@stravica-ai/rcf-schemas 0.6.1 → 0.6.3

package/CHANGELOG.md

@@ -4,6 +4,58 @@ All notable changes to `@stravica-ai/rcf-schemas` are documented in this file.
 
 The format roughly follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Pre-1.0 breaking changes are signalled by a minor bump per semver 0.x convention.
 
+## 0.6.3 - 2026-09-17
+
+Patch bump for the last two schema-shaped claims on the rcf-lite 0.28.0 referee-guarantees train (docs claims C-33 and C-38). Adds an additive, optional `shipWithoutEval[]` carrier on the manifest (sister of `shipWithoutVerified`, written by `rcf finalise --ship-without-eval`), and an additive, optional `applicable` boolean on `browserVerificationProbePackCheck` (mirrors the pack-level `applicable`, so a check whose own `appliesTo` predicate returned false records `applicable: false` at the check level without a stray verdict or severity). Every change is additive: every 0.6.2-valid manifest keeps validating.
+
+Patch semver convention: URLs pinned at `v0.6.0`. No breaking change; every 0.6.2-valid document keeps validating.
+
+### Added
+
+- **`manifest.schema.json`**: new optional `shipWithoutEval` array on the top-level properties. Items are the new `$defs.shipWithoutEvalRecord` def: required `id` (pattern `^swe-FBS-\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\d+$`, mirroring the `swv-` family and accepting both numeric-only and kebab-slug FBS ids), `fbsId`, `ackedAt` (ISO timestamp), `reason` (min-length-1 string, the operator's `--ship-without-eval "<reason>"` argument), `declaredAcs` (min-items-1, items are the new `$defs.shipWithoutEvalDeclaredAc` def with required `acId` and `verdict` enum `EVAL-MISSING | EVAL-BELOW-THRESHOLD`, plus an optional verify-supplied `reason`), and `reportPath` (min-length-1 string). `additionalProperties: false` on both new objects. Written by `packages/rcf-lite/src/finalise/ship-without-eval.js`; the writer's file header (rcf-lite `main` at time of this release) already names the exact deltas landed here.
+- **`manifest.schema.json`**: new optional `applicable` boolean on `$defs.browserVerificationProbePackCheck`. When present and false, `verdict` and `severity` are omitted and the aggregate verdict rule (per spec section 3.4) treats the check as neither pass nor fail. When absent or true, the pre-0.6.3 requiredness of `verdict` and `severity` is preserved via an `if/then` guard, so every 0.6.1-valid check keeps validating. Mirrors the pack-level `applicable` on `browserVerificationProbePack`. Emitted by `packages/rcf-lite/src/browser-verify/pack-runner.js` from rcf-lite 0.28.0 for a check whose own `appliesTo` predicate returned false (rcf-lite `main` file header names the check-level `applicable: false` write path that this schema addition unblocks).
+- **`manifest.schema.json`**: top-level `description` extended to name the new `shipWithoutEval[]` field and the check-level `applicable` flag, following the "From 0.X.Y the manifest additionally carries..." precedent set at 0.4.1, 0.4.4, 0.4.5, and 0.5.1.
+- **Fixtures (valid)**: `fixtures/valid/manifest/manifest-015-ship-without-eval.json` (one ack with two `declaredAcs`, one carrying an optional verify-supplied `reason`, both verdict enum values exercised), `fixtures/valid/manifest/manifest-016-probe-pack-check-applicable-false.json` (a probe-pack with three checks: two normal `pass`, one `applicable: false` with a detail and no verdict / severity).
+- **Fixtures (invalid)**: `fixtures/invalid/manifest/manifest-024-ship-without-eval-bad-id.json` (id does not match the `swe-FBS-<n>` pattern), `fixtures/invalid/manifest/manifest-025-ship-without-eval-missing-reason.json` (record missing the required `reason`), `fixtures/invalid/manifest/manifest-026-probe-pack-check-applicable-omitted-no-verdict.json` (a check omits `applicable` and omits `verdict` / `severity`, so the back-compat requiredness fires).
+- **Tests**: `test/manifest.test.js` gains 15 cases: 11 for `shipWithoutEval` (positive shape, both verdict enum values, slugged FBS id, id-pattern rejection, verdict enum restriction, `reason` requiredness with both missing and empty-string, empty `declaredAcs` rejection, missing `fbsId`, empty `reportPath`, unknown-property rejection on the record, and a back-compat absent-`shipWithoutEval` case); 4 for the check-level `applicable` field (positive `applicable: false` with no verdict / severity, `applicable: true` still requires verdict + severity, back-compat check without `applicable` still requires verdict + severity, `applicable` typed as boolean not string). Total suite grows from 350 to 365.
+
+### Migration
+
+- **Existing chains on 0.6.2**: bump `@stravica-ai/rcf-schemas` to `0.6.3`. Every existing document keeps validating; both additions are optional and unknown to pre-0.6.3 callers.
+- **rcf-lite consumer bump**: `rcf-lite` pins `@stravica-ai/rcf-schemas` exactly. rcf-lite 0.28.0 already emits both shapes (the `shipWithoutEval[]` writer and the check-level `applicable: false` path); the follow-up rcf-lite PR bumps its schema pin to `0.6.3` and drops the two "schema-skipped" workarounds (the manifest-write validator skip in `ship-without-eval.js` and the `verdict: 'skipped'` fallback in the check-level applicability arm of `pack-runner.js`) so both writers persist through the strict validator.
+
+### Notes
+
+- Traces to work item `w-2026-09-16-dave-019` (project `rcf-lite-wsd`) and the referee-guarantees train that shipped rcf-lite 0.28.0 (referee page docs claims C-33 for `shipWithoutEval` and C-38 for check-level `applicable`).
