rcf-lite 0.0.1 → 0.7.1

package/rcf/user-stories/us-503.json

@@ -0,0 +1,40 @@
+{
+  "usId": "US-503",
+  "prdId": "PRD-001",
+  "reqId": "REQ-005",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Mark a slice done",
+  "description": "A project owner or AI tool marks an FBS slice done so the Build Sequence reflects real progress and coverage stays honest.",
+  "asA": "project owner or AI tool",
+  "iWant": "to mark a build slice done once it is finished",
+  "soThat": "the build sequence reflects real progress and the coverage report stays honest",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-503-1",
+      "description": "Marking done advances the FBS execution status and the matching Build Sequence slot status, both validating",
+      "given": "a finished slice",
+      "when": "it is marked done",
+      "then": "the FBS execution status advances and the corresponding Build Sequence slot status is updated, both validating",
+      "testable": true
+    },
+    {
+      "id": "AC-503-2",
+      "description": "Mark-done on an unknown FBS id returns a not-found error and writes nothing",
+      "given": "a mark-done request for an unknown FBS id",
+      "when": "it runs",
+      "then": "a not-found error is returned and nothing is written",
+      "testable": true
+    },
+    {
+      "id": "AC-503-3",
+      "description": "Mark-done only changes execution status fields and leaves the rest of the documents untouched",
+      "given": "a mark-done operation",
+      "when": "it runs",
+      "then": "it changes only execution status fields and leaves the rest of the documents untouched",
+      "testable": true
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/user-stories/us-601.json

@@ -0,0 +1,40 @@
+{
+  "usId": "US-601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-006",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Query and view over MCP",
+  "description": "An AI tool running in a harness uses the local stdio MCP server to query and view the project's RCF tree without shelling out to the CLI.",
+  "asA": "AI tool running in a harness",
+  "iWant": "the query and view operations exposed as MCP tools over local stdio",
+  "soThat": "I can read and report on the project's RCF tree without shelling out to the CLI",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-601-1",
+      "description": "An MCP client listing tools sees the query and view operations with structured input and output",
+      "given": "a running local stdio MCP server",
+      "when": "an MCP client lists tools",
+      "then": "the query and view operations are present with structured input and output",
+      "testable": true
+    },
+    {
+      "id": "AC-601-2",
+      "description": "A coverage query over MCP returns the same result the CLI coverage command returns for the same project",
+      "given": "a coverage query over MCP",
+      "when": "it runs",
+      "then": "it returns the same result the CLI coverage command returns for the same project",
+      "testable": true
+    },
+    {
+      "id": "AC-601-3",
+      "description": "The MCP server communicates over local stdio only and opens no network listener",
+      "given": "the MCP server",
+      "when": "it runs",
+      "then": "it communicates over local stdio only and opens no network listener",
+      "testable": true
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/user-stories/us-602.json

@@ -0,0 +1,40 @@
+{
+  "usId": "US-602",
+  "prdId": "PRD-001",
+  "reqId": "REQ-006",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "CRUD and build over MCP",
+  "description": "An AI tool running in a harness uses MCP tools to mutate the RCF tree and assemble build prompts with the same validation behaviour as the CLI.",
+  "asA": "AI tool running in a harness",
+  "iWant": "the CRUD and build operations exposed as MCP tools",
+  "soThat": "I can construct and maintain the RCF tree on the owner's behalf through structured tools that validate",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-602-1",
+      "description": "A create operation over MCP applies the same validation and parent-linkage behaviour as the CLI create verb",
+      "given": "a create operation over MCP",
+      "when": "it runs",
+      "then": "it applies the same validation and parent-linkage behaviour as the CLI create verb",
+      "testable": true
+    },
+    {
+      "id": "AC-602-2",
+      "description": "A build-assembly operation over MCP returns the assembled prompt for the named FBS",
+      "given": "a build-assembly operation over MCP",
+      "when": "it runs",
+      "then": "it returns the assembled prompt for the named FBS",
+      "testable": true
+    },
+    {
+      "id": "AC-602-3",
+      "description": "A mutating MCP operation that would write an invalid document writes nothing and returns the validation error",
+      "given": "any mutating MCP operation that would write an invalid document",
+      "when": "it runs",
+      "then": "nothing is written and the validation error is returned to the client",
+      "testable": true
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/user-stories/us-701.json

