rcf-lite 0.21.0 → 0.23.0

package/rcf/test-suites/ts-072.json

@@ -0,0 +1,62 @@
+{
+  "createdAt": "2026-09-06T19:17:48.415Z",
+  "updatedAt": "2026-09-06T19:18:05.472Z",
+  "purpose": "Cover AC-4201-1..6 via unit tests over the shipped messaging-queue-cloudflare blueprint shape (contribution count, capabilities, suggestedCompanions, ADR standardsTraceClause), applies-clean behaviour, REQ-004 dead_letter_queue grep and retention wording, six Node-only probe module contract with anchorAcId cross-check, induced-failure switch documentation on the fixture README, and shelf-doc consistency (section 6a table row for queue with reserved sibling note, shelf-wide docs/topics.md row for messaging-queue-cloudflare at 29101-29899 / 30xx).",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-4201-1",
+    "AC-4201-2",
+    "AC-4201-3",
+    "AC-4201-4",
+    "AC-4201-5",
+    "AC-4201-6"
+  ],
+  "id": "TS-072",
+  "usId": "US-4201",
+  "title": "messaging-queue-cloudflare v1.0.0 shelf shape, apply-clean, DLQ REQ description grep, six-probe module contract, induced-failure switches and shelf-doc consistency",
+  "testCases": [
+    {
+      "id": "TC-072-blueprint-json-shape",
+      "acId": "AC-4201-1",
+      "description": "Cover AC-4201-1 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::blueprint.json declares 21 contributions with capabilities queue, suggestedCompanions logging and errorHandling, and standardsTraceClause on every ADR entry (TC-072-blueprint-json-shape)"
+    },
+    {
+      "id": "TC-072-applies-clean",
+      "acId": "AC-4201-2",
+      "description": "Cover AC-4201-2 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::apply messaging-queue-cloudflare lands 21 contributions on a scratch project (TC-072-applies-clean)"
+    },
+    {
+      "id": "TC-072-dlq-req-grep",
+      "acId": "AC-4201-3",
+      "description": "Cover AC-4201-3 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::REQ-004 description names dead_letter_queue and the 4-day DLQ retention with the Cloudflare DLQ doc URL (TC-072-dlq-req-grep)"
+    },
+    {
+      "id": "TC-072-probe-anchor-ids-cross-check",
+      "acId": "AC-4201-4",
+      "description": "Cover AC-4201-4 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::every probe module exports the section 3.2 verdict envelope with an anchorAcId matching a contributed AC id (TC-072-probe-anchor-ids-cross-check)"
+    },
+    {
+      "id": "TC-072-fixture-and-switches",
+      "acId": "AC-4201-5",
+      "description": "Cover AC-4201-5 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::sample-app fixture ships wrangler.toml, src/producer.mjs, src/consumer.mjs, src/dlq-inspector.mjs, and its README documents wrangler dev and the three wired induced-failure switches (TC-072-fixture-and-switches)"
+    },
+    {
+      "id": "TC-072-shelf-doc-consistency",
+      "acId": "AC-4201-6",
+      "description": "Cover AC-4201-6 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/messaging-queue-cloudflare-anatomy.test.js::section 6a table gains a queue row with reserved messaging-queue-postgres sibling and every shipped blueprint docs/topics.md gains a messaging-queue-cloudflare row at 29101-29899 / 30xx (TC-072-shelf-doc-consistency)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-073.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-07T09:11:24.816Z",
+  "updatedAt": "2026-09-07T09:12:00.080Z",
+  "purpose": "Cover AC-2901-1..3 via unit tests over the shipped deploy-cloudflare-workers v1.2.0 blueprint shape (12 REQs 15 USs 6 TACs 6 ADRs, no capabilities, suggestedCompanions logging and errorHandling unchanged, standardsTraceClause on ADR-1306 contribution entry), the assets-manifest-scan probe module contract and passing run against the cf-platform fixture, and the repo chain-slice counts and validate-clean.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-2901-1",
+    "AC-2901-2",
+    "AC-2901-3"
+  ],
+  "id": "TS-073",
+  "usId": "US-2901",
+  "title": "T-0 deploy-cloudflare-workers v1.2.0 shelf shape, apply-clean, chain-slice cross-check",
+  "testCases": [
+    {
+      "id": "TC-073-blueprint-json-shape",
+      "acId": "AC-2901-1",
+      "description": "Cover AC-2901-1 via anatomy test: blueprint.json declares slug deploy-cloudflare-workers, version 1.2.0, category deploy; contributions split 12 req, 15 us, 6 tac, 6 adr; suggestedCompanions unchanged; standardsTraceClause non-null on every ADR contribution entry including ADR-1306",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js::blueprint.json declares 41 contributions with v1.2.0, delta shape and unchanged v1.1.0 companions (TC-073-blueprint-json-shape)"
+    },
+    {
+      "id": "TC-073-probe-module-and-scan-pass",
+      "acId": "AC-2901-2",
+      "description": "Cover AC-2901-2 via anatomy test: assets-manifest-scan.mjs exports the section 3.2 verdict envelope with anchorAcId AC-12113-1 and accountBound false; the shim run-assets-manifest-scan.mjs on the cf-platform fixture exits 0 and the report carries aggregateVerdict pass with directory ./dist and no pages_build_output_dir field",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js::assets-manifest-scan probe module contract and cf-platform fixture scan-pass (TC-073-probe-module-and-scan-pass)"
+    },
+    {
+      "id": "TC-073-chain-slice-cross-check",
+      "acId": "AC-2901-3",
+      "description": "Cover AC-2901-3 via anatomy test: the repo chain adds REQ-029 REQ-030 US-2901 US-2902 US-3001 TS-073 TS-074 TS-075 FBS-063 CN-209, every US carries at least one AC, every AC has a covering TC on a paired TS with a resolvable test-pointer, and rcf define validate reports the tree clean",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js::T-0 chain slice adds two REQs three USs three TSs one FBS and one CN under the HQ block (TC-073-chain-slice-cross-check)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-074.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-07T09:11:24.993Z",
+  "updatedAt": "2026-09-07T09:12:00.427Z",
