rcf-lite 0.13.0 → 0.15.0

package/blueprints/security-auth-clerk/assets/wiring/workers-wrangler-toml-shape.md

@@ -0,0 +1,51 @@
+# Workers wrangler.toml integration note
+
+The wrangler-side configuration a project needs when the Clerk middleware runs inside a Cloudflare Worker. This is a composition boundary between this blueprint (owns the middleware and session-verifier contracts) and `deploy-cloudflare-workers` (owns the wrangler shape); the notes below are the Clerk-specific overlay a Workers deployer applies on top of that blueprint's wrangler-toml sample.
+
+## The Clerk-specific overlay
+
+```
+# wrangler.toml - Clerk-specific overlay
+compatibility_flags = ["nodejs_compat"]
+
+[vars]
+# Public URL of the Clerk-hosted sign-in surface. Not a secret; safe to
+# commit. The middleware's HTML refusal path redirects here.
+CLERK_SIGN_IN_URL = "https://<clerk-subdomain>.accounts.dev/sign-in"
+
+[assets]
+directory = "./public"
+binding = "ASSETS"
+# Every auth-gated route that could collide with a static file must appear
+# here, or the assets binding serves the static file BEFORE the fetch
+# handler runs and the middleware is silently bypassed. See the composition
+# note below.
+run_worker_first = ["/api/*", "/sign-in"]
+```
+
+Secrets are declared by name only, in the deploy blueprint's discipline: no `[secrets]` block in wrangler.toml (that block is decorative and not honoured by wrangler at 4.x, per the deploy blueprint's F-009 fix), and no value in any committed file. The two names the Clerk middleware reads are:
+
+- `CLERK_SECRET_KEY` - server-side Clerk API key, read as `env.CLERK_SECRET_KEY` by `session-verifier.mjs`.
+- `CLERK_PUBLISHABLE_KEY` - Clerk publishable key, read as `env.CLERK_PUBLISHABLE_KEY` by `session-verifier.mjs`.
+
+Bootstrap-and-steady-state guidance for setting the values lives on the deploy blueprint's `bootstrap-vs-steady-state.md` asset; the shape is the same for both Clerk secrets.
+
+## The auth-gate bypass finding
+
+The default `[assets]` binding on a Cloudflare Worker serves any file in the assets directory at its path before the Worker's `fetch` handler runs. If an auth-gated route (`/notes` for a UI page, `/api/notes` for an API surface) collides with a static file at the same path, the static file is served without ever hitting the middleware. This is a silent auth bypass at ship time; a project ships assuming the middleware protects `/notes` and only finds out on the first live probe that `/notes` returned the HTML shell to an unauthenticated request.
+
+The `run_worker_first` array is the wrangler-side fix: every path listed there is routed through the fetch handler before the assets binding gets a chance. A project on the middleware boundary shape should list every auth-gated route class on the list.
+
+The composition responsibility is shared: `deploy-cloudflare-workers` teaches the mechanism (`run_worker_first` in wrangler-toml-shape.md, its US-12101 AC-12101-4 is the runtime-observable acceptance), and this blueprint teaches which routes need it (every auth-gated one on the project's HTTP surface). Neither blueprint carries the project's route list; that emerges from the project's own routing surface.
+
+## What is NOT taught here
+
+- **Which routes are gated.** The blueprint fixes the middleware boundary shape and the auth model. The concrete route list is a project decision the wrangler.toml integrates against.
+- **How the assets binding composes with static-first vs worker-first per-path routing.** The rules and mechanism belong to the deploy blueprint.
+- **Custom-domain vs workers.dev-only production URL.** Same: deploy blueprint concern. The Clerk overlay above is identical either way.
+
+## Notes
+
+- The `CLERK_SIGN_IN_URL` var is not a secret. Committing it in `wrangler.toml [vars]` is the default; a project that wants the value to differ across environments moves it to an environment-specific `[env.<name>.vars]` block per wrangler's standard shape.
+- The `nodejs_compat` flag is required because `@clerk/backend` relies on Node built-ins. Without it, the Worker fails to start with a runtime error naming the missing built-in.
+- Reading the secret at request time from `env` (not at module top-level from `process.env`) is what the workers-fetch-shape sample's `createVerify` factory does; the two files together are the enabling shape.

package/blueprints/security-auth-clerk/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "security-auth-clerk",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "category": "security",
   "contributions": [
     { "id": "security-auth-clerk-REQ-001", "kind": "req", "path": "requirements/security-auth-clerk-req-001.json" },

package/blueprints/security-auth-clerk/docs/topics.md

@@ -10,7 +10,7 @@ This file is the security-auth-clerk half of the cross-blueprint contract. The P
 
 The security-auth-clerk blueprint claims one global topic. Every other contribution is scope-local (ADR-1002 through ADR-1005 name the middleware-boundary shape, the authorisation-adapter contract, the claims-mapping discipline, and the session-lifecycle posture without contributing global topics; a composing blueprint that holds a different opinion on any of them authors its own project-level ADR if it wants to override).
 