+- The check-level `applicable` change uses a JSON Schema `if / then` conditional (mirroring the pattern set by the `uiBaselineDrift` per-kind `tsId` requiredness rule at 0.4.2): the `if` matches only when `applicable` is present with value `false`, so the `then` clause requiring `verdict` and `severity` is applied to every other case (absent `applicable` and `applicable: true` alike). Back-compat for every pre-0.6.3 probe-pack check is preserved.
+- Sub-defs for `shipWithoutEval` sit alongside the existing `shipWithoutVerifiedRecord` and `shipWithoutVerifiedDeclaredAc` peers; the id family (`swe-FBS-<n>`) and verdict enum (`EVAL-MISSING | EVAL-BELOW-THRESHOLD`) are the eval-node analogues of the verify-integrity `swv-FBS-<n>` and `MOCK-ONLY-DECLARED | BLOCKED-BY-DECLARATION` shapes.
+
+## 0.6.2 - 2026-09-09
+
+Patch bump for four additive, optional fields that let a blueprint's own layers point at their owning artefacts rather than restating shapes and promises inline. Adds `deliveredBy` on the requirement record (naming the TAC or ADR that delivers the requirement's externally promised property), and `ownerRef`, `disposition`, and `vendorCitation` on the acceptance criterion inline on a user story. Every change is additive: every 0.6.1-valid document remains valid.
+
+Patch semver convention: URLs pinned at `v0.6.0`. No breaking change; every 0.6.1-valid document keeps validating.
+
+### Added
+
+- **`req.schema.json`**: new optional `deliveredBy` on the requirement record, `$defs.deliveredBy`. Object with three optional sub-fields (`tacId` via the shared `common.$defs.tacId` pattern, `adrId` via `common.$defs.adrId`, and a min-length-1 `field` string carrying an optional dotted path into the delivering record). `additionalProperties: false` on the object. All sub-fields are optional at the schema surface so the record composes additively; consumer rulesets that gate the delivery link may require at least one of `tacId` or `adrId`.
+- **`user-story.schema.json`**: new optional `ownerRef` on the inline `$defs.acceptanceCriterion`, `$defs.acOwnerRef`. Same shape as `deliveredBy` (optional `tacId`, optional `adrId`, optional `field`), naming the owning TAC or ADR an acceptance criterion references instead of restating. `additionalProperties: false`.
+- **`user-story.schema.json`**: new optional `disposition` on the inline `$defs.acceptanceCriterion`, `$defs.acDisposition`. Enum `fixed | template`. Marks whether the criterion is the blueprint's to fix (mechanism-invariant, inherited unchanged by every applying project) or the applying agent's to set (project-parameterised, shape-given and value-open). Absence carries no default: a consumer that requires the marker treats an unmarked AC as a defect, and a consumer that does not require it ignores the absence.
+- **`user-story.schema.json`**: new optional `vendorCitation` on the inline `$defs.acceptanceCriterion`, `$defs.acVendorCitation`. Object with two required sub-fields (`url`, JSON Schema `format: uri`, min-length-1; `verifiedOn`, `format: date`, ISO-8601 `YYYY-MM-DD`) for any criterion whose truth rests on a third-party platform fact. `additionalProperties: false`. Consumers may fetch the URL at gate time so a dead link is a finding, and may compare `verifiedOn` against a tolerance window.
+- **Fixtures (valid)**: `fixtures/valid/req/req-004-delivered-by.json` (a REQ with `deliveredBy` pointing at a TAC field), `fixtures/valid/user-story/us-006-ac-ownership-and-disposition.json` (a US with two ACs exercising `ownerRef`, `disposition` at both enum values, and `vendorCitation`).
+- **Fixtures (invalid)**: `fixtures/invalid/req/req-006-delivered-by-not-object.json` (deliveredBy as a bare id string), `fixtures/invalid/user-story/us-006-ac-owner-ref-not-object.json` (ownerRef as a bare id string), `fixtures/invalid/user-story/us-007-ac-disposition-bad-enum.json` (disposition outside the `fixed | template` enum), `fixtures/invalid/user-story/us-008-ac-vendor-citation-missing-verified-on.json` (vendorCitation object missing its required `verifiedOn` date).
+- **Tests**: `test/req.test.js` gains 7 cases for `deliveredBy` (optional back-compat, TAC-pointing, ADR-pointing, empty object, string rejection, unknown-property rejection, bad-tacId-shape rejection). `test/user-story.test.js` gains 13 cases across `ownerRef`, `disposition`, and `vendorCitation` (both enum values, both id targets, missing required sub-fields, bad `verifiedOn` format, unknown property rejections, and a combined-shape case alongside `scope`, `determinism`-adjacent optional fields, and `provenance`). Total suite grows from 330 to 350.
+
+### Migration
+
+- **Existing chains on 0.6.1**: bump `@stravica-ai/rcf-schemas` to `0.6.2`. Every existing document keeps validating; all four fields are optional and unknown to pre-0.6.2 callers.
+- **Consumers that inline the AC record**: pre-0.6.2 code that used `additionalProperties: false` at the AC level via a local extension keeps refusing the new fields until the consumer's own schema pins are bumped. The shared record accepts the fields immediately.
+
+### Notes
+
+- Sub-defs sit alongside the existing `acProvenance` peer on the user story schema, and alongside `reqShapeClassification` on the requirement schema. Both `deliveredBy` and `acOwnerRef` are the same {`tacId?`, `adrId?`, `field?`} shape but defined per file rather than in `common.schema.json`, on the same grounds as `reqShapeClassification` and `acProvenance`: a small, record-local $def keeps the change surface additive on exactly the two files it lives on.
+- The lint mechanics that consume these fields (single-definition ownership, REQ delivery, disposition ledger, vendor-citation freshness) live in the consuming `rcf-lite` build, not in this schema. The schema surface stays validation-only.
+
 ## 0.6.1 - 2026-09-05
 