+  "purpose": "Cover AC-2902-1..2 via unit tests over the top-level elicits[] shape (id, kind, default, loader shape gate) and the cf-platform fixture files (wrangler.toml, dist/, src/, package.json, run-assets-manifest-scan.mjs, README naming the switches).",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-2902-1",
+    "AC-2902-2"
+  ],
+  "id": "TS-074",
+  "usId": "US-2902",
+  "title": "T-0 deploy-cloudflare-workers v1.2.0 elicits: assets-directory and run-worker-first on blueprint.json elicits[] and cf-platform fixture",
+  "testCases": [
+    {
+      "id": "TC-074-elicits-shape",
+      "acId": "AC-2902-1",
+      "description": "Cover AC-2902-1 via anatomy test: blueprint.json elicits[] declares exactly two new entries assets-directory and run-worker-first with the correct id, kind and default; neither carries providesCapability; the loader loads blueprint.json without a validation error",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js::elicits[] declares assets-directory string default empty and run-worker-first boolean default false and loader accepts blueprint.json (TC-074-elicits-shape)"
+    },
+    {
+      "id": "TC-074-cf-platform-fixture-files",
+      "acId": "AC-2902-2",
+      "description": "Cover AC-2902-2 via anatomy test: the cf-platform fixture ships wrangler.toml with the [assets] block, dist/index.html, src/index.mjs, package.json with wrangler dev script and wrangler as a devDependency, run-assets-manifest-scan.mjs shim and README naming the wrangler dev boot line, the elicit answers and the two induced-failure switches",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js::cf-platform fixture ships wrangler.toml dist index.html src index.mjs package.json shim and README with SIMULATE_MIXED_SHAPE and SIMULATE_EMPTY_ASSETS switches (TC-074-cf-platform-fixture-files)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-075.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-07T09:11:25.167Z",
+  "updatedAt": "2026-09-07T09:12:00.950Z",
+  "purpose": "Cover AC-3001-1..3 via unit tests over the ADR-1306 body validity and standardsTraceClause on the contribution entry, the guide's new SPA-on-Workers section with the two Cloudflare URLs (fetched 200 at gate time), and the probe module driven on the three fixture states (canonical, SIMULATE_MIXED_SHAPE fails naming pages_build_output_dir, SIMULATE_EMPTY_ASSETS passes with the empty-directory record).",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-3001-1",
+    "AC-3001-2",
+    "AC-3001-3"
+  ],
+  "id": "TS-075",
+  "usId": "US-3001",
+  "title": "T-0 deploy-cloudflare-workers v1.2.0 ADR-1306, guide section, and probed spaFallbackShape with induced-failure switches",
+  "testCases": [
+    {
+      "id": "TC-075-adr-1306-body-and-clause",
+      "acId": "AC-3001-1",
+      "description": "Cover AC-3001-1 via anatomy test: ADR-1306 body validates against rcf-schemas 0.6.1 (required fields present, no standardsTraceClause on body), the body carries the verbatim Cloudflare Pages landing-page quote in context or decision, and the blueprint.json contribution entry carries standardsTraceClause Cloudflare Pages landing-page recommendation (2026-09-06) with recommendedDefault true and elicited false",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js::ADR-1306 body validates against 0.6.1 with verbatim Cloudflare quote and standardsTraceClause on the contribution entry (TC-075-adr-1306-body-and-clause)"
+    },
+    {
+      "id": "TC-075-guide-section-and-urls",
+      "acId": "AC-3001-2",
+      "description": "Cover AC-3001-2 via anatomy test: the guide file carries the new Workers-with-static-assets: the SPA-on-Workers shape section with both the migrate-from-Pages guide URL and the static-assets docs URL. The urls-fetched log (fetched at ship time) records both URLs at HTTP 200.",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js::guide section Workers-with-static-assets adds the two Cloudflare URLs and the elicit signatures and the wrangler.toml snippet (TC-075-guide-section-and-urls)"
+    },
+    {
+      "id": "TC-075-probed-spa-fallback-shape",
+      "acId": "AC-3001-3",
+      "description": "Cover AC-3001-3 via anatomy test: the assets-manifest-scan probe run against the cf-platform fixture returns verdict pass on the canonical state; SIMULATE_MIXED_SHAPE=true returns verdict fail with a detail naming pages_build_output_dir; SIMULATE_EMPTY_ASSETS=true returns verdict pass with the empty-directory record for the bare-Worker shape",
+      "status": "pending",
+      "testPointer": "test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js::assets-manifest-scan drives three fixture states and produces the expected pass fail pass verdicts (TC-075-probed-spa-fallback-shape)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-076.json

@@ -0,0 +1,70 @@
+{
+  "createdAt": "2026-09-07T10:15:20.121Z",
+  "updatedAt": "2026-09-07T10:15:59.868Z",
+  "purpose": "Cover AC-4301-1..7 via unit tests over the shipped jobs-background blueprint shape (contribution count, capabilities, suggestedCompanions, requiresAppliedCapabilities gate shape, ADR standardsTraceClause), the four capabilities-apply.test.js cases (bare-project refusal with tag and messaging-queue-cloudflare name, --allow-no-queue-yet override with queue-family sidecar note, happy path with messaging-queue-cloudflare applied producing appliedCapabilities including queue, and backward-compatible --allow-no-auth-yet also unblocks the override), the five-probe module contract with anchorAcId cross-check, the two induced-failure switch documentation on the fixture README, and shelf-doc consistency (section 6a table row for backgroundJobs, shelf-wide docs/topics.md row for jobs-background at 30101-30899 / 31xx).",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-4301-1",
+    "AC-4301-2",
+    "AC-4301-3",
+    "AC-4301-4",
+    "AC-4301-5",
+    "AC-4301-6",
+    "AC-4301-7"
+  ],
+  "id": "TS-076",
+  "usId": "US-4301",
+  "title": "Jobs-background v1.0.0 shelf shape, apply-time refusal and override paths (via capabilities-apply tests), five-probe module contract, induced-failure switches, and shelf-doc consistency",
+  "testCases": [
+    {
+      "id": "TC-076-blueprint-json-shape",