@@ -0,0 +1,40 @@
+{
+  "usId": "US-701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-007",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Refuse invalid writes",
+  "description": "A project owner trusts that the tool refuses to write any document that does not validate, so on-disk state is always valid even when the owner cannot inspect it.",
+  "asA": "project owner",
+  "iWant": "the tool to refuse to write any document that does not validate against the schema",
+  "soThat": "what is on disk is always valid, even though I cannot check it myself",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-701-1",
+      "description": "A create or update that would produce an invalid document writes nothing",
+      "given": "any create or update that would produce an invalid document",
+      "when": "it runs",
+      "then": "nothing is written",
+      "testable": true
+    },
+    {
+      "id": "AC-701-2",
+      "description": "A successful write produces a document that validates against its schema",
+      "given": "a successful write",
+      "when": "it completes",
+      "then": "the written document validates against its schema",
+      "testable": true
+    },
+    {
+      "id": "AC-701-3",
+      "description": "Validation uses the published schema bundle registered once at start-up, not a local copy",
+      "given": "the validation step",
+      "when": "it runs",
+      "then": "it uses the published schema bundle registered once at start-up, not a local copy that could drift",
+      "testable": true
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/user-stories/us-702.json

@@ -0,0 +1,40 @@
+{
+  "usId": "US-702",
+  "prdId": "PRD-001",
+  "reqId": "REQ-007",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Clear validation errors",
+  "description": "A project owner or AI tool gets structured, readable validation errors that name the offending field and rule, with all failures in one document reported together.",
+  "asA": "project owner or AI tool",
+  "iWant": "validation failures reported as clear, structured errors",
+  "soThat": "I can understand and fix what is wrong without reading the schema",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-702-1",
+      "description": "A reported validation failure names the offending field and the rule it broke",
+      "given": "a validation failure",
+      "when": "it is reported",
+      "then": "the error names the offending field and the rule it broke",
+      "testable": true
+    },
+    {
+      "id": "AC-702-2",
+      "description": "Multiple validation failures in one document are returned together, not just the first",
+      "given": "multiple validation failures in one document",
+      "when": "they are reported",
+      "then": "all of them are returned together, not just the first",
+      "testable": true
+    },
+    {
+      "id": "AC-702-3",
+      "description": "Validation errors delivered to an AI tool over MCP are structured objects the tool can act on, not free text",
+      "given": "a validation error returned to an AI tool over MCP",
+      "when": "it is delivered",
+      "then": "it is a structured object the tool can act on, not a free-text string",
+      "testable": true
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/user-stories/us-801.json

@@ -0,0 +1,49 @@
+{
+  "createdAt": "2026-07-20T17:03:40.038Z",
+  "updatedAt": "2026-07-20T17:10:45.603Z",
+  "description": "The build loop leaves every project with a working, documented local preview as its default outcome, so a non-coding owner always has a runtime they can drive and review without a cloud account or a deploy step.",
+  "asA": "non-coding product owner",
+  "iWant": "every build to leave me a working, documented way to run the app locally",
+  "soThat": "I can see and use what was built without needing to deploy it anywhere first",
+  "usId": "US-801",
+  "prdId": "PRD-001",
+  "reqId": "REQ-008",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Every build leaves a working local preview",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-801-1",
+      "description": "A build's definition of done requires a documented local preview loop as the default outcome",
+      "given": "the RCF build method as taught by the shipped guidance pack",
+      "when": "a build reaches its definition of done",
+      "then": "the guidance requires a working, documented local preview loop (a dev server, and seeded data where the app needs it) to be present as the default deliverable",
+      "testable": true
+    },
+    {
+      "id": "AC-801-2",
+      "description": "The local preview is startable via a single documented command where the stack allows",
+      "given": "the shipped build guidance describing the local preview",
+      "when": "it states how the owner starts the app",
+      "then": "it directs the build toward one documented command to start the preview wherever the stack makes a single command possible",
+      "testable": true
+    },
+    {
+      "id": "AC-801-3",
+      "description": "The local preview is produced whether or not a hosting target was stated",
+      "given": "an owner who has not stated a hosting target, or who asked for a recommendation instead",
+      "when": "the build completes",
+      "then": "the guidance still requires the local preview to be produced as the default, not made conditional on a stated host",
+      "testable": true
+    },
+    {
+      "id": "AC-801-4",
+      "description": "The preview includes seeded data when the app needs data to be usable",
+      "given": "an application that needs data present to be exercisable",
+      "when": "the local preview loop is produced",
+      "then": "the guidance requires seeded or sample data so the preview can actually be driven, not an empty shell",
+      "testable": true
+    }
+  ],
+  "tacIds": []
+}