 Patch bump for the T-0 visual-round Playwright-first ship-gate seam (`projects/blueprint-library/specs/visual-round-spec-2026-09-04.md`, section 3.4). Adds an additive, optional `probePacks[]` carrier on `browserVerificationRecord` so the record shape that rcf-lite's `packages/rcf-lite/src/browser-verify/pack-runner.js` already emits (per pack `packName`, `packVersion`, `blueprintSlug`, `applicable`, `checks[]`, optional `preChecks[]`, optional pack-level `detail` string) can persist without tripping `additionalProperties: false`.

package/docs/req.md

@@ -27,6 +27,7 @@ Individual Requirement within a PRD. One file per REQ. Recommended path: `rcf/re
 |---|---|---|
 | `rationale` | string | Why this REQ exists. |
 | `tags` | array of strings | Free-form tags for grouping or filtering. |
+| `deliveredBy` | object: `{tacId?, adrId?, field?}` | 0.6.2. Back-reference naming the TAC or ADR that delivers the requirement's externally promised property (a global staleness ceiling, an anti-enumeration guarantee, a forward-only migration invariant, a boot-event contract). `tacId` and `adrId` re-use the shared id patterns; `field` is an optional dotted path into the delivering record (for example, `responsibilities.replicationCeiling` or `decision.retryPolicy`). All sub-fields optional at schema level so the record composes additively; consumer rulesets may require at least one of `tacId` or `adrId` on a REQ that promises an externally observable property. `additionalProperties: false`. |
 
 ## Why REQ is its own file
 

package/docs/user-story.md

@@ -44,6 +44,9 @@ Each AC inside `acceptanceCriteria[]`:
 | `testable` | boolean | yes | Author declares the AC is testable. |
 | `scope` | `scopeTag` enum | no | `library`, `runtime`, `deployed`, `unclassified`. Optional at schema level (0.4.3). Names the scope at which the AC is observable; governs which test scopes count as coverage. |
 | `determinism` | enum: `deterministic`, `nonDeterministic` | no | 0.6.0. Author's declaration of whether the AC's observable output is deterministic or non-deterministic (LLM-generated text, ranked results, generated code, judgement calls). Optional at schema level; absence is treated as `deterministic` by every consumer. Governs whether an EVAL is required by `rcf audit eval coverage --strict` and whether the merge gate emits `EVAL-MISSING` / `EVAL-BELOW-THRESHOLD` per-AC verdicts. |
+| `ownerRef` | object: `{tacId?, adrId?, field?}` | no | 0.6.2. Back-reference naming the owning TAC or ADR the criterion observes rather than restating. `tacId` and `adrId` re-use the shared id patterns; `field` is an optional dotted path into the owning record (for example, `interfaces.principal.fields` or `decision.retryPolicy`) pinpointing the surface. All sub-fields optional at schema level so the record composes additively; consumers may require at least one of `tacId` or `adrId` when the criterion references an owning artefact. `additionalProperties: false`. |
+| `disposition` | enum: `fixed`, `template` | no | 0.6.2. Marks whether the criterion is the blueprint's to fix (mechanism-invariant, inherited unchanged by every applying project) or the applying agent's to set (project-parameterised, shape-given and value-open). Optional at schema level; consumer rulesets that gate blueprint contributions may require it on every AC of a shipped blueprint. Absence carries no default: a consumer that requires the marker treats an unmarked AC as a defect, and a consumer that does not require it ignores the absence. |
+| `vendorCitation` | object: `{url, verifiedOn}` | no | 0.6.2. Vendor citation for a criterion whose truth rests on a third-party platform fact. Both sub-fields required when the object is present: `url` is the vendor documentation URL (JSON Schema `format: uri`); `verifiedOn` is the ISO-8601 date (`format: date`, `YYYY-MM-DD`) the fact was verified against that URL. Consumers may fetch the URL at gate time so a dead link is a finding, and may compare `verifiedOn` against a tolerance window. `additionalProperties: false`. |
 
