rcf-lite 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -4,11 +4,39 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Pre-1.0, breaking changes are signalled by a minor version bump.
 
+## [0.14.0] - 2026-08-31
+
+The WSD-handover release. Nine PRs on top of 0.13.0 covering update-awareness end-to-end (feed source-of-truth + validator, `rcf version --check`, RULE 14), the `ci-pipeline` rename to `delivery-ci-workflows`, external-blueprint-library resolution (phase 2b), scoped deep links in the live docs viewer, product-identity rename to "RCF Lite", and one integration-review fix batch.
+
+### Changed (BREAKING)
+
+- **`ci-pipeline` blueprint renamed to `delivery-ci-workflows`** (#122). `rcf define blueprint add ci-pipeline` no longer resolves; use `rcf define blueprint add delivery-ci-workflows`. The v2 rewrite ships in the same PR: the operator declares a `workflowShape` once in `.rcf/config/delivery-ci-workflows.json`, gets a two-tier check catalogue (mandatory `validate` + `coverage-strict`, plus an elicited tier of linter, formatter, typecheck, unit-test, security-scan), a four-mode release workflow (`none` / `tagOnly` / `tagPlusArtefact` / `deployHandoff:<slug>`), and an optional `scheduledAudit` fifth dimension. Sibling blueprints (`application-spa`, `persistence-data-d1`, `observability-essentials`) had their prose references swept. Band registry updated with `releaseArtefacts` as a new global topic.
+
+### Added
+
+- **`rcf version` and `rcf version --check`** (#125, update-awareness Phase 2). New core verb. Bare `rcf version` prints `rcf-lite <semver>` with no network call. `rcf version --check` fetches the release feed at `https://stravica.ai/docs/rcf/releases.json`, semver-compares against the installed version, and prints a compact headline diff (or `--json`). Zero telemetry, two-second fetch budget, XDG cache with a six-hour fresh window and a 24-hour stale ceiling on network failure, kill-switch via `RCF_UPDATE_CHECK=off` or `updateCheck: "off"` in the platform config file. Exit 0 on any check outcome including behind; exit 3 only when `--check` has no usable signal. Global `--version` flag unchanged.
+- **`releases.yaml` source of truth + `prepublishOnly` validator** (#121, update-awareness Phase 1). New file at `packages/rcf-lite/releases/releases.yaml` is the single source the docs site reads to publish the machine-readable feed at `https://stravica.ai/docs/rcf/releases.json`. `scripts/validate-releases.mjs` runs at `prepublishOnly` and refuses publish when the top entry does not match `package.json:version`, when a release fails the field contract, when versions duplicate, or when the list is not ordered newest-first by semver. `files[]` extended with `releases` so the YAML travels inside the tarball.
+- **RULE 14 (freshness check at session start)** (#127, update-awareness Phase 3). New rule appended to the canonical agent-instructions block after RULE 13: at session start, run `rcf version --check` once, silent on network trouble, and if a newer release is available, tell the operator in one line and OFFER the upgrade. Never install without the operator's explicit go. Static wording per spec so the managed-block hash does not drift release-to-release; version-specific content lives in the CLI verb's output.
+- **External blueprint libraries phase 2b** (#126). Local-source libraries only; git and tarball fetchers land in phase 2c. Registry file at `rcf/blueprint-libraries.json` sits next to `rcf/manifest.json`; the manifest walker does not touch it. Colon-qualified reference `<libraryPrefix>:<slug>` is the canonical form (the pre-existing `@<other>/<slug>` slash form stays refused, now with a hint at the colon form). Verbs: `rcf define blueprint library add | list | remove | refresh`, with `--i-have-reviewed` and `--no-review` on `add`. Applied records stamp their effective slug as `<libraryPrefix>-<blueprintSlug>` and carry the qualified typed ref in `source`. Add-time band-collision gate cross-checks every registered library plus the core-shelf reservations shipped in the new `data/core-band-reservations.json`; apply-time band gate refuses contributions whose numeric portion falls outside the library's declared bands.
+- **Scoped deep links in the live docs viewer** (#123, `w-2026-08-30-dave-020`). `rcf audit view open [--blueprint <slug>] [--node <id>] [--no-open] [--json]` resolves a scoped URL into the running (or default) view server, prints it, and opens it. Viewer honours `/?blueprint=<slug>` and `/?node=<id>` (composable) at page load and after every SSE swap. New `GET /scope.json[?blueprint=<slug>]` returns the applied contribution list and the customised-since-apply subset without re-parsing HTML. Read-only in v1; approve/reject is deferred.
+- **`security-auth-clerk` blueprint v1.1.0** (#124). Workers-runtime samples added to the shipped blueprint.
+
+### Changed
+
+- **Product identity renamed to "RCF Lite"** (#128, #129). Every user-facing chrome string and every identity string under the shipped `rcf/` tree renamed from "RCF Build Lite" / "rcf-build-lite" to "RCF Lite" / "rcf-lite". `rcf --version` and `rcf -v` now print `rcf-lite <semver>` in the same shape as the new `rcf version` verb. Cascaded fixtures (`test/build/fixtures/`, `test/view/fixtures/phase-3-6-static.html`), the build-cycle playbook's worked-example lines, and the MCP conformance assertion regenerated in step.
+
+### Fixed
+
+- **`manifest.blueprints[].source` records absolute paths for shelf and path applies again** (#130 F1, w-2026-08-31-dave-031). Post-0.13 applied records dropped the resolved path for shelf slugs; `/scope.json?blueprint=application-spa` reported every contribution as missing, and `blueprint list` collapsed every applied blueprint under `# uncategorised`. Shelf and path applies now record the absolute source path; library applies keep the qualified typed ref (`wsd:auth-oauth2`) per external-libraries spec section 5.3. Consumers (`src/view/scope.js`, `src/blueprint/list.js`) re-resolve non-path sources through `resolveBlueprintSource` against `projectRoot` before handing tokens to the loader.
+- **`data/core-band-reservations.json` catches up to the `ci-pipeline` rename** (#130 F2). Three occurrences of `ci-pipeline` updated to `delivery-ci-workflows`.
+- **`rcf help core` and `rcf help core <verb>` now recognised** (#130 F5). `rcf help core` prints the core-group help block; `rcf help core <verb>` delegates to the same per-verb block as `rcf help <verb>`. Recogniser addition only.
+- **CHANGELOG 0.13.0 shelf enumeration** (#130 F3). The 14-name list in the 0.13.0 entry names `delivery-ci-workflows` in place of `ci-pipeline` so it matches the shipped shelf. Historical entries otherwise untouched.
+
 ## [0.13.0] - 2026-08-31
 
 WSD-readiness packaging release. Five focused fixes so a first-time operator's very first commands succeed on the shipped tarball, not on a source clone.
 
