teams aren't forced into it; the `testable` boolean is required to make authors stop and confirm the AC can actually be tested.
 

package/fixtures/invalid/fbs/fbs-012-uppercase-slug.json

@@ -0,0 +1,13 @@
+{
+  "fbsId": "FBS-004-UserLogin",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 4,
+  "executionStatus": "notStarted",
+  "title": "x",
+  "summary": "y",
+  "acIds": ["AC-001"],
+  "dependsOnFbsIds": [],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/invalid/fbs/fbs-013-standard-ids-non-slug.json

@@ -0,0 +1,16 @@
+{
+  "fbsId": "FBS-014",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 14,
+  "executionStatus": "notStarted",
+  "title": "Bad standardIds shape",
+  "summary": "standardIds carries an uppercase entry that is not a valid slug.",
+  "acIds": ["AC-001"],
+  "dependsOnFbsIds": [],
+  "contextRequirements": {
+    "standardIds": ["WSD-Naming"]
+  },
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/fixtures/invalid/manifest/manifest-018-blueprint-bad-slug.json

@@ -0,0 +1,15 @@
+{
+  "version": "2.0.0",
+  "projectName": "Invalid blueprint slug",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "blueprints": [
+    {
+      "slug": "SPA",
+      "version": "1.0.0",
+      "appliedAt": "2026-08-18T10:00:00Z",
+      "source": "@stravica-ai/rcf-blueprint-spa@1.0.0"
+    }
+  ]
+}

package/fixtures/invalid/manifest/manifest-019-standards-bad-id.json

@@ -0,0 +1,17 @@
+{
+  "version": "2.0.0",
+  "projectName": "Invalid standards id",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "standards": [
+    {
+      "id": "wsd-naming",
+      "slug": "wsd-naming",
+      "sourcePath": "docs/standards/wsd-naming",
+      "tags": ["naming"],
+      "testsProvidedBy": "agent",
+      "provenance": "corporate"
+    }
+  ]
+}

package/fixtures/invalid/req/req-005-slug-prefix-uppercase.json

@@ -0,0 +1,13 @@
+{
+  "reqId": "SPA-REQ-001",
+  "prdId": "PRD-001",
+  "title": "Uppercase slug prefix must be rejected",
+  "description": "Slug prefixes are lowercase kebab; upper-case must fail.",
+  "category": "functional",
+  "domain": "ui",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/fixtures/invalid/test-suite/ts-007-bad-tc-scope.json

@@ -0,0 +1,20 @@
+{
+  "id": "TS-001",
+  "usId": "US-001",
+  "title": "x",
+  "purpose": "y",
+  "testLevel": "unit",
+  "acIds": ["AC-001"],
+  "testCases": [
+    {
+      "id": "TC-001-a",
+      "acId": "AC-001",
+      "description": "TC scope is not one of the ratified vocabulary values.",
+      "status": "pending",
+      "scope": "production"
+    }
+  ],
+  "status": "draft",
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-01-01T00:00:00Z"
+}

package/fixtures/invalid/user-story/us-004-bad-ac-scope.json

@@ -0,0 +1,21 @@
+{
+  "usId": "US-001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "x",
+  "asA": "y",
+  "iWant": "z",
+  "soThat": "w",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-001",
+      "description": "AC scope is not one of the ratified vocabulary values.",
+      "testable": true,
+      "scope": "production"
+    }
+  ],
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-01-01T00:00:00Z"
+}

package/fixtures/invalid/user-story/us-005-slug-prefix-trailing-hyphen.json

@@ -0,0 +1,20 @@
+{
+  "usId": "spa--US-101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Double-hyphen slug prefix must be rejected",
+  "asA": "user",
+  "iWant": "to see this fail",
+  "soThat": "the slug grammar rejects double hyphens",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-001",
+      "description": "n/a",
+      "testable": true
+    }
+  ],
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/fixtures/valid/adr/adr-004-slugged-id.json

@@ -0,0 +1,14 @@
+{
+  "adrId": "ADR-012-choose-postgres",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Choose PostgreSQL for the primary datastore",
+  "context": "The service needs a relational store with strong consistency and mature JSON support.",
+  "decision": "Adopt PostgreSQL 16 as the primary datastore.",
+  "consequences": "Introduces PostgreSQL as a runtime dependency; simplifies query semantics.",
+  "relatedAdrs": ["ADR-005-alignment-policy"],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/build-sequence/bs-002-slug-prefix.json

@@ -0,0 +1,8 @@
+{
+  "bsId": "spa-BS-001",
+  "prdId": "PRD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/fixtures/valid/cn/cn-003-slugged-id.json