 The Given/When/Then triple is optional at the schema level so non-Gherkin teams aren't forced into it; the `testable` boolean is required to make authors stop and confirm the AC can actually be tested.
 

package/fixtures/invalid/manifest/manifest-024-ship-without-eval-bad-id.json

@@ -0,0 +1,19 @@
+{
+  "version": "2.0.0",
+  "projectName": "Ship-without-eval bad id",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "shipWithoutEval": [
+    {
+      "id": "not-a-swe-id",
+      "fbsId": "FBS-015",
+      "ackedAt": "2026-09-16T14:20:00Z",
+      "reason": "reason string",
+      "declaredAcs": [
+        { "acId": "AC-1501-2", "verdict": "EVAL-MISSING" }
+      ],
+      "reportPath": ".rcf-verify-report.json"
+    }
+  ]
+}

package/fixtures/invalid/manifest/manifest-025-ship-without-eval-missing-reason.json

@@ -0,0 +1,18 @@
+{
+  "version": "2.0.0",
+  "projectName": "Ship-without-eval missing reason",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "shipWithoutEval": [
+    {
+      "id": "swe-FBS-015-1",
+      "fbsId": "FBS-015",
+      "ackedAt": "2026-09-16T14:20:00Z",
+      "declaredAcs": [
+        { "acId": "AC-1501-2", "verdict": "EVAL-MISSING" }
+      ],
+      "reportPath": ".rcf-verify-report.json"
+    }
+  ]
+}

package/fixtures/invalid/manifest/manifest-026-probe-pack-check-applicable-omitted-no-verdict.json

@@ -0,0 +1,35 @@
+{
+  "version": "2.0.0",
+  "projectName": "Probe-pack check omits verdict without applicable:false",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "browserVerification": [
+    {
+      "id": "bv-FBS-042-3",
+      "fbsId": "FBS-042",
+      "createdAt": "2026-09-16T15:10:00Z",
+      "mode": "agentScreenshotCritique",
+      "runtimeProfile": "local-dev",
+      "runtimeUrl": "http://127.0.0.1:3000",
+      "routesChecked": [
+        { "path": "/", "screenshotPath": ".rcf/artefacts/x.png", "themeApplied": "light" }
+      ],
+      "invariantChecks": [
+        { "invariant": "sharedNavPresent", "verdict": "pass" }
+      ],
+      "probePacks": [
+        {
+          "packName": "application-datatable-grid-shell",
+          "packVersion": "1.0.0",
+          "blueprintSlug": "application-datatable",
+          "applicable": true,
+          "checks": [
+            { "id": "AC-17101-2" }
+          ]
+        }
+      ],
+      "verdict": "pass"
+    }
+  ]
+}

package/fixtures/invalid/req/req-006-delivered-by-not-object.json

@@ -0,0 +1,14 @@
+{
+  "reqId": "REQ-201",
+  "prdId": "PRD-100",
+  "title": "Delivered-by must be an object, not a string",
+  "description": "Rejects a REQ whose deliveredBy is a bare id string instead of the {tacId?, adrId?, field?} object.",
+  "category": "functional",
+  "domain": "cache",
+  "priority": "must",
+  "version": "1.0.0",
+  "status": "draft",
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": "TAC-401"
+}

package/fixtures/invalid/user-story/us-006-ac-owner-ref-not-object.json

@@ -0,0 +1,21 @@
+{
+  "usId": "US-201",
+  "prdId": "PRD-100",
+  "reqId": "REQ-201",
+  "version": "1.0.0",
+  "status": "draft",
+  "title": "Owner-ref must be an object, not a string",
+  "asA": "author",
+  "iWant": "the AC's ownerRef to be the {tacId?, adrId?, field?} object shape",
+  "soThat": "the reference is machine-checkable rather than free text",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-201-1",
+      "description": "Owner ref is a string instead of an object.",
+      "testable": true,
+      "ownerRef": "TAC-401"
+    }
+  ],
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/fixtures/invalid/user-story/us-007-ac-disposition-bad-enum.json

