rcf-lite 0.19.0 → 0.21.0

package/blueprints/observability-logging/blueprint.json

@@ -1,27 +1,119 @@
 {
   "slug": "observability-logging",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "category": "observability",
-  "providesRoles": ["logging"],
+  "providesRoles": [
+    "logging"
+  ],
+  "capabilities": [
+    "auditLog"
+  ],
   "contributions": [
-    { "id": "observability-logging-REQ-001", "kind": "req", "path": "requirements/observability-logging-req-001.json" },
-    { "id": "observability-logging-REQ-002", "kind": "req", "path": "requirements/observability-logging-req-002.json" },
-    { "id": "observability-logging-REQ-003", "kind": "req", "path": "requirements/observability-logging-req-003.json" },
-    { "id": "observability-logging-REQ-004", "kind": "req", "path": "requirements/observability-logging-req-004.json" },
-    { "id": "observability-logging-REQ-005", "kind": "req", "path": "requirements/observability-logging-req-005.json" },
-    { "id": "observability-logging-US-15101", "kind": "us", "path": "user-stories/observability-logging-us-15101.json" },
-    { "id": "observability-logging-US-15102", "kind": "us", "path": "user-stories/observability-logging-us-15102.json" },
-    { "id": "observability-logging-US-15103", "kind": "us", "path": "user-stories/observability-logging-us-15103.json" },
-    { "id": "observability-logging-US-15104", "kind": "us", "path": "user-stories/observability-logging-us-15104.json" },
-    { "id": "observability-logging-US-15105", "kind": "us", "path": "user-stories/observability-logging-us-15105.json" },
-    { "id": "observability-logging-US-15106", "kind": "us", "path": "user-stories/observability-logging-us-15106.json" },
-    { "id": "observability-logging-US-15107", "kind": "us", "path": "user-stories/observability-logging-us-15107.json" },
-    { "id": "observability-logging-US-15108", "kind": "us", "path": "user-stories/observability-logging-us-15108.json" },
-    { "id": "TAC-1601-observability-logging-logger-factory", "kind": "tac", "path": "tacs/tac-1601-observability-logging-logger-factory.json" },
-    { "id": "TAC-1602-observability-logging-redaction-boundary", "kind": "tac", "path": "tacs/tac-1602-observability-logging-redaction-boundary.json" },
-    { "id": "ADR-1601-observability-logging-line-shape", "kind": "adr", "path": "adrs/adr-1601-observability-logging-line-shape.json", "scope": "global", "topic": "logging" },
-    { "id": "ADR-1602-observability-logging-correlation-id-header", "kind": "adr", "path": "adrs/adr-1602-observability-logging-correlation-id-header.json", "recommendedDefault": true, "elicited": true, "standardsTraceClause": "generic enterprise practice" },
-    { "id": "ADR-1603-observability-logging-redaction-categories", "kind": "adr", "path": "adrs/adr-1603-observability-logging-redaction-categories.json", "recommendedDefault": true, "elicited": true, "standardsTraceClause": "generic enterprise practice" },
-    { "id": "ADR-1604-observability-logging-level-vocabulary", "kind": "adr", "path": "adrs/adr-1604-observability-logging-level-vocabulary.json", "recommendedDefault": true, "elicited": true, "standardsTraceClause": "generic enterprise practice" }
+    {
+      "id": "observability-logging-REQ-001",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-001.json"
+    },
+    {
+      "id": "observability-logging-REQ-002",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-002.json"
+    },
+    {
+      "id": "observability-logging-REQ-003",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-003.json"
+    },
+    {
+      "id": "observability-logging-REQ-004",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-004.json"
+    },
+    {
+      "id": "observability-logging-REQ-005",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-005.json"
+    },
+    {
+      "id": "observability-logging-US-15101",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15101.json"
+    },
+    {
+      "id": "observability-logging-US-15102",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15102.json"
+    },
+    {
+      "id": "observability-logging-US-15103",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15103.json"
+    },
+    {
+      "id": "observability-logging-US-15104",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15104.json"
+    },
+    {
+      "id": "observability-logging-US-15105",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15105.json"
+    },
+    {
+      "id": "observability-logging-US-15106",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15106.json"
+    },
+    {
+      "id": "observability-logging-US-15107",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15107.json"
+    },
+    {
+      "id": "observability-logging-US-15108",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15108.json"
+    },
+    {
+      "id": "TAC-1601-observability-logging-logger-factory",
+      "kind": "tac",
+      "path": "tacs/tac-1601-observability-logging-logger-factory.json"
+    },
+    {
+      "id": "TAC-1602-observability-logging-redaction-boundary",
+      "kind": "tac",
+      "path": "tacs/tac-1602-observability-logging-redaction-boundary.json"
+    },
+    {
+      "id": "ADR-1601-observability-logging-line-shape",
+      "kind": "adr",
+      "path": "adrs/adr-1601-observability-logging-line-shape.json",
+      "scope": "global",
+      "topic": "logging"
+    },
+    {
+      "id": "ADR-1602-observability-logging-correlation-id-header",
+      "kind": "adr",
+      "path": "adrs/adr-1602-observability-logging-correlation-id-header.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-1603-observability-logging-redaction-categories",
+      "kind": "adr",
+      "path": "adrs/adr-1603-observability-logging-redaction-categories.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-1604-observability-logging-level-vocabulary",
+      "kind": "adr",
+      "path": "adrs/adr-1604-observability-logging-level-vocabulary.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    }
   ]
 }

