rcf-lite 0.0.1 → 0.8.0

package/guidance/persona-programme.md

@@ -0,0 +1,44 @@
+# Persona programme: tail-interview template
+
+<!-- Never-skip-RCF invariant is a platform rule; see build-cycle-playbook.md §13 and elicitation-playbook.md §11.1 for the byte-identical statement. Editors: any change to guidance wording is subject to canary release-block. -->
+
+## 1. Why this exists
+
+Personas run against a shipping build; the run produces a corpus of behaviour a real user would see. Two classes of finding do not surface in that corpus by construction:
+
+1. **Affective failure modes.** Register fatigue, first-impression posture, "did that feel long to read" - the persona is an LLM; asking it to notice these during the run is asking it to be something it structurally cannot be.
+2. **Silent non-asks.** Credentials the persona would have volunteered if asked. Permissions the operator granted that the agent forgot to act on. Preferences the persona has a settled view on that the run never touched. A persona reporting only what the agent said produces a corpus with a systematic blind spot on the credentials and permissions it never got a chance to describe.
+
+The tail interview is the mechanised second question, run after the main persona task closes. It never turns the persona back into a human; it just asks the questions the run itself could not, in a dedicated turn, and records the answers on the run's report for the corpus reader.
+
+## 2. When to run it
+
+At the end of every persona run, immediately after the main task closes and before the report is finalised. The tail interview is a mandatory closing turn - the persona role definition dispatches it in a fresh turn against the same persona; the corpus reader picks up the appended answers alongside the primary run.
+
+## 3. The tail interview
+
+Reach the persona in a dedicated turn, in character, and pose these five questions. The persona answers as the persona, not as a reviewer of the run; if the honest answer is "I do not know" or "as an LLM I cannot judge", say so - do not fabricate an answer to have something to write.
+
+> **Tail interview.** After the persona run's main task completes, the persona role is asked the following questions in a dedicated dispatch turn. Answer as the persona, in the persona's voice, without breaking character. If the honest answer is "I do not know" or "as an LLM I cannot judge", say so; do not fabricate.
+>
+> 1. **Response length and density.** Across the run, did any agent response feel long or dense to read? Which ones, and at what points? If none felt long, say so plainly; do not invent length concerns to have an answer.
+> 2. **Silent non-asks.** What did the agent NOT ask you that you (as the persona) would have volunteered if asked? Think about credentials, permissions, preferences, or context that would have been useful earlier in the run but the agent never raised. If nothing comes to mind, say so.
+> 3. **First-impression posture.** Read the agent's first response again. Does it read as "the agent has this in hand and you can steer" or "the agent is asking you to do the work of parsing"? Name specifics.
+> 4. **Register drift.** Did the agent's register (formality, jargon density, verbosity) change across the run? If yes, at what point and in which direction? If no, say so.
+> 5. **Anything else the run made you think about that the questions above did not cover?**
+
+## 4. Recording the answers
+
+The persona role appends the answers to the run's report under a dedicated `tailInterview` section. Each answer carries the question id (1-5) so a corpus reader can join across runs; free-text follow-ups land at question 5.
+
+The corpus reader treats the tail interview as advisory signal, not ground truth. An LLM persona's introspective answers are lower-fidelity than a human's, and reading them straight would over-weight them. The value is directional: a pattern of "the agent felt long at the same point across three runs" is signal even if any single answer is noisy.
+
+## 5. What this is not
+
+- Not a reviewer's verdict on the run. The persona is playing the persona; the reviewer's verdict lives elsewhere.
+- Not a scoring rubric. There is no numeric grading; the answers are prose.
+- Not a substitute for the primary run. A persona programme with a strong tail interview and a weak primary run is a bad persona run; the tail interview does not compensate.
+
+## 6. Where the template lives
+
+Ships with the build-lite guidance pack so operators running personas via rcf-lite have the template as a discoverable resource; `rcf guidance persona-programme` prints it, and MCP-wired agents reach the same content via the `rcf://docs/persona-programme` resource. The operator-side persona role definitions that run the interview inherit the template from here; a change to the wording lands in one place.