-- **Blueprint shelf is now inside the tarball.** The 14 first-party blueprints (`application-spa`, `application-api-rest`, `ci-pipeline`, `deploy-cloudflare-workers`, `email-smtp-resend`, `observability-essentials`, `observability-probe-endpoints`, `persistence-data-d1`, `persistence-data-sqlite`, `security-auth-clerk`, `security-auth-keycloak`, `security-auth-magic-link`, `security-auth-oauth2`, `security-secrets-management`) ship inside the package. Pre-0.13 tarballs were missing the shelf entirely (`npm pack --dry-run` reported 390 files with zero blueprints), so any doc pointing at a `blueprints/<slug>` path was dead on install. Wired via `files: [ "blueprints" ]` plus a `prepack` script that stages the repo-root shelf into the package before pack runs.
+- **Blueprint shelf is now inside the tarball.** The 14 first-party blueprints (`application-spa`, `application-api-rest`, `delivery-ci-workflows`, `deploy-cloudflare-workers`, `email-smtp-resend`, `observability-essentials`, `observability-probe-endpoints`, `persistence-data-d1`, `persistence-data-sqlite`, `security-auth-clerk`, `security-auth-keycloak`, `security-auth-magic-link`, `security-auth-oauth2`, `security-secrets-management`) ship inside the package. Pre-0.13 tarballs were missing the shelf entirely (`npm pack --dry-run` reported 390 files with zero blueprints), so any doc pointing at a `blueprints/<slug>` path was dead on install. Wired via `files: [ "blueprints" ]` plus a `prepack` script that stages the repo-root shelf into the package before pack runs.
 - **Bare-slug and `@stock/<slug>` resolution on `rcf define blueprint add`.** `rcf define blueprint add deploy-cloudflare-workers` and `rcf define blueprint add @stock/deploy-cloudflare-workers` both resolve against the packaged shelf; local / absolute paths (starting with `.`, `/`, `~`, or containing a separator) keep the pre-0.13 pass-through behaviour byte-for-byte. Any `@<library>/<slug>` other than `@stock` is refused with a message pointing at the phase-2 external-libraries reservation, so the phase-2 registry can land without a breaking rename.
 - **Preinstall hard-fail on Node < 24.** The `engines` block in `package.json` only asks npm to warn; recent npm defaults ignore the warning, and a session on Node 22 silently resolved the last publish that advertised support for it (the `0.0.1` placeholder stub) instead of the current release. `scripts/preinstall-node-check.mjs` now refuses the install outright with a message that names the version detected. Maintainer bypass: `RCF_LITE_SKIP_NODE_CHECK=1`. The README's start-here section also names the Node prereq up front.
 - **Phantom `AC-N-1` seed no longer pollutes coverage on the first real AC.** `rcf define create us` still seeds one placeholder AC (the schema demands `acceptanceCriteria` minItems:1), but the operator's first `rcf define create ac --parent US-N` now REPLACES that placeholder in place instead of appending, so the first real acceptance criterion lands at `AC-N-1` and `audit coverage --strict` / `audit trace` no longer count the seed as an unmet criterion. Detection is strict: replacement only fires when the parent US carries exactly one AC, its id is `AC-<us>-1`, its description matches the exact seed sentinel, `testable === true`, and no `given` / `when` / `then` / `scope` / `provenance` fields are set - any operator edit disqualifies replacement and the append path runs as before.

package/bin/rcf.js

@@ -44,6 +44,7 @@ import { main as blueprintMain } from '../src/cli/blueprint.js';
 import { main as standardsMain } from '../src/cli/standards.js';
 import { main as updateMain } from '../src/cli/update.js';
 import { main as validateMain } from '../src/cli/validate.js';
+import { main as versionMain } from '../src/cli/version.js';
 import { main as viewMain } from '../src/cli/view.js';
 import { main as reqClassifyMain } from '../src/cli/req-classify.js';
 import { main as reqBaselineMain } from '../src/cli/req-baseline.js';
@@ -65,6 +66,7 @@ export const CORE = {
   doctor: doctorMain,
   guidance: guidanceMain,
   mcp: mcpMain,
+  version: versionMain,
   // help handled inline below (needs group context)
 };
 
@@ -170,7 +172,7 @@ export async function main(argv, deps = {}) {
   const first = argv[0];
   if (first === '--version' || first === '-v') {
     const version = await readPackageVersion();
-    stdout.write(`rcf ${version}\n`);
+    stdout.write(`rcf-lite ${version}\n`);
     return 0;
   }
   if (first === '--help' || first === '-h') {

package/blueprints/application-api-rest/docs/topics.md

@@ -27,7 +27,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
 | hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| ci-pipeline | 6101-6899 | 7xx | shipped v1.0.0 | `ciGates`, `strictCoverageGate` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v1.0.0 | `healthProbes`, `readinessSemantics`, `statusPageContract` |
 | security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |

package/blueprints/application-spa/README.md

@@ -49,9 +49,9 @@ v1.1.0 is an additive-non-global minor bump. No global topics change; no contrib
 - `application-spa-US-1130` (anchored to application-spa-REQ-011) with four ACs binding the icon-adherence probe.
 - `TAC-207-application-spa-token-adherence-probe`: a Node build-scan probe the project realises; scans the built component-scope stylesheets for raw palette literals, diffs the light and dark token key sets for parity, writes a stable JSON report, and exits non-zero on any violation.
 - `TAC-208-application-spa-icon-adherence-probe`: a Node build-scan probe the project realises; scans the component source for inline SVG outside the icon registry and for icon references naming aliases the registry does not declare, writes a stable JSON report, and exits non-zero on any violation.
-- `ADR-202-application-spa-theming` and `ADR-206-application-spa-iconography` are amended in place at version 1.1.0: the decision is unchanged; the consequences narrative names the new probe and the ci-pipeline gate-failure path the probe rides.
+- `ADR-202-application-spa-theming` and `ADR-206-application-spa-iconography` are amended in place at version 1.1.0: the decision is unchanged; the consequences narrative names the new probe and the delivery-ci-workflows gate-failure path the probe rides.
 
-The v1.1 probes are runtime-observable AC binding at the ship gate. When a project wires each probe as a required gate in the ci-pipeline runner (TAC-701), a violation refuses ship through TAC-702's per-gate report and TAC-703's aggregate report; the run4 pattern of a discipline declared but not compelled no longer applies to these two categories.
+The v1.1 probes are runtime-observable AC binding at the ship gate. When a project wires each probe as a required gate in the delivery-ci-workflows runner (TAC-701), a violation refuses ship through TAC-702's per-gate report and TAC-703's aggregate report; the run4 pattern of a discipline declared but not compelled no longer applies to these two categories.
 
 ## What v1.2.0 adds
 
@@ -69,7 +69,7 @@ The bump encodes three class rules the deployment / handover gates now compel:
 
 1. **External-service dependency provisioning.** Every external service the app calls at runtime is enumerated on a stable manifest; every credential field is checked against the canonical placeholder-shape detector; every `verified` dependency requires captured live-handshake evidence from the shipped runtime; every `deferred` dependency requires an operator-ratified persistent record (a README note or a status.md quirk line does NOT satisfy).
 2. **Core-flow end-to-end.** Every core user flow is enumerated on a stable manifest; authentication is ALWAYS included when the app has a application-spa-REQ-009 surface; every flow executes end-to-end against the shipped runtime (production entry-point construction, production security headers, real external providers) driven by a real browser, with captured evidence per flow; a skipped, timed-out, or absent flow is a hard refusal.
-3. **Sign-off vocabulary.** A run in which every core flow completes and every external dependency is verified-or-ratified-deferred lands at aggregate verdict `ok`. Any placeholder-shape credential, any missing handshake evidence, any unratified deferral, any core-flow fail-or-skip lands at aggregate verdict `deployed-with-defects`. A "documented workaround exists" does not convert a broken flow into `ok`; the aggregate verdict is what the ci-pipeline runner surfaces.
+3. **Sign-off vocabulary.** A run in which every core flow completes and every external dependency is verified-or-ratified-deferred lands at aggregate verdict `ok`. Any placeholder-shape credential, any missing handshake evidence, any unratified deferral, any core-flow fail-or-skip lands at aggregate verdict `deployed-with-defects`. A "documented workaround exists" does not convert a broken flow into `ok`; the aggregate verdict is what the delivery-ci-workflows runner surfaces.
 