package/rcf/user-stories/us-802.json

@@ -0,0 +1,49 @@
+{
+  "createdAt": "2026-07-20T17:04:24.408Z",
+  "updatedAt": "2026-07-20T17:10:45.759Z",
+  "description": "Elicitation establishes where the application will run before any stack is committed, and the stack the tool builds is constrained by that answer, so the owner is not led into a stack their hosting cannot run.",
+  "asA": "non-coding product owner",
+  "iWant": "the tool to work out where my app will run before it picks the technology to build it with",
+  "soThat": "it does not build me something my hosting cannot actually run",
+  "usId": "US-802",
+  "prdId": "PRD-001",
+  "reqId": "REQ-008",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Deploy target is established before the stack is chosen",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-802-1",
+      "description": "Elicitation asks where the app will run as an early item before any stack is committed",
+      "given": "the shipped elicitation guidance",
+      "when": "an agent runs elicitation with an owner",
+      "then": "the guidance places a deploy-target question early, before any technology stack is committed",
+      "testable": true
+    },
+    {
+      "id": "AC-802-2",
+      "description": "The stack choice is constrained by the deploy-target answer",
+      "given": "a stated deploy target",
+      "when": "the agent chooses the technology stack",
+      "then": "the guidance requires the stack to be constrained to what that target can host, so an incompatible stack is not committed",
+      "testable": true
+    },
+    {
+      "id": "AC-802-3",
+      "description": "The deploy target and its stack implication are captured as an ADR on the project tree",
+      "given": "a deploy target established during elicitation",
+      "when": "the decision is made",
+      "then": "the guidance requires it and the stack constraint it implies to be recorded as an ADR on the project's own tree, visible and revisable",
+      "testable": true
+    },
+    {
+      "id": "AC-802-4",
+      "description": "The harness fragment forbids committing a stack before the deploy target is established",
+      "given": "the harness fragment written into agent-instructions files",
+      "when": "it is inspected",
+      "then": "it carries a rule that a technology stack must not be committed before the deploy target is established",
+      "testable": true
+    }
+  ],
+  "tacIds": []
+}

package/rcf/user-stories/us-803.json

@@ -0,0 +1,49 @@
+{
+  "createdAt": "2026-07-20T17:04:24.594Z",
+  "updatedAt": "2026-07-20T17:10:45.914Z",
+  "description": "When the owner does not know where the application will run, the agent walks them through choosing and configuring a hosting account in plain language, honestly isolating the steps only the human account-holder can do, rather than choosing silently or pretending to act as them.",
+  "asA": "non-coding product owner who does not know my hosting options",
+  "iWant": "to be walked through choosing and setting up somewhere to run my app, in plain language",
+  "soThat": "I can make and act on the hosting decision without already being an expert",
+  "usId": "US-803",
+  "prdId": "PRD-001",
+  "reqId": "REQ-008",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Hosting-choice guidance when the owner is unsure",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-803-1",
+      "description": "When the owner does not know where the app will run, the agent runs a hosting-choice walkthrough rather than choosing silently",
+      "given": "an owner who does not know their hosting options",
+      "when": "the deploy-target question is reached",
+      "then": "the guidance directs the agent to run a hosting-choice walkthrough instead of silently selecting a host",
+      "testable": true
+    },
+    {
+      "id": "AC-803-2",
+      "description": "The walkthrough explains the options in plain language",
+      "given": "the hosting-choice walkthrough guidance",
+      "when": "it presents hosting options to the owner",
+      "then": "it requires plain-language explanation with no unexplained jargon",
+      "testable": true
+    },
+    {
+      "id": "AC-803-3",
+      "description": "Steps only the human account-holder can do are isolated and named honestly",
+      "given": "the walkthrough reaching steps only the account-holder can perform (sign-ups, billing, tokens, CLI authentication)",
+      "when": "those steps arise",
+      "then": "the guidance requires them to be isolated and named honestly as the human's to do, not performed silently by the agent nor pretended",
+      "testable": true
+    },
+    {
+      "id": "AC-803-4",
+      "description": "The walkthrough covers configuring the chosen account, not only naming a provider",
+      "given": "a hosting choice the owner has made",
+      "when": "the walkthrough continues past the choice",
+      "then": "the guidance requires it to cover configuring the account - accounts, tokens and CLI setup - not just naming a provider",
+      "testable": true
+    }
+  ],
+  "tacIds": []
+}