package/package.json

@@ -1,14 +1,77 @@
 {
   "name": "rcf-lite",
-  "version": "0.0.1",
-  "description": "Reserved for RCF Lite, the Requirements Confidence Framework lite suite from Stravica. First real release lands here as 0.7.1.",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Stravica/rcf-lite.git"
+  "version": "0.8.0",
+  "type": "module",
+  "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI (init, view, validate, build, verify, finalise and 25+ more verbs), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/Stravica/rcf-lite",
+  "bugs": "https://github.com/Stravica/rcf-lite/issues",
+  "keywords": [
+    "rcf",
+    "requirements",
+    "traceability",
+    "mcp",
+    "cli",
+    "sdd",
+    "verification",
+    "adversarial"
+  ],
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "bin": {
+    "rcf": "bin/rcf.js",
+    "rcf-verify": "bin/rcf-verify.js"
   },
-  "homepage": "https://stravica.ai",
   "files": [
-    "README.md"
+    "bin",
+    "src",
+    "guidance",
+    "rcf",
+    "fixtures",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
   ],
-  "license": "Apache-2.0"
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Stravica/rcf-lite.git",
+    "directory": "packages/rcf-lite"
+  },
+  "imports": {
+    "#core/store": "./src/core/store/index.js",
+    "#core/store/*": "./src/core/store/*",
+    "#core/errors": "./src/core/errors/index.js",
+    "#core/mcp-shell": "./src/core/mcp/index.js",
+    "#core/isolation": "./src/core/isolation/index.js",
+    "#core/patterns/ui-shapes": "./src/core/patterns/ui-shapes.js",
+    "#core/patterns/req-shapes": "./src/core/patterns/req-shapes.js",
+    "#core/patterns/services": "./src/core/patterns/services.js",
+    "#core/patterns/register-canary": "./src/core/patterns/register-canary.js",
+    "#core/baseline-catalog": "./src/core/baseline-catalog/index.js",
+    "#core/fixtures/register-canary/*": "./src/core/fixtures/register-canary/*",
+    "#ruleset": "./src/ruleset/index.js",
+    "#admissibility": "./src/admissibility/index.js"
+  },
+  "dependencies": {
+    "@stravica-ai/rcf-schemas": "0.4.3",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1"
+  },
+  "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "mermaid": "11.6.0"
+  },
+  "scripts": {
+    "test": "node --test --test-concurrency=1 'test/**/*.test.js'",
+    "vendor": "node scripts/vendor-mermaid.mjs",
+    "build:managed": "node scripts/gen-managed-artefacts.mjs",
+    "canary:register": "node scripts/canary-register.mjs",
+    "rcf": "node bin/rcf.js",
+    "rcf-verify": "node bin/rcf-verify.js"
+  }
 }