@@ -0,0 +1,10 @@
+{
+  "cnId": "CN-042-store-validator",
+  "path": "src/store/validator.js#getAjv",
+  "implementsAcIds": ["AC-102-1"],
+  "dependencies": ["CN-001", "CN-002-user-notifier"],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/fbs/fbs-006-slugged-id.json

@@ -0,0 +1,13 @@
+{
+  "fbsId": "FBS-004-user-login",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 4,
+  "executionStatus": "notStarted",
+  "title": "User login",
+  "summary": "HTML login page and session cookie on submit.",
+  "acIds": ["AC-004-1"],
+  "dependsOnFbsIds": ["FBS-001", "FBS-002-persist-notes"],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/fbs/fbs-007-standard-ids.json

@@ -0,0 +1,18 @@
+{
+  "fbsId": "FBS-014",
+  "prdId": "PRD-001",
+  "bsId": "BS-001",
+  "buildOrder": 14,
+  "executionStatus": "notStarted",
+  "title": "Wire error envelope on the POST /users endpoint",
+  "summary": "Introduce the RFC 7807 problem-details envelope on the POST /users error paths.",
+  "acIds": ["AC-014-1", "AC-014-2"],
+  "dependsOnFbsIds": [],
+  "contextRequirements": {
+    "tacIds": ["TAC-002-error-envelope"],
+    "adrIds": ["ADR-004-rfc7807"],
+    "standardIds": ["wsd-naming", "security-baseline"]
+  },
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/fixtures/valid/manifest/manifest-008-blueprints-registered.json

@@ -0,0 +1,32 @@
+{
+  "version": "2.0.0",
+  "projectName": "Composed SPA + REST project",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "blueprints": [
+    {
+      "slug": "spa",
+      "version": "1.0.0",
+      "appliedAt": "2026-08-18T10:00:00Z",
+      "source": "@stravica-ai/rcf-blueprint-spa@1.0.0",
+      "contributions": [
+        { "id": "spa-REQ-001", "path": "rcf/requirements/spa-req-001.json", "kind": "req" },
+        { "id": "spa-US-101",  "path": "rcf/user-stories/spa-us-101.json",  "kind": "us"  },
+        { "id": "TAC-002-spa-tokens", "path": "rcf/tacs/tac-002-spa-tokens.json", "kind": "tac" },
+        { "id": "ADR-004-spa-theme",  "path": "rcf/adrs/adr-004-spa-theme.json",  "kind": "adr" }
+      ]
+    },
+    {
+      "slug": "rest",
+      "version": "1.0.0",
+      "appliedAt": "2026-08-18T10:00:05Z",
+      "source": "@stravica-ai/rcf-blueprint-rest@1.0.0",
+      "namespace": "rest",
+      "contributions": [
+        { "id": "rest-REQ-001",       "path": "rcf/requirements/rest-req-001.json", "kind": "req" },
+        { "id": "ADR-005-rest-versioning", "path": "rcf/adrs/adr-005-rest-versioning.json", "kind": "adr" }
+      ]
+    }
+  ]
+}

package/fixtures/valid/manifest/manifest-009-standards-in-repo.json

@@ -0,0 +1,18 @@
+{
+  "version": "2.0.0",
+  "projectName": "In-repo standards project",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "standards": [
+    {
+      "id": "std-wsd-naming",
+      "slug": "wsd-naming",
+      "sourcePath": "docs/standards/wsd-naming",
+      "tags": ["naming", "conventions"],
+      "summary": "Naming conventions for symbols, files and endpoints across WSD services.",
+      "testsProvidedBy": "agent",
+      "provenance": "corporate"
+    }
+  ]
+}

package/fixtures/valid/manifest/manifest-010-standards-copied-in.json

@@ -0,0 +1,26 @@
+{
+  "version": "2.0.0",
+  "projectName": "Out-of-root standards project",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "standards": [
+    {
+      "id": "std-security-baseline",
+      "slug": "security-baseline",
+      "sourcePath": "/Users/thefoot/personal/patterns/security-baseline",
+      "copyPath": "rcf/standards/security-baseline",
+      "tags": ["security", "logging"],
+      "testsProvidedBy": "standard",
+      "provenance": "personal"
+    },
+    {
+      "id": "std-http-errors",
+      "slug": "http-errors",
+      "sourcePath": "docs/patterns/http-errors",
+      "tags": ["api", "errors"],
+      "testsProvidedBy": "none",
+      "provenance": "corporate"
+    }
+  ]
+}