 Contributions:
 

package/blueprints/application-spa/contributions/adrs/adr-202-application-spa-theming.json

@@ -7,7 +7,7 @@
   "title": "Semantic design tokens as CSS custom properties with a root-level theme switch",
   "context": "Dark and light parity is a ratified requirement (application-spa-REQ-005). Parity is only checkable when every colour decision routes through a named token that exists in both palettes. How theming is realised is a whole-project decision: two theming mechanisms cannot coexist without drift. Watchpost run4 demonstrated that declaring the discipline is not the same as compelling it: raw palette values can sit in component stylesheets across passing build cycles. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
   "decision": "The token layer in assets/tokens/design-tokens.json is the single source of colour, spacing, radius, typography, elevation, and motion values. Tokens are realised as CSS custom properties on the document root (assets/tokens/theme.css); the active theme is a data-theme attribute swap. Components consume semantic tokens only; raw palette values in component styles are a defect.",
-  "consequences": "Theme parity and contrast become data checks over one JSON file. Re-skinning is a token edit. The indirection cost is one layer of naming; the working agent extends tokens by adding pairs, never by inlining values. The v1.1 token-adherence probe (TAC-207-application-spa-token-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the built stylesheet output for raw colour literals outside the token-realisation file and diffs the light and dark token key sets, and exits non-zero on any violation. When the probe is wired as a ci-pipeline gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
+  "consequences": "Theme parity and contrast become data checks over one JSON file. Re-skinning is a token edit. The indirection cost is one layer of naming; the working agent extends tokens by adding pairs, never by inlining values. The v1.1 token-adherence probe (TAC-207-application-spa-token-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the built stylesheet output for raw colour literals outside the token-realisation file and diffs the light and dark token key sets, and exits non-zero on any violation. When the probe is wired as a delivery-ci-workflows gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
   "alternativesConsidered": [
     {
       "name": "Per-component theme conditionals",

package/blueprints/application-spa/contributions/adrs/adr-206-application-spa-iconography.json

@@ -7,7 +7,7 @@
   "title": "One icon set behind semantic aliases",
   "context": "application-spa-REQ-011 requires a single icon set. Which construction (stroke width, grid) and how components reference icons needs one recorded answer inside the SPA. Watchpost run4 demonstrated that recording the discipline is not the same as compelling it: a build cycle passed while eight surfaces shipped zero icons. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
   "decision": "The project selects exactly one icon set (consistent stroke and grid across all glyphs) and components reference icons only through semantic aliases (icon.close, icon.danger, icon.search, and peers) declared in one registry. Bespoke per-component artwork requires extending the registry, not inlining SVG.",
-  "consequences": "Swapping icon sets is a registry edit. Decorative versus meaningful icon semantics get one enforcement point for the application-spa-REQ-019 naming rules. The v1.1 icon-adherence probe (TAC-208-application-spa-icon-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the component source for inline SVG outside the registry and for icon references naming aliases the registry does not declare, and exits non-zero on any violation. When the probe is wired as a ci-pipeline gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
+  "consequences": "Swapping icon sets is a registry edit. Decorative versus meaningful icon semantics get one enforcement point for the application-spa-REQ-019 naming rules. The v1.1 icon-adherence probe (TAC-208-application-spa-icon-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the component source for inline SVG outside the registry and for icon references naming aliases the registry does not declare, and exits non-zero on any violation. When the probe is wired as a delivery-ci-workflows gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
   "createdAt": "2026-08-19T09:00:00Z",
   "updatedAt": "2026-08-24T00:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-207-application-spa-token-adherence-probe.json

@@ -5,14 +5,14 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Token adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). Watchpost run4 demonstrated that declaring the discipline does not compel the shipped surface: build cycles ran green while raw hex values sat in component stylesheets. This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit when the discipline is violated, and writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). Watchpost run4 demonstrated that declaring the discipline does not compel the shipped surface: build cycles ran green while raw hex values sat in component stylesheets. This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit when the discipline is violated, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
-    "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a ci-pipeline gate (AC-1129-1, AC-1129-4).",
+    "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1129-1, AC-1129-4).",
     "Read the design tokens source at a configured path (default `assets/tokens/design-tokens.json` per ADR-202) and enumerate the semantic token key sets for both themes (AC-1129-2).",
     "Read the built stylesheet output at a configured glob (component-scope CSS files, excluding the token-realisation file at `assets/tokens/theme.css`) and scan each file line-by-line for raw palette literals: hex (`#[0-9a-fA-F]{3,8}`), `rgb(`, `rgba(`, `hsl(`, `hsla(`, `oklch(`, `oklab(`, and named CSS colours outside the pass-through allow list `transparent | currentColor | inherit | initial | unset` (AC-1129-1).",
     "Diff the enumerated light and dark token key sets by key equality; every key present in one theme MUST be present in the other. A missing counterpart is a violation, not a runtime fallback (AC-1129-2).",
-    "Write a JSON report at a stable relative path (`reports/token-adherence.json` under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every stylesheet file scanned, every raw-literal violation found with file path and line number, every missing-parity token key, and the ok/fail verdict (AC-1129-3).",
-    "Exit with code 0 when zero violations were found and both parity sets match; exit with code 1 (or the configured non-zero code) on any violation, so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1129-1, AC-1129-2, AC-1129-4).",
+    "Write a JSON report at a stable relative path (`reports/token-adherence.json` under the configured report directory, matching the delivery-ci-workflows per-gate report shape of TAC-702) naming: every stylesheet file scanned, every raw-literal violation found with file path and line number, every missing-parity token key, and the ok/fail verdict (AC-1129-3).",
+    "Exit with code 0 when zero violations were found and both parity sets match; exit with code 1 (or the configured non-zero code) on any violation, so a delivery-ci-workflows runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1129-1, AC-1129-2, AC-1129-4).",
     "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1129-4)."
   ],
   "internalStructure": "One Node module that exports a `runTokenAdherenceProbe({ tokensPath, stylesheetGlob, reportDir })` function and a shebang entry point that reads its configuration and calls the exported function. Two independent scanners: (1) a stylesheet scanner that walks the resolved file list, matches every line against the raw-literal regex bank, and accumulates a `{ file, line, snippet, category }` record per violation; (2) a token-parity checker that reads the tokens JSON, extracts the theme-keyed sub-objects, and diffs their key sets. Both scanners contribute to one accumulated report object; the writer serialises the report and the caller returns the exit code derived from the ok/fail verdict.",
@@ -45,10 +45,10 @@
       "description": "The component-scope stylesheet output as it lands in the deployed bundle. The probe scans the built (post-preprocessor) output, not source Sass or CSS-in-JS input, because the runtime surface is what the ADR-202 discipline binds."
     },
     {
-      "name": "ci-pipeline gate runner",
+      "name": "delivery-ci-workflows gate runner",
       "kind": "tac",
-      "tacId": "TAC-701-ci-pipeline-gate-runner",
-      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+      "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+      "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
   "tradeoffs": "Scanning built CSS costs one file walk per build cycle; that cost buys a runtime-observable enforcement of the semantic-token discipline that ADR-202 declares. Scanning at the built layer rather than the source layer catches violations that a preprocessor may otherwise mask (a token indirection that a build-time script expands into a raw literal). The regex bank over string colours accepts some false-positive risk on unusual identifier shapes; the allow list captures the pass-through cases, and a project that needs to extend the allow list does so through the probe's configuration surface, not by silencing the gate.",