@@ -0,0 +1,21 @@
+{
+  "usId": "US-201",
+  "prdId": "PRD-100",
+  "reqId": "REQ-201",
+  "version": "1.0.0",
+  "status": "draft",
+  "title": "Disposition outside the enum is rejected",
+  "asA": "author",
+  "iWant": "disposition to be one of fixed or template",
+  "soThat": "the marker is unambiguous for a consumer that gates on it",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-201-1",
+      "description": "Disposition is neither fixed nor template.",
+      "testable": true,
+      "disposition": "invariant"
+    }
+  ],
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/fixtures/invalid/user-story/us-008-ac-vendor-citation-missing-verified-on.json

@@ -0,0 +1,23 @@
+{
+  "usId": "US-201",
+  "prdId": "PRD-100",
+  "reqId": "REQ-201",
+  "version": "1.0.0",
+  "status": "draft",
+  "title": "Vendor citation without verifiedOn is rejected",
+  "asA": "author",
+  "iWant": "a vendor citation to carry both url and the ISO-8601 verified-on date",
+  "soThat": "a consumer can tell a fresh fact from a stale one",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-201-1",
+      "description": "Vendor citation without the required verifiedOn date.",
+      "testable": true,
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/"
+      }
+    }
+  ],
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/fixtures/valid/manifest/manifest-015-ship-without-eval.json

@@ -0,0 +1,27 @@
+{
+  "version": "2.0.0",
+  "projectName": "Ship-without-eval ack coverage",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "shipWithoutEval": [
+    {
+      "id": "swe-FBS-015-1",
+      "fbsId": "FBS-015",
+      "ackedAt": "2026-09-16T14:20:00Z",
+      "reason": "grading rubric still needs an operator pass; ship the FBS on shape review only",
+      "declaredAcs": [
+        {
+          "acId": "AC-1501-2",
+          "verdict": "EVAL-MISSING",
+          "reason": "no EVAL doc authored for the non-deterministic AC"
+        },
+        {
+          "acId": "AC-1501-3",
+          "verdict": "EVAL-BELOW-THRESHOLD"
+        }
+      ],
+      "reportPath": ".rcf-verify-report.json"
+    }
+  ]
+}

package/fixtures/valid/manifest/manifest-016-probe-pack-check-applicable-false.json

@@ -0,0 +1,37 @@
+{
+  "version": "2.0.0",
+  "projectName": "Probe-pack check-level applicable:false coverage",
+  "prd": { "id": "PRD-001", "path": "rcf/prd.json" },
+  "tad": { "id": "TAD-001", "path": "rcf/tad.json" },
+  "bs":  { "id": "BS-001",  "path": "rcf/build-sequence.json" },
+  "browserVerification": [
+    {
+      "id": "bv-FBS-042-1",
+      "fbsId": "FBS-042",
+      "createdAt": "2026-09-16T15:00:00Z",
+      "mode": "agentScreenshotCritique",
+      "runtimeProfile": "local-dev",
+      "runtimeUrl": "http://127.0.0.1:3000",
+      "routesChecked": [
+        { "path": "/", "screenshotPath": ".rcf/artefacts/bv-FBS-042-1/root.png", "themeApplied": "light" }
+      ],
+      "invariantChecks": [
+        { "invariant": "sharedNavPresent", "verdict": "pass" }
+      ],
+      "probePacks": [
+        {
+          "packName": "application-datatable-grid-shell",
+          "packVersion": "1.0.0",
+          "blueprintSlug": "application-datatable",
+          "applicable": true,
+          "checks": [
+            { "id": "AC-17101-1", "verdict": "pass", "severity": "block" },
+            { "id": "AC-17101-2", "applicable": false, "detail": "check-level appliesTo: capability datatable-server-side-sort not applied" },
+            { "id": "AC-17101-3", "verdict": "pass", "severity": "warn" }
+          ]
+        }
+      ],
+      "verdict": "pass"
+    }
+  ]
+}

package/fixtures/valid/req/req-004-delivered-by.json

@@ -0,0 +1,19 @@
+{
+  "reqId": "REQ-201",
+  "prdId": "PRD-100",
+  "title": "Application cache stays fresh within a stated ceiling",
+  "description": "The application cache surfaces stale reads no older than the ceiling stated in the delivering TAC's replication guarantee.",
+  "category": "nonFunctional",
+  "domain": "cache",
+  "priority": "must",
+  "rationale": "Stale reads beyond the ceiling break invalidation-sensitive views.",
+  "tags": ["cache", "freshness"],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-401-cache-aside-store",
+    "field": "responsibilities.replicationCeiling"
+  }
+}