+      "acId": "AC-4301-1",
+      "description": "blueprint.json declares 22 contributions with capabilities backgroundJobs, requiresAppliedCapabilities on queue with allowSkipFlag allow-no-queue-yet and refusalMessageId jobs-background-no-queue, and standardsTraceClause on every ADR entry",
+      "status": "pending",
+      "testPointer": "test/blueprint/jobs-background-anatomy.test.js::blueprint.json declares 22 contributions with capabilities backgroundJobs, requiresAppliedCapabilities on queue with allowSkipFlag allow-no-queue-yet and refusalMessageId jobs-background-no-queue, and standardsTraceClause on every ADR entry (TC-076-blueprint-json-shape)"
+    },
+    {
+      "id": "TC-076-bare-refusal",
+      "acId": "AC-4301-2",
+      "description": "jobs-background apply refuses on a bare project with the jobs-background-no-queue tag, names messaging-queue-cloudflare and the --allow-no-queue-yet override",
+      "status": "pending",
+      "testPointer": "test/blueprint/capabilities-apply.test.js::jobs-background apply refuses on a bare project with the jobs-background-no-queue tag, names messaging-queue-cloudflare and the --allow-no-queue-yet override (TC-051-jobs-background-refuse)"
+    },
+    {
+      "id": "TC-076-override-sidecar",
+      "acId": "AC-4301-3",
+      "description": "jobs-background --allow-no-queue-yet override writes sidecar with queue-family notes",
+      "status": "pending",
+      "testPointer": "test/blueprint/capabilities-apply.test.js::jobs-background --allow-no-queue-yet override writes sidecar with queue-family notes (TC-051-jobs-background-allow-skip)"
+    },
+    {
+      "id": "TC-076-happy-path-caps",
+      "acId": "AC-4301-4",
+      "description": "jobs-background apply passes on a project with messaging-queue-cloudflare (queue) applied",
+      "status": "pending",
+      "testPointer": "test/blueprint/capabilities-apply.test.js::jobs-background apply passes on a project with messaging-queue-cloudflare (queue) applied (TC-051-jobs-background-cap-satisfied)"
+    },
+    {
+      "id": "TC-076-probe-anchor-ids-cross-check",
+      "acId": "AC-4301-5",
+      "description": "every probe module exports the section 3.2 verdict envelope with an anchorAcId matching a contributed AC id",
+      "status": "pending",
+      "testPointer": "test/blueprint/jobs-background-anatomy.test.js::every probe module exports the section 3.2 verdict envelope with an anchorAcId matching a contributed AC id (TC-076-probe-anchor-ids-cross-check)"
+    },
+    {
+      "id": "TC-076-fixture-and-switches",
+      "acId": "AC-4301-6",
+      "description": "sample-app fixture ships jobs/ toy job-definitions plus src/jobs-runtime.mjs and src/scheduler.mjs and its README documents the two wired induced-failure switches SIMULATE_HANDLER_THROW and SIMULATE_PII_IN_JOB_INPUT",
+      "status": "pending",
+      "testPointer": "test/blueprint/jobs-background-anatomy.test.js::sample-app fixture ships jobs/ toy job-definitions plus src/jobs-runtime.mjs and src/scheduler.mjs and its README documents the two wired induced-failure switches SIMULATE_HANDLER_THROW and SIMULATE_PII_IN_JOB_INPUT (TC-076-fixture-and-switches)"
+    },
+    {
+      "id": "TC-076-shelf-doc-consistency",
+      "acId": "AC-4301-7",
+      "description": "section 6a table gains a backgroundJobs row naming jobs-background and reserved sibling posture; every shipped blueprint docs/topics.md gains a jobs-background row at 30101-30899 / 31xx",
+      "status": "pending",
+      "testPointer": "test/blueprint/jobs-background-anatomy.test.js::section 6a table gains a backgroundJobs row naming jobs-background and reserved sibling posture; every shipped blueprint docs/topics.md gains a jobs-background row at 30101-30899 / 31xx (TC-076-shelf-doc-consistency)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-2401.json

@@ -0,0 +1,62 @@
+{
+  "createdAt": "2026-09-06T15:38:51.042Z",
+  "updatedAt": "2026-09-06T15:38:51.042Z",
+  "asA": "shelf consumer applying the application-empty-error-states v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the eight named states of the empty and error catalogue, the recovery-action router across parent-surface search request-access and retry, the offline state with the write-buffer contract, and a sample-app fixture proving the pack passes on a compliant surface and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the eight-state contract with a runtime-verified pack, the least-privilege surface for the 500 and 403 states, and a golden fixture the pack refuses on a surface that leaks a stack trace, leaks a resource id, drops a recovery affordance, or drops the polite live-region wrapper",
+  "description": "US-2401 anchors the shelf-shape acceptance criteria for the T-1 track: shelf carries blueprint.json with the ratified shape, contributions apply cleanly on a fresh init project, the pack cross-checks against contributed AC ids, the sample-app fixture serves every state on the honest branch, and the break switches refuse on the negative branch. The blueprint contributes 19 to 24 further AC records on its own USs 22101 to 22108; those are covered by the pack against the fixture and by the anatomy test that walks the contributions.",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2401-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shelf carries blueprints/application-empty-error-states/blueprint.json declaring slug application-empty-error-states, version 1.0.0, category application, and 19 to 24 contributions in the 5 REQ / 8 US / 3 TAC / 3 ADR groups per spec section 5.1; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.1; providesRoles is absent; capabilities is absent or empty; requiresAppliedCapabilities is absent (no auth required)."
+    },
+    {
+      "id": "AC-2401-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "rcf define blueprint add ./blueprints/application-empty-error-states applies the 19 contributions cleanly on a fresh init project (exit 0, contribution count matches blueprint.json); rcf define validate on the scratch project reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project."