package/blueprints/application-spa/contributions/tacs/tac-208-application-spa-icon-adherence-probe.json

@@ -5,13 +5,13 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Icon adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). Watchpost run4 shipped zero icons across eight surfaces while the build cycle ran green; declaring the discipline is not the same as compelling it. This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit when a component sidesteps the alias registry, and writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). Watchpost run4 shipped zero icons across eight surfaces while the build cycle ran green; declaring the discipline is not the same as compelling it. This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit when a component sidesteps the alias registry, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
-    "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a ci-pipeline gate (AC-1130-1, AC-1130-4).",
+    "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1130-1, AC-1130-4).",
     "Read the icon alias registry at a configured path (default `assets/icons/aliases.json` or the project-declared equivalent per ADR-206) and enumerate the declared alias names (AC-1130-2).",
     "Read the component source tree at a configured glob (excluding the icon registry file itself and the icon-set source files it references) and scan each file for two violation classes: (a) any inline `<svg>...</svg>` element that is NOT a JSX fragment consumed by the registry, and (b) any icon reference that resolves to a name absent from the enumerated alias set (AC-1130-1, AC-1130-2).",
-    "Write a JSON report at a stable relative path (`reports/icon-adherence.json` under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every component file scanned, every inline-SVG violation with file path and line number, every unknown-alias violation with file path, line number, and the offending name, and the ok/fail verdict (AC-1130-3).",
-    "Exit with code 0 when zero violations were found; exit with code 1 (or the configured non-zero code) on any violation, so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1130-1, AC-1130-2, AC-1130-4).",
+    "Write a JSON report at a stable relative path (`reports/icon-adherence.json` under the configured report directory, matching the delivery-ci-workflows per-gate report shape of TAC-702) naming: every component file scanned, every inline-SVG violation with file path and line number, every unknown-alias violation with file path, line number, and the offending name, and the ok/fail verdict (AC-1130-3).",
+    "Exit with code 0 when zero violations were found; exit with code 1 (or the configured non-zero code) on any violation, so a delivery-ci-workflows runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1130-1, AC-1130-2, AC-1130-4).",
     "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1130-4)."
   ],
   "internalStructure": "One Node module that exports a `runIconAdherenceProbe({ registryPath, componentGlob, reportDir })` function and a shebang entry point that reads its configuration and calls the exported function. Two scanners share the walked file list: (1) an inline-SVG scanner that matches the shipped source for `<svg` opening tags and refuses any occurrence in a file whose path is outside the registry allow list; (2) an alias-reference scanner that matches configured icon-reference call sites (`icon.<name>`, `<Icon name=\"...\">`, or the project-declared reference shape recorded on the probe's configuration) and looks up every referenced name in the enumerated alias set. Both scanners contribute to one accumulated report; the writer serialises and the caller returns the exit code derived from the ok/fail verdict.",
@@ -44,10 +44,10 @@
       "description": "The shipped component source as it lands in the built bundle. The probe scans the source layer for inline-SVG and alias-reference violations because that is the layer at which the ADR-206 discipline binds; a build-time compilation that inlines an alias to the underlying SVG file is not a violation."
     },
     {
-      "name": "ci-pipeline gate runner",
+      "name": "delivery-ci-workflows gate runner",
       "kind": "tac",
-      "tacId": "TAC-701-ci-pipeline-gate-runner",
-      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+      "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+      "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
   "tradeoffs": "Scanning source for inline SVG accepts that a project may sometimes ship a genuinely single-use bespoke glyph; the discipline says such a glyph joins the registry rather than living inline, and the probe surfaces the choice at the ship gate rather than at design review. The alias-reference scanner needs a project-declared reference-shape pattern (JSX prop, function call, or template literal); the probe ships a small pattern library and the project selects the shape it uses. The cost is one line of configuration; the buy is a runtime-observable enforcement that closes the mechanism-reach gap watchpost run4 caught.",

package/blueprints/application-spa/contributions/tacs/tac-209-application-spa-csp-styled-adherence-probe.json