package/rcf/user-stories/us-804.json

@@ -0,0 +1,49 @@
+{
+  "createdAt": "2026-07-20T17:04:24.748Z",
+  "updatedAt": "2026-07-20T17:10:46.062Z",
+  "description": "Every claim the tool or its agent makes that something is verified or tested names the runtime it was checked against, and never implies verification on a deployed runtime that did not happen, so the owner can tell what was actually proven.",
+  "asA": "non-coding product owner",
+  "iWant": "every claim that something was verified to say what it was verified against",
+  "soThat": "I am not told the deployed app works when only a local emulator was checked",
+  "usId": "US-804",
+  "prdId": "PRD-001",
+  "reqId": "REQ-008",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Verification claims name their runtime",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-804-1",
+      "description": "Every verified or tested claim names the runtime it was checked against",
+      "given": "the shipped build guidance on reporting verification",
+      "when": "a 'verified' or 'tested' claim is made",
+      "then": "the guidance requires the claim to name the runtime it was checked against",
+      "testable": true
+    },
+    {
+      "id": "AC-804-2",
+      "description": "No claim implies deploy-runtime verification that did not happen",
+      "given": "a verification that ran against a local or emulated runtime",
+      "when": "the claim is written",
+      "then": "the guidance forbids the claim from stating or implying verification on a deployed runtime that was not exercised",
+      "testable": true
+    },
+    {
+      "id": "AC-804-3",
+      "description": "The PR-authoring guidance requires the runtime label in the verification section",
+      "given": "the build-cycle PR-authoring guidance",
+      "when": "the verification section of a PR body is authored",
+      "then": "it requires each verification claim to carry the runtime it was checked against",
+      "testable": true
+    },
+    {
+      "id": "AC-804-4",
+      "description": "The guidance includes an explicit labelled-claim example",
+      "given": "the shipped build guidance",
+      "when": "it illustrates a verification claim",
+      "then": "it includes an explicit example naming the runtime (for example 'verified against wrangler dev (localhost) - NOT the deployed Worker runtime')",
+      "testable": true
+    }
+  ],
+  "tacIds": []
+}

package/rcf/user-stories/us-805.json

@@ -0,0 +1,49 @@
+{
+  "createdAt": "2026-07-20T17:04:24.904Z",
+  "updatedAt": "2026-07-28T16:39:51.461Z",
+  "description": "The method carries guidance for a periodic and end-of-build fresh-context self-review that drives the app against its acceptance criteria to catch the defect classes green test suites miss, honestly scoped as an in-loop check subordinate to the independent verification gate that rcf finalise runs.",
+  "asA": "non-coding product owner",
+  "iWant": "the build to include a periodic fresh look that actually drives the app against what it is supposed to do",
+  "soThat": "defects my passing tests miss are caught before I rely on the result",
+  "usId": "US-805",
+  "prdId": "PRD-001",
+  "reqId": "REQ-008",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Interim self-review guidance",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-805-1",
+      "description": "The guidance describes a periodic and end-of-build fresh-context self-review dispatch",
+      "given": "the shipped build guidance",
+      "when": "it describes the self-review",
+      "then": "it describes a fresh-context manual-review subagent dispatch run periodically (every few FBS builds) and once at the end of the build",
+      "testable": true
+    },
+    {
+      "id": "AC-805-2",
+      "description": "The reviewer drives the app against the acceptance criteria rather than reading the code",
+      "given": "the self-review guidance",
+      "when": "it states what the reviewer does",
+      "then": "it requires the reviewer to drive the running application against its acceptance criteria, not to read the code",
+      "testable": true
+    },
+    {
+      "id": "AC-805-3",
+      "description": "The review targets the named defect classes",
+      "given": "the self-review guidance",
+      "when": "it states what the review looks for",
+      "then": "it names the target defect classes: session-class bugs, false-promise UI, runtime mismatch (localhost versus deployed), dead auth paths and dead code",
+      "testable": true
+    },
+    {
+      "id": "AC-805-4",
+      "description": "The guidance scopes the self-review honestly as an in-loop check and not the independent gate",
+      "given": "the self-review guidance",
+      "when": "it frames the review",
+      "then": "it states plainly that this is an in-loop check and not the independent verification gate, names rcf finalise (section 7) as the gate, and says it is guidance and not a new subsystem",
+      "testable": true
+    }
+  ],
+  "tacIds": []
+}