package/fixtures/valid/manifest/manifest-011-preblueprint-chain-frozen.json

@@ -0,0 +1,8 @@
+{
+  "version": "2.0.0",
+  "projectName": "Frozen pre-0.4.3 chain manifest",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "testCommand": "pnpm -r test"
+}

package/fixtures/valid/prd/prd-002-slug-prefix.json

@@ -0,0 +1,12 @@
+{
+  "prdId": "spa-PRD-001",
+  "productName": "Blueprint-owned PRD fragment",
+  "version": "0.1.0",
+  "status": "draft",
+  "problemStatement": "Blueprint-contributed PRD fragment attached to a wider project PRD.",
+  "objectives": [
+    "Cover the SPA-specific scope the blueprint owns."
+  ],
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/fixtures/valid/req/req-002-slug-prefix.json

@@ -0,0 +1,13 @@
+{
+  "reqId": "spa-REQ-001",
+  "prdId": "PRD-001",
+  "title": "Every route ships loading, empty, error and success states",
+  "description": "Blueprint-contributed requirement: every declared route in the SPA carries all four state visuals.",
+  "category": "functional",
+  "domain": "ui",
+  "priority": "must",
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/fixtures/valid/tac/tac-003-slugged-id.json

@@ -0,0 +1,18 @@
+{
+  "tacId": "TAC-004-payment-gateway",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "name": "Payment gateway",
+  "purpose": "Server-side integration with the third-party payment provider.",
+  "responsibilities": [
+    "Issue authorization requests",
+    "Reconcile capture events"
+  ],
+  "dependencies": [
+    { "name": "Notes store", "kind": "tac", "tacId": "TAC-002-notes-store" }
+  ],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/tad/tad-002-slug-prefix.json

@@ -0,0 +1,14 @@
+{
+  "tadId": "spa-TAD-001",
+  "prdId": "PRD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "systemOverview": {
+    "executiveSummary": "Blueprint-contributed TAD fragment covering the SPA shell.",
+    "systemPurpose": "Frame the design tokens, nav shell and theme parity the SPA blueprint owns.",
+    "architecturalApproach": "Single-page application delivered light and dark by default.",
+    "keyCapabilities": ["Theme toggle", "Skeleton loaders", "Responsive layout"]
+  },
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/fixtures/valid/test-suite/ts-004-widened-tsId.json

@@ -0,0 +1,27 @@
+{
+  "id": "TS-1000",
+  "usId": "US-1001",
+  "title": "Boot integration smoke",
+  "purpose": "Cover the boot-integration observable for AC-1001-1 on a real host.",
+  "testLevel": "integration",
+  "acIds": ["AC-1001-1"],
+  "testCases": [
+    {
+      "id": "TC-1000-startup-loads-config",
+      "acId": "AC-1001-1",
+      "description": "On boot, the config loader wires and dispatches the first tick.",
+      "status": "passing",
+      "scope": "runtime"
+    },
+    {
+      "id": "TC-1000-deployed-smoke",
+      "acId": "AC-1001-1",
+      "description": "On the deployed instance, the first probe fires against a real target.",
+      "status": "passing",
+      "scope": "deployed"
+    }
+  ],
+  "status": "approved",
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/test-suite/ts-005-slug-prefix.json

@@ -0,0 +1,19 @@
+{
+  "id": "spa-TS-001",
+  "usId": "spa-US-101",
+  "title": "Loading-state coverage on every fetched route",
+  "purpose": "Assert every declared SPA route with a fetch shows a skeleton loader within 100ms.",
+  "testLevel": "unit",
+  "acIds": ["AC-001"],
+  "testCases": [
+    {
+      "id": "TC-001-happy-path",
+      "acId": "AC-001",
+      "description": "Skeleton renders synchronously for a route with a pending fetch.",
+      "status": "pending"
+    }
+  ],
+  "status": "draft",
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/fixtures/valid/user-story/us-004-ac-scope-tags.json