-Rules for new topics (inherited from the application-spa, application-api-rest, security-auth-magic-link, persistence-data-sqlite, ci-pipeline, observability-essentials, and security-secrets-management vocabularies, restated as law): lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer. Do not mint variants of existing strings (`identity`, `identityProvider`, `authVendor`, `signIn` are all wrong when `authModel` already exists).
+Rules for new topics (inherited from the application-spa, application-api-rest, security-auth-magic-link, persistence-data-sqlite, delivery-ci-workflows, observability-essentials, and security-secrets-management vocabularies, restated as law): lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer. Do not mint variants of existing strings (`identity`, `identityProvider`, `authVendor`, `signIn` are all wrong when `authModel` already exists).
 
 ## Id number bands (registry bootstrap)
 
@@ -26,7 +26,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
 | hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| ci-pipeline | 6101-6899 | 7xx | shipped v1.0.0 | `ciGates`, `strictCoverageGate` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v1.0.0 | `healthProbes`, `readinessSemantics`, `statusPageContract` |
 | security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |

package/blueprints/security-auth-clerk/guide/security-auth-clerk.md

@@ -66,6 +66,15 @@ A project applies the blueprint on a fresh tree, provisions a Clerk development
 - Provisioning-script directory location (`scripts/provisioning/` by convention on AC-9110-1, or a project-declared equivalent). Blueprint owns that provisioning is not a request handler; project owns where the scripts live.
 - Whether to layer a project-authored Clerk-webhook consumer (for user-created, session-ended, or organisation-membership-changed events). Blueprint's default omits it; a project that adds one authors one TAC and one ADR alongside this blueprint's contributions.
 
+## Runtime coverage
+
+The middleware boundary contract (TAC-1001's `verify(request) -> { authenticated, principal?, reason? }`) is framework-agnostic and runs unchanged on Node HTTP servers (Express, Fastify) and on the Cloudflare Workers fetch handler. Two sample sets ship in `assets/`:
+
+- `assets/middleware/node-middleware-shape.md` for Express and Fastify: adapter wrappers around `verify(request)` that attach the reduced `Principal` to `request.auth`.
+- `assets/middleware/workers-fetch-shape.md` and `assets/wiring/workers-wrangler-toml-shape.md` for Cloudflare Workers: a fetch-handler adapter that carries the same `verify(request)` contract onto the Fetch API `Request` shape, plus the wrangler.toml overlay (`nodejs_compat`, the two Clerk secret names, the `CLERK_SIGN_IN_URL` var, and the `run_worker_first` posture on auth-gated routes that the assets binding would otherwise silently bypass).
+
+A project on a single framework picks up one adapter and pays nothing for the others; a project that hosts multiple runtimes (a Node main app plus a Workers edge function against the same Clerk instance) picks up both sample sets and shares one session verifier and one claims mapper across them.
+
 ## Cost-honesty paragraph
 
 Shipping this doc set costs the project the following. Clerk is a paid vendor beyond the development tier; the operator budgets for it. The `accountBound` runtime-verify posture means the CI runner needs Clerk reachability to actually verify the runtime-verify ACs; a CI runner without outbound network for that vendor either skips those ACs (which the ship gate flags) or the operator wires a preview Clerk instance for CI to reach. The middleware boundary discipline (`request.auth` and `can`/`assert` everywhere) is a code-review load on every new handler; a project that lets the discipline slip loses the vendor-swap-safety the blueprint is buying. The `revocationCheckIntervalMs` window is a stated trade between per-request cost and sign-out prompt-ness; the operator picks a number that reflects the project's actual policy, not the blueprint's default forever. The read-only provisioning posture forces the operator to run Clerk mutations outside the request lifecycle; a project that wants a per-request user-create call is on a different pattern and should think again. The blueprint says nothing about MFA policy, about pricing, about SLA, or about vendor-lock exit; a project that needs any of those spends its own build cycles on them and this blueprint does not save it any work there.

package/blueprints/security-auth-keycloak/docs/topics.md

@@ -10,7 +10,7 @@ This file is the security-auth-keycloak half of the cross-blueprint contract. Th
 
 The security-auth-keycloak blueprint claims one global topic. Every other contribution is scope-local (ADR-1202 through ADR-1206 name the verification-mode choice, the provider-routing seam, the session-vs-token contract, the JWKS rotation-cache lifetime, and the refresh-and-sign-out posture without contributing global topics; a composing blueprint that holds a different opinion on any of them authors its own project-level ADR if it wants to override).
 