package/fixtures/valid/user-story/us-006-ac-ownership-and-disposition.json

@@ -0,0 +1,47 @@
+{
+  "usId": "US-201",
+  "prdId": "PRD-100",
+  "reqId": "REQ-201",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Deploy a Durable Object namespace with a migration record",
+  "asA": "operator deploying a Worker that mints a Durable Object namespace",
+  "iWant": "the wrangler configuration and migration record to be consistent with the platform's minting rules",
+  "soThat": "the deploy succeeds and the namespace mints on the current backend",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-201-1",
+      "description": "The migration record carries the new_sqlite_classes keyword against every minted class name.",
+      "given": "a Worker configuration with a Durable Object binding block",
+      "when": "the deploy runs",
+      "then": "the migration record uses the vendor-current keyword and the deploy succeeds",
+      "testable": true,
+      "scope": "deployed",
+      "ownerRef": {
+        "tacId": "TAC-401-durable-objects-namespace",
+        "field": "interfaces.migration.keyword"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/durable-objects/reference/durable-objects-migrations/",
+        "verifiedOn": "2026-09-08"
+      }
+    },
+    {
+      "id": "AC-201-2",
+      "description": "The wrangler binding names commit to the project's chosen class names on both binding blocks.",
+      "given": "a Worker configuration with a Durable Object binding block",
+      "when": "the applying agent has substituted the project's chosen class names",
+      "then": "each binding's class_name appears once in the migration record",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-401-durable-objects-namespace",
+        "field": "interfaces.wrangler.bindings"
+      },
+      "disposition": "template"
+    }
+  ],
+  "createdAt": "2026-01-01T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/rcf-schemas",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "type": "module",
   "description": "JSON Schemas for the Requirements Confidence Framework (RCF). Language-neutral. The contract every RCF tool keys to.",
   "license": "Apache-2.0",