@@ -5,9 +5,9 @@
   "version": "1.0.1",
   "status": "approved",
   "name": "Styled-under-shipped-CSP adherence probe",
-  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). Watchpost run4 demonstrated the mechanism-reach gap this probe cures: FBS-011 declared a strict CSP (style-src 'self', no unsafe-inline), FBS-013/015 rendered inline <style> blocks, every existing UI-bearing gate passed (28 styled screenshots, browser-verify green), and yet every production page rendered unstyled at deploy because the harness bypassed the production security-header path. This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). Watchpost run4 demonstrated the mechanism-reach gap this probe cures: FBS-011 declared a strict CSP (style-src 'self', no unsafe-inline), FBS-013/015 rendered inline <style> blocks, every existing UI-bearing gate passed (28 styled screenshots, browser-verify green), and yet every production page rendered unstyled at deploy because the harness bypassed the production security-header path. This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
-    "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a ci-pipeline gate (AC-1131-5, AC-1131-6).",
+    "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1131-5, AC-1131-6).",
     "Accept configuration naming (i) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration), (ii) the enumerated set of UI-bearing routes to probe, and (iii) the stylesheet URL every rendered document is expected to link (AC-1131-3, AC-1131-4).",
     "For every enumerated route: navigate a real headless browser to the served URL, capture the response `content-security-policy` header, capture the response body, read the browser's final URL after any redirect chain resolves, run getComputedStyle on document.body, and record the results (AC-1131-1, AC-1131-2, AC-1131-3).",
     "Refuse the run when any captured CSP declares 'unsafe-inline' or 'unsafe-eval' on style-src, when style-src is absent, or when style-src is served as a wildcard (AC-1131-1).",
@@ -15,8 +15,8 @@
     "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, watchpost run4 partial-acceptance gap w-2026-08-24-003).",
     "Refuse the run when the computed body backgroundColor for any route is the browser default (`rgba(0, 0, 0, 0)` / `transparent`) or when the computed body fontFamily resolves to an empty value; both indicate the shipped stylesheet did NOT reach the runtime surface under the production headers (AC-1131-3).",
     "Issue a same-origin GET against the linked stylesheet URL through the same server instance and refuse when the response is not 200 with content-type `text/css` (AC-1131-4).",
-    "Write a JSON report at a stable relative path (`reports/csp-styled-adherence.json` under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every route probed, the CSP header captured, whether an inline <style> was detected, the computed background and fontFamily values, the stylesheet GET verdict, and an ok / fail verdict (AC-1131-5).",
-    "Exit with code 0 when every route passes; exit with code 1 (or the configured non-zero code) on any refusal, so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1131-5, AC-1131-6).",
+    "Write a JSON report at a stable relative path (`reports/csp-styled-adherence.json` under the configured report directory, matching the delivery-ci-workflows per-gate report shape of TAC-702) naming: every route probed, the CSP header captured, whether an inline <style> was detected, the computed background and fontFamily values, the stylesheet GET verdict, and an ok / fail verdict (AC-1131-5).",
+    "Exit with code 0 when every route passes; exit with code 1 (or the configured non-zero code) on any refusal, so a delivery-ci-workflows runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1131-5, AC-1131-6).",
     "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1131-6)."
   ],
   "internalStructure": "One Node module that exports a `runCspStyledAdherenceProbe({ bootServer, routes, stylesheetUrl, reportDir })` function and a shebang entry point that reads its configuration and calls the exported function. Two independent scanners driven from one browser session: (1) an HTML + header scanner that reads the response body and the CSP header per route and applies the inline-style-block and style-src-relaxation refusal rules; (2) a computed-style scanner that first reads `new URL(page.url()).pathname` and applies the `pathMismatch` refusal (a silent redirect chain fails loud with a per-route diagnostic naming both the requested and the landed path, so downstream styled-body checks never run against a redirect target), then runs a `page.evaluate(() => { const cs = getComputedStyle(document.body); return { background: cs.backgroundColor, fontFamily: cs.fontFamily }; })` and applies the browser-default refusal rules. A third check issues a same-origin GET for the linked stylesheet URL and captures status + content-type. All scanners and the stylesheet check contribute to one accumulated report object; the writer serialises the report and the caller returns the exit code derived from the ok / fail verdict.",
@@ -49,13 +49,13 @@
       "description": "A real browser (Playwright chromium, Puppeteer chromium, or equivalent). The probe MUST drive a browser fetch through the shipped headers; an in-process fetch or app.inject() does not exercise the CSP path and cannot satisfy AC-1131-3."
     },
     {
-      "name": "ci-pipeline gate runner",
+      "name": "delivery-ci-workflows gate runner",
       "kind": "tac",
-      "tacId": "TAC-701-ci-pipeline-gate-runner",
-      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+      "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+      "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a real browser and a running server for every ci-pipeline invocation. That cost buys the runtime-observable enforcement the mechanism-reach gap at watchpost run4 proved was missing: build cycles ran green and shipped an unstyled surface because no gate exercised the production header path with a real browser. Driving the shipped construction (not a bespoke harness) is the load-bearing choice; refusing app.inject() satisfaction is deliberate. The requirement that verification runs THROUGH the shipped headers is what makes the AC bite; a probe that stamps its own headers would recreate the class defect it exists to refuse. The v1.0.1 landed-path refusal cures a second gap the same class defect exposed: Playwright's `page.goto` follows redirects by default and returns the FINAL response, so a session-broken authenticated route silently 302'ing to a styled /login left every downstream styled-body assertion validating the login page instead of the requested surface (watchpost partial-acceptance w-2026-08-24-003 / AC-1601-14). Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes the gap without coupling the probe to session-lane internals.",
+  "tradeoffs": "The probe requires a real browser and a running server for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the mechanism-reach gap at watchpost run4 proved was missing: build cycles ran green and shipped an unstyled surface because no gate exercised the production header path with a real browser. Driving the shipped construction (not a bespoke harness) is the load-bearing choice; refusing app.inject() satisfaction is deliberate. The requirement that verification runs THROUGH the shipped headers is what makes the AC bite; a probe that stamps its own headers would recreate the class defect it exists to refuse. The v1.0.1 landed-path refusal cures a second gap the same class defect exposed: Playwright's `page.goto` follows redirects by default and returns the FINAL response, so a session-broken authenticated route silently 302'ing to a styled /login left every downstream styled-body assertion validating the login page instead of the requested surface (watchpost partial-acceptance w-2026-08-24-003 / AC-1601-14). Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes the gap without coupling the probe to session-lane internals.",
   "createdAt": "2026-08-24T10:30:00Z",
   "updatedAt": "2026-08-31T11:15:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-210-application-spa-external-dependency-provisioning-probe.json