-Rules for new topics (inherited from the application-spa, application-api-rest, security-auth-magic-link, security-auth-clerk, security-auth-oauth2, persistence-data-sqlite, ci-pipeline, observability-essentials, and security-secrets-management vocabularies, restated as law): lower camelCase, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer. Do not mint variants of existing strings (`auth`, `authentication`, `identityProvider`, `keycloakProvider` are all wrong when `authModel` already exists).
+Rules for new topics (inherited from the application-spa, application-api-rest, security-auth-magic-link, security-auth-clerk, security-auth-oauth2, persistence-data-sqlite, delivery-ci-workflows, observability-essentials, and security-secrets-management vocabularies, restated as law): lower camelCase, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer. Do not mint variants of existing strings (`auth`, `authentication`, `identityProvider`, `keycloakProvider` are all wrong when `authModel` already exists).
 
 ## The deliberate authModel conflict, restated
 
@@ -37,7 +37,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
 | hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| ci-pipeline | 6101-6899 | 7xx | shipped v1.0.0 | `ciGates`, `strictCoverageGate` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v1.0.0 | `healthProbes`, `readinessSemantics`, `statusPageContract` |
 | security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |

package/blueprints/security-auth-magic-link/README.md

@@ -21,7 +21,7 @@ Phase 1 resolves local path sources only; registry and git-ref resolution is a m
 | Principal registry samples | `assets/principal-registry-samples/single-address.md` | The single-address registry implementation for solo-operator deployments |
 | Principal registry samples | `assets/principal-registry-samples/allow-list-file.md` | An allow-list file registry pattern for small teams |
 | Guide | `guide/security-auth-magic-link.md` | Operator-facing: when to use it, when not, what stays your call, and the promotion signal for the future auth-oidc blueprint |
-| Coordination vocabulary | `docs/topics.md` | The one global-topic string this blueprint contributes, the shared id band registry (application-spa, application-api-rest, security-auth-magic-link, hello-panel, persistence-data-sqlite, ci-pipeline, observability-essentials) |
+| Coordination vocabulary | `docs/topics.md` | The one global-topic string this blueprint contributes, the shared id band registry (application-spa, application-api-rest, security-auth-magic-link, hello-panel, persistence-data-sqlite, delivery-ci-workflows, observability-essentials) |
 
 The doc set is contributions (copied into the project tree by `rcf define blueprint add`); the guide, assets, and docs are package-resident references. Guide rendering into `rcf/knowledge/docs/blueprint-guides/` and asset ingestion are mechanism follow-ups; until they land, the working agent reads them from the applied blueprint's source path recorded in `manifest.blueprints[].source`.
 

package/blueprints/security-auth-magic-link/docs/topics.md

@@ -26,7 +26,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
 | hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| ci-pipeline | 6101-6899 | 7xx | shipped v1.0.0 | `ciGates`, `strictCoverageGate` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v1.0.0 | `healthProbes`, `readinessSemantics`, `statusPageContract` |
 | security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |

package/blueprints/security-auth-oauth2/README.md

@@ -23,7 +23,7 @@ Composing with `security-auth-magic-link`, `security-auth-clerk`, or any other b
 | Mock provider bootstrap | `assets/mock-provider/mock-oidc-shape.md` | The shape of a local mock OIDC provider stood up per REQ-010's acceptance-bar AC; the file names the endpoints, the JWKS shape, and the token minting shape without committing a specific library version |
 | Provider selector sample | `assets/provider-selector/list-shape.md` | The rendering shape the reference selector emits and the query-parameter contract a bespoke replacement honours |
 | Guide | `guide/security-auth-oauth2.md` | Operator-facing: when to use it, when not, the promotion signals for the Clerk and Keycloak siblings, the operator decisions that remain open, the cost-honesty paragraph |
-| Coordination vocabulary | `docs/topics.md` | The one global-topic string this blueprint contributes and the shared id band registry (application-spa, application-api-rest, security-auth-magic-link, email-smtp-resend, persistence-data-sqlite, ci-pipeline, observability-essentials, security-secrets-management, security-auth-clerk, security-auth-oauth2) |
+| Coordination vocabulary | `docs/topics.md` | The one global-topic string this blueprint contributes and the shared id band registry (application-spa, application-api-rest, security-auth-magic-link, email-smtp-resend, persistence-data-sqlite, delivery-ci-workflows, observability-essentials, security-secrets-management, security-auth-clerk, security-auth-oauth2) |
 