package/schemas/manifest.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://schemas.stravica.io/rcf/v0.6.0/manifest.schema.json",
   "title": "RCF Project Manifest",
-  "description": "Project manifest. Roots-only shape: declares prd, tad, bs. Children are owned by their parents and discovered by walking from the roots. From 0.4.0 the manifest also carries optional records for pre-flight configuration, review audits, UI baselines, browser verification, baseline-AC opt-outs, intake classification, register-regression canaries, and the review-surface state. From 0.4.1 the manifest additionally carries optional shipWithoutVerified acknowledgements written by rcf finalise --ship-without-verified. From 0.4.2 the testTheatreFinding shape carries an optional anchorId and drops tsId from its required list when kind is uiBaselineDrift (the drift finding is not anchored on a test suite); every other kind still requires tsId, and any 0.4.0- or 0.4.1-valid record remains valid. From 0.4.4 the manifest carries two optional additive sections that host the blueprint-library mechanism: blueprints[] (applied-blueprints registry written by rcf blueprint add / remove / upgrade) and standards[] (standards-pack registry written at rcf init and rcf standards add). From 0.4.5 the manifest additionally carries an optional resolutions[] section: one entry per operator-authored resolution of a cross-blueprint conflict, keyed at first by the globalAdrTopic conflict class (two applied blueprints each contributing a scope:global ADR on the same topic, resolved by a project-level ADR that supersedes both). Written by rcf blueprint supersede and by rcf blueprint add --resolve; read by the conflict detector so the resolved conflict is honoured and both blueprint ADRs may co-reside as superseded history. From 0.5.1 the appliedBlueprintRecord carries an optional libraryPrefix (blueprintSlug), stamped when an apply resolves through a registered external blueprint library so the library-registered ownership is durable on the record itself rather than derived by string-matching source; absent for shelf or path applies. Every added field is optional; pre-0.4.0 manifests remain valid.",
+  "description": "Project manifest. Roots-only shape: declares prd, tad, bs. Children are owned by their parents and discovered by walking from the roots. From 0.4.0 the manifest also carries optional records for pre-flight configuration, review audits, UI baselines, browser verification, baseline-AC opt-outs, intake classification, register-regression canaries, and the review-surface state. From 0.4.1 the manifest additionally carries optional shipWithoutVerified acknowledgements written by rcf finalise --ship-without-verified. From 0.4.2 the testTheatreFinding shape carries an optional anchorId and drops tsId from its required list when kind is uiBaselineDrift (the drift finding is not anchored on a test suite); every other kind still requires tsId, and any 0.4.0- or 0.4.1-valid record remains valid. From 0.4.4 the manifest carries two optional additive sections that host the blueprint-library mechanism: blueprints[] (applied-blueprints registry written by rcf blueprint add / remove / upgrade) and standards[] (standards-pack registry written at rcf init and rcf standards add). From 0.4.5 the manifest additionally carries an optional resolutions[] section: one entry per operator-authored resolution of a cross-blueprint conflict, keyed at first by the globalAdrTopic conflict class (two applied blueprints each contributing a scope:global ADR on the same topic, resolved by a project-level ADR that supersedes both). Written by rcf blueprint supersede and by rcf blueprint add --resolve; read by the conflict detector so the resolved conflict is honoured and both blueprint ADRs may co-reside as superseded history. From 0.5.1 the appliedBlueprintRecord carries an optional libraryPrefix (blueprintSlug), stamped when an apply resolves through a registered external blueprint library so the library-registered ownership is durable on the record itself rather than derived by string-matching source; absent for shelf or path applies. From 0.6.3 the manifest additionally carries an optional shipWithoutEval[] section written by rcf finalise --ship-without-eval (sister of shipWithoutVerified; acknowledges EVAL-MISSING or EVAL-BELOW-THRESHOLD per-AC verdicts on the verify report and carries the operator's reason string); and the browserVerificationProbePackCheck item accepts an optional applicable:boolean flag, letting a check-level appliesTo predicate record applicable:false without a verdict or severity (aggregate verdict treats such a check as neither pass nor fail). Every added field is optional; pre-0.4.0 manifests remain valid.",
   "type": "object",
   "additionalProperties": false,
   "required": ["version", "projectName", "prd", "tad", "bs"],
@@ -56,6 +56,11 @@
       "items": { "$ref": "#/$defs/shipWithoutVerifiedRecord" },
       "description": "Operator acknowledgements recorded when rcf finalise --ship-without-verified acknowledges a MOCK-ONLY-DECLARED or BLOCKED-BY-DECLARATION verdict on the verify report and ships the FBS at complete without promoting to verified. One entry per acknowledgement (verification-integrity-cluster-spec section 5.2). The ack is durable and greppable at ship time."
     },
+    "shipWithoutEval": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/shipWithoutEvalRecord" },
+      "description": "Operator acknowledgements recorded when rcf finalise --ship-without-eval acknowledges an EVAL-MISSING or EVAL-BELOW-THRESHOLD per-AC verdict on the verify report and ships the FBS at complete without a passing EVAL. One entry per acknowledgement. Sister of shipWithoutVerified; carries the operator's --ship-without-eval reason string on the record (rcf-eval-node spec sections 5.2 and 8). The ack is durable and greppable at ship time."
+    },
     "blueprints": {
       "type": "array",
       "items": { "$ref": "#/$defs/appliedBlueprintRecord" },
@@ -502,23 +507,44 @@
     "browserVerificationProbePackCheck": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "verdict", "severity"],
+      "required": ["id"],
       "properties": {
         "id": {
           "type": "string",
           "minLength": 1,
           "description": "Check id. For a browser check the id equals an AC id contributed by the same blueprint (loader cross-checks this at pack load time)."
         },
+        "applicable": {
+          "type": "boolean",
+          "description": "Optional check-level applicability flag. When present and false, the check's own appliesTo predicate returned false (typically because the applied capability set does not include a capability the check depends on); verdict and severity are then omitted and the aggregate verdict treats the check as neither pass nor fail. When absent or true, verdict and severity are required as before. Mirrors the pack-level applicable boolean on browserVerificationProbePack. Emitted by packages/rcf-lite/src/browser-verify/pack-runner.js from rcf-lite 0.28.0."
+        },
         "verdict": {
           "enum": ["pass", "warn", "fail", "skipped"],
-          "description": "Check verdict. skipped is emitted by the pack-runner when a browser check's dependsOn pre-check failed."
+          "description": "Check verdict. skipped is emitted by the pack-runner when a browser check's dependsOn pre-check failed. Required when applicable is absent or true; omitted when applicable is false."
         },
         "severity": {
           "enum": ["block", "warn", "advisory"],
-          "description": "Check severity, copied from the pack declaration. Feeds the aggregate verdict rule per spec section 3.4."
+          "description": "Check severity, copied from the pack declaration. Feeds the aggregate verdict rule per spec section 3.4. Required when applicable is absent or true; omitted when applicable is false."
         },
         "detail": { "type": "string" }
-      }
+      },
+      "allOf": [
+        {
+          "if": {
+            "not": {
+              "properties": { "applicable": { "const": false } },
+              "required": ["applicable"]
+            }
+          },
+          "then": {
+            "properties": {
+              "verdict": true,
+              "severity": true
+            },
+            "required": ["verdict", "severity"]
+          }
+        }
+      ]
     },
     "browserVerificationRoute": {
       "type": "object",
@@ -846,6 +872,53 @@
         }
       }
     },
+    "shipWithoutEvalRecord": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "fbsId", "ackedAt", "reason", "declaredAcs", "reportPath"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^swe-FBS-\\d{3,}(?:-[a-z0-9]+(?:-[a-z0-9]+)*)?-\\d+$",
+          "description": "Ship-without-eval acknowledgement id. Format: swe-<fbsId>-<n>; the trailing integer increments per acknowledgement of the same FBS. Accepts both numeric-only and kebab-slug FBS ids. Sister of the shipWithoutVerified swv- id family."
+        },
+        "fbsId": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/fbsId" },
+        "ackedAt": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/timestamp" },
+        "reason": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Operator-supplied reason string passed on the finalise command (rcf finalise --ship-without-eval \"<reason>\"). Required and non-empty; the acknowledgement's purpose is to record why the operator shipped without a passing EVAL."
+        },
+        "declaredAcs": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/shipWithoutEvalDeclaredAc" },
+          "description": "The per-AC verdicts on the verify report that the operator acknowledged. At least one entry, otherwise there is nothing to acknowledge."
+        },
+        "reportPath": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Path (repo-relative or absolute as recorded by finalise) to the verify report file that carried the acknowledged verdicts."
+        }
+      },
+      "description": "Operator acknowledgement recorded on rcf finalise --ship-without-eval. Records the FBS, the operator's reason string, the verify verdicts acknowledged, and the report they came from, so the ack is durable and greppable at ship time. Written by packages/rcf-lite/src/finalise/ship-without-eval.js."
+    },
+    "shipWithoutEvalDeclaredAc": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["acId", "verdict"],
+      "properties": {
+        "acId": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/acId" },
+        "verdict": {
+          "enum": ["EVAL-MISSING", "EVAL-BELOW-THRESHOLD"],
+          "description": "The verify per-AC verdict class the operator acknowledged. Only these two verdict classes are legitimately acknowledgeable via --ship-without-eval."
+        },
+        "reason": {
+          "type": "string",
+          "description": "Optional verify-supplied reason string carried through from the report entry."
+        }
+      }
+    },
     "appliedBlueprintRecord": {
       "type": "object",
       "additionalProperties": false,