+    },
+    {
+      "id": "AC-2401-3",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shipped probe pack blueprints/application-empty-error-states/probe-packs/application-empty-error-states.pack.mjs loads via T-0s pack-loader against a scratch project with the blueprint applied; each of its eight check ids (AC-22101-1 through AC-22108-1) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack-level appliesTo predicate references BOTH tacIds and route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source."
+    },
+    {
+      "id": "AC-2401-4",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/ ships a dependency-free Node HTTP server (server.js) with a start script; every one of the eight states renders on its default branch and is selectable via ?state=<name>; PORT env overrides the bind port (default 3000, never binds 4200); the fixture responds LISTENING <port> once bound."
+    },
+    {
+      "id": "AC-2401-5",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The probe pack refuses ship on each broken fixture branch: ?break=stack-trace re-adds a stack trace to the 500 state so AC-22103-1 fails at severity block; ?break=leak-id re-adds the resource id to the forbidden and permission-denied surfaces so AC-22102-1 or AC-22104-1 fails at severity block; ?break=no-recovery drops the recovery control from the empty-list state so AC-22106-1 fails at severity block; ?break=no-live-region drops the polite live-region wrapper so AC-22105-1 (offline reconnection announcement) fails at severity block."
+    },
+    {
+      "id": "AC-2401-6",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The eight enumerated named states appear identically across the scope paragraph in the blueprint README, the packs checks[] list, the guide, and the docs/topics.md registry table; a grep sweep for each state slug (not-found, forbidden, server-error, offline, permission-denied, empty-list, no-search-results, error-boundary) confirms every occurrence is accounted for and no state is silently dropped."
+    },
+    {
+      "id": "AC-2401-7",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The blueprint README lists every runtime-observable AC the pack does NOT bind directly under Known mechanism-reach gaps, individually per AC id; the blueprint CHANGELOG.md carries a single 1.0.0 entry naming the eight state contracts, the pack checks, the recovery-action router and the offline strategy ADR; docs/topics.md carries the shelf id band registry table extended with the T-1 row (application-empty-error-states 22101-22899 / 23xx)."
+    }
+  ],
+  "tacIds": [],
+  "tags": [
+    "blueprint:application-empty-error-states"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "usId": "US-2401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-024",
+  "title": "The application-empty-error-states blueprint ships on the shelf with its eight-state pack and sample-app fixture; the pack refuses on the four break switches"
+}

package/rcf/user-stories/us-2501.json

@@ -0,0 +1,58 @@
+{
+  "createdAt": "2026-09-06T16:55:12.496Z",
+  "updatedAt": "2026-09-06T16:56:03.586Z",
+  "description": "US-2501 anchors the shelf-shape acceptance criteria for the T-2 track: shelf carries blueprint.json with the ratified shape, contributions apply cleanly on a fresh init project, the pack cross-checks against contributed AC ids, the sample-app fixture serves both transport branches (multipart POST default and tus.io elicited alternative) on the honest branch, and the break switches refuse on the negative branch. The blueprint contributes further AC records on its own USs 23101 to 23107; those are covered by the pack against the fixture and by the anatomy test that walks the contributions.",
+  "usId": "US-2501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-025",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-file-upload blueprint ships on the shelf with its four-check pack and sample-app fixture; the pack refuses on the four break switches",
+  "asA": "shelf consumer applying the application-file-upload v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the four surface-observable checks of the file-upload contract (input surface with a labelled file input plus drop-zone plus keyboard alternative, transport contract with a chunked path and a refusal contract, and a progress announcer with a polite tick and an assertive completion), and a sample-app fixture proving the pack passes on both transport branches multipart POST and tus.io and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the WCAG 2.5.7 dragging-movements safe file-upload contract with a runtime-verified pack, one recommended transport with two elicited alternatives, and a golden fixture the pack refuses on a surface that drops the file input, drops the polite live-region, ships a refused file to the server or collapses the chunked path",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2501-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shelf carries blueprints/application-file-upload/blueprint.json declaring slug application-file-upload, version 1.0.0, category application, and 18 to 22 contributions in the 5 REQ / 7 US / 3 TAC / 3 ADR groups per spec section 5.2; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.2; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities is absent."
+    },
+    {
+      "id": "AC-2501-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "rcf define blueprint add ./blueprints/application-file-upload applies the 18 contributions cleanly on a fresh init project (exit 0, contribution count matches blueprint.json); rcf define validate on the scratch project reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project."
+    },
+    {
+      "id": "AC-2501-3",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shipped probe pack blueprints/application-file-upload/probe-packs/application-file-upload.pack.mjs loads via T-0s pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-23101-1 input surface, AC-23102-1 progress announcer, AC-23103-1 refusal contract, AC-23104-1 chunked transport) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack-level appliesTo predicate references BOTH tacIds and route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source."
+    },
+    {
+      "id": "AC-2501-4",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/ ships a dependency-free Node HTTP server (server.js) with a start script; on the multipart POST default branch the four states idle, uploading, refused and complete render honestly and per-file plus aggregate progress ticks fire through the polite live-region wrapper; on the ?transport=tus branch chunked PATCH uploads carry an Upload-Offset header per chunk and the assertive completion announcement fires; PORT env overrides the bind port (default 3000, never binds 4200); the fixture responds LISTENING <port> once bound."
+    },
+    {
+      "id": "AC-2501-5",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The probe pack refuses ship on each broken fixture branch: ?break=no-input drops the file input leaving only the drop-zone so AC-23101-1 fails at severity block (WCAG 2.5.7 keyboard alternative gone); ?break=no-live-region drops the polite live-region wrapper so AC-23102-1 fails at severity block; ?break=send-refused sends a refused file to the server so AC-23103-1 fails at severity block (a POST for the refused filename is observed on the network); ?break=no-chunks collapses the chunked path to a single POST so AC-23104-1 fails at severity block (no Upload-Offset header on any request)."