 The doc set is contributions (copied into the project tree by `rcf define blueprint add`); the guide, assets, and docs are package-resident references. Guide rendering into `rcf/knowledge/docs/blueprint-guides/` and asset ingestion are mechanism follow-ups; until they land, the working agent reads them from the applied blueprint's source path recorded in `manifest.blueprints[].source`.
 

package/blueprints/security-auth-oauth2/docs/topics.md

@@ -10,7 +10,7 @@ This file is the security-auth-oauth2 half of the cross-blueprint contract. The
 
 The security-auth-oauth2 blueprint claims one global topic. Every other contribution is scope-local (ADR-1102 through ADR-1106 name the provider-abstraction contract shape, the PKCE discipline, the session-bridge shape, the refresh-token posture, and the multi-provider routing without contributing global topics; a composing blueprint that holds a different opinion on any of them authors its own project-level ADR if it wants to override).
 
-Rules for new topics (inherited from the application-spa, application-api-rest, security-auth-magic-link, security-auth-clerk, persistence-data-sqlite, ci-pipeline, observability-essentials, and security-secrets-management vocabularies, restated as law): lower camelCase, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer. Do not mint variants of existing strings (`auth`, `authentication`, `identityProvider`, `oauthProvider` are all wrong when `authModel` already exists).
+Rules for new topics (inherited from the application-spa, application-api-rest, security-auth-magic-link, security-auth-clerk, persistence-data-sqlite, delivery-ci-workflows, observability-essentials, and security-secrets-management vocabularies, restated as law): lower camelCase, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer. Do not mint variants of existing strings (`auth`, `authentication`, `identityProvider`, `oauthProvider` are all wrong when `authModel` already exists).
 
 ## The deliberate authModel conflict, restated
 
@@ -37,7 +37,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
 | hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| ci-pipeline | 6101-6899 | 7xx | shipped v1.0.0 | `ciGates`, `strictCoverageGate` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v1.0.0 | `healthProbes`, `readinessSemantics`, `statusPageContract` |
 | security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |

package/blueprints/security-secrets-management/README.md

@@ -21,7 +21,7 @@ Phase 1 resolves local path sources only; registry and git-ref resolution is a m
 | Agent access pattern | `assets/cli-usage/agent-access-pattern.md` | The piped-stdin pattern for `secrets read` and `secrets put`, including a Node.js spawn wrapper that keeps the value off argv and off any log line |
 | UI three-way choice | `assets/ui-integration/three-way-choice.md` | The elicitation script for the admin-UI choice with the shape of each outcome and the field contract for the `integrate` variant |
 | Guide | `guide/security-secrets-management.md` | Operator-facing: when to use it, when not, what stays your call, and the promotion signals for the hosted-vendor and admin-SPA companion blueprints |
-| Coordination vocabulary | `docs/topics.md` | The one global-topic string this blueprint contributes and the shared id band registry (application-spa, application-api-rest, security-auth-magic-link, hello-panel, persistence-data-sqlite, ci-pipeline, observability-essentials, security-secrets-management) |
+| Coordination vocabulary | `docs/topics.md` | The one global-topic string this blueprint contributes and the shared id band registry (application-spa, application-api-rest, security-auth-magic-link, hello-panel, persistence-data-sqlite, delivery-ci-workflows, observability-essentials, security-secrets-management) |
 
 The doc set is contributions (copied into the project tree by `rcf define blueprint add`); the guide, assets, and docs are package-resident references. Guide rendering into `rcf/knowledge/docs/blueprint-guides/` and asset ingestion are mechanism follow-ups; until they land, the working agent reads them from the applied blueprint's source path recorded in `manifest.blueprints[].source`.
 

package/blueprints/security-secrets-management/docs/topics.md

@@ -6,11 +6,11 @@ This file is the security-secrets-management half of the cross-blueprint contrac
 