package/blueprints/observability-logging/docs/topics.md

@@ -17,5 +17,10 @@
 | Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
 |---|---|---|---|---|
 | observability-logging | 15101-15899 | 16xx | shipped v1.0.0 | `logging` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
 
 The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.

package/blueprints/observability-probe-endpoints/docs/topics.md

@@ -40,6 +40,11 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
 
 US 14101-14108 sit at the LOW end of the 14101-14899 band on purpose. A project-side story that mechanically derives from an observability-probe-endpoints REQ id into the number `14108` would collide against observability-probe-endpoints-US-14108 in this package; the band leaves headroom at the HIGH end (US 14181-14899) so a project's own stories anchored to observability-probe-endpoints REQs can allocate without conflict. The watchpost run4 lesson applies here too. Band spacing between the previous HQ-lane row (persistence-data-d1, 13101-13899, 14xx) and this one (14101-14899, 15xx) reflects the four-digit widening pattern opened by security-auth-clerk at 10xx and continued through the round-2 HQ lane.
 

package/blueprints/persistence-data-d1/docs/topics.md

@@ -38,6 +38,11 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
 
 US 13101-13107 sit at the LOW end of the 13101-13899 band on purpose. A project-side story that mechanically derives from a persistence-data-d1 REQ id into the number `13107` would collide against persistence-data-d1-US-13107 in this package; the band leaves headroom at the HIGH end (US 13181-13899) so a project's own stories anchored to persistence-data-d1 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/persistence-data-sqlite/docs/topics.md

@@ -38,6 +38,11 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
 
 US 5101-5111 sit at the LOW end of the 5101-5899 band on purpose. A project-side story that mechanically derives from `persistence-data-sqlite-REQ-011` into the number `5111` would collide against persistence-data-sqlite-US-5111 in this package; the band leaves headroom at the HIGH end (US 5181-5899) so a project's own stories anchored to persistence-data-sqlite REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-clerk/CHANGELOG.md

@@ -0,0 +1,5 @@
+# security-auth-clerk CHANGELOG
+
+## 1.2.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-clerk/blueprint.json