+    },
+    {
+      "id": "AC-2501-6",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The four fixture states (idle, uploading, refused, complete) and the two transport slugs (multipart, tus) appear identically across the scope paragraph in the blueprint README, the packs checks[] list, the guide, the fixture README and the docs/topics.md registry table; a grep sweep for each slug confirms every occurrence is accounted for and no state or transport is silently dropped."
+    },
+    {
+      "id": "AC-2501-7",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The blueprint README lists every runtime-observable AC the pack does NOT bind directly under Known mechanism-reach gaps, individually per AC id; the blueprint CHANGELOG.md carries a single 1.0.0 entry naming the input contract, the progress contract, the refusal contract, the transport contract with the multipart default and the tus.io elicited alternative, the completion contract, the pack checks, the sample-app fixture and the three ADRs; docs/topics.md carries the shelf id band registry table extended with the T-2 row (application-file-upload 23101-23899 / 24xx)."
+    }
+  ]
+}

package/rcf/user-stories/us-2601.json

@@ -0,0 +1,51 @@
+{
+  "createdAt": "2026-09-06T19:03:26.530Z",
+  "updatedAt": "2026-09-06T19:07:14.938Z",
+  "description": "US-2601 anchors the shelf-shape acceptance criteria for the T-3 track: shelf carries blueprint.json with the ratified shape, contributions apply cleanly on a fresh init project, the pack cross-checks against contributed AC ids, the sample-app fixture serves the four wizard surfaces honestly and drives both save-and-return transports on their query branches, and the break switches refuse on the negative branch. The blueprint contributes further AC records on its own USs 24101 to 24108; those are covered by the pack against the fixture and by the anatomy test that walks the contributions.",
+  "usId": "US-2601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-026",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-forms-wizard blueprint ships on the shelf with its four-check pack and sample-app fixture; the pack refuses on the four break switches",
+  "asA": "shelf consumer applying the application-forms-wizard v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the four surface-observable checks of the wizard contract (task-list contract with the closed GOV.UK vocabulary, error-summary contract with the top-of-page summary and aria bindings, summary-review pattern with the change-per-row and answer retention, and save-and-return contract with a server-side draft table or a client-side local buffer with a sync tick), and a sample-app fixture proving the pack passes on the honest render of the four wizard surfaces and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the WCAG 2.2 AA compliant multi-step forms contract with a runtime-verified pack, the GOV.UK Design System task-list pattern out of the box, one recommended navigation posture with an elicited alternative, two save-and-return transports with no default so the abandoned-draft loss class does not ship silently, and a golden fixture the pack refuses on a surface that swaps a state string away from the closed vocabulary, drops the error summary, drops answer retention on the summary review, or drops the draft transport altogether",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2601-1",
+      "description": "The shelf carries blueprints/application-forms-wizard/blueprint.json declaring slug application-forms-wizard, version 1.0.0, category application, and 19 contributions in the 5 REQ / 8 US / 3 TAC / 3 ADR groups per spec section 5.3; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.3; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities is absent.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-2",
+      "description": "rcf define blueprint add ./blueprints/application-forms-wizard applies the 19 contributions cleanly on a fresh init project (exit 0, contribution count matches blueprint.json); rcf define validate on the scratch project reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-3",
+      "description": "The shipped probe pack blueprints/application-forms-wizard/probe-packs/application-forms-wizard.pack.mjs loads via T-0 pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-24101-1 task-list, AC-24103-1 error-summary, AC-24104-1 summary-review, AC-24105-1 save-and-return) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack-level appliesTo predicate references BOTH tacIds and route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-4",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-forms-wizard/ ships a dependency-free Node HTTP server (server.js) with a start script; on the honest branch /task-list renders the ARIA progressbar wrapper plus one step row per manifest entry with a data-step-state from the closed GOV.UK vocabulary; /step/2?refused=1 pre-renders the error-summary shape with a heading, one skip link per failed field and aria-invalid=\"true\" on the field with aria-describedby to the message; /summary?seed=complete renders one summary-list section per step with data-summary-row entries and a data-recovery=\"change\" link per row; /step/1?draft-store=server&preseed=1 writes into the in-memory drafts table so GET /drafts returns the persisted fields, and /step/1?draft-store=local&preseed=1 writes to window.localStorage under draft:application-forms-wizard:<step-slug> and renders [data-sync-tick] carrying an ISO-8601 timestamp; PORT env overrides the bind port (default 3000, never binds 4200); the fixture prints LISTENING <port> once bound.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-5",
+      "description": "The probe pack refuses ship on each broken fixture branch: ?break=task-list-vocab swaps a step-state string away from the closed GOV.UK vocabulary so AC-24101-1 fails at severity block; ?break=no-summary drops the [data-surface=\"error-summary\"] region on the refused step so AC-24103-1 fails at severity block; ?break=no-retain wipes every unedited answer on the edit-and-save round-trip so AC-24104-1 fails at severity block; ?break=no-draft drops the draft transport altogether so AC-24105-1 fails at severity block on both branches (no POST to /drafts, no localStorage write, no data-sync-tick element).",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-6",
+      "description": "The four state slugs from the closed GOV.UK vocabulary (Cannot start yet, Not started, In progress, Completed), the two save-and-return transport slugs (server-draft-table, client-local-buffer), the four break switches and the four probe-pack check ids appear identically across the scope paragraph in the blueprint README, the pack checks[] list, the guide, the fixture README and the docs/topics.md registry table; a grep sweep for each slug confirms every occurrence is accounted for and no vocabulary string is silently dropped.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-7",
