rcf-lite 0.25.0 → 0.27.0

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-004.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-901-security-secrets-management-manager-client",
+    "field": "responsibilities.audit"
+  }
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "security-secrets-management-REQ-005",
   "prdId": "PRD-001",
   "title": "Coding agents work with secrets through a piped-stdin CLI; secret material never appears in a chat transcript, log line, or source-tree file",
-  "description": "A secrets CLI ships alongside the client. Every verb that would surface a secret VALUE accepts and produces that value only on stdin or stdout piped to a downstream consumer; the value never appears in a command argument, an environment variable printed at startup, a prompt echo, a chat transcript captured by any agent harness, or a log line the CLI itself writes. Agent-authored code and agent-authored configuration reference secrets by their logical name only. The CLI's structured output surface (`--json`, `--report`) enumerates names and metadata, never values. A verb that prints a value to a terminal is refused unless the process has an interactive TTY on stdout AND the operator has passed an explicit `--show` flag; the flag is deliberately not scriptable through an agent transcript.",
+  "description": "A secrets CLI ships alongside the client. Every verb that would surface a secret VALUE accepts and produces that value only on stdin or stdout piped to a downstream consumer; the value never appears in a command argument, an environment variable printed at startup, a prompt echo, a chat transcript captured by any agent harness, or a log line the CLI itself writes. Agent-authored code and agent-authored configuration reference secrets by their logical name only. The CLI's structured output surface (`--json`, `--report`) enumerates names and metadata, never values. A verb that prints a value to a terminal is refused unless the process has an interactive TTY on stdout AND the operator has passed an explicit `--show` flag; the flag is deliberately not scriptable through an agent transcript. The single exception is the ephemeral `.env` reflection written by the env-reflector under REQ-006: it lives at a fixed repo-root path (`.env` or `.env.<environment>`) that must be present on the repo-root `.gitignore` (the reflector refuses to run when it is not), the file mode is set to `0600` on write so only the owning process user can read it, and the reflector overwrites atomically on re-run so no stale variant survives an environment switch. The `.env` file is not a chat transcript, log line, or committed file; the source-tree prohibition of REQ-005 applies to every other secret-value-carrying byte on the tree.",
   "category": "functional",
   "domain": "security",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-905-security-secrets-management-agent-cli",
+    "field": "responsibilities.stdin"
+  }
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-006.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-903-security-secrets-management-env-reflector",
+    "field": "responsibilities.env"
+  }
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-007.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-902-security-secrets-management-manifest",
+    "field": "responsibilities.environments"
+  }
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-008.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-901-security-secrets-management-manager-client",
+    "field": "responsibilities.boot"
+  }
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-009.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-904-security-secrets-management-rotation-gate",
+    "field": "responsibilities.rotationDays"
+  }
 }

package/blueprints/security-secrets-management/contributions/requirements/security-secrets-management-req-010.json

@@ -2,10 +2,10 @@
   "reqId": "security-secrets-management-REQ-010",
   "prdId": "PRD-001",
   "title": "The operator picks one of three UI outcomes for the Secrets Management surface: integrate a Secrets page into an existing admin UI, adopt an admin-SPA blueprint, or decline a UI",
-  "description": "At apply the working agent elicits a three-way choice about the operator-facing Secrets Management surface: (a) integrate a Secrets Management page into an existing project admin UI, wired to the CLI's structured surface (names and metadata only; the page never renders a secret value); (b) adopt a separate admin-SPA blueprint (a future companion blueprint) that hosts the Secrets page as one of its screens; (c) decline a UI entirely and rely on the CLI plus the audit stream. The choice is recorded in the manifest header. When (a) is chosen the page's contract is fixed by TAC-905 (list, filter by environment, show last-rotated, request-rotation button that hands off to the operator's rotation procedure); the page implementation lives in the host project. When (b) is chosen the project applies the admin-SPA blueprint on top of this one and inherits the page from there. When (c) is chosen this blueprint contributes nothing to the operator UI surface and the CLI plus audit sink remain the whole story.",
+  "description": "At apply the working agent elicits a three-way choice about the operator-facing Secrets Management surface: (a) integrate a Secrets Management page into an existing project admin UI, wired to the CLI's structured surface (names and metadata only; the page never renders a secret value); (b) adopt a separate admin-SPA blueprint (a future companion blueprint) that hosts the Secrets page as one of its screens; (c) decline a UI entirely and rely on the CLI plus the audit stream. The choice is recorded in the manifest header. When (a) is chosen the page's contract is fixed by TAC-905 (list, filter by environment, show last-rotated, request-rotation button that hands off to the operator's rotation procedure); the page implementation lives in the host project. When (b) is chosen the project applies the admin-SPA blueprint on top of this one and inherits the page from there. When (c) is chosen this blueprint contributes nothing to the operator UI surface and the CLI plus audit sink remain the whole story. The option value `integrate` selects the in-project admin-UI page shape; `admin-spa` selects the composed admin-SPA blueprint path; `none` declines a UI and leaves the CLI plus audit sink as the sole surface. The option value `none` is the default at apply; the applying agent overrides it explicitly.",
   "category": "functional",
   "domain": "security",
-  "priority": "should",
+  "priority": "must",
   "rationale": "A UI over secret metadata (names, environments, ages, owners) is useful; a UI over secret values reintroduces the leakage class this blueprint spent nine requirements eliminating. Forcing every project onto a UI would add surface most rcf-lite projects do not need; forbidding one would push operators back to spreadsheets. Eliciting the choice at apply time keeps the blueprint honest across small and larger projects.",
   "tags": [
     "blueprint:security-secrets-management",
@@ -14,5 +14,8 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-08-30T00:00:00Z",
+  "deliveredBy": {
+    "adrId": "ADR-901-security-secrets-management-secrets-source"
+  }
 }