@@ -5,16 +5,16 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "External-service-dependency provisioning adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the deployment-gate class defect the watchpost first-production review caught (w-2026-08-24-005, w-2026-08-24-006): the only login path (magic-link email) shipped inert because RESEND_API_KEY was a placeholder, the gap was filed as a 'quirk' in status.md rather than blocked at sign-off, and a real key existed in the estate all along. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md quirk line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the deployment-gate class defect the watchpost first-production review caught (w-2026-08-24-005, w-2026-08-24-006): the only login path (magic-link email) shipped inert because RESEND_API_KEY was a placeholder, the gap was filed as a 'quirk' in status.md rather than blocked at sign-off, and a real key existed in the estate all along. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md quirk line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
-    "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a ci-pipeline gate (AC-1132-5, AC-1132-6).",
+    "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1132-5, AC-1132-6).",
     "Accept configuration naming (i) the path of the application's external-service-dependency manifest, (ii) how to boot the target server for handshake evidence (a Node module or command that starts the same server instance the production entry point starts, with the same route registration and middleware stack), (iii) the path of the ratified-deferrals store the deferral records live in, and (iv) the report directory (AC-1132-1, AC-1132-3, AC-1132-4).",
     "Read the external-service-dependency manifest, iterate every declared dependency, and refuse when any runtime-reached external service is missing from the manifest (the probe accepts a project-supplied enumerator that lists runtime-reached externals; a strict-mode config refuses when the enumerator finds a service not on the manifest) (AC-1132-1).",
     "Resolve each manifest-named credential-field value from the shipped runtime environment (the boot-server factory hands the probe the environment the runtime observes, not the developer machine's environment). Apply the canonical placeholder-shape detector (rcf-lite exports detectPlaceholderCredentialShape) and refuse the run when any manifest-named credential field carries a placeholder-shape value (AC-1132-2).",
     "For every dependency at status 'verified', replay the manifest-declared handshake against the shipped runtime, capture the provider-side acknowledgement (a provider message id, a provider status endpoint 2xx, or an equivalent provider-attested receipt), and record it on the probe report. A run refuses when a 'verified' entry has no captured provider-attested evidence, when the captured evidence is synthetic (in-process stub, mock adapter, unit-test double), or when the handshake failed at provider level (AC-1132-3).",
     "For every dependency at status 'deferred', check the ratified-deferrals store for a record naming the dependency id, the reason for deferral, the acknowledging operator identifier, the ISO-8601 acknowledgement timestamp, and the intended resolution route. Refuse the run when the record is absent, malformed, refers to a dependency the manifest does not declare, or its acknowledgement timestamp is stale beyond the ratified window the store declares (AC-1132-4).",
-    "Write a JSON report at a stable relative path ('reports/external-dependency-provisioning.json' under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every dependency declared, the credential-field placeholder-detector verdict per dependency, the captured handshake evidence per 'verified' dependency, the ratified deferral record reference per 'deferred' dependency, per-dependency verdict, and an aggregate verdict of 'ok' | 'deployed-with-defects' (AC-1132-5).",
-    "Exit with code 0 when the aggregate verdict is 'ok'; exit with code 1 (or the configured non-zero code) on 'deployed-with-defects', so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1132-5, AC-1132-6).",
+    "Write a JSON report at a stable relative path ('reports/external-dependency-provisioning.json' under the configured report directory, matching the delivery-ci-workflows per-gate report shape of TAC-702) naming: every dependency declared, the credential-field placeholder-detector verdict per dependency, the captured handshake evidence per 'verified' dependency, the ratified deferral record reference per 'deferred' dependency, per-dependency verdict, and an aggregate verdict of 'ok' | 'deployed-with-defects' (AC-1132-5).",
+    "Exit with code 0 when the aggregate verdict is 'ok'; exit with code 1 (or the configured non-zero code) on 'deployed-with-defects', so a delivery-ci-workflows runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1132-5, AC-1132-6).",
     "Never treat the absence of a manifest, the absence of a deferrals store, or an unreadable credential resolution as an implicit pass; every such condition refuses ship (AC-1132-1, AC-1132-4).",
     "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1132-6)."
   ],
@@ -58,13 +58,13 @@
       "description": "rcf-lite exports 'detectPlaceholderCredentialShape(value)' from 'packages/rcf-lite/src/deployment/placeholder-detector.js' as the canonical detector this probe (and downstream projects) apply. Extending the detector's ruleset is a rcf-lite minor bump, not a per-project reinvention."
     },
     {
-      "name": "ci-pipeline gate runner",
+      "name": "delivery-ci-workflows gate runner",
       "kind": "tac",
-      "tacId": "TAC-701-ci-pipeline-gate-runner",
-      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+      "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+      "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a running server booted through the production construction and network reach to real external providers for every ci-pipeline invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: the build cycle ran green, sign-off said DEPLOYED, and the only login path was inert on a placeholder credential. Requiring a manifest is a deliberate load-bearing choice: without the manifest, the enumeration set of runtime-reached externals is invisible to the gate. Requiring the ratified-deferrals store to be a persistent machine-readable artefact (not a README note) is the choice that refuses the 'quirk-in-status.md' pattern the class defect exposed. Extending the detector's ruleset in rcf-lite (rather than per-project) is deliberate: one authoritative catalogue of placeholder shapes serves every downstream project.",
+  "tradeoffs": "The probe requires a running server booted through the production construction and network reach to real external providers for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: the build cycle ran green, sign-off said DEPLOYED, and the only login path was inert on a placeholder credential. Requiring a manifest is a deliberate load-bearing choice: without the manifest, the enumeration set of runtime-reached externals is invisible to the gate. Requiring the ratified-deferrals store to be a persistent machine-readable artefact (not a README note) is the choice that refuses the 'quirk-in-status.md' pattern the class defect exposed. Extending the detector's ruleset in rcf-lite (rather than per-project) is deliberate: one authoritative catalogue of placeholder shapes serves every downstream project.",
   "createdAt": "2026-08-24T13:00:00Z",
   "updatedAt": "2026-08-24T13:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-211-application-spa-core-flow-e2e-probe.json

@@ -5,17 +5,17 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Core-flow end-to-end adherence probe",
-  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. Watchpost first production (w-2026-08-24-005) demonstrated the deployment-gate class defect this probe cures: the app was signed off as DEPLOYED, admin access was reachable only via ssh-minted tokens because magic-link email never worked in production, and the authentication core flow was never proven end-to-end in the shipped runtime. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. Watchpost first production (w-2026-08-24-005) demonstrated the deployment-gate class defect this probe cures: the app was signed off as DEPLOYED, admin access was reachable only via ssh-minted tokens because magic-link email never worked in production, and the authentication core flow was never proven end-to-end in the shipped runtime. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
-    "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a ci-pipeline gate (AC-1133-5, AC-1133-6).",
+    "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1133-5, AC-1133-6).",
     "Accept configuration naming (i) the path of the application's core-flow manifest, (ii) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration, the same production security-header stack, and the same middleware), (iii) how to reach real external-service providers (the deferrals-permission is the same shape as TAC-210 accepts for its 'deferred' entries), and (iv) the report directory (AC-1133-1, AC-1133-2, AC-1133-4).",
     "Read the core-flow manifest, iterate every declared core flow, and refuse ship when the manifest omits an authentication flow while the application declares any application-spa-REQ-009 authentication surface. The auth-flow enumeration requirement is a hard invariant of the probe (AC-1133-1).",
     "For every enumerated core flow, drive a real headless browser through the ordered step sequence against the SHIPPED runtime: the same server construction the production entry point boots, the same production security-header stack, real external-service providers (never in-process stubs, mocked adapters, or app.inject). Refuse the run when any flow ran through a bypassed header path, an in-process fetch, a mocked provider, or a bespoke test harness (AC-1133-2).",
     "For every flow capture: an ordered navigation trace of routes visited with response status codes, the terminal DOM assertion result, the wall-clock timing per step, and any provider-side ids the flow generated (e.g. an emailed magic-link id, a payment intent id). Persist the evidence per flow on the probe report (AC-1133-3, AC-1133-5).",
     "Refuse ship on any enumerated core flow whose evidence is absent, whose verdict is 'skip', whose verdict is 'fail', or whose terminal DOM assertion did not hold. 'A documented workaround exists', a status.md quirk line, an operator note, or an admin-bypass (e.g. mint-your-own-token) explicitly does NOT convert a broken or skipped flow into a passing verdict; the probe emits a hard refusal on any such flow (AC-1133-3).",
     "For every fail-or-skip flow, write a structured refusal on the report naming the flow id, the entry-point route, the step at which the flow diverged, the assertion that did not hold, and the captured evidence up to the divergence; emit a stdout line naming the flow id and the report path (AC-1133-4).",
-    "Write a JSON report at a stable relative path ('reports/core-flow-e2e-adherence.json' under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every core flow enumerated, its captured evidence entry, its per-flow verdict ('ok' | 'fail' | 'skip'), and an aggregate 'verdict' of 'ok' | 'deployed-with-defects' (AC-1133-5).",
-    "Exit with code 0 when the aggregate verdict is 'ok'; exit with code 1 (or the configured non-zero code) on 'deployed-with-defects', so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1133-5, AC-1133-6).",
+    "Write a JSON report at a stable relative path ('reports/core-flow-e2e-adherence.json' under the configured report directory, matching the delivery-ci-workflows per-gate report shape of TAC-702) naming: every core flow enumerated, its captured evidence entry, its per-flow verdict ('ok' | 'fail' | 'skip'), and an aggregate 'verdict' of 'ok' | 'deployed-with-defects' (AC-1133-5).",
+    "Exit with code 0 when the aggregate verdict is 'ok'; exit with code 1 (or the configured non-zero code) on 'deployed-with-defects', so a delivery-ci-workflows runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1133-5, AC-1133-6).",
     "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1133-6)."
   ],
   "internalStructure": "One Node module that exports a 'runCoreFlowE2eProbe({ manifestPath, bootServer, reportDir })' function and a shebang entry point that reads its configuration and calls the exported function. A driver orchestrates: (1) a manifest scanner that reads the enumerated flow set and refuses when the auth-flow-required invariant is violated, (2) a per-flow runner that drives a real headless browser through the ordered step sequence against the boot-server-produced URL, respecting the shipped headers and reaching real providers, and (3) an evidence recorder that persists the navigation trace, response status codes, timings, and any provider ids per flow. The writer serialises the accumulated report and the caller returns the exit code derived from the aggregate verdict.",
@@ -58,13 +58,13 @@
       "description": "The probe drives every enumerated core flow against real providers named on the external-service-dependency manifest TAC-210 reads. When a provider is 'deferred' per TAC-210, the affected flow is 'skip' and the aggregate lands 'deployed-with-defects' (a deferred provider cannot underwrite a passing core-flow gate)."
     },
     {
-      "name": "ci-pipeline gate runner",
+      "name": "delivery-ci-workflows gate runner",
       "kind": "tac",
-      "tacId": "TAC-701-ci-pipeline-gate-runner",
-      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+      "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+      "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a real browser, the shipped server construction, and network reach to real external providers for every ci-pipeline invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: sign-off said DEPLOYED, admin login was only reachable via a manually minted token, and no gate demanded the auth flow work end-to-end in the shipped runtime. Requiring an auth-flow-enumeration hard invariant is deliberate: authentication is the flow the class-defect instance exposed, and its enumeration cannot be optional when application-spa-REQ-009 surfaces are present. Refusing to accept a 'documented workaround' as sign-off is the choice that refuses the 'quirk-in-status.md' pattern; the aggregate 'deployed-with-defects' vocabulary is what the probe emits to name the distinction between 'shipped and accepted' and 'shipped with a broken core flow'.",
+  "tradeoffs": "The probe requires a real browser, the shipped server construction, and network reach to real external providers for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: sign-off said DEPLOYED, admin login was only reachable via a manually minted token, and no gate demanded the auth flow work end-to-end in the shipped runtime. Requiring an auth-flow-enumeration hard invariant is deliberate: authentication is the flow the class-defect instance exposed, and its enumeration cannot be optional when application-spa-REQ-009 surfaces are present. Refusing to accept a 'documented workaround' as sign-off is the choice that refuses the 'quirk-in-status.md' pattern; the aggregate 'deployed-with-defects' vocabulary is what the probe emits to name the distinction between 'shipped and accepted' and 'shipped with a broken core flow'.",
   "createdAt": "2026-08-24T13:00:00Z",
   "updatedAt": "2026-08-24T13:00:00Z"
 }