package/rcf/adrs/adr-001.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-001",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Local filesystem is the single source of truth",
+  "context": "RCF Build Lite must guarantee that a project's RCF documents live in the source repository, beside the code. v1 tooling operated over the GitHub API rather than the local repo, which broke the in-repository differentiator and tied the tool to a network surface.",
+  "decision": "Every read and write targets the local rcf tree directly. No external service, cache or database mirrors the documents. The CLI, the MCP server and the build loop all reach the filesystem only through the document store.",
+  "consequences": "The tool works offline and stays harness-agnostic. There is no sync problem and no second source to drift. The cost is that any multi-user or hosted scenario is out of scope by construction, which matches the product boundaries.",
+  "alternativesConsidered": [
+    {
+      "name": "GitHub API as source of truth",
+      "summary": "Read and write documents through the GitHub contents API as v1 did.",
+      "reasonNotChosen": "Breaks the in-repository differentiator, requires network access and hit the API single-file fetch limit on large documents."
+    },
+    {
+      "name": "Local database index",
+      "summary": "Keep the files but maintain a database index for fast queries.",
+      "reasonNotChosen": "Introduces a second source of truth that can drift; query volumes for a single project do not justify it."
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/adrs/adr-002.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-002",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Validate against the published schema bundle at boundaries",
+  "context": "A non-coder cannot catch a malformed RCF document by eye, and an AI agent left unchecked can drift the document shape silently. Validation has to be a property of the tool, not a discipline of the user.",
+  "decision": "Register the published @stravica/rcf-schemas bundle once at start-up and validate every document on load and before persist. Refuse to write any document that does not validate.",
+  "consequences": "On-disk state is always valid. A small validation cost runs on every operation. The published schema package is the single source of truth for shape; local drift is impossible.",
+  "alternativesConsidered": [
+    {
+      "name": "Local copies of the schemas",
+      "summary": "Vendor the schemas into the tool repository and validate against the local copy.",
+      "reasonNotChosen": "Allows local copies to drift from the published contract; the whole point of publishing the schemas is that every consumer keys to the same version."
+    },
+    {
+      "name": "Validate only on persist",
+      "summary": "Skip validation on load to save the cost of validating documents already on disk.",
+      "reasonNotChosen": "Misses drift caused by edits made outside the tool; load validation is what makes broken trees visible to the owner."
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/adrs/adr-003.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-003",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Plain JavaScript, no TypeScript pin",
+  "context": "v1 was TypeScript-heavy and the build pipeline was a maintenance burden out of proportion to the project size. The product is small enough that boundary validation can carry the safety types would, and contributors should not have to set up a TypeScript toolchain to read or edit the code.",
+  "decision": "Build Lite is Node 24 ESM, plain JavaScript with JSDoc where types help. Schema validation at boundaries does the work compile-time types would otherwise do.",
+  "consequences": "Lower friction for contributors and a faster iteration loop. Some IDE assistance is given up. The team accepts that giving up in exchange for the simpler stack.",
+  "alternativesConsidered": [
+    {
+      "name": "TypeScript everywhere",
+      "summary": "Author the tool in TypeScript with a tsc build step.",
+      "reasonNotChosen": "Adds a toolchain dependency for a small project; boundary validation carries the safety guarantee instead."
+    },
+    {
+      "name": "JSDoc plus checkJs",
+      "summary": "Use JSDoc with TypeScript checkJs to get partial type checking without authoring TypeScript.",
+      "reasonNotChosen": "Worth considering later if friction grows; not the round-1 default because the schema bundle is already the load-bearing contract."
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/adrs/adr-004.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-004",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Thin adapters over a shared core",
+  "context": "The same operations are reached from the CLI, the MCP server and the build loop. Putting behaviour in any surface guarantees drift between surfaces.",
+  "decision": "Put every behaviour in a shared core module set. The CLI, the MCP server and the build loop are thin adapters that map their surface verbs to core operations and render results. The core's internal API is the stable contract.",
+  "consequences": "One behaviour, many surfaces, no drift between how a verb behaves on the CLI versus over MCP. The adapters carry no business logic so they are small and easy to keep in step.",
+  "alternativesConsidered": [
+    {
+      "name": "Per-surface implementations",
+      "summary": "Implement each verb separately for the CLI and for MCP.",
+      "reasonNotChosen": "Guaranteed drift over time; the cost of duplication is paid forever in tests and bug reports."
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/adrs/adr-005.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-005",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "MCP is local stdio only",
+  "context": "Remote MCP cannot see the user's local codebase or RCF documents, which breaks the in-repository differentiator and the source-of-truth rule. The product is local-first by design; the MCP surface must follow.",
+  "decision": "The MCP server uses local stdio transport only. No network listener is opened. Remote MCP is excluded.",
+  "consequences": "The harness gets the full feature set with filesystem access. There is no hosted MCP path. The trade matches the local-filesystem source-of-truth rule and keeps the product boundaries clean.",
+  "alternativesConsidered": [
+    {
+      "name": "Hosted MCP server",
+      "summary": "Run an MCP server over network transport with the user pointing it at a remote project.",
+      "reasonNotChosen": "Breaks the in-repository differentiator and the source-of-truth rule; a hosted surface would have to mirror or re-fetch the local tree."
+    }
+  ],
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-06-25T00:00:00Z"
+}