+      "description": "The blueprint README lists every runtime-observable AC the pack does NOT bind directly under Known mechanism-reach gaps, individually per AC id; the blueprint CHANGELOG.md carries a single 1.0.0 entry naming the task-list contract, the per-step validation timing rule, the error-summary contract, the summary-review pattern, the save-and-return contract with the two transports, the pack checks, the sample-app fixture and the three ADRs; docs/topics.md carries the shelf id band registry table extended with the T-3 row (application-forms-wizard 24101-24899 / 25xx) and the cross-reference to application-empty-error-states for the no-in-progress empty state.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2701.json

@@ -0,0 +1,55 @@
+{
+  "createdAt": "2026-09-06T21:11:39.906Z",
+  "updatedAt": "2026-09-06T21:12:11.457Z",
+  "usId": "US-2701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-027",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-account-settings blueprint ships on the shelf with its 5-check pack and sample-app fixture; the pack refuses on the four break switches; the four auth minors and the observability-logging minor bump ship in the same PR with the extended section 6a capability table",
+  "asA": "shelf consumer applying the application-account-settings v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the five surface-observable checks (shell tabs, profile autocomplete, security branch, sessions dialog-modal, theme radiogroup) with capability-gated appliesTo, and a sample-app fixture proving the pack passes on the honest render of the five conditional surfaces and fails on the four break switches; the four auth blueprint minor bumps and the observability-logging minor bump riding the same PR extending the section 6a capability table with credentialSelfService sessionInventory and hostedIdentityUi",
+  "soThat": "a project consuming rcf-lite gets the WCAG 2.2 AA compliant account-settings surface with a runtime-verified pack that gates on the applied capability set (no bespoke work when magic-link is applied and only profile activates; the security surface renders self-service on Keycloak or hosted-link-out on Clerk; the sessions surface renders on any applied sessionInventory provider including observability-logging as the logging-projection provider), one recommended default per elicit where honest and no recommended default on security-surface-shape where dishonest",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2701-1",
+      "description": "The shelf carries blueprints/application-account-settings/blueprint.json declaring slug application-account-settings, version 1.0.0, category application, and 24 contributions in the 6 REQ / 10 US / 4 TAC / 4 ADR groups per spec section 5.4; suggestedCompanions declares logging and errorHandling with reasons; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities declares principalDirectory with allowSkipFlag allow-no-auth-yet and refusalMessageId application-account-settings-bare-spa.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-2",
+      "description": "The shelf carries blueprints/application-account-settings/blueprint.json declaring slug application-account-settings, version 1.0.0, category application, and 24 contributions in the 6 REQ / 10 US / 4 TAC / 4 ADR groups per spec section 5.4; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.4; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities declares principalDirectory with allowSkipFlag allow-no-auth-yet and refusalMessageId application-account-settings-bare-spa.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-3",
+      "description": "rcf define blueprint add ./blueprints/application-account-settings applies the 24 contributions cleanly on a fresh init project with security-auth-magic-link applied (exit 0, contribution count matches blueprint.json); the applied sidecar records appliedCapabilities principalDirectory only; a fresh init project with no auth applied refuses at exit 3 with the [application-account-settings-bare-spa] refusal message; --allow-no-auth-yet applies with allowNoAuthYet true and a scaffolding-pass note on the sidecar.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-4",
+      "description": "The shipped probe pack blueprints/application-account-settings/probe-packs/application-account-settings.pack.mjs loads via T-0 pack-loader against a scratch project with the blueprint applied; each of its five check ids (AC-25101-1 shell, AC-25102-1 profile, AC-25105-1 security, AC-25106-1 sessions, AC-25108-1 theme) resolves to an AC id contributed by the blueprint; every check carries a description field; the pack-level appliesTo predicate references BOTH tacIds AND route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-5",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/ ships a dependency-free Node HTTP server (server.js) with a start script; on the honest branch /account renders the ARIA APG tabs shell whose tabs mirror the CAPS env; /account/profile renders the form with autocomplete tokens name email bday country; /account/security?security-surface-shape=self-service renders the change-password and mfa-management regions when credentialSelfService is in CAPS; /account/sessions renders one row per session with data-session-id and a terminate control on non-current rows plus the ARIA dialog-modal; /account/theme renders the radiogroup with light dark system and persists per the ACCOUNT_SETTINGS_THEME_PERSIST env; PORT env overrides the bind port (default 3000, never binds 4200).",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-6",
+      "description": "The probe pack fails on each broken fixture branch: ?break=leak-tab renders the security tab even when neither credentialSelfService nor hostedIdentityUi is in CAPS so AC-25101-1 fails at severity block; ?break=no-autocomplete drops the autocomplete tokens on the profile form so AC-25102-1 fails at severity block; ?break=no-dialog removes the terminate confirmation dialog so AC-25106-1 fails at severity block; ?break=no-persist drops the theme persistence write so AC-25108-1 does not fail on this fixture-side signal directly but the data-persist attribute mismatch triggers the fail.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-7",
+      "description": "The four capability strings principalDirectory credentialSelfService sessionInventory hostedIdentityUi and the security surface shape enum self-service hosted-link-out hosted-embed appear identically across README, guide, pack checks[] descriptions and docs/topics.md registry; the section 6a capability table in packages/rcf-lite/docs/blueprint-authoring.md lists credentialSelfService sessionInventory and hostedIdentityUi with the shelf providers named.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-8",