 | Topic string | security-secrets-management contribution | Origin | Composition note |
 |---|---|---|---|
-| `secretsSource` | ADR-901-security-secrets-management-secrets-source | Minted here; pre-cleared as unclaimed against application-spa (`clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel`), application-api-rest (`errorEnvelope`, `authModel`, `apiVersioning`, `logging`), security-auth-magic-link (`authModel`), persistence-data-sqlite (`persistenceStore`, `migrationDiscipline`), ci-pipeline (`ciGates`, `strictCoverageGate`), observability-essentials (`healthProbes`, `readinessSemantics`, `statusPageContract`), and the hello-panel walkthrough exemplar (`operatorPanel`) | The one project-wide source of truth for secret material: a repo-root `secrets.yaml` manifest plus a vendor-agnostic Secrets Manager client. A composing blueprint that holds a different opinion on the secrets source (a vendor-committed opinionated blueprint, a config-server pattern, a plaintext-committed pattern for a public reference project) contributes its own scope:global ADR on this exact string and lets composition surface the pairing. Expected resolution: one project-level ADR that fixes the source shape and the vendor selection |
+| `secretsSource` | ADR-901-security-secrets-management-secrets-source | Minted here; pre-cleared as unclaimed against application-spa (`clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel`), application-api-rest (`errorEnvelope`, `authModel`, `apiVersioning`, `logging`), security-auth-magic-link (`authModel`), persistence-data-sqlite (`persistenceStore`, `migrationDiscipline`), delivery-ci-workflows (`ciGates`, `strictCoverageGate`), observability-essentials (`healthProbes`, `readinessSemantics`, `statusPageContract`), and the hello-panel walkthrough exemplar (`operatorPanel`) | The one project-wide source of truth for secret material: a repo-root `secrets.yaml` manifest plus a vendor-agnostic Secrets Manager client. A composing blueprint that holds a different opinion on the secrets source (a vendor-committed opinionated blueprint, a config-server pattern, a plaintext-committed pattern for a public reference project) contributes its own scope:global ADR on this exact string and lets composition surface the pairing. Expected resolution: one project-level ADR that fixes the source shape and the vendor selection |
 
 The security-secrets-management blueprint claims one global topic. Every other contribution is scope-local (ADR-902 through ADR-905 name the default vendor, the agent access discipline, the `.env` reflection posture, and the rotation-and-audit posture without contributing global topics; a composing blueprint that holds a different opinion on any of them authors its own project-level ADR if it wants to override).
 
-Rules for new topics (inherited from the application-spa, application-api-rest, security-auth-magic-link, persistence-data-sqlite, ci-pipeline, and observability vocabularies, restated as law): lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer. Do not mint variants of existing strings (`secrets`, `secretsStore`, `vault`, `secretsVendor`, `credentialsSource` are all wrong when `secretsSource` already exists).
+Rules for new topics (inherited from the application-spa, application-api-rest, security-auth-magic-link, persistence-data-sqlite, delivery-ci-workflows, and observability vocabularies, restated as law): lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer. Do not mint variants of existing strings (`secrets`, `secretsStore`, `vault`, `secretsVendor`, `credentialsSource` are all wrong when `secretsSource` already exists).
 
 ## Id number bands (registry bootstrap)
 
@@ -26,7 +26,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
 | hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| ci-pipeline | 6101-6899 | 7xx | shipped v1.0.0 | `ciGates`, `strictCoverageGate` |
+| delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v1.0.0 | `healthProbes`, `readinessSemantics`, `statusPageContract` |
 | security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |

package/guidance/build-cycle-playbook.md

@@ -264,7 +264,7 @@ One condensed pass against this repository's own tree, captured at build time. Q
 
 ```
 $ rcf build
-# Build queue: BS-001 - RCF Build Lite initial delivery
+# Build queue: BS-001 - RCF Lite initial delivery
 
 Generation strategy: dependencyFirst
 
@@ -311,7 +311,7 @@ Two actionable items, and the tier column says how they relate: FBS-013 and FBS-
 - Estimated hours: 7
 - Risk level: medium
 - Domain: guidance
-- Parent chain: BS-001 -> PRD-001 (RCF Build Lite)
+- Parent chain: BS-001 -> PRD-001 (RCF Lite)
 ```
 
 Mark pickup, and the cycle is running:

package/guidance/document-model.md

@@ -26,7 +26,7 @@ One page per document type, the reference rule that keeps the tree drift-proof,
 
 **TC (Test Case).** One test: which AC it verifies, where the executable test lives (its test pointer), and its status.
 
-**CN (Code Node).** The spec-to-code bridge: a working-tree source path, optionally `#symbol`-suffixed, that implements one or more acceptance criteria (`implementsAcIds`, which may be empty - an orphan CN is a legitimate state for utilities and glue code). `rcf define validate` checks every CN's path/symbol against the working tree, so a rename or deletion that leaves the pointer dangling is caught the same way a broken spec-side reference is. Author CNs during Stage 2 of the build cycle (see below), not after: `rcf build mark <fbs-id> complete` refuses when an in-scope acceptance criterion has none. Full detail, including the honest limits, is `docs/code-nodes.md` in the rcf-build-lite repo.
+**CN (Code Node).** The spec-to-code bridge: a working-tree source path, optionally `#symbol`-suffixed, that implements one or more acceptance criteria (`implementsAcIds`, which may be empty - an orphan CN is a legitimate state for utilities and glue code). `rcf define validate` checks every CN's path/symbol against the working tree, so a rename or deletion that leaves the pointer dangling is caught the same way a broken spec-side reference is. Author CNs during Stage 2 of the build cycle (see below), not after: `rcf build mark <fbs-id> complete` refuses when an in-scope acceptance criterion has none. Full detail, including the honest limits, is `docs/code-nodes.md` in the rcf-lite repo.
 