package/rcf/adrs/adr-006.json

@@ -0,0 +1,25 @@
+{
+  "createdAt": "2026-07-20T17:03:19.245Z",
+  "updatedAt": "2026-07-20T17:56:46.383Z",
+  "context": "The tool's target user is a non-coding owner who cannot self-verify a deployed application. Across the persona programme the one thing every such user could always exercise was the app running locally; a deployment could dead-end (run 03), be accepted-not-deployed (run 04), or pass locally yet fail in production (run 05). A build whose only demonstrable outcome lives on a remote runtime the owner cannot inspect leaves them with nothing they can check.",
+  "decision": "Every build lands, as its default outcome, a working and documented local preview loop - a dev server, seeded data where the app needs it, ideally reachable in one command. This holds whether or not the owner has stated a hosting target and whether they asked for a recommendation or not; local-first is the rock-solid default, and remote deployment is an addition on top of it, never a replacement for it. The elicitation and build-cycle guidance both carry this as a required deliverable, and the definition of done for a build includes the preview loop being present and documented.",
+  "consequences": "The owner always has a runtime they can drive and review, independent of any cloud account or deploy step. Local preview also becomes the honest substrate for the runtime-provenance discipline (ADR-008): a claim verified against local preview can say so truthfully. The cost is that a working local preview does not prove the deployed runtime works - which is precisely why provenance labelling and the interim self-review exist alongside this decision, not instead of it.",
+  "alternativesConsidered": [
+    {
+      "name": "Deploy-first, preview optional",
+      "summary": "Treat a successful cloud deployment as the primary outcome and local preview as a nicety.",
+      "reasonNotChosen": "Strands owners whose deploy dead-ends or who decline to deploy, and hides defects behind a runtime they cannot inspect."
+    },
+    {
+      "name": "Preview only when the owner asks",
+      "summary": "Produce a local preview loop only when the owner explicitly requests one.",
+      "reasonNotChosen": "The owners who most need it are the least likely to know to ask; a default that depends on the user knowing the right question fails the target user."
+    }
+  ],
+  "adrId": "ADR-006",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Local-first preview is the default build outcome"
+}

package/rcf/adrs/adr-007.json

@@ -0,0 +1,25 @@
+{
+  "createdAt": "2026-07-20T17:03:19.405Z",
+  "updatedAt": "2026-07-20T17:56:46.538Z",
+  "context": "Elicitation ran to a full RCF tree without ever establishing where the application would run. In run 03 the agent silently committed an entire Node-plus-node:sqlite stack that the owner's Cloudflare-only holdings could not host, dead-ending at deploy with no flag; run 04 chose the same incompatible stack class but disclosed it, and the difference was traced to that persona's contract forcing hosting into the spec early. The stack is a load-bearing architecture decision being made for a user who cannot judge it, and making it before the deploy target is known is how the G9 silent-architecture failure happens.",
+  "decision": "Elicitation establishes the deploy target early - a first-class elicitation item asked before the stack is committed, not inferred late - and the stack choice is constrained by the answer. When the owner does not know where it will run, the agent runs a jargon-free hosting-choice walkthrough (ADR captured separately in the guidance) rather than choosing silently. The deploy target and the stack constraint it implies are captured as an ADR on the project's own tree so the decision is visible and revisable.",
+  "consequences": "The stack the tool builds can actually be hosted where the owner can host it, and the hosting decision is surfaced instead of buried. Elicitation gains an early question the lite method did not previously carry, and the harness fragment gains a rule that a stack must not be committed before the deploy target is established. The cost is a small increase in elicitation length up front, paid back many times over against a dead-end at deploy the owner cannot diagnose.",
+  "alternativesConsidered": [
+    {
+      "name": "Infer hosting from the stack later",
+      "summary": "Let the agent pick a stack on technical merit and determine hosting afterwards.",
+      "reasonNotChosen": "Produced the run-03 dead-end: a stack chosen before hosting is a stack that may have no host, discovered only at deploy."
+    },
+    {
+      "name": "Always ask the owner to choose a host explicitly",
+      "summary": "Require the owner to name a hosting provider during elicitation.",
+      "reasonNotChosen": "The target user often does not know the options; a bare demand to choose freezes them. The guidance must walk an unsure owner through choosing, not just ask."
+    }
+  ],
+  "adrId": "ADR-007",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Deploy target is elicited early and constrains the stack"
+}