+      "description": "README lists mechanism-reach gaps individually per AC id per checklist section 6.g; CHANGELOG carries one 1.0.0 entry naming the auth minors and the observability-logging minor that ride the same PR; docs/topics.md carries the T-4 shelf registry row and the cross-references to application-empty-error-states and application-admin-console; the four amended auth blueprints each carry a README latest note and a CHANGELOG entry naming the new capabilities and the account-settings consumer; the observability-logging blueprint carries the same.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2801.json

@@ -0,0 +1,55 @@
+{
+  "createdAt": "2026-09-06T23:03:12.225Z",
+  "updatedAt": "2026-09-06T23:04:29.543Z",
+  "usId": "US-2801",
+  "prdId": "PRD-001",
+  "reqId": "REQ-028",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-onboarding-tour blueprint ships on the shelf with its 4-check pack and sample-app fixture; the pack refuses on the four break switches; the tour composes on dashboard notifications-in-app account-settings and the SPA with the documented fallback per Q4 when no persistence blueprint is applied",
+  "asA": "shelf consumer applying the application-onboarding-tour v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the four surface-observable checks (step-container focus and Escape, tooltip-as-dialog contract, checklist slot with dashboard-when-applied and settings-page-when-not, completion-state persistence per the elicited store shape) with the pack composing on the applied blueprint set (dashboard for the anchor slot, notifications-in-app for the completion announcement, account-settings for the restart control, any auth for the per-principal state) and a sample-app fixture proving the pack passes on both the ?apps=dashboard and ?apps= (empty) branches plus multiple ?store= branches and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets a WCAG 2.2 AA compliant onboarding-tour surface (2.1.1 Keyboard, 2.1.2 No Keyboard Trap, 2.4.11 Focus Not Obscured Minimum, 2.4.3 Focus Order) built on the ARIA APG dialog-modal pattern, a first-run checklist that renders on the dashboard shell when application-dashboard is applied and collapses to the settings page when not, three-to-five steps with per-step content owned by the project voice, one recommended default per elicit (dismissal policy dismiss-permanently, completion-state store spa-local-storage per Q4 when no persistence blueprint is applied, checklist anchor derived at apply time), and a documented restart-tour affordance on the settings surface",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2801-1",
+      "description": "The shelf carries blueprints/application-onboarding-tour/blueprint.json declaring slug application-onboarding-tour, version 1.0.0, category application, and 17 to 22 contributions in the 4 REQ / 7 US / 3 TAC / 3 ADR groups per spec section 5.5; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.5; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities is absent (no hard dependency; documented Q4 fallback spa-local-storage when no persistence blueprint is applied).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-2",
+      "description": "The 3 ADR JSON documents under blueprints/application-onboarding-tour/contributions/adrs/ validate against rcf-schemas 0.6.1 ADR shape; the ADR contribution entries in blueprint.json carry a non-null standardsTraceClause per spec section 8a.4 (dialog-modal pattern for ADR-2701, WCAG 2.5.3 or generic enterprise practice for ADR-2702 and ADR-2703 as honest); ADR-2701 dismissal-policy declares recommendedDefault true elicited true; ADR-2702 completion-store-shape declares elicited true with the Q4 default spa-local-storage; ADR-2703 checklist-anchor declares elicited true with the default derived at apply time.",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-3",
+      "description": "rcf define blueprint add ./blueprints/application-onboarding-tour applies the 17 contributions cleanly on a fresh init project (exit 0; contribution count matches blueprint.json); the applied sidecar records appliedElicitations for dismissal policy completion-state store checklist anchor tour-step-manifest per-step-content-voice; no requiresAppliedCapabilities refusal fires (T-5 has no hard dependency).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-4",
+      "description": "The shipped probe pack blueprints/application-onboarding-tour/probe-packs/application-onboarding-tour.pack.mjs loads via the T-0 pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-26101-1 step-container focus and Escape, AC-26102-1 tooltip-as-dialog contract, AC-26103-1 checklist slot with dashboard-when-applied and settings-page-when-not, AC-26104-1 completion-state persistence) resolves to an AC id contributed by the blueprint; every check carries a description field; the pack-level appliesTo predicate references BOTH tacIds AND route (via the operator-configured tour-anchor path glob); every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source; the tooltip-as-dialog check uses browser.resize(1440, 900) and browser.resize(360, 640) to probe focus-not-obscured (WCAG 2.4.11).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-5",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-onboarding-tour/ ships a dependency-free Node HTTP server (server.js) with a start script; on the honest branch /tour renders the tooltip-as-dialog opened on the first step (role=dialog, aria-labelledby to the step heading, focus moves to the tooltip on open, focus returns to the anchor on close); Escape dismisses the tour; Tab traverses tour controls in DOM order and Enter activates the next step; ?apps=dashboard renders the checklist as a <details open> on the dashboard-top anchor; ?apps= (empty) renders the checklist as a <details> (closed) on the settings-page anchor; ?store=<spa-local-storage|spa-session-storage|server-side-per-principal> selects the completion-store backend; ?first-run=<0|1> gates the auto-open; PORT env overrides the bind port (default 3000, never binds 4200).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-6",
+      "description": "The probe pack fails on each broken fixture branch: ?break=no-role drops role=dialog on the tooltip so AC-26102-1 fails at severity block; ?break=focus-escape allows Tab to escape the tooltip to the underlying surface so AC-26101-1 fails at severity block; ?break=no-collapse drops the <details> collapse contract on the checklist slot so AC-26103-1 fails at severity block; ?break=no-persist drops the completion-state write so AC-26104-1 fails at severity block. The aggregate verdict on each break switch reports fail.",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-7",
+      "description": "The four surface-observable checks (AC-26101-1 step-container, AC-26102-1 tooltip-as-dialog, AC-26103-1 checklist-slot, AC-26104-1 completion-state) appear identically across README, guide, pack checks[] descriptions, and docs/topics.md registry; the topics.md T-5 row lists the four cross-references (application-dashboard, application-notifications-in-app, application-account-settings, application-spa) with the compose reason in one line each; the Q4 default (spa-local-storage) is named on ADR-2702 and README with the same rationale.",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-8",