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8101.json

@@ -16,7 +16,8 @@
       "when": "a manifest loader runs against `secrets.yaml`",
       "then": "the loader returns a manifest object whose `secrets` array is non-empty and every entry has the fields `name`, `paths`, `owner`, `rotationDays`, `required`; no entry carries a `value` field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8101-2",
@@ -25,7 +26,8 @@
       "when": "the process calls `secretsClient.get('unknown-key')`",
       "then": "the call throws a stable-coded `SECRETS_UNDECLARED_NAME` error naming `unknown-key` and no vendor call is made",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8101-3",
@@ -34,7 +36,8 @@
       "when": "the CI gate runs on the change",
       "then": "the run fails with a stable-coded `SECRETS_MANIFEST_MISS` error naming the offending source path and the missing manifest name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8102.json

@@ -16,7 +16,8 @@
       "when": "the source tree is scanned for imports of the vendor SDK identifier or of any additional secrets-reader module",
       "then": "the only source file that imports the vendor SDK is the Secrets Manager module and no other module names an alternative secrets-reader import",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8102-2",
@@ -25,7 +26,8 @@
       "when": "a caller invokes `secretsClient.getRequired('X')`",
       "then": "the call throws a `SECRETS_REQUIRED_ABSENT` error whose message names `X` and the active environment string, and no secret value is served",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8102-3",
@@ -34,7 +36,8 @@
       "when": "a `refresh()` call runs while a concurrent `get(name)` call is in flight",
       "then": "the concurrent `get(name)` returns either the pre-refresh value or the post-refresh value; it never returns null when both refresh states have a value, and it never returns a mixed-slice combination across two names",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8103.json

@@ -16,7 +16,8 @@
       "when": "the process calls `secretsClient.get('A')`, `secretsClient.get('B')`, then `secretsClient.get('C')`",
       "then": "the `A` and `B` calls return their values, and the `C` call throws `SECRETS_OUT_OF_SLICE` naming `C` and the current deployable id, with no vendor call made for `C`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8103-2",
@@ -25,7 +26,8 @@
       "when": "a probe using those credentials reads directly against the vendor for path `C`",
       "then": "the vendor responds with its permission-denied outcome for those credentials on that path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8104.json

@@ -16,7 +16,8 @@
       "when": "the process calls `secretsClient.get('N')` and reads the audit sink for events matching that call",
       "then": "exactly one event is emitted, its keys are the enumerated set above, and byte-equality checks against V return no match on any field value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8104-2",
@@ -25,7 +26,8 @@
       "when": "the process calls `secretsClient.get('C')` and the sink is read",
       "then": "one event is emitted with `outcome: 'refusedOutOfSlice'`, name `C`, and no field contains vendor path metadata beyond what the manifest already declares",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8104-3",
@@ -34,7 +36,8 @@
       "when": "the process runs its test suite covering successful and refused fetches",
       "then": "the in-memory adapter accumulates exactly one event per fetch attempt and no vendor SDK is invoked for the audit path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8105.json