package/rcf/adrs/adr-008.json

@@ -0,0 +1,25 @@
+{
+  "createdAt": "2026-07-20T17:03:19.567Z",
+  "updatedAt": "2026-07-20T17:56:46.693Z",
+  "context": "In run 05 the tool's self-verification claimed the work was 'verified against a live Worker', but its end-to-end tests actually ran against wrangler dev on localhost, which does not enforce the Cloudflare edge PBKDF2 iteration cap. The result was 89/89 green tests, a confident verification claim, and a CRITICAL signup/login 500 on the actually-deployed runtime. The failure was not laziness but provenance: a claim implied a runtime it had never touched. A non-coding owner cannot tell 'verified against the deployed runtime' from 'verified against a local emulator', so the claim itself must carry the distinction.",
+  "decision": "Every 'verified' or 'tested' claim the tool or its agent makes names the runtime it was checked against - for example 'verified against wrangler dev (localhost) - NOT the deployed Worker runtime'. No claim may state or imply deploy-runtime verification that did not happen. The build-cycle guidance requires the runtime label on verification claims in the Test and Finalise stages and in the PR body's verification section; a claim without a named runtime is treated as incomplete.",
+  "consequences": "The owner can see exactly what was and was not proven, and the gap between 'passes locally' and 'works deployed' stops being invisible. This makes local preview (ADR-006) an honest thing to cite rather than a false proxy for deployment, and it defines the seam the interim self-review and the future independent gate target. The cost is that verification claims become longer and, deliberately, less reassuring - which is the point: an unlabelled claim was falsely reassuring.",
+  "alternativesConsidered": [
+    {
+      "name": "Require verification against the deployed runtime",
+      "summary": "Mandate that every verification run against the real deployed target, removing the provenance ambiguity by removing local verification.",
+      "reasonNotChosen": "Not always possible for the owner (no deploy yet, no account), and it belongs to the productised independent gate (rcf-verify-lite); the base offering's job is to label provenance honestly, not to force a deployed run."
+    },
+    {
+      "name": "Trust green suites as verification",
+      "summary": "Treat a passing test suite as sufficient evidence of 'verified'.",
+      "reasonNotChosen": "Run 05 is the counter-example: 89/89 green with a critical production failure. A green suite is evidence about the runtime it ran on and nothing more."
+    }
+  ],
+  "adrId": "ADR-008",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Verification claims carry runtime provenance"
+}

package/rcf/adrs/adr-009.json

@@ -0,0 +1,25 @@
+{
+  "createdAt": "2026-07-20T17:03:19.722Z",
+  "updatedAt": "2026-07-28T16:40:20.554Z",
+  "context": "The persona programme showed self-verification is only as truthful as the runtime it verifies against, and that a green suite plus a confident claim can still ship a user-facing defect (runs 03 and 05). The durable answer is a productised independent verification gate (rcf-verify-lite), being scoped separately at HQ. But the base offering needs a stopgap now, and it must not pretend to be the independent gate: an in-loop self-review by the same agent is not an independent check and cannot be sold as one.",
+  "decision": "The guidance carries interim self-review guidance - documentation and prompt-level, not a new subsystem - for a carefully-scoped manual-review subagent dispatch: a periodic review every few FBS builds plus one at the end of the build. The reviewer runs fresh-context, drives the APP against the acceptance criteria rather than reading the code, and targets the defect classes green suites miss: session-class bugs, false-promise UI (stubs that imply real actions), runtime mismatch (localhost versus deployed), dead auth paths, and dead code. The guidance states plainly that this is an interim stopgap until rcf-verify-lite exists and that it is not the independent verification gate.",
+  "consequences": "The base offering gains a review step that catches the defect classes the five-stage loop demonstrably missed, at documentation cost and with no new code surface to maintain. Because it is guidance, it can ship now and be retired or folded into rcf-verify-lite later without a migration. The cost and the honesty boundary are the same point: a same-programme reviewer is better than nothing and weaker than an independent gate, and the guidance says so rather than overclaiming. Update 2026-07-28: rcf-verify-lite has since shipped and rcf finalise runs it as the independent gate, so the 'stopgap until the gate exists' framing recorded in the decision above is spent. The decision itself stands - the self-review is still guidance, still not a subsystem, still not the gate - but it is now positioned as the cheap in-loop check that runs between builds, subordinate to the finalise gate rather than a placeholder for it, and AC-805-4 and the guidance were reworded to match.",
+  "alternativesConsidered": [
+    {
+      "name": "Wait for rcf-verify-lite",
+      "summary": "Ship no review step until the productised independent gate exists.",
+      "reasonNotChosen": "Leaves the base offering shipping the exact defect classes the programme caught, for months, against users who cannot catch them themselves."
+    },
+    {
+      "name": "Build an independent-gate subsystem now",
+      "summary": "Solve the independent-verification problem inside rcf-build-lite immediately.",
+      "reasonNotChosen": "That is a separate product being scoped at HQ; duplicating it here pre-empts a repo reshape and over-builds the lite tier. The Tier-1 scope is guidance, not a gate."
+    }
+  ],
+  "adrId": "ADR-009",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Interim self-review is guidance, not the independent gate"
+}