package/rcf/user-stories/us-901.json

@@ -0,0 +1,40 @@
+{
+  "usId": "US-901",
+  "prdId": "PRD-001",
+  "reqId": "REQ-009",
+  "title": "Route `rcf verify` through the same dispatcher as the alias bin",
+  "description": "A consumer running the unified `rcf` CLI can reach the adversarial ship-gate verifier as `rcf verify <verb>` and get identical behaviour to the legacy `rcf-verify <verb>` invocation. The legacy bin remains available and emits a one-line deprecation notice on stderr so scripts can be migrated at their own pace.",
+  "asA": "consumer of the RCF Lite CLI",
+  "iWant": "to invoke the verify suite as `rcf verify <verb>` inside the unified CLI",
+  "soThat": "verify sits inside the same verb space as the rest of the RCF chain and I only have to install one package",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-901-1",
+      "description": "The `rcf` bin exposes `verify` as a top-level subcommand routed to the same dispatcher as the `rcf-verify` alias bin",
+      "given": "the unified `rcf` binary imported from bin/rcf.js",
+      "when": "`verify` is looked up on the top-level SUBCOMMANDS map",
+      "then": "the handler resolves to the same `main` function that bin/rcf-verify.js exports and dispatches over run/report/provision/cleanup/mcp/help",
+      "testable": true
+    },
+    {
+      "id": "AC-901-2",
+      "description": "The top-level `rcf --help` output advertises `verify` as an available subcommand",
+      "given": "the unified `rcf` binary",
+      "when": "`--help` or `help` runs",
+      "then": "the printed usage lists `verify <verb>` alongside the other top-level commands",
+      "testable": true
+    },
+    {
+      "id": "AC-901-3",
+      "description": "The `rcf-verify` alias bin emits a one-line stderr deprecation notice when invoked directly and stays fully functional",
+      "given": "the `rcf-verify` alias bin invoked as the entry point (isMain)",
+      "when": "the entry point runs without RCF_QUIET",
+      "then": "a single line describing the deprecation and the `rcf verify` replacement is written to stderr before dispatch, and the dispatch itself is unchanged",
+      "testable": true
+    }
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-08-11T00:00:00Z",
+  "updatedAt": "2026-08-11T00:00:00Z"
+}