@@ -0,0 +1,33 @@
+{
+  "usId": "US-1001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-010",
+  "version": "0.1.0",
+  "status": "approved",
+  "title": "Signed-in owner sees the dashboard on boot",
+  "asA": "signed-in owner",
+  "iWant": "to land on the dashboard after logging in",
+  "soThat": "I can see every monitor's status at a glance",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1001-1",
+      "description": "on startup, the loader wires the config file and the first probe fires",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1001-2",
+      "description": "on the deployed instance, the first probe hits the real target within 60s of boot",
+      "testable": true,
+      "scope": "deployed"
+    },
+    {
+      "id": "AC-1001-3",
+      "description": "parseConfig rejects an empty configuration document",
+      "testable": true,
+      "scope": "library"
+    }
+  ],
+  "createdAt": "2026-08-12T09:00:00Z",
+  "updatedAt": "2026-08-12T09:00:00Z"
+}

package/fixtures/valid/user-story/us-005-slug-prefix.json

@@ -0,0 +1,20 @@
+{
+  "usId": "spa-US-101",
+  "prdId": "PRD-001",
+  "reqId": "spa-REQ-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "As a visitor I see a loading state on every fetch",
+  "asA": "first-time visitor",
+  "iWant": "to see a skeleton or spinner while data is loading",
+  "soThat": "I know the app is doing something instead of guessing whether it is broken",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-001",
+      "description": "Every route with a fetch shows a skeleton within 100ms of navigation",
+      "testable": true
+    }
+  ],
+  "createdAt": "2026-08-18T00:00:00Z",
+  "updatedAt": "2026-08-18T00:00:00Z"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/rcf-schemas",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "type": "module",
   "description": "JSON Schemas for the Requirements Confidence Framework (RCF). Language-neutral. The contract every RCF tool keys to.",
   "license": "Apache-2.0",
@@ -19,6 +19,9 @@
     "LICENSE",
     "CHANGELOG.md"
   ],
+  "scripts": {
+    "test": "node --test test/*.test.js"
+  },
   "devDependencies": {
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1"
@@ -37,8 +40,5 @@
     "json-schema",
     "specifications",
     "traceability"
-  ],
-  "scripts": {
-    "test": "node --test test/*.test.js"
-  }
-}
+  ]
+}