@@ -1,7 +1,8 @@
 {
   "slug": "security-auth-clerk",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "category": "security",
+  "capabilities": ["principalDirectory", "roleModel"],
   "contributions": [
     { "id": "security-auth-clerk-REQ-001", "kind": "req", "path": "requirements/security-auth-clerk-req-001.json" },
     { "id": "security-auth-clerk-REQ-002", "kind": "req", "path": "requirements/security-auth-clerk-req-002.json" },

package/blueprints/security-auth-clerk/docs/topics.md

@@ -35,6 +35,11 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
 
 US 9101-9110 sit at the LOW end of the 9101-9899 band on purpose. A project-side story that mechanically derives from a security-auth-clerk REQ id into the number `9110` would collide against security-auth-clerk-US-9110 in this package; the band leaves headroom at the HIGH end (US 9181-9899) so a project's own stories anchored to security-auth-clerk REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-keycloak/CHANGELOG.md

@@ -0,0 +1,5 @@
+# security-auth-keycloak CHANGELOG
+
+## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-keycloak/blueprint.json

@@ -1,7 +1,8 @@
 {
   "slug": "security-auth-keycloak",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "category": "security",
+  "capabilities": ["principalDirectory", "roleModel"],
   "contributions": [
     { "id": "security-auth-keycloak-REQ-001", "kind": "req", "path": "requirements/security-auth-keycloak-req-001.json" },
     { "id": "security-auth-keycloak-REQ-002", "kind": "req", "path": "requirements/security-auth-keycloak-req-002.json" },

package/blueprints/security-auth-keycloak/docs/topics.md

@@ -46,6 +46,11 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
 
 US 11101-11113 sit at the LOW end of the 11101-11899 band on purpose. A project-side story that mechanically derives from a security-auth-keycloak REQ id into the number `11113` would collide against security-auth-keycloak-US-11113 in this package; the band leaves headroom at the HIGH end (US 11181-11899) so a project's own stories anchored to security-auth-keycloak REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-auth-magic-link/CHANGELOG.md

@@ -0,0 +1,5 @@
+# security-auth-magic-link CHANGELOG
+
+## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+
+- Declares `capabilities: [principalDirectory]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-magic-link/blueprint.json

@@ -1,7 +1,8 @@
 {
   "slug": "security-auth-magic-link",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "category": "security",
+  "capabilities": ["principalDirectory"],
   "contributions": [
     { "id": "security-auth-magic-link-REQ-001", "kind": "req", "path": "requirements/security-auth-magic-link-req-001.json" },
     { "id": "security-auth-magic-link-REQ-002", "kind": "req", "path": "requirements/security-auth-magic-link-req-002.json" },

package/blueprints/security-auth-magic-link/docs/topics.md

@@ -35,6 +35,11 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
 
 US 3101-3111 sit at the LOW end of the 3101-3899 band on purpose. A project-side story that mechanically derives from `security-auth-magic-link-REQ-011` into the number `3111` would collide against security-auth-magic-link-US-3111 in this package; the band leaves headroom at the HIGH end (US 3181-3899) so a project's own stories anchored to security-auth-magic-link REQs can allocate without conflict.
 

package/blueprints/security-auth-oauth2/CHANGELOG.md

@@ -0,0 +1,5 @@
+# security-auth-oauth2 CHANGELOG
+
+## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-oauth2/blueprint.json

@@ -1,7 +1,8 @@
 {
   "slug": "security-auth-oauth2",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "category": "security",
+  "capabilities": ["principalDirectory", "roleModel"],
   "contributions": [
     { "id": "security-auth-oauth2-REQ-001", "kind": "req", "path": "requirements/security-auth-oauth2-req-001.json" },
     { "id": "security-auth-oauth2-REQ-002", "kind": "req", "path": "requirements/security-auth-oauth2-req-002.json" },

package/blueprints/security-auth-oauth2/docs/topics.md

@@ -46,6 +46,11 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
 
 US 10101-10111 sit at the LOW end of the 10101-10899 band on purpose. A project-side story that mechanically derives from a security-auth-oauth2 REQ id into the number `10111` would collide against security-auth-oauth2-US-10111 in this package; the band leaves headroom at the HIGH end (US 10181-10899) so a project's own stories anchored to security-auth-oauth2 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-secrets-management/docs/topics.md