@@ -16,7 +16,8 @@
       "when": "the command runs",
       "then": "the exit code is non-zero, stderr names `SECRETS_TTY_WITHOUT_SHOW`, and stdout contains no bytes of the secret value for `N`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8105-2",
@@ -25,7 +26,8 @@
       "when": "the command runs",
       "then": "the exit code is non-zero, stderr names `SECRETS_VALUE_ON_ARGV_REFUSED`, and no vendor write is issued",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8105-3",
@@ -34,7 +36,8 @@
       "when": "the JSON payload is inspected",
       "then": "every top-level entry carries `name`, `environment`, `owner`, `rotationDays`, `lastRotatedAt`, and `required`; no entry contains a field whose value equals or byte-includes any resolved secret value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8105-4",
@@ -43,7 +46,8 @@
       "when": "the CLI runs and the log capture is read back",
       "then": "no captured log line contains V or any substring of length greater than the placeholder length, and every line in place carries the fixed placeholder token",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8106.json

@@ -16,7 +16,8 @@
       "when": "the operator runs `secrets reflect --deployable <id> --env <env>` and reads the resulting `.env`",
       "then": "the file's parsed key set equals the declared slice for `<id>` and every value equals the vendor-resolved value for the active environment; a repeat run atomically replaces the file and no intermediate partial-write state is observable",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8106-2",
@@ -25,7 +26,8 @@
       "when": "`git check-ignore .env` runs at the repo root",
       "then": "the command reports `.env` as ignored and exits 0",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8106-3",
@@ -34,7 +36,8 @@
       "when": "the CI gate runs on the change",
       "then": "the run fails with a stable-coded `SECRETS_DOTENV_DIRECT_READ` error naming the offending source path and directing the author to the Secrets Manager client",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8107.json

@@ -16,7 +16,8 @@
       "when": "the manifest loader validates the file",
       "then": "the loader rejects the manifest with a stable-coded `SECRETS_ENV_PATH_MISSING` error naming the entry and the missing environment string",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8107-2",
@@ -25,7 +26,8 @@
       "when": "the client initialises",
       "then": "boot fails with a stable-coded `SECRETS_ENV_AMBIGUOUS` error naming both inputs, and no vendor call is made",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8107-3",
@@ -34,7 +36,8 @@
       "when": "the process boots in `live`",
       "then": "boot fails with `SECRETS_REQUIRED_ABSENT` naming `X` and `live`, and no listener binds to any port",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8108.json

@@ -16,7 +16,8 @@
       "when": "the process boots",
       "then": "the process exits with a stable-coded `SECRETS_REQUIRED_ABSENT` error naming `R` and the active environment, and a subsequent port scan on the process's declared listen ports returns closed on every port",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8108-2",
@@ -25,7 +26,8 @@
       "when": "the process boots and a caller invokes `secretsClient.get('O')`",
       "then": "the process comes up normally, the call returns null, and no `SECRETS_REQUIRED_ABSENT` error is emitted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8108-3",
@@ -34,7 +36,8 @@
       "when": "boot runs against instrumented vendor code that counts read attempts for that entry",
       "then": "the read is attempted once (plus any vendor-level automatic retry the SDK does internally within a single call), the process exits, and the read counter is one",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8109.json

@@ -16,7 +16,8 @@
       "when": "the rotation gate runs in CI",
       "then": "CI fails with `SECRETS_ROTATION_EXPIRED` naming `S`, the environment, the `lastRotatedAt` value, and the number `120`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8109-2",
@@ -25,7 +26,8 @@
       "when": "the rotation gate runs",
       "then": "CI fails with `SECRETS_ROTATION_UNKNOWN` naming `S` and the environment, whether `required` is true or false",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8109-3",
@@ -34,7 +36,8 @@
       "when": "the rotation gate runs against `S` past its rotation budget",
       "then": "the run does not fail on `S`, and a `SECRETS_ROTATION_OVERRIDE_APPLIED` audit event is emitted naming `S`, the override author, the override expiry, and the wall-clock at gate time",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8110.json

@@ -16,7 +16,8 @@
       "when": "the working agent elicits the choice and writes the manifest",
       "then": "the manifest's `uiIntegration.mode` string equals one of `integrate`, `admin-spa`, or `none` and no other value passes manifest validation",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8110-2",
@@ -25,7 +26,8 @@
       "when": "the operator fetches the deployed Secrets page and inspects its rendered content",
       "then": "every row carries the fields above and byte-equality checks against the vendor-resolved secret values return no match anywhere on the rendered page",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8110-3",
@@ -34,7 +36,8 @@
       "when": "the deployed application is scanned for a Secrets page under any admin path",
       "then": "no path returns a page whose contents identify as the Secrets Management surface (no page metadata declaring it, no HTML fragment matching the TAC-905 shape)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/docs/topics.md

@@ -46,7 +46,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/fixtures/canary-manifest.json