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1129.json

@@ -38,8 +38,8 @@
     },
     {
       "id": "AC-1129-4",
-      "description": "When the token-adherence probe is wired as a gate in the ci-pipeline runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the ci-pipeline runner refuses ship with a non-zero exit.",
-      "given": "the ci-pipeline runner configured with the token-adherence probe as a required gate",
+      "description": "When the token-adherence probe is wired as a gate in the delivery-ci-workflows runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the delivery-ci-workflows runner refuses ship with a non-zero exit.",
+      "given": "the delivery-ci-workflows runner configured with the token-adherence probe as a required gate",
       "when": "the probe reports `fail` on any run",
       "then": "the aggregate report records the gate as failed and the runner exits non-zero",
       "testable": true,

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1130.json

@@ -38,8 +38,8 @@
     },
     {
       "id": "AC-1130-4",
-      "description": "When the icon-adherence probe is wired as a gate in the ci-pipeline runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the ci-pipeline runner refuses ship with a non-zero exit.",
-      "given": "the ci-pipeline runner configured with the icon-adherence probe as a required gate",
+      "description": "When the icon-adherence probe is wired as a gate in the delivery-ci-workflows runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the delivery-ci-workflows runner refuses ship with a non-zero exit.",
+      "given": "the delivery-ci-workflows runner configured with the icon-adherence probe as a required gate",
       "when": "the probe reports `fail` on any run",
       "then": "the aggregate report records the gate as failed and the runner exits non-zero",
       "testable": true,

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1131.json

@@ -56,8 +56,8 @@
     },
     {
       "id": "AC-1131-6",
-      "description": "When the styled-under-shipped-CSP adherence probe is wired as a gate in the ci-pipeline runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the ci-pipeline runner refuses ship with a non-zero exit.",
-      "given": "the ci-pipeline runner configured with the styled-under-CSP adherence probe as a required gate",
+      "description": "When the styled-under-shipped-CSP adherence probe is wired as a gate in the delivery-ci-workflows runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the delivery-ci-workflows runner refuses ship with a non-zero exit.",
+      "given": "the delivery-ci-workflows runner configured with the styled-under-CSP adherence probe as a required gate",
       "when": "the probe reports `fail` on any run",
       "then": "the aggregate report records the gate as failed and the runner exits non-zero",
       "testable": true,

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1132.json

@@ -56,8 +56,8 @@
     },
     {
       "id": "AC-1132-6",
-      "description": "When the external-service-dependency provisioning probe is wired as a gate in the ci-pipeline runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the ci-pipeline runner refuses ship with a non-zero exit. The 'deployed-with-defects' probe verdict maps deterministically to a 'failed' entry in the TAC-703 aggregate; a run cannot land the pipeline aggregate at 'passed' while any external-service dependency carries placeholder credentials or an unratified deferral.",
-      "given": "the ci-pipeline runner configured with the external-service-dependency provisioning probe as a required gate",
+      "description": "When the external-service-dependency provisioning probe is wired as a gate in the delivery-ci-workflows runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the delivery-ci-workflows runner refuses ship with a non-zero exit. The 'deployed-with-defects' probe verdict maps deterministically to a 'failed' entry in the TAC-703 aggregate; a run cannot land the pipeline aggregate at 'passed' while any external-service dependency carries placeholder credentials or an unratified deferral.",
+      "given": "the delivery-ci-workflows runner configured with the external-service-dependency provisioning probe as a required gate",
       "when": "the probe reports 'deployed-with-defects' on any run",
       "then": "the aggregate report records the gate as failed and the runner exits non-zero",
       "testable": true,