 ## Edges live on the child
 

package/guidance/harness-template.md

@@ -222,6 +222,19 @@ ask for. A failure the operator has to point out is a failure you did
 not check for. The depth for each stage's self-check lives in the
 build-cycle playbook.
 
+### RULE 14: Check freshness at session start; offer, never install.
+
+At the start of a new session on this project, run `rcf version --check`
+(one call, silent on network trouble) and note the result. If a newer
+release is available, tell the operator in one line what changed and
+OFFER the upgrade. The exact command to run depends on how rcf-lite is
+installed here (global npm, per-repo dep, npx pin); propose the command
+that matches this repo's setup and wait for the operator's yes before
+running it. If the check reports `status: "unknown"` (offline, cache
+miss, feed unreachable) say nothing to the operator; freshness is a
+convenience, not a gate. Never run the upgrade without the operator's
+explicit go.
+
 ### Session start
 
 Run `rcf define validate`. A broken tree is fixed or reported before anything

package/guidance/managed/agent-instructions-block.hash

@@ -1 +1 @@
-70e0048d6160f15191dfbcf43588b0ba4cd24349b7ee8098671f121110677348
+a36dfe0d47c57bafa2ace121e7390fac95c7fff70ee362e864adf75c07be190a

package/guidance/managed/agent-instructions-block.md

@@ -209,6 +209,19 @@ ask for. A failure the operator has to point out is a failure you did
 not check for. The depth for each stage's self-check lives in the
 build-cycle playbook.
 
+### RULE 14: Check freshness at session start; offer, never install.
+
+At the start of a new session on this project, run `rcf version --check`
+(one call, silent on network trouble) and note the result. If a newer
+release is available, tell the operator in one line what changed and
+OFFER the upgrade. The exact command to run depends on how rcf-lite is
+installed here (global npm, per-repo dep, npx pin); propose the command
+that matches this repo's setup and wait for the operator's yes before
+running it. If the check reports `status: "unknown"` (offline, cache
+miss, feed unreachable) say nothing to the operator; freshness is a
+convenience, not a gate. Never run the upgrade without the operator's
+explicit go.
+
 ### Session start
 
 Run `rcf define validate`. A broken tree is fixed or reported before anything

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",
@@ -27,6 +27,7 @@
     "src",
     "guidance",
     "rcf",
+    "releases",
     "fixtures",
     "blueprints",
     "scripts/preinstall-node-check.mjs",
@@ -38,17 +39,6 @@
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   },
-  "scripts": {
-    "test": "node --test --test-concurrency=1 'test/**/*.test.js'",
-    "vendor": "node scripts/vendor-mermaid.mjs",
-    "build:managed": "node scripts/gen-managed-artefacts.mjs",
-    "canary:register": "node scripts/canary-register.mjs",
-    "stage:blueprints": "node scripts/stage-blueprint-shelf.mjs",
-    "preinstall": "node scripts/preinstall-node-check.mjs",
-    "prepack": "node scripts/stage-blueprint-shelf.mjs",
-    "prepublishOnly": "node scripts/gen-managed-artefacts.mjs && node scripts/stage-blueprint-shelf.mjs",
-    "rcf": "node bin/rcf.js"
-  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Stravica/rcf-lite.git",
@@ -70,12 +60,23 @@
     "#admissibility": "./src/admissibility/index.js"
   },
   "dependencies": {
-    "@stravica-ai/rcf-schemas": "0.5.0",
+    "@stravica-ai/rcf-schemas": "0.5.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "js-yaml": "^4.1.0",
     "mermaid": "11.6.0"
+  },
+  "scripts": {
+    "test": "node --test --test-concurrency=1 'test/**/*.test.js'",
+    "vendor": "node scripts/vendor-mermaid.mjs",
+    "build:managed": "node scripts/gen-managed-artefacts.mjs",
+    "canary:register": "node scripts/canary-register.mjs",
+    "validate:releases": "node scripts/validate-releases.mjs",
+    "stage:blueprints": "node scripts/stage-blueprint-shelf.mjs",
+    "preinstall": "node scripts/preinstall-node-check.mjs",
+    "rcf": "node bin/rcf.js"
   }
-}
+}