@@ -1,9 +1,9 @@
 {
   "registerCanary": [
     {
-      "id": "rc-2026-09-08-001",
-      "createdAt": "2026-09-08T05:23:05.136Z",
-      "buildVersion": "0.25.0-mockdriver",
+      "id": "rc-2026-09-11-001",
+      "createdAt": "2026-09-11T08:43:30.531Z",
+      "buildVersion": "0.27.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -34,9 +34,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-08-002",
-      "createdAt": "2026-09-08T05:23:05.137Z",
-      "buildVersion": "0.25.0-mockdriver",
+      "id": "rc-2026-09-11-002",
+      "createdAt": "2026-09-11T08:43:30.532Z",
+      "buildVersion": "0.27.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -67,9 +67,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-08-003",
-      "createdAt": "2026-09-08T05:23:05.137Z",
-      "buildVersion": "0.25.0-mockdriver",
+      "id": "rc-2026-09-11-003",
+      "createdAt": "2026-09-11T08:43:30.532Z",
+      "buildVersion": "0.27.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/guidance/harness-template.md

@@ -252,6 +252,73 @@ miss, feed unreachable) say nothing to the operator; freshness is a
 convenience, not a gate. Never run the upgrade without the operator's
 explicit go.
 
+### RULE 15: On blueprint apply, dispose every AC.
+
+A blueprint's acceptance criteria come in two shapes: `fixed`
+(mechanism-invariant, true for every applying project) and `template`
+(shape given, values project-specific). When you apply a blueprint
+(`rcf define blueprint add ...`), walk every AC the blueprint
+contributed. A `fixed` AC stands as authored: do not weaken or drop
+one, and if one appears wrong for the project, that is a defect against
+the blueprint, escalated on the blueprint's repo, not edited locally. A
+`template` AC is a starting shape: actively dispose of it by accepting
+as written, adjusting with the project's values, or dropping with a
+stated reason recorded against the story. Silent inheritance of a
+`template` AC is a defect. After you have disposed of every `template`
+AC, re-sweep the applied AC set against the scenario-class prompt list
+(credential missing, non-2xx, rate limit, timeout, partial write,
+permission denied, malformed input, already exists, gone, concurrent
+access, quota exhausted, dependency not ready, first-vs-repeat run,
+idempotency, empty and maximal collections, boundary values) so the
+story still covers the mechanism's documented failure paths. Any AC
+that rests on a third-party platform fact must show its vendor
+documentation URL and the ISO-8601 date the fact was verified; a
+citation older than the operator's tolerance is re-verified before the
+AC is treated as ground truth.
+
+A blueprint's seed docs are a minimal representational seed set, not a
+project spec. You have full scope of the project you are driving, and
+you are the party best placed to integrate the seed with the project's
+own chain. After you have disposed of every AC, walk the seed's REQs,
+TACs and ADRs against the project chain (existing REQs, TACs, ADRs and
+the PRD/TAD): resolve integration contradictions you can (parameter
+substitution against a settled project value, naming reconciliation
+against a settled project convention, composition-order reconciliation
+against another applied blueprint), record the disposition in the
+tree, and escalate to the operator only the ones that need a
+product-shape decision or a two-way credential or account decision. An
+internal contradiction (two of the seed's own layers disagreeing about
+the same contract) is not yours to resolve; escalate it as a defect
+against the blueprint's repo and refuse to derive downstream work from
+the ambiguity.
+
+When you escalate, pitch the question at the operator's declared
+register. On your first exchange after `rcf init`, if
+`rcf/.identity/profile.md` carries no `operatorRegister` value, ask one
+question and record the answer to the profile: "One quick set-up
+question. When we need to escalate a decision to you, do you want it
+framed as a product-owner question (plain English, outcome-shaped) or
+an engineer question (with the AC id, the seed's assertion, the
+project's convention)? Answer 'product owner', 'engineer', or 'skip'
+and I will hold the default." A `skip` answer writes `unstated`, which
+reads as `productOwner` on the first escalation; if the operator
+answers in method vocabulary, silently promote to `engineer` for the
+rest of the session and offer to persist the change to the profile.
+
+### RULE 16: Verify with positive evidence.
+
+Every "verified" claim (in the Test and Finalise stages, in the PR body's
+verification section, in any status update) names the runtime it was
+checked against AND cites the positive evidence of the property (a
+request id, a response body excerpt, a created-then-deleted resource id
+in an inventory diff, a real deploy record). "The check did not show the
+bad signature" is not evidence; "the request returned id 8f7a-... and
+the response body carried the created resource id 12345" is. Where the
+account credentials are not present, record the skip honestly (name the
+env var that was unset), never fabricate a pass on the strength of
+absence. This rule mirrors RULE 15's active-disposition posture: an
+absent check is a skip you name, an actual check is a claim you cite.
+
 ### Session start
 
 Run `rcf define validate`. A broken tree is fixed or reported before anything

package/guidance/managed/agent-instructions-block.hash

@@ -1 +1 @@
-129f4018f526ececaef7ae5bea19ecd72be03a957e2cf2ee3323e85f117f6cba
+d35bd2dfec14db5567c2bcfa2934ce58ac5d7c23fd24e47776501660e06063eb

package/guidance/managed/agent-instructions-block.md

@@ -239,6 +239,73 @@ miss, feed unreachable) say nothing to the operator; freshness is a
 convenience, not a gate. Never run the upgrade without the operator's
 explicit go.
 