@@ -35,6 +35,11 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
 | persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.1.0 | `healthProbes`, `readinessSemantics` |
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
 
 US 8101-8110 sit at the LOW end of the 8101-8899 band on purpose. A project-side story that mechanically derives from a security-secrets-management REQ id into the number `8110` would collide against security-secrets-management-US-8110 in this package; the band leaves headroom at the HIGH end (US 8181-8899) so a project's own stories anchored to security-secrets-management REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/fixtures/canary-manifest.json

@@ -1,9 +1,9 @@
 {
   "registerCanary": [
     {
-      "id": "rc-2026-09-04-001",
-      "createdAt": "2026-09-04T14:40:53.602Z",
-      "buildVersion": "0.19.0-mockdriver",
+      "id": "rc-2026-09-05-001",
+      "createdAt": "2026-09-05T04:18:06.946Z",
+      "buildVersion": "0.21.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -34,9 +34,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-04-002",
-      "createdAt": "2026-09-04T14:40:53.603Z",
-      "buildVersion": "0.19.0-mockdriver",
+      "id": "rc-2026-09-05-002",
+      "createdAt": "2026-09-05T04:18:06.947Z",
+      "buildVersion": "0.21.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -67,9 +67,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-04-003",
-      "createdAt": "2026-09-04T14:40:53.603Z",
-      "buildVersion": "0.19.0-mockdriver",
+      "id": "rc-2026-09-05-003",
+      "createdAt": "2026-09-05T04:18:06.947Z",
+      "buildVersion": "0.21.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",
@@ -60,7 +60,7 @@
     "#admissibility": "./src/admissibility/index.js"
   },
   "dependencies": {
-    "@stravica-ai/rcf-schemas": "0.5.1",
+    "@stravica-ai/rcf-schemas": "0.6.1",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1"
   },

package/rcf/code-nodes/cn-098.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-098",
+  "path": "src/cli/eval-coverage.js#main",
+  "title": "eval-coverage.js: rcf audit eval coverage main handler; parses args, dispatches strict gate, formats table/json/mermaid, exits 4 on missing",
+  "implementsAcIds": [
+    "AC-1601-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T16:25:42.896Z",
+  "updatedAt": "2026-09-04T16:25:42.896Z"
+}

package/rcf/code-nodes/cn-099.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-099",
+  "path": "src/query/eval-coverage.js#computeEvalCoverage",
+  "title": "eval-coverage.js: computeEvalCoverage pure function classifies each AC into covered/covered-optional/missing/not-required",
+  "implementsAcIds": [
+    "AC-1601-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T16:25:43.056Z",
+  "updatedAt": "2026-09-04T16:25:43.056Z"
+}

package/rcf/code-nodes/cn-100.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-100",
+  "path": "src/verify/verdict/index.js#evalPerAcVerdict",
+  "title": "verdict/index.js: evalPerAcVerdict emits EVAL-MISSING or EVAL-BELOW-THRESHOLD for nonDeterministic ACs",
+  "implementsAcIds": [
+    "AC-1601-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T16:25:43.219Z",
+  "updatedAt": "2026-09-04T16:25:43.219Z"
+}

package/rcf/code-nodes/cn-101.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-101",
+  "path": "src/verify/chain/index.js#evalBindingFor",
+  "title": "chain/index.js: evalBindingFor aggregates evalStatus + evalRunVerdict per AC from tree.evals[]",
+  "implementsAcIds": [
+    "AC-1601-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T16:25:43.382Z",
+  "updatedAt": "2026-09-04T16:25:43.382Z"
+}

package/rcf/code-nodes/cn-102.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-102",
+  "path": "src/finalise/ship-without-eval.js#composeShipWithoutEvalRecord",
+  "title": "ship-without-eval.js: composeShipWithoutEvalRecord builds the ack record with monotonic id, reason, declared per-AC verdicts, reportPath",
+  "implementsAcIds": [
+    "AC-1601-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T16:25:43.546Z",
+  "updatedAt": "2026-09-04T16:25:43.546Z"
+}