package/rcf/adrs/adr-001.json

@@ -5,7 +5,7 @@
   "version": "0.1.0",
   "status": "accepted",
   "title": "Local filesystem is the single source of truth",
-  "context": "RCF Build Lite must guarantee that a project's RCF documents live in the source repository, beside the code. v1 tooling operated over the GitHub API rather than the local repo, which broke the in-repository differentiator and tied the tool to a network surface.",
+  "context": "RCF Lite must guarantee that a project's RCF documents live in the source repository, beside the code. v1 tooling operated over the GitHub API rather than the local repo, which broke the in-repository differentiator and tied the tool to a network surface.",
   "decision": "Every read and write targets the local rcf tree directly. No external service, cache or database mirrors the documents. The CLI, the MCP server and the build loop all reach the filesystem only through the document store.",
   "consequences": "The tool works offline and stays harness-agnostic. There is no sync problem and no second source to drift. The cost is that any multi-user or hosted scenario is out of scope by construction, which matches the product boundaries.",
   "alternativesConsidered": [

package/rcf/adrs/adr-009.json

@@ -12,7 +12,7 @@
     },
     {
       "name": "Build an independent-gate subsystem now",
-      "summary": "Solve the independent-verification problem inside rcf-build-lite immediately.",
+      "summary": "Solve the independent-verification problem inside rcf-lite immediately.",
       "reasonNotChosen": "That is a separate product being scoped at HQ; duplicating it here pre-empts a repo reshape and over-builds the lite tier. The Tier-1 scope is guidance, not a gate."
     }
   ],

package/rcf/build-sequence.json

@@ -3,7 +3,7 @@
   "prdId": "PRD-001",
   "version": "0.1.0",
   "status": "draft",
-  "title": "RCF Build Lite initial delivery",
+  "title": "RCF Lite initial delivery",
   "buildPhilosophy": "Dependency-first. Build the document store, then the read-only view surface, then mutating CRUD, then the query layer, then the build loop, then the MCP surface over everything below. Each layer is usable on its own before the next is added.",
   "generationStrategy": "dependencyFirst",
   "createdAt": "2026-06-25T00:00:00Z",

package/rcf/manifest.json

@@ -1,7 +1,7 @@
 {
   "version": "2.0.0",
-  "projectName": "RCF Build Lite",
-  "description": "RCF tree for the RCF Build Lite product. Manifest declares the three root documents; every other document is discovered by walking from the roots.",
+  "projectName": "RCF Lite",
+  "description": "RCF tree for the RCF Lite product. Manifest declares the three root documents; every other document is discovered by walking from the roots.",
   "prd": {
     "id": "PRD-001",
     "path": "prd.json"

package/rcf/prd.json

@@ -1,9 +1,9 @@
 {
   "prdId": "PRD-001",
-  "productName": "RCF Build Lite",
+  "productName": "RCF Lite",
   "version": "0.1.0",
   "status": "draft",
-  "executiveSummary": "RCF Build Lite is the tooling product of the RCF suite. It runs the full Requirements Confidence Framework over a project whose RCF documents live in the source repository, alongside the code. It gives a non-engineering product owner deterministic create, read, update and delete operations on every RCF document type, a visual review surface, traceability and query, a build loop that turns build specifications into implementation prompts, and a local MCP surface that exposes all of this to AI tooling.",
+  "executiveSummary": "RCF Lite is the tooling product of the RCF suite. It runs the full Requirements Confidence Framework over a project whose RCF documents live in the source repository, alongside the code. It gives a non-engineering product owner deterministic create, read, update and delete operations on every RCF document type, a visual review surface, traceability and query, a build loop that turns build specifications into implementation prompts, and a local MCP surface that exposes all of this to AI tooling.",
   "problemStatement": "Power vibe-coders build real applications without engineering teams. They cannot read code, so they cannot judge whether what an AI tool produces is trustworthy. The full RCF chain makes output trustworthy without reading code, but authoring that chain by hand is the very effort these users lack the time and discipline for. There is no tool that runs the full RCF method over in-repository documents and surfaces it through structured, deterministic operations.",
   "targetUsers": [
     "Power vibe-coders: product owners, founders and business voices building applications without engineering teams",