+### RULE 15: On blueprint apply, dispose every AC.
+
+A blueprint's acceptance criteria come in two shapes: `fixed`
+(mechanism-invariant, true for every applying project) and `template`
+(shape given, values project-specific). When you apply a blueprint
+(`rcf define blueprint add ...`), walk every AC the blueprint
+contributed. A `fixed` AC stands as authored: do not weaken or drop
+one, and if one appears wrong for the project, that is a defect against
+the blueprint, escalated on the blueprint's repo, not edited locally. A
+`template` AC is a starting shape: actively dispose of it by accepting
+as written, adjusting with the project's values, or dropping with a
+stated reason recorded against the story. Silent inheritance of a
+`template` AC is a defect. After you have disposed of every `template`
+AC, re-sweep the applied AC set against the scenario-class prompt list
+(credential missing, non-2xx, rate limit, timeout, partial write,
+permission denied, malformed input, already exists, gone, concurrent
+access, quota exhausted, dependency not ready, first-vs-repeat run,
+idempotency, empty and maximal collections, boundary values) so the
+story still covers the mechanism's documented failure paths. Any AC
+that rests on a third-party platform fact must show its vendor
+documentation URL and the ISO-8601 date the fact was verified; a
+citation older than the operator's tolerance is re-verified before the
+AC is treated as ground truth.
+
+A blueprint's seed docs are a minimal representational seed set, not a
+project spec. You have full scope of the project you are driving, and
+you are the party best placed to integrate the seed with the project's
+own chain. After you have disposed of every AC, walk the seed's REQs,
+TACs and ADRs against the project chain (existing REQs, TACs, ADRs and
+the PRD/TAD): resolve integration contradictions you can (parameter
+substitution against a settled project value, naming reconciliation
+against a settled project convention, composition-order reconciliation
+against another applied blueprint), record the disposition in the
+tree, and escalate to the operator only the ones that need a
+product-shape decision or a two-way credential or account decision. An
+internal contradiction (two of the seed's own layers disagreeing about
+the same contract) is not yours to resolve; escalate it as a defect
+against the blueprint's repo and refuse to derive downstream work from
+the ambiguity.
+
+When you escalate, pitch the question at the operator's declared
+register. On your first exchange after `rcf init`, if
+`rcf/.identity/profile.md` carries no `operatorRegister` value, ask one
+question and record the answer to the profile: "One quick set-up
+question. When we need to escalate a decision to you, do you want it
+framed as a product-owner question (plain English, outcome-shaped) or
+an engineer question (with the AC id, the seed's assertion, the
+project's convention)? Answer 'product owner', 'engineer', or 'skip'
+and I will hold the default." A `skip` answer writes `unstated`, which
+reads as `productOwner` on the first escalation; if the operator
+answers in method vocabulary, silently promote to `engineer` for the
+rest of the session and offer to persist the change to the profile.
+
+### RULE 16: Verify with positive evidence.
+
+Every "verified" claim (in the Test and Finalise stages, in the PR body's
+verification section, in any status update) names the runtime it was
+checked against AND cites the positive evidence of the property (a
+request id, a response body excerpt, a created-then-deleted resource id
+in an inventory diff, a real deploy record). "The check did not show the
+bad signature" is not evidence; "the request returned id 8f7a-... and
+the response body carried the created resource id 12345" is. Where the
+account credentials are not present, record the skip honestly (name the
+env var that was unset), never fabricate a pass on the strength of
+absence. This rule mirrors RULE 15's active-disposition posture: an
+absent check is a skip you name, an actual check is a claim you cite.
+
 ### Session start
 
 Run `rcf define validate`. A broken tree is fixed or reported before anything

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.25.0",
+  "version": "0.27.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",
@@ -60,7 +60,7 @@
     "#admissibility": "./src/admissibility/index.js"
   },
   "dependencies": {
-    "@stravica-ai/rcf-schemas": "0.6.1",
+    "@stravica-ai/rcf-schemas": "0.6.2",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1"
   },