package/schemas/req.schema.json

@@ -35,9 +35,24 @@
     "status": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/authoringStatus" },
     "createdAt": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/timestamp" },
     "updatedAt": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/timestamp" },
-    "shapeClassification": { "$ref": "#/$defs/reqShapeClassification" }
+    "shapeClassification": { "$ref": "#/$defs/reqShapeClassification" },
+    "deliveredBy": { "$ref": "#/$defs/deliveredBy" }
   },
   "$defs": {
+    "deliveredBy": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "tacId": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/tacId" },
+        "adrId": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/adrId" },
+        "field": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Optional dotted path into the owning TAC or ADR record (for example, 'principal.fields' or 'decision.retryPolicy') that pinpoints the delivering surface. Optional; presence is not enforced."
+        }
+      },
+      "description": "Optional back-reference on a REQ naming the TAC or ADR that delivers the requirement's externally promised property. All sub-fields are optional at schema level so the record composes additively; ruleset-enforcing consumers may require at least one of tacId or adrId when the REQ carries a delivery promise."
+    },
     "reqShapeClassification": {
       "type": "object",
       "additionalProperties": false,

package/schemas/user-story.schema.json

@@ -68,9 +68,49 @@
           "enum": ["deterministic", "nonDeterministic"],
           "description": "Whether the AC's observable output is deterministic (same inputs, same outputs) or non-deterministic (LLM-generated text, ranked results, generated code, judgement calls). Optional at schema level; absence is treated as 'deterministic' by every consumer. Governs whether an EVAL is required by rcf audit eval coverage --strict and whether the merge gate emits EVAL-MISSING or EVAL-BELOW-THRESHOLD per-AC verdicts."
         },
+        "ownerRef": { "$ref": "#/$defs/acOwnerRef" },
+        "disposition": { "$ref": "#/$defs/acDisposition" },
+        "vendorCitation": { "$ref": "#/$defs/acVendorCitation" },
         "provenance": { "$ref": "#/$defs/acProvenance" }
       }
     },
+    "acOwnerRef": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "tacId": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/tacId" },
+        "adrId": { "$ref": "https://schemas.stravica.io/rcf/v0.6.0/common.schema.json#/$defs/adrId" },
+        "field": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Optional dotted path into the owning TAC or ADR record (for example, 'interfaces.principal.fields' or 'decision.retryPolicy') that pinpoints the referenced surface. Optional; presence is not enforced."
+        }
+      },
+      "description": "Optional back-reference on an acceptance criterion naming the owning TAC or ADR the criterion observes rather than restating. All sub-fields are optional at schema level so the record composes additively; ruleset-enforcing consumers may require at least one of tacId or adrId when the criterion references an owning artefact."
+    },
+    "acDisposition": {
+      "enum": ["fixed", "template"],
+      "description": "Marks whether an acceptance criterion is the blueprint's to fix (mechanism-invariant, inherited unchanged by every applying project) or the applying agent's to set (project-parameterised, shape-given and value-open). Optional at schema level; consumer rulesets that gate blueprint contributions may require it on every AC of a shipped blueprint. Absence carries no default: a consumer that requires the marker treats an unmarked AC as a defect, and a consumer that does not require it ignores the absence."
+    },
+    "acVendorCitation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["url", "verifiedOn"],
+      "properties": {
+        "url": {
+          "type": "string",
+          "format": "uri",
+          "minLength": 1,
+          "description": "Vendor documentation URL the third-party fact rests on. Consumers may fetch it at gate time so a dead link is a finding."
+        },
+        "verifiedOn": {
+          "type": "string",
+          "format": "date",
+          "description": "ISO-8601 date (YYYY-MM-DD) the vendor fact was verified against the cited URL. Consumers compare against their own tolerance window and refuse or warn when the citation is beyond it."
+        }
+      },
+      "description": "Vendor citation for an acceptance criterion whose truth rests on a third-party platform fact. Optional at schema level; consumer rulesets may require it on any AC that asserts a vendor fact (for example, a platform migration keyword or a rate-limit value)."
+    },
     "acProvenance": {
       "type": "object",
       "additionalProperties": false,