package/schemas/common.schema.json

@@ -2,22 +2,22 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json",
   "title": "RCF Shared Definitions",
-  "description": "Shared $defs referenced via $ref from every other RCF schema. ID patterns, status enums, version string, timestamp format, and the docRef shape. This file is not a document schema; consumers register it alongside the 11 doc-type schemas at validator init.",
+  "description": "Shared $defs referenced via $ref from every other RCF schema. ID patterns, status enums, version string, timestamp format, and the docRef shape. This file is not a document schema; consumers register it alongside the 11 doc-type schemas at validator init. From 0.4.4 the reqId/usId/prdId/bsId/tadId/tsId patterns accept an optional lowercase kebab-slug prefix (for example, spa-REQ-001) so blueprint mechanisms can contribute namespaced doc ids without colliding with project-authored ids. Existing numeric-only ids remain valid. The adrId/tacId/fbsId/cnId patterns already carry an optional kebab-slug SUFFIX (0.4.3) and are intentionally left untouched: id grammar is mixed across types for tonight (prefix for REQ/US/PRD/BS/TAD/TS; suffix for ADR/TAC/FBS/CN); unifying is a schemas follow-up.",
   "$defs": {
     "prdId": {
       "type": "string",
-      "pattern": "^PRD-\\d{3,}$",
-      "description": "PRD identifier. Three-digit minimum, unbounded above."
+      "pattern": "^([a-z][a-z0-9]*(?:-[a-z0-9]+)*-)?PRD-\\d{3,}$",
+      "description": "PRD identifier. Three-digit minimum, unbounded above. An optional lowercase kebab-slug prefix (for example, spa-PRD-001) is permitted for blueprint-contributed docs; existing numeric-only ids remain valid."
     },
     "reqId": {
       "type": "string",
-      "pattern": "^REQ-\\d{3,}$",
-      "description": "Requirement identifier."
+      "pattern": "^([a-z][a-z0-9]*(?:-[a-z0-9]+)*-)?REQ-\\d{3,}$",
+      "description": "Requirement identifier. An optional lowercase kebab-slug prefix (for example, spa-REQ-001) is permitted for blueprint-contributed docs; existing numeric-only ids remain valid."
     },
     "usId": {
       "type": "string",
-      "pattern": "^US-\\d{3,}$",
-      "description": "User Story identifier."
+      "pattern": "^([a-z][a-z0-9]*(?:-[a-z0-9]+)*-)?US-\\d{3,}$",
+      "description": "User Story identifier. An optional lowercase kebab-slug prefix (for example, spa-US-101) is permitted for blueprint-contributed docs; existing numeric-only ids remain valid."
     },
     "acId": {
       "type": "string",
@@ -26,43 +26,43 @@
     },
     "tadId": {
       "type": "string",
-      "pattern": "^TAD-\\d{3,}$",
-      "description": "Technical Architecture Document identifier."
+      "pattern": "^([a-z][a-z0-9]*(?:-[a-z0-9]+)*-)?TAD-\\d{3,}$",
+      "description": "Technical Architecture Document identifier. An optional lowercase kebab-slug prefix (for example, spa-TAD-001) is permitted for blueprint-contributed docs; existing numeric-only ids remain valid."
     },
     "tacId": {
       "type": "string",
-      "pattern": "^TAC-\\d{3,}$",
-      "description": "Technical Architecture Component identifier."
+      "pattern": "^TAC-\\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$",
+      "description": "Technical Architecture Component identifier. Three-digit minimum, unbounded above. An optional kebab-case slug suffix (for example, TAC-004-payment-gateway) is permitted; existing numeric-only ids remain valid."
     },
     "adrId": {
       "type": "string",
-      "pattern": "^ADR-\\d{3,}$",
-      "description": "Architectural Decision Record identifier."
+      "pattern": "^ADR-\\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$",
+      "description": "Architectural Decision Record identifier. Three-digit minimum, unbounded above. An optional kebab-case slug suffix (for example, ADR-012-choose-postgres) is permitted; existing numeric-only ids remain valid."
     },
     "bsId": {
       "type": "string",
-      "pattern": "^BS-\\d{3,}$",
-      "description": "Build Sequence identifier."
+      "pattern": "^([a-z][a-z0-9]*(?:-[a-z0-9]+)*-)?BS-\\d{3,}$",
+      "description": "Build Sequence identifier. An optional lowercase kebab-slug prefix (for example, spa-BS-001) is permitted for blueprint-contributed docs; existing numeric-only ids remain valid."
     },
     "fbsId": {
       "type": "string",
-      "pattern": "^FBS-\\d{3,}$",
-      "description": "Functional Build Specification identifier."
+      "pattern": "^FBS-\\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$",
+      "description": "Functional Build Specification identifier. Three-digit minimum, unbounded above. An optional kebab-case slug suffix (for example, FBS-004-user-login) is permitted; existing numeric-only ids remain valid."
     },
     "tsId": {
       "type": "string",
-      "pattern": "^TS-\\d{3}$",
-      "description": "Test Suite identifier."
+      "pattern": "^([a-z][a-z0-9]*(?:-[a-z0-9]+)*-)?TS-\\d{3,}$",
+      "description": "Test Suite identifier. Three-digit minimum, unbounded above. An optional lowercase kebab-slug prefix (for example, spa-TS-001) is permitted for blueprint-contributed docs; existing numeric-only ids remain valid."
     },
     "tcId": {
       "type": "string",
-      "pattern": "^TC-\\d{3}-[a-z0-9-]+$",
-      "description": "Test Case identifier. TS suffix (three digits) joined to a lowercase alphanumeric slug."
+      "pattern": "^TC-\\d{3,}-[a-z0-9-]+$",
+      "description": "Test Case identifier. TS suffix (three-digit minimum, unbounded above) joined to a lowercase alphanumeric slug."
     },
     "cnId": {
       "type": "string",
-      "pattern": "^CN-\\d{3,}$",
-      "description": "Code Node identifier. Three-digit minimum, unbounded above."
+      "pattern": "^CN-\\d{3,}(-[a-z0-9]+(?:-[a-z0-9]+)*)?$",
+      "description": "Code Node identifier. Three-digit minimum, unbounded above. An optional kebab-case slug suffix (for example, CN-042-store-validator) is permitted; existing numeric-only ids remain valid."
     },
     "version": {
       "type": "string",
@@ -94,6 +94,20 @@
       "enum": ["live", "sandboxed", "mocked", "declaredMockOnly", "notShipped"],
       "description": "How a third-party service dependency is attested by tests. Shared between fbs.dependsOnServices[] and manifest.preFlightConfig.servicesInScope[]. live: tests hit the live provider with real credentials. sandboxed: tests hit a provider-run sandbox. mocked: local fixtures or stubs; not ship-authoritative on its own. declaredMockOnly: operator has explicitly declared the FBS ships mock-only for this service. notShipped: the service is used only in local development."
     },
+    "scopeTag": {
+      "enum": ["library", "runtime", "deployed", "unclassified"],
+      "description": "Scope tag classifying where a behaviour is observable. Shared between user-story.acceptanceCriteria[].scope and test-suite.testCases[].scope. library: observable in an isolated library or fixture. runtime: observable in the running product against local integration. deployed: observable on a booted artefact against real config and real network. unclassified: migration state for chains authored before the scope-tag vocabulary shipped; ruleset-enforcing consumers decide whether unclassified is currently accepted."
+    },
+    "blueprintSlug": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",
+      "description": "Blueprint slug in lowercase kebab (for example, spa, rest, msg-consumer). Same shape as the id-prefix slug that namespaces blueprint-contributed docs."
+    },
+    "standardSlug": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",
+      "description": "Standards-pack slug in lowercase kebab (for example, wsd-naming, security-baseline). Used by manifest.standards[] and referenced by fbs.contextRequirements.standardIds."
+    },
     "docRef": {
       "type": "object",
       "additionalProperties": false,