package/rcf/build-sequence.json

@@ -0,0 +1,11 @@
+{
+  "bsId": "BS-001",
+  "prdId": "PRD-001",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "RCF Build Lite initial delivery",
+  "buildPhilosophy": "Dependency-first. Build the document store, then the read-only view surface, then mutating CRUD, then the query layer, then the build loop, then the MCP surface over everything below. Each layer is usable on its own before the next is added.",
+  "generationStrategy": "dependencyFirst",
+  "createdAt": "2026-06-25T00:00:00Z",
+  "updatedAt": "2026-07-02T10:22:43Z"
+}

package/rcf/code-nodes/cn-001.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-001",
+  "path": "src/core/store/validator.js#getAjv",
+  "title": "Ajv instance builder registering the published schema bundle once",
+  "description": "Builds and caches the single Ajv 2020 instance, registering the published @stravica-ai/rcf-schemas bundle at start-up. Satisfies the 'published bundle, registered once' clause.",
+  "implementsAcIds": [
+    "AC-701-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:13:55.704Z",
+  "updatedAt": "2026-07-10T11:13:55.704Z"
+}

package/rcf/code-nodes/cn-002.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-002",
+  "path": "src/core/store/walker.js#netNewErrors",
+  "title": "Net-new error diff between pre- and post-write error sets",
+  "description": "Diffs post-write errors against pre-write errors on the full structured tuple, so an operation is refused only when it introduces breakage not already present.",
+  "implementsAcIds": [
+    "AC-701-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:13:55.793Z",
+  "updatedAt": "2026-07-10T11:13:55.793Z"
+}

package/rcf/code-nodes/cn-003.json

@@ -0,0 +1,15 @@
+{
+  "cnId": "CN-003",
+  "path": "src/core/errors/index.js#rcfError",
+  "title": "Structured error constructor",
+  "description": "Constructs the plain-data RcfError carrying kind, message, documentId, filePath, field and rule. The structured-object contract every surface returns rather than free text.",
+  "implementsAcIds": [
+    "AC-702-1",
+    "AC-702-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:13:55.883Z",
+  "updatedAt": "2026-07-10T11:13:55.883Z"
+}

package/rcf/code-nodes/cn-004.json

@@ -0,0 +1,17 @@
+{
+  "cnId": "CN-004",
+  "path": "src/core/store/walker.js",
+  "title": "Tree walker module (file-level)",
+  "description": "File-level Code Node over the whole walker module. Parallel to symbol-level Code Nodes over simulateWriteErrors/netNewErrors for the granularity comparison.",
+  "implementsAcIds": [
+    "AC-701-1",
+    "AC-102-1",
+    "AC-102-2",
+    "AC-102-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:13:55.972Z",
+  "updatedAt": "2026-07-10T11:15:24.638Z"
+}

package/rcf/code-nodes/cn-005.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-005",
+  "path": "src/core/store/validator.js#validateDocument",
+  "title": "Schema validation entry point with structured field+rule errors",
+  "description": "Validates one document against its schema; on failure extracts the offending field and broken rule and returns a structured error carrying all failures.",
+  "implementsAcIds": [
+    "AC-701-2",
+    "AC-702-1",
+    "AC-702-2"
+  ],
+  "dependencies": [
+    "CN-001",
+    "CN-003"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:14:05.169Z",
+  "updatedAt": "2026-07-10T11:14:05.169Z"
+}

package/rcf/code-nodes/cn-006.json

@@ -0,0 +1,17 @@
+{
+  "cnId": "CN-006",
+  "path": "src/core/errors/index.js#formatErrors",
+  "title": "Multi-error renderer with field+rule detail",
+  "description": "Renders a list of structured errors plus a summary line, surfacing field and rule in verbose mode and reporting every failure together rather than only the first.",
+  "implementsAcIds": [
+    "AC-702-1",
+    "AC-702-2"
+  ],
+  "dependencies": [
+    "CN-003"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:14:05.257Z",
+  "updatedAt": "2026-07-10T11:14:05.257Z"
+}

