@stravica-ai/rcf-verify-lite 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Pre-1.0, breaking changes are signalled by a minor version bump.
 
+## [0.1.1] - 2026-07-22
+
+Documentation-only release. No code, CLI, contract or dependency changes.
+
+### Documentation
+
+- **README consumability pass + reference doc** ([#52](https://github.com/Stravica/rcf-lite/pull/52)): the verify README was rewritten for a consumer landing on the npm package page cold — what the verifier is, how it is invoked (both the `rcf finalise` finalise-gate path and the operator CLI), and the runtime-profile / ship-authority model. Adds `docs/reference.md` as the full flag-and-exit-code reference.
+
 ## [0.1.0] - 2026-07-22
 
 First publish. `rcf-verify-lite` v1 — a fresh-context adversarial verifier for the RCF Lite suite.

package/README.md

@@ -1,76 +1,44 @@
-# @stravica-ai/rcf-verify-lite
+# rcf-verify-lite
 
-A **fresh-context adversarial verifier** for the RCF Lite suite.
+[![ci](https://github.com/Stravica/rcf-lite/actions/workflows/ci.yml/badge.svg)](https://github.com/Stravica/rcf-lite/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/%40stravica-ai%2Frcf-verify-lite)](https://www.npmjs.com/package/@stravica-ai/rcf-verify-lite)
+[![license](https://img.shields.io/badge/license-Apache--2.0-blue)](./LICENSE)
+[![node](https://img.shields.io/badge/node-%3E%3D24-brightgreen)](https://nodejs.org)
 
-Given an RCF chain (the acceptance contract) and a **running instance** of an
-app under a **declared runtime profile**, `rcf-verify` launches an isolated
-verifier agent that walks real user journeys adversarially — trying to
-*disprove* the app against its acceptance criteria — and emits a **structured
-verdict stamped with the runtime it ran against**.
+The ship gate for AI-built software.
 
-It never reads the source tree, the test suite, or the builder's self-report.
-Its only inputs are the chain and the live URL. That information disjointness
-is what makes it an *independent* ship-readiness verdict rather than another
-self-check.
+Point `rcf-verify` at your running app and the acceptance criteria in your repo's [RCF chain](https://stravica.ai/rcf-methodology), and it launches a fresh, isolated AI agent that behaves like a hostile user: walking real journeys against the live app, trying to prove it *doesn't* meet its contract. You get a structured report and a verdict you can gate a release on.
 
-> **Honest limit.** Verify does not make an app "fully verified" or "safe". It
-> **replaces the ship-readiness verdict with an independent one.** An agent
-> cannot fully adversarially test its own build; verify mitigates that blind
-> spot, it does not eliminate it.
+The verifier never sees your source code, your tests, or your builder's claims about what works. It gets the acceptance contract and a URL, nothing else. That blindness is deliberate: an agent cannot mark its own homework, so the agent that judges the app is never the agent that built it.
+
+> **Honest limit.** Verify does not make an app "fully verified" or "safe". It replaces a self-reported ship-readiness verdict with an independent one — it mitigates the builder's blind spot, it does not eliminate it.
 
 ## Install
 
-```
-npm i @stravica-ai/rcf-build-lite @stravica-ai/rcf-verify-lite
+```sh
+npm install -g @stravica-ai/rcf-build-lite @stravica-ai/rcf-verify-lite
 ```
 
-The two are independently installable (verify alone for CI; build alone if
-truly wanted), but installing together is the recommended default.
+Installing alongside [`@stravica-ai/rcf-build-lite`](https://www.npmjs.com/package/@stravica-ai/rcf-build-lite) is the recommended default. Verify also installs standalone (`npm install -g @stravica-ai/rcf-verify-lite`) — for example as a verification-only step in CI.
 
-## Usage
+## Use it
 
-```
-rcf-verify run \
-  --repo <path-to-rcf-chain> \
-  --profile <deployed|ci|local-dev> \
-  --url <running-app-url> \
-  --out report.json \
-  [--parity-env] [--provision creds.json] \
-  [--severity-gate BROKEN] [--provision-mode run|skip] [--persona name]
-
-rcf-verify report report.json     # re-render a prior report
-rcf-verify provision ...          # stand up prerequisites standalone
-rcf-verify cleanup ...            # tear down provisioned 'zzverify-' artefacts
-rcf-verify mcp                    # serve over MCP (local stdio)
+```sh
+rcf-verify run --repo . --profile deployed --url https://your-app.example.com --out report.json
 ```
 
-### Runtime profiles
+That runs the adversarial pass and writes `report.json`: findings with severities, and a verdict stamped with the runtime it was earned against. Re-render any saved report with `rcf-verify report report.json`.
 
-| Profile | Verdict authority |
-|---|---|
-| `deployed` | SHIP-readiness verdict (the ship gate). A local/unreachable URL under `deployed` yields `NOT-DEPLOYED`, never a soft pass. |
-| `ci` | Correctness/regression verdict. Ship gate **only** with `--parity-env`. |
-| `local-dev` | Correctness/regression verdict. Never a ship gate. |
+A `deployed` run is the ship verdict. You can also point it at CI or local builds (`--profile ci` / `--profile local-dev`) for correctness passes — same engine, honestly labelled with lower authority, so a localhost pass can never masquerade as ship-ready.
 
-`localhost` is a first-class target under `ci`/`local-dev`. What is forbidden
-is a lower profile claiming the authority of `deployed`.
+If your app needs accounts, sandboxes or test data to be exercised properly, verify provisions them first and tears them down after — see the reference for `provision` and `cleanup`.
 
-### Exit codes (`run`)
+**Using rcf-build-lite?** You rarely run this by hand: `rcf finalise` invokes verify automatically as the gate between "built" and "verified".
 
-```
-0  report written, verdict below the severity gate
-1  IO / unexpected runtime failure (incl. verifier-agent launch failure)
-2  usage error
-3  chain could not be loaded
-5  severity gate tripped, or NOT-DEPLOYED / BLOCKED
-```
+## Going deeper
+
+[docs/reference.md](docs/reference.md) has the full surface: runtime profiles and verdict authority, exit codes, prerequisite provisioning, MCP mode, and the launcher seam for custom agent harnesses.
 
-## Verifier-agent launcher
+## License
 
-Verify launches an isolated fresh agent (Claude Code by default) with the
-proven isolation env (`CLAUDE_CODE_DISABLE_AUTO_MEMORY=1` +
-`CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`) and browser tooling; that agent
-drives the running app and returns structured findings. The launcher is
-injectable via the `RCF_VERIFY_LAUNCHER` env var (a module exporting
-`launchAgent`) — the seam used for integration harnesses and the recorded
-manual e2e.
+Apache 2.0 — see [LICENSE](./LICENSE).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/rcf-verify-lite",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "RCF Verify Lite - a fresh-context adversarial verifier. Given an RCF chain (the acceptance contract) and a running instance under a declared runtime profile, it launches an isolated verifier agent that walks real user journeys adversarially and emits a structured verdict stamped with the runtime it ran against.",
   "license": "Apache-2.0",