package/schemas/fbs.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.stravica.io/rcf/v0.4.0/fbs.schema.json",
   "title": "RCF Functional Build Spec",
-  "description": "Functional Build Specification. One per build session. Carries the mandatory bsId parent reference plus buildOrder and executionStatus. Owns its acIds[] scope (Acceptance Criteria delivered by this FBS) and its dependsOnFbsIds[] graph edge (other FBSs this one depends on).",
+  "description": "Functional Build Specification. One per build session. Carries the mandatory bsId parent reference plus buildOrder and executionStatus. Owns its acIds[] scope (Acceptance Criteria delivered by this FBS) and its dependsOnFbsIds[] graph edge (other FBSs this one depends on). From 0.4.4 the contextRequirements block carries an optional standardIds[] array. It is the host for the bundle assembler's selective-retrieval step: the assembler analyses the FBS work text against the manifest.standards[] tag vocabulary and populates standardIds for that bundle only, or honours an operator override authored on the FBS. Every added field is optional; pre-0.4.4 FBSes remain valid.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -57,6 +57,11 @@
           "type": "array",
           "items": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/adrId" }
         },
+        "standardIds": {
+          "type": "array",
+          "items": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/standardSlug" },
+          "description": "Standards-pack slugs (from manifest.standards[]) that apply to this FBS. Populated by the bundle assembler's agentic selective-retrieval step at bundle-assembly time; an operator-authored value overrides the agentic selection for that FBS. Empty or absent means no standards content is included in the bundle; the assembler never blocks on an empty selection."
+        },
         "existingModules": {
           "type": "array",
           "items": { "type": "string" }