package/rcf/code-nodes/cn-007.json

@@ -0,0 +1,16 @@
+{
+  "cnId": "CN-007",
+  "path": "src/mcp/map-errors.js#issueFromRcfError",
+  "title": "MCP structured-issue mapper",
+  "description": "Maps an RcfError to the structured issue object delivered to an AI tool over MCP, so validation errors reach the tool as actionable objects, not free text.",
+  "implementsAcIds": [
+    "AC-702-3"
+  ],
+  "dependencies": [
+    "CN-003"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:14:05.346Z",
+  "updatedAt": "2026-07-10T11:14:05.346Z"
+}

package/rcf/code-nodes/cn-008.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-008",
+  "path": "src/core/store/validator.js",
+  "title": "Schema validator module (file-level)",
+  "description": "File-level Code Node over the whole validator module. Parallel to symbol-level Code Nodes over getAjv/validateDocument for the granularity comparison.",
+  "implementsAcIds": [
+    "AC-701-2",
+    "AC-701-3",
+    "AC-702-1",
+    "AC-702-2"
+  ],
+  "dependencies": [
+    "CN-004"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:14:05.435Z",
+  "updatedAt": "2026-07-10T11:14:05.435Z"
+}

package/rcf/code-nodes/cn-009.json

@@ -0,0 +1,16 @@
+{
+  "cnId": "CN-009",
+  "path": "src/core/store/walker.js#simulateWriteErrors",
+  "title": "In-memory post-write tree simulation",
+  "description": "Recomputes the walker error set as if a change-set were applied, without touching disk. The core of the B5 post-write validation gate that lets a write refuse only net-new breakage.",
+  "implementsAcIds": [
+    "AC-701-1"
+  ],
+  "dependencies": [
+    "CN-005"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:14:14.814Z",
+  "updatedAt": "2026-07-10T11:14:14.814Z"
+}

package/rcf/code-nodes/cn-010.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-010",
+  "path": "src/core/store/loader.js#loadDocument",
+  "title": "Load-path validation",
+  "description": "Reads and parses a document by id, then validates it against the published schema on load, so every document brought into memory is validated at the boundary.",
+  "implementsAcIds": [
+    "AC-701-2",
+    "AC-701-3"
+  ],
+  "dependencies": [
+    "CN-005",
+    "CN-003"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:14:14.902Z",
+  "updatedAt": "2026-07-10T11:14:14.902Z"
+}

package/rcf/code-nodes/cn-011.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-011",
+  "path": "src/core/store/writer.js#postWriteGate",
+  "title": "Post-write refusal gate",
+  "description": "Runs a change-set through the tree simulation and refuses the write if any error appears post-write that was not present pre-write. The enforcement point for 'refuse invalid writes'.",
+  "implementsAcIds": [
+    "AC-701-1"
+  ],
+  "dependencies": [
+    "CN-009",
+    "CN-002",
+    "CN-003"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:14:23.483Z",
+  "updatedAt": "2026-07-10T11:14:23.483Z"
+}

package/rcf/code-nodes/cn-012.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-012",
+  "path": "src/core/store/writer.js",
+  "title": "Persistence / CRUD writer module (file-level)",
+  "description": "File-level Code Node over the whole writer module. Parallel to symbol-level Code Nodes over postWriteGate/createDocument for the granularity comparison.",
+  "implementsAcIds": [
+    "AC-701-1",
+    "AC-701-2"
+  ],
+  "dependencies": [
+    "CN-008",
+    "CN-004"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:14:23.587Z",
+  "updatedAt": "2026-07-10T11:14:23.587Z"
+}

package/rcf/code-nodes/cn-013.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-013",
+  "path": "src/core/store/writer.js#createDocument",
+  "title": "Create verb with pre-write validation and post-write gate",
+  "description": "Assembles a document body, schema-validates it, and routes through the post-write gate so a create that would produce an invalid document writes nothing and a successful create validates.",
+  "implementsAcIds": [
+    "AC-701-1",
+    "AC-701-2"
+  ],
+  "dependencies": [
+    "CN-005",
+    "CN-011",
+    "CN-003"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-07-10T11:14:23.703Z",
+  "updatedAt": "2026-07-10T11:14:23.703Z"
+}