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1133.json

@@ -38,7 +38,7 @@
     },
     {
       "id": "AC-1133-4",
-      "description": "For every core flow that fails or is skipped, the probe writes a machine-readable refusal on the report naming the flow id, the entry-point route, the step at which the flow diverged from expectation, the assertion that did not hold, and the captured evidence up to the divergence. The refusal renders in the probe's stdout with the flow id and the report path, so a ci-pipeline operator reading the runner output sees which flow refused and where to look. Silent-log refusals are not permitted; every refusal exits the probe non-zero.",
+      "description": "For every core flow that fails or is skipped, the probe writes a machine-readable refusal on the report naming the flow id, the entry-point route, the step at which the flow diverged from expectation, the assertion that did not hold, and the captured evidence up to the divergence. The refusal renders in the probe's stdout with the flow id and the report path, so a delivery-ci-workflows operator reading the runner output sees which flow refused and where to look. Silent-log refusals are not permitted; every refusal exits the probe non-zero.",
       "given": "any core flow the probe records as 'fail' or 'skip'",
       "when": "the probe run terminates",
       "then": "the probe report carries a structured refusal entry naming the flow, the divergence step, and the failing assertion; stdout names the flow id and the report path; the process exit is non-zero",
@@ -56,8 +56,8 @@
     },
     {
       "id": "AC-1133-6",
-      "description": "When the core-flow end-to-end probe is wired as a gate in the ci-pipeline runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the ci-pipeline runner refuses ship with a non-zero exit. The 'deployed-with-defects' probe verdict maps deterministically to a 'failed' entry in the TAC-703 aggregate; a run cannot land the pipeline aggregate at 'passed' while any enumerated core flow ran as 'fail' or 'skip'.",
-      "given": "the ci-pipeline runner configured with the core-flow end-to-end probe as a required gate",
+      "description": "When the core-flow end-to-end probe is wired as a gate in the delivery-ci-workflows runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the delivery-ci-workflows runner refuses ship with a non-zero exit. The 'deployed-with-defects' probe verdict maps deterministically to a 'failed' entry in the TAC-703 aggregate; a run cannot land the pipeline aggregate at 'passed' while any enumerated core flow ran as 'fail' or 'skip'.",
+      "given": "the delivery-ci-workflows runner configured with the core-flow end-to-end probe as a required gate",
       "when": "the probe reports 'deployed-with-defects' on any run",
       "then": "the aggregate report records the gate as failed and the runner exits non-zero",
       "testable": true,

package/blueprints/application-spa/docs/topics.md

@@ -32,7 +32,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
 | hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| ci-pipeline | 6101-6899 | 7xx | shipped v1.0.0 | `ciGates`, `strictCoverageGate` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v1.0.0 | `healthProbes`, `readinessSemantics`, `statusPageContract` |
 | security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |

package/blueprints/delivery-ci-workflows/CHANGELOG.md

@@ -0,0 +1,39 @@
+# Changelog: delivery-ci-workflows blueprint
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the blueprint version is semver per the authoring standard section 8.
+
+## [2.0.0] - 2026-08-31
+
+Rename from `ci-pipeline` and redesign into a workflow SET the operator declares via a `workflowShape` block; introduces the elicited-check tier (linter, formatter, typecheck, unitTest, securityScan) alongside the preserved v1 RCF-gate mandatory tier; introduces the release workflow scaled across four modes; introduces the optional scheduled-audit workflow; mints one new global topic (`releaseArtefacts`). Ratified 2026-08-31 (Q1 one-blueprint-the-set; Q6-B releaseMode-optional; all other section-12 questions accepted as recommended).
+
+### Changed (BREAKING)
+
+- **Slug rename**: `ci-pipeline` -> `delivery-ci-workflows`. Directory `blueprints/ci-pipeline/` -> `blueprints/delivery-ci-workflows/`. Every contribution id rewrites: prefix-family `ci-pipeline-REQ-NNN` -> `delivery-ci-workflows-REQ-NNN` (numbers preserved), suffix-family `TAC-70N-ci-pipeline-<tail>` -> `TAC-70N-delivery-ci-workflows-<tail>` (numbers and tails preserved).
+- **`ciGates` topic answer surface broadened**: the topic string is unchanged; the delivery-side answer is now the mandatory tier (v1 fixed two-gate set, preserved verbatim) plus the elicited tier the project turns on and off through `workflowShape.checkSet` (default: every catalogued elicited check on). Downstream readers of the aggregate report see a longer `gates[]` array; the report shape itself is unchanged.
+- **New global topic**: `releaseArtefacts` is minted for the decision area of what the release workflow produces on a release trigger. ADR-709 is the delivery-side answer (the four-mode `releaseMode` enumeration).
+- **`workflowShape` elicitation surface required**: the project ships `.rcf/config/delivery-ci-workflows.json` with three required fields (`branchModel`, `checkSet`, `providerHint`) plus one optional field (`releaseMode`, absent = no release workflow, per Q6-B ratification) and two optional dimensions (`scheduledAudit`, `trunkPullRequests`). The workflow-materialiser boot-check refuses on missing required fields or unrecognised values.
+
+### Added
+
+- Six new REQs covering the elicitation surface (REQ-011, REQ-012, REQ-013), branch model (REQ-014, REQ-015), the elicited check catalogue (REQ-016..020), the release workflow (REQ-021), the deploy handoff (REQ-022), and the scheduled-audit dimension (REQ-023). Total REQ count: 23 (up from 10 at v1).
+- Corresponding new user stories US-6111..US-6123 (23 total) with additive ACs; the aggregate AC count sits inside the ratified 6101-6899 band.
+- Three new TACs: TAC-704 (workflow-materialiser), TAC-705 (release-workflow orchestrator), TAC-706 (scheduled-audit runner). The v1 three TACs (gate-runner, per-gate report, aggregate report) are preserved verbatim except for the report-writer picking up the v2 `checkKind` field.
+- Six new ADRs: ADR-705 (elicitation-surface location), ADR-706 (branch-model defaults), ADR-707 (release-workflow shape), ADR-708 (provider-hint shape), ADR-709 (`releaseArtefacts` global), ADR-710 (scheduled-audit dimension). The v1 four ADRs are preserved with content updated for v2 broadened scope.
+- Per-gate report shape gains a `checkKind` field naming the elicited-check kind (`validate`, `coverage-strict`, `linter`, `formatter`, `typecheck`, `unitTest`, `securityScan`, `custom:<name>`). The v1 fixed key set is preserved as a strict subset.
+- Distinct aggregate report paths per workflow: commit-triggered stays at `.rcf/reports/ci/pipeline.json`; release writes to `.rcf/reports/ci/release.json`; scheduled-audit writes to `.rcf/reports/ci/scheduled-audit.json`.
+- GHA illustrative asset set now covers one file per workflow in the matrix under `assets/ci-provider-examples/github-actions/`. The alternate-provider notes doc extends the four-point mapping to cover every workflow.
+
+### Migration
+
+For a project that applied `ci-pipeline` v1:
+
+1. `rcf define blueprint remove ci-pipeline`.
+2. `rcf define blueprint add <path>/blueprints/delivery-ci-workflows`.
+3. Populate `.rcf/config/delivery-ci-workflows.json` with the `workflowShape` block (see the guide for the four dimensions plus the two optional).
+4. Run the project-realised workflow-materialiser (TAC-704 realisation) to produce the workflow set.
+5. Any project-authored ADR that superseded v1's `ciGates` topic is re-authored to supersede v2's `ciGates` (topic string unchanged; the mechanism records the pair).
+6. Downstream readers that read per-gate reports pick up the new `checkKind` field; readers written against the v1 fixed key set continue to work (the v1 keys are a strict subset).
+
+## [1.0.0] - 2026-08-24
+
+Initial release under the `ci-pipeline` slug. Ships the two-gate mandatory suite (`validate` then `coverage-strict`), the Node-only runner contract, the per-gate and aggregate JSON report shapes, and one illustrative GHA workflow. Two global topics: `ciGates`, `strictCoverageGate`. Superseded by v2.0.0 under the `delivery-ci-workflows` slug.