package/rcf/code-nodes/cn-103.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-103",
+  "path": "src/finalise/ingest.js#reportHasEvalRefusal",
+  "title": "ingest.js: reportHasEvalRefusal / findEvalRefusalAcs read EVAL-MISSING and EVAL-BELOW-THRESHOLD from perAcVerdicts[]",
+  "implementsAcIds": [
+    "AC-1601-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T16:25:43.709Z",
+  "updatedAt": "2026-09-04T16:25:43.709Z"
+}

package/rcf/code-nodes/cn-104.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-104",
+  "path": "src/eval/judge.js#runOneCase",
+  "title": "eval/judge.js: runOneCase spawns claude (or codex) with -p system-prompt, sends per-case payload on stdin, validates response, returns graded envelope",
+  "implementsAcIds": [
+    "AC-1601-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T16:25:43.873Z",
+  "updatedAt": "2026-09-04T16:25:43.873Z"
+}

package/rcf/code-nodes/cn-105.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-105",
+  "path": "src/eval/judge.js#composeRunRecord",
+  "title": "eval/judge.js: composeRunRecord aggregates perCriterion scores, applies criticalMustPass, resolves pass/fail verdict",
+  "implementsAcIds": [
+    "AC-1601-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T16:25:44.037Z",
+  "updatedAt": "2026-09-04T16:25:44.037Z"
+}

package/rcf/code-nodes/cn-106.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-106",
+  "path": "src/browser-verify/pack-schema.js#validatePackModule",
+  "implementsAcIds": [
+    "AC-1701-1",
+    "AC-1701-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T18:01:22.256Z",
+  "updatedAt": "2026-09-04T18:01:22.256Z"
+}

package/rcf/code-nodes/cn-107.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-107",
+  "path": "src/browser-verify/pack-loader.js#loadProbePacks",
+  "implementsAcIds": [
+    "AC-1701-1",
+    "AC-1701-2",
+    "AC-1701-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T18:01:22.423Z",
+  "updatedAt": "2026-09-04T18:01:22.423Z"
+}

package/rcf/code-nodes/cn-108.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-108",
+  "path": "src/browser-verify/pack-runner.js#runProbePacksForFbs",
+  "implementsAcIds": [
+    "AC-1701-4",
+    "AC-1701-6"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T18:01:22.584Z",
+  "updatedAt": "2026-09-04T18:01:22.584Z"
+}

package/rcf/code-nodes/cn-109.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-109",
+  "path": "src/browser-verify/manifest-writer.js#aggregateVerdict",
+  "implementsAcIds": [
+    "AC-1701-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T18:01:22.744Z",
+  "updatedAt": "2026-09-04T18:01:22.744Z"
+}

package/rcf/code-nodes/cn-110.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-110",
+  "path": "src/cli/browser-verify.js#main",
+  "implementsAcIds": [
+    "AC-1701-5"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T18:01:22.906Z",
+  "updatedAt": "2026-09-04T18:01:22.906Z"
+}

package/rcf/code-nodes/cn-111.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-111",
+  "path": "src/browser-verify/pack-browser.js#createPackBrowser",
+  "implementsAcIds": [
+    "AC-1701-7"
+  ],
+  "dependencies": [
+    "CN-108"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T18:51:45.216Z",
+  "updatedAt": "2026-09-04T18:51:45.216Z"
+}

package/rcf/code-nodes/cn-112.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-112",
+  "path": "src/browser-verify/boot.js#bootIfNeeded",
+  "implementsAcIds": [
+    "AC-1701-8"
+  ],
+  "dependencies": [
+    "CN-110"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-04T18:51:45.216Z",
+  "updatedAt": "2026-09-04T18:51:45.216Z"
+}