package/src/browser-verify/auth-smoke.js

@@ -0,0 +1,109 @@
+// Auth-REQ smoke checks (ui-design-gate-0.7.0-spec §9).
+//
+// A small pack of curl-shape checks that run at Finalise for any FBS
+// binding an auth REQ. Composes with Track A's preflight rec 3
+// (`uiBaseline.defaults.authFlow.htmlLoginPageRequired`); when the
+// baseline says API-only, the pack is skipped.
+//
+// Directly addresses the cold-run defect where `/login` returned 404
+// for the full run. Implemented as fetch-shaped checks against a
+// runtime URL; the runner (injectable) is the ambient `fetch` by
+// default. Callers pass `runtimeUrl` (e.g. http://127.0.0.1:3000).
+
+/**
+ * @typedef {object} AuthSmokeResult
+ * @property {string} check
+ * @property {number} [status]
+ * @property {string} [contentType]
+ * @property {'pass'|'warn'|'fail'} verdict
+ * @property {string} [detail]
+ */
+
+/**
+ * @typedef {object} AuthSmokeRunnerInput
+ * @property {(url: string, init?: object) => Promise<{ status: number, headers: { get: (name: string) => string|null } }>} fetch
+ * @property {string} runtimeUrl
+ */
+
+const HTML_CONTENT_TYPE_RE = /^text\/html\b/i;
+
+/**
+ * True when a FBS should run the auth smoke pack. Reads (in priority
+ * order) the FBS's own dependsOnServices auth categories, then falls
+ * back to the manifest's uiBaseline.defaults.authFlow.smokeChecksRequired.
+ *
+ * @param {object} fbs
+ * @param {object|null} uiBaseline
+ * @returns {boolean}
+ */
+export function shouldRunAuthSmokeChecks(fbs, uiBaseline) {
+  const services = Array.isArray(fbs?.dependsOnServices) ? fbs.dependsOnServices : [];
+  const authCategories = new Set(['auth', 'oauth', 'identityProvider', 'emailAuth']);
+  const bindsAuth = services.some((s) => authCategories.has(String(s?.serviceCategory ?? '')));
+  const baselineRequires = uiBaseline?.defaults?.authFlow?.htmlLoginPageRequired === true
+    && uiBaseline?.defaults?.authFlow?.smokeChecksRequired !== false;
+  return bindsAuth || baselineRequires;
+}
+
+/**
+ * Run the smoke pack against `runtimeUrl`. Returns one result per check.
+ *
+ * @param {AuthSmokeRunnerInput} args
+ * @returns {Promise<AuthSmokeResult[]>}
+ */
+export async function runAuthSmokeChecks({ fetch, runtimeUrl }) {
+  /** @type {AuthSmokeResult[]} */
+  const results = [];
+  results.push(await runOne({
+    check: 'GET /login', fetch,
+    request: () => fetch(joinUrl(runtimeUrl, '/login')),
+    accept: (status, contentType) => {
+      if (status !== 200) return { verdict: 'fail', detail: `status ${status} (expected 200)` };
+      if (!HTML_CONTENT_TYPE_RE.test(contentType ?? '')) return { verdict: 'fail', detail: `content-type '${contentType ?? '(missing)'}' (expected text/html)` };
+      return { verdict: 'pass' };
+    },
+  }));
+  results.push(await runOne({
+    check: 'POST /logout', fetch,
+    request: () => fetch(joinUrl(runtimeUrl, '/logout'), { method: 'POST', redirect: 'manual' }),
+    accept: (status) => {
+      if (status === 200 || status === 302 || status === 303) return { verdict: 'pass' };
+      return { verdict: 'fail', detail: `status ${status} (expected 200 | 302 | 303)` };
+    },
+  }));
+  results.push(await runOne({
+    check: 'GET /login/verify?token=',
+    fetch,
+    request: () => fetch(joinUrl(runtimeUrl, '/login/verify?token='), { redirect: 'manual' }),
+    accept: (status) => {
+      if (status === 400 || status === 401 || status === 403) return { verdict: 'pass' };
+      if (status === 302 || status === 303) return { verdict: 'pass' };
+      if (status === 200) return { verdict: 'fail', detail: 'status 200 (empty-token accepted; regression on the empty-token vuln)' };
+      return { verdict: 'fail', detail: `status ${status} (expected 400 | 401 | 403 | 302 | 303)` };
+    },
+  }));
+  return results;
+}
+
+async function runOne({ check, request, accept }) {
+  try {
+    const response = await request();
+    const status = response?.status;
+    const contentType = response?.headers?.get ? response.headers.get('content-type') : null;
+    const outcome = accept(status, contentType);
+    return {
+      check,
+      status,
+      ...(contentType ? { contentType } : {}),
+      verdict: outcome.verdict,
+      ...(outcome.detail ? { detail: outcome.detail } : {}),
+    };
+  } catch (err) {
+    return { check, verdict: 'fail', detail: `request failed: ${err.message}` };
+  }
+}
+
+function joinUrl(base, path) {
+  const trimmed = base.replace(/\/+$/, '');
+  return `${trimmed}${path.startsWith('/') ? path : `/${path}`}`;
+}

package/src/browser-verify/index.js

@@ -0,0 +1,29 @@
+// Public surface for the browser-verify module
+// (ui-design-gate-0.7.0-spec §8, §9). CLI handler at
+// `src/cli/browser-verify.js`.
+
+export {
+  UI_INVARIANTS_V1,
+  compareTopLevelStructure,
+  foldInvariantsForRecord,
+  runInvariantsForCapture,
+} from './invariants.js';
+
+export {
+  runAuthSmokeChecks,
+  shouldRunAuthSmokeChecks,
+} from './auth-smoke.js';
+
+export {
+  aggregateVerdict,
+  composeBrowserVerificationRecord,
+  nextBrowserVerificationId,
+  writeBrowserVerificationAck,
+  writeBrowserVerificationRecord,
+} from './manifest-writer.js';
+
+export {
+  composeOperatorSessionRecord,
+  runAgentScreenshotCritique,
+  stubBrowserDriver,
+} from './runner.js';