package/releases/releases.yaml

@@ -0,0 +1,126 @@
+# rcf-lite release feed source of truth.
+#
+# This file is the single source that the docs site (stravica.ai) reads
+# at build time to publish the machine-readable feed at
+#   https://stravica.ai/docs/rcf/releases.json
+# and that the rcf-lite package's prepublishOnly step validates against
+# `package.json:version` so a release cannot ship without its own entry.
+#
+# Contract lives in
+#   projects/rcf-lite-wsd/specs/update-awareness-spec-2026-08-28.md
+# section 1 (ratified 2026-08-30).
+#
+# Editing rules at release time:
+#   1. Add the new release as the top entry under `releases:` (newest
+#      first).
+#   2. Update `latest:` to match the new top entry's `version`.
+#   3. Keep `headlines[]` operator-facing: one to three sentences, plain
+#      language, sentence case, terminal period, no method vocabulary
+#      shortcuts.
+#   4. Set `breaking: true` only when the release is a semver-breaking
+#      change per the pre-1.0 breaking-is-minor convention (see
+#      CHANGELOG.md preamble).
+#   5. `minAgentAction` names the extra work the agent needs to do beyond
+#      running the install command. `null` means no extra action. The
+#      enumerated values are listed in the spec section 1.5:
+#        - rewrite-shell-invocations
+#        - rerun-init
+#        - regenerate-chain
+#        - schema-migration
+#   6. `notesUrl` is optional. It currently points at the top of the
+#      human changelog; per-release deep links are a follow-up once the
+#      docs pipeline gives /docs/ headings stable anchor ids.
+#   7. Do not delete or rewrite historical entries; the feed is append-only.
+#
+# Every published release under the `rcf-lite` npm name is listed here.
+# The pre-rename history (packages published under
+# `@stravica-ai/rcf-build-lite`, `@stravica-ai/rcf-lite-core`, and
+# `@stravica-ai/rcf-verify-lite`) lives in CHANGELOG.md but is not part of
+# this feed; the feed is scoped to what an operator can install today as
+# `npm install rcf-lite`.
+
+feedVersion: 1
+latest: "0.15.0"
+releases:
+  - version: "0.15.0"
+    date: "2026-08-31"
+    breaking: false
+    headlines:
+      - "Library-applied blueprints now carry a durable ownership stamp so re-registering a library under a different prefix no longer orphans records that came from it."
+      - "The review-on-add card gained a global-topics section and a prefix-check line so a library's cross-topic surface is visible before the operator commits."
+      - "The delivery-ci-workflows blueprint gained optional package-manager and branch-name shape fields, taught the coverage-strict bootstrap trap in the guide, and shipped a starting-point supersession ADR."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.14.0"
+    date: "2026-08-31"
+    breaking: true
+    headlines:
+      - "The ci-pipeline blueprint is renamed to delivery-ci-workflows and gains a broader set of CI workflows and optional checks."
+      - "A new rcf version command reports the installed version, with --check comparing against the release feed."
+      - "Rerun rcf init to refresh the agent guidance block with the new session-start freshness check."
+    minAgentAction: "rerun-init"
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.13.0"
+    date: "2026-08-31"
+    breaking: false
+    headlines:
+      - "The 14 first-party blueprints now ship inside the installed package, so any doc pointing at a blueprint slug works on a fresh install."
+      - "rcf define blueprint add resolves bare slugs and @stock slugs against the packaged shelf, matching how the docs write the commands."
+      - "Installing on Node earlier than 24 now refuses outright instead of silently resolving an old placeholder release."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.12.0"
+    date: "2026-08-28"
+    breaking: true
+    headlines:
+      - "Tests that claim to pass or fail must now point at a real test file, enforced by the shared schema."
+      - "Tests marked pending or skipped no longer need a pointer, matching how in-progress coverage really looks."
+    minAgentAction: "schema-migration"
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.11.0"
+    date: "2026-08-27"
+    breaking: false
+    headlines:
+      - "The shipped agent guidance gained three new rules for how the agent drives the method loop."
+      - "Re-run rcf init to refresh the managed block in your project's agent instructions file."
+    minAgentAction: "rerun-init"
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.10.0"
+    date: "2026-08-26"
+    breaking: true
+    headlines:
+      - "The command-line interface is reorganised: every command now sits under one of five groups."
+      - "Old flat command forms fail with a message that names the new form."
+    minAgentAction: "rewrite-shell-invocations"
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.9.0"
+    date: "2026-08-25"
+    breaking: false
+    headlines:
+      - "Blueprints landed: compose pre-built implementation patterns onto your project instead of inventing them from a blank page."
+      - "Six starter blueprints ship in the same release, covering web app, REST API, auth, persistence, CI pipeline and observability."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.8.0"
+    date: "2026-08-12"
+    breaking: false
+    headlines:
+      - "A shared standards ruleset ships bundled with the package and now feeds refuse-first admissibility checks on the chain."
+      - "The verifier catches a subtle dishonesty: a test that is narrower in scope than the check it claims to prove."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.7.1"
+    date: "2026-08-12"
+    breaking: false
+    headlines:
+      - "The first release under the unified rcf-lite name, bringing the previously separate tools together as one package on the public npm registry."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"