+      "description": "README lists mechanism-reach gaps individually per AC id per checklist section 6.g (T-1 gate discipline); CHANGELOG carries one 1.0.0 entry naming the four checks, the checklist collapse contract and the Q4 fallback; guide/application-onboarding-tour.md exists and names the ARIA APG dialog-modal pattern with a URL, the WCAG 2.2 AA success criteria (2.1.1, 2.1.2, 2.4.3, 2.4.11) with links, the fixture READMEs manual boot line, and the Q4 fallback rationale; packages/rcf-lite/CHANGELOG.md is NOT edited (the round-close release PR owns the 0.22.0 entry).",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2901.json

@@ -0,0 +1,45 @@
+{
+  "createdAt": "2026-09-07T09:11:05.053Z",
+  "updatedAt": "2026-09-07T09:11:05.053Z",
+  "asA": "shelf consumer applying the deploy-cloudflare-workers v1.2.0 blueprint on a fresh SPA-on-Workers project",
+  "iWant": "the shipped v1.2.0 blueprint files (blueprint.json version 1.2.0 with the seven-contribution delta on top of the v1.1.0 shipped set; two new REQ contributions deploy-cloudflare-workers-REQ-013 and REQ-014; three new US contributions in the existing 12xx band deploy-cloudflare-workers-US-12113 SPA-on-Workers deploy, US-12114 assets-directory elicitation, US-12115 migrate-from-Pages guidance; one new ADR contribution ADR-1306-deploy-cloudflare-workers-spa-shape with the verbatim Cloudflare Pages landing-page quote and standardsTraceClause Cloudflare Pages landing-page recommendation 2026-09-06; one new probe module assets-manifest-scan.mjs anchored to AC-2901-2 assetsBlockEmitted; two new elicits assets-directory and run-worker-first) proven against the cf-platform shared sample-app fixture",
+  "soThat": "a rcf-lite project applying deploy-cloudflare-workers v1.2.0 gets a Workers-with-static-assets shape ratified over Pages for greenfield SPA-on-Workers projects (per the Cloudflare Pages landing-page recommendation, verbatim quoted on ADR-1306), an elicited [assets] directory in wrangler.toml, a probed assertion of the emitted assets block, an unchanged v1.1.0 contribution set (12 REQs, 12 USs, 6 TACs, 5 ADRs, deploymentTarget global topic, suggestedCompanions logging and errorHandling), and a shared sample-app fixture that T-1 through T-3 and T-5 extend later",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2901-1",
+      "description": "The shelf carries blueprints/deploy-cloudflare-workers/blueprint.json declaring slug deploy-cloudflare-workers, version 1.2.0, category deploy; the contributions array holds 41 entries splitting 14 req + 15 us + 6 tac + 6 adr (the probe is NOT a contribution kind under the loader's CONTRIBUTABLE_KINDS gate; assets-manifest-scan.mjs ships under contributions/probes/ as a source file only, cross-referenced from the shipped README and the applied fixture shim); the delta over v1.1.0 is six contribution-kind entries plus the probe module: 2 REQs REQ-013 and REQ-014, 3 USs US-12113 US-12114 US-12115, 1 ADR ADR-1306 with recommendedDefault true and standardsTraceClause Cloudflare Pages landing-page recommendation (2026-09-06) on the contribution entry, 1 probe contribution assets-manifest-scan with anchorAcId AC-12113-1 and accountBound false; providesRoles absent, capabilities absent, requiresAppliedCapabilities absent, suggestedCompanions unchanged with logging and errorHandling; the top-level elicits[] gains the two new entries assets-directory and run-worker-first; every ADR contribution entry carries a non-null standardsTraceClause per section 8a.2.",
+      "given": "the shelf tree after this blueprint delta lands",
+      "when": "jq queries against blueprints/deploy-cloudflare-workers/blueprint.json",
+      "then": "jq .slug returns deploy-cloudflare-workers; jq .version returns 1.2.0; jq .contributions returns an array whose kinds split 14 req, 15 us, 6 tac, 6 adr (total 41 entries); the probe module lives under blueprints/deploy-cloudflare-workers/contributions/probes/assets-manifest-scan.mjs and is NOT listed as a contribution; jq .capabilities returns null; jq .suggestedCompanions maps to logging and errorHandling; jq .elicits returns an array containing assets-directory and run-worker-first; jq .contributions[] where kind is adr yields standardsTraceClause non-null for every entry",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2901-2",
+      "description": "The canonical AC assetsBlockEmitted (from spec section 5.0 example ACs) is realised as blueprint contribution AC-12113-1 on US-12113 with a runtime-observable then clause. The shipped probe blueprints/deploy-cloudflare-workers/contributions/probes/assets-manifest-scan.mjs exports a Node module whose default export is a scan verb returning the section 3.2 verdict envelope {verdict, detail, anchorAcId, aggregateVerdict} with anchorAcId AC-12113-1 and accountBound false; the module parses the applied fixture wrangler.toml, asserts the [assets] block directory matches the elicited assets-directory answer, and asserts the absence of any pages_build_output_dir field.",
+      "given": "the cf-platform sample-app fixture at packages/rcf-lite/test/fixtures/cf-platform/ with wrangler.toml carrying [assets] directory = ./dist and no pages_build_output_dir field",
+      "when": "the shim run-assets-manifest-scan.mjs drives the probe module against the fixture wrangler.toml",
+      "then": "the process exits 0 and the written report at .rcf/reports/blueprints/deploy-cloudflare-workers/assets-manifest-scan.json carries aggregateVerdict pass with a detail record naming directory ./dist and no pages_build_output_dir field on the parsed wrangler.toml",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2901-3",
+      "description": "The rcf-lite repo chain is extended with the T-0 delta and validates clean; the chain adds two REQs REQ-029 and REQ-030 under PRD-001, three USs US-2901 US-2902 US-3001, three test suites TS-073 TS-074 TS-075, one FBS FBS-063, and one CN CN-209 anchoring the assets-manifest-scan.mjs probe module; every US carries at least one AC; every AC is covered by a TC on the paired TS with a resolvable test-pointer to test/blueprint/deploy-cloudflare-workers-v-1-2-0-anatomy.test.js. Repo counts bump: requirements 31 to 33, userStories 60 to 63, fbs 50 to 51, testSuite 60 to 63, codeNode 195 to 196.",
+      "given": "the extended repo chain on the T-0 branch after all define create commands have run",
+      "when": "node bin/rcf.js define validate runs from packages/rcf-lite",
+      "then": "the CLI reports rcf define validate: tree is clean and both node bin/rcf.js audit coverage --strict and node bin/rcf.js audit eval coverage --strict exit 0",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tags": [
+    "blueprint:deploy-cloudflare-workers"
+  ],
+  "usId": "US-2901",
+  "prdId": "PRD-001",
+  "reqId": "REQ-029",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "T-0 delta on deploy-cloudflare-workers v1.2.0 shelf: seven-contribution additive minor bump plus cf-platform fixture with the assets-manifest-scan probe passing"
+}