package/schemas/manifest.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.stravica.io/rcf/v0.4.0/manifest.schema.json",
   "title": "RCF Project Manifest",
-  "description": "Project manifest. Roots-only shape: declares prd, tad, bs. Children are owned by their parents and discovered by walking from the roots. From 0.4.0 the manifest also carries optional records for pre-flight configuration, review audits, UI baselines, browser verification, baseline-AC opt-outs, intake classification, register-regression canaries, and the review-surface state. From 0.4.1 the manifest additionally carries optional shipWithoutVerified acknowledgements written by rcf finalise --ship-without-verified. From 0.4.2 the testTheatreFinding shape carries an optional anchorId and drops tsId from its required list when kind is uiBaselineDrift (the drift finding is not anchored on a test suite); every other kind still requires tsId, and any 0.4.0- or 0.4.1-valid record remains valid. Every added field is optional; pre-0.4.0 manifests remain valid.",
+  "description": "Project manifest. Roots-only shape: declares prd, tad, bs. Children are owned by their parents and discovered by walking from the roots. From 0.4.0 the manifest also carries optional records for pre-flight configuration, review audits, UI baselines, browser verification, baseline-AC opt-outs, intake classification, register-regression canaries, and the review-surface state. From 0.4.1 the manifest additionally carries optional shipWithoutVerified acknowledgements written by rcf finalise --ship-without-verified. From 0.4.2 the testTheatreFinding shape carries an optional anchorId and drops tsId from its required list when kind is uiBaselineDrift (the drift finding is not anchored on a test suite); every other kind still requires tsId, and any 0.4.0- or 0.4.1-valid record remains valid. From 0.4.4 the manifest carries two optional additive sections that host the blueprint-library mechanism: blueprints[] (applied-blueprints registry written by rcf blueprint add / remove / upgrade) and standards[] (standards-pack registry written at rcf init and rcf standards add). Every added field is optional; pre-0.4.0 manifests remain valid.",
   "type": "object",
   "additionalProperties": false,
   "required": ["version", "projectName", "prd", "tad", "bs"],
@@ -55,6 +55,16 @@
       "type": "array",
       "items": { "$ref": "#/$defs/shipWithoutVerifiedRecord" },
       "description": "Operator acknowledgements recorded when rcf finalise --ship-without-verified acknowledges a MOCK-ONLY-DECLARED or BLOCKED-BY-DECLARATION verdict on the verify report and ships the FBS at complete without promoting to verified. One entry per acknowledgement (verification-integrity-cluster-spec section 5.2). The ack is durable and greppable at ship time."
+    },
+    "blueprints": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/appliedBlueprintRecord" },
+      "description": "Applied-blueprints registry. One entry per rcf blueprint add / upgrade invocation on the project. Records the blueprint's slug, applied version, source, namespace and the ids and paths the blueprint contributed to the tree. Written by the rcf blueprint verb family; read by rcf blueprint list / remove / upgrade. Optional; projects that never call rcf blueprint have no entries. Composition (multiple applied blueprints) is expressed by multiple entries with distinct slugs."
+    },
+    "standards": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/standardsPackRecord" },
+      "description": "Standards-pack registry. One entry per standards folder registered at rcf init (or later via rcf standards add). Records the pack's id, slug, source path, optional copy path (present only when the source lived outside the project root and was copied into rcf/standards/<slug>/ for portability), tag vocabulary, testsProvidedBy classification, and provenance. Read by the bundle assembler's selective-retrieval step when populating fbs.contextRequirements.standardIds. Optional; projects that register no standards have no entries."
     }
   },
   "$defs": {
@@ -154,8 +164,8 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^ra-FBS-\\d{3,}-\\d+$",
-          "description": "Review-audit record id. Format: ra-<fbsId>-<n>; the trailing integer increments per re-audit of the same FBS."
+          "pattern": "^ra-FBS-\\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\\d+$",
+          "description": "Review-audit record id. Format: ra-<fbsId>-<n>; the trailing integer increments per re-audit of the same FBS. Accepts both numeric-only and kebab-slug FBS ids."
         },
         "fbsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/fbsId" },
         "createdAt": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" },
@@ -389,8 +399,8 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^bv-FBS-\\d{3,}-\\d+$",
-          "description": "Browser-verification record id. Format: bv-<fbsId>-<n>."
+          "pattern": "^bv-FBS-\\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\\d+$",
+          "description": "Browser-verification record id. Format: bv-<fbsId>-<n>. Accepts both numeric-only and kebab-slug FBS ids."
         },
         "fbsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/fbsId" },
         "createdAt": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" },
@@ -730,8 +740,8 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^swv-FBS-\\d{3,}-\\d+$",
-          "description": "Ship-without-verified acknowledgement id. Format: swv-<fbsId>-<n>; the trailing integer increments per acknowledgement of the same FBS."
+          "pattern": "^swv-FBS-\\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\\d+$",
+          "description": "Ship-without-verified acknowledgement id. Format: swv-<fbsId>-<n>; the trailing integer increments per acknowledgement of the same FBS. Accepts both numeric-only and kebab-slug FBS ids."
         },
         "fbsId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/fbsId" },
         "ackedAt": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" },
@@ -764,6 +774,102 @@
           "description": "Optional verify-supplied reason string carried through from the report entry."
         }
       }
+    },
+    "appliedBlueprintRecord": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["slug", "version", "appliedAt", "source"],
+      "properties": {
+        "slug": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/blueprintSlug" },
+        "version": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/version" },
+        "appliedAt": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/timestamp" },
+        "source": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Where the blueprint was resolved from at apply time (for example, a registry path, a git ref, or a local file path). Provenance for rcf blueprint upgrade."
+        },
+        "namespace": {
+          "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/blueprintSlug",
+          "description": "Doc-id namespace used for this blueprint's contributions. Defaults to slug when omitted; the field exists so an operator can rename the namespace at add-time to avoid a project-authored slug collision."
+        },
+        "contributions": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/appliedBlueprintContribution" },
+          "description": "Every doc id and file path the blueprint contributed to the tree at apply time. Makes rcf blueprint remove and rcf blueprint upgrade mechanical: remove deletes exactly these paths and refuses when any project-authored doc references any of these ids; upgrade diffs the new contribution set against this one."
+        }
+      },
+      "description": "One applied-blueprint record. Written by rcf blueprint add on clean apply and rewritten by rcf blueprint upgrade; removed by rcf blueprint remove."
+    },
+    "appliedBlueprintContribution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "path"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Contributed doc id (for example, spa-REQ-001, or TAC-002-spa-logging when the doc kind namespaces via kebab-suffix). Schema-wise a minLength: 1 string because the union of all doc-id patterns is enforced at the owning doc's schema."
+        },
+        "path": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Project-relative path the contribution was written to (for example, rcf/requirements/spa-req-001.json)."
+        },
+        "kind": {
+          "enum": ["prd", "req", "us", "tad", "tac", "adr", "bs", "fbs", "ts", "cn"],
+          "description": "Optional doc-kind classifier. Purely informational; the id + path pair is authoritative."
+        },
+        "scope": {
+          "enum": ["global"],
+          "description": "ADR contributions only: marks a whole-project decision (auth model, error envelope, versioning strategy). Two applied blueprints each contributing a scope:global ADR on the same topic is a hard conflict, surfaced by rcf blueprint add. Absent for non-global contributions."
+        },
+        "topic": {
+          "type": "string",
+          "minLength": 1,
+          "description": "ADR contributions only, required in practice when scope=global: the topic key the conflict detector matches on (for example, 'versioning', 'auth', 'errorEnvelope'). Absent for non-global contributions."
+        }
+      }
+    },
+    "standardsPackRecord": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "slug", "sourcePath", "tags", "testsProvidedBy", "provenance"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^std-[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",
+          "description": "Standards-pack record id. Format: std-<slug>. Slug is repeated in the id so the record id is grep-friendly across the manifest."
+        },
+        "slug": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/standardSlug" },
+        "sourcePath": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Path to the standards content. When the source lives inside the project root the pack is referenced in place (no copy is written); when outside, the pack is copied into rcf/standards/<slug>/ and copyPath records the copy destination."
+        },
+        "copyPath": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Present only when sourcePath was outside the project root at registration time. Points at the in-tree mirror under rcf/standards/<slug>/. Absent for in-repo sources (reference-by-default)."
+        },
+        "tags": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1 },
+          "description": "Ordered tag vocabulary for this pack (for example, naming, security, logging, ui, api). Read by the bundle assembler's selective-retrieval step alongside the pack summary when scoring relevance to an FBS's work text."
+        },
+        "summary": {
+          "type": "string",
+          "description": "Short human-readable summary of the pack's scope. Read by the selective-retrieval step; omitted for guidance-only packs where the tags carry enough signal."
+        },
+        "testsProvidedBy": {
+          "enum": ["standard", "agent", "none"],
+          "description": "How adherence to this pack is expressed. standard: the pack ships adherence checks that convert into ACs in the tree at registration or standards add time. agent: the working agent derives adherence from the pack's prose during build. none: guidance-only; the pack contributes prose that lands in the bundle but no adherence tests."
+        },
+        "provenance": {
+          "enum": ["personal", "corporate"],
+          "description": "Records whether the pack is a personal pattern collection or a corporate standards library. Reads at bundle-time as informational; init records the distinction so a project-level report can name where each pack came from."
+        }
+      },
+      "description": "One standards-pack registration. Written by rcf init (during standards prompting) and rcf standards add; read by the bundle assembler's selective-retrieval step."
     }
   }
 }

package/schemas/test-suite.schema.json

@@ -45,8 +45,8 @@
       "properties": {
         "id": {
           "type": "string",
-          "pattern": "^TC-\\d{3}-[a-z0-9-]+$",
-          "description": "Test Case identifier. TS suffix (three digits) joined to a lowercase alphanumeric slug (hyphens allowed)."
+          "pattern": "^TC-\\d{3,}-[a-z0-9-]+$",
+          "description": "Test Case identifier. TS suffix (three-digit minimum, unbounded above) joined to a lowercase alphanumeric slug (hyphens allowed)."
         },
         "acId": { "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/acId" },
         "description": { "type": "string", "minLength": 1 },
@@ -55,6 +55,10 @@
           "description": "Optional pointer to the executable test, format: filePath::testName."
         },
         "status": { "enum": ["pending", "passing", "failing", "skipped"] },
+        "scope": {
+          "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/scopeTag",
+          "description": "Scope this test case exercises (library, runtime, deployed, unclassified). Optional at schema level; ruleset-enforcing consumers may require the TC scope to be equal to or wider than the covered AC's scope."
+        },
         "runtimeProvenance": { "$ref": "#/$defs/runtimeProvenance" }
       }
     },

package/schemas/user-story.schema.json

@@ -55,6 +55,10 @@
         "when": { "type": "string" },
         "then": { "type": "string" },
         "testable": { "type": "boolean" },
+        "scope": {
+          "$ref": "https://schemas.stravica.io/rcf/v0.4.0/common.schema.json#/$defs/scopeTag",
+          "description": "Scope at which this acceptance criterion is observable (library, runtime, deployed, unclassified). Optional at schema level; ruleset-enforcing consumers may require it. Governs which test scopes count as coverage for this AC."
+        },
         "provenance": { "$ref": "#/$defs/acProvenance" }
       }
     },