rcf-lite 0.25.0 → 0.27.0

package/rcf/user-stories/us-15201.json

@@ -0,0 +1,21 @@
+{
+  "createdAt": "2026-09-08T12:17:34.801Z",
+  "updatedAt": "2026-09-08T12:19:47.822Z",
+  "asA": "rcf-lite maintainer applying messaging-queue-cloudflare v1.0.0",
+  "iWant": "real-account-concurrency-smoke to publish 500 messages through the producer facade wired to a live Queues binding on a deployed Worker and assert concurrent processing up to the documented push-invocation cap when CI_HAS_CLOUDFLARE_ACCOUNT is set (or record accountBoundSkipped when it is not)",
+  "soThat": "the real-account run proves the queue actually processes messages concurrently on Cloudflare (not just that credentials are present) and the accountBoundSkipped pass-stub can never again be reached from account-flag presence alone",
+  "description": "Part of H-2. Cloudflare Queues does not support wrangler dev --remote, so the real-account driver rides a deployed Worker that binds the queue (queue name and binding parameterised via env; HQ supplies values at gate time, canonical queue rcf-lite-ci-queue-smoke per HQ runbook). The account-set branch publishes 500 messages, waits for delivery under a bounded timeout, and asserts concurrent processing per the documented push-invocation cap. Local proof against miniflare or wrangler dev (local queue simulation). The env-absent branch keeps pass-with-skip. The documented Cloudflare Queues limits URL (https://developers.cloudflare.com/queues/platform/limits/) is re-verified 200 at merge time and logged in the PR provenance transcript.",
+  "usId": "US-15201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-152",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 queue real concurrency driver: real-account-concurrency-smoke publishes 500 messages through the producer facade against a live Queues binding on a deployed Worker and asserts concurrent processing up to the documented push-invocation cap",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15201-1",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set with the deployed-Worker binding env vars, real-account-concurrency-smoke publishes 500 messages through the producer facade wired to a live Queues binding on the deployed Worker (queue name and binding parameterised via env, canonical queue rcf-lite-ci-queue-smoke), waits under a bounded timeout for all 500 to be observed on the consumer side, and asserts concurrent processing occurred (observed max-in-flight consumers greater than one, up to and not exceeding the documented push-invocation cap read from Cloudflare Queues limits). accountBoundSkipped is never set on the account-set branch; a pass is unreachable from account-flag presence alone. Local proof: the same driver path against miniflare or wrangler dev with local queue simulation. Env-absent branch keeps section 3.5 pass-with-skip. The documented limits URL https://developers.cloudflare.com/queues/platform/limits/ is fetched once at merge time, must answer 200 and is logged in the PR provenance transcript.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-15301.json

@@ -0,0 +1,31 @@
+{
+  "createdAt": "2026-09-08T12:17:35.296Z",
+  "updatedAt": "2026-09-08T12:19:48.200Z",
+  "asA": "rcf-lite maintainer applying edge-cloudflare-tunnel v1.0.0",
+  "iWant": "real-account-connector-healthy to actually provision the throwaway hetzner server through the T-1 fixture surface and run cloudflared tunnel info <name> asserting healthy connector count (when both CI_HAS_CLOUDFLARE_ACCOUNT and CI_HAS_HETZNER_ACCOUNT are set), real-account-tunnel-hostname-routes to drive undici for the public-hostname sub-case (activated on CI_HAS_CLOUDFLARE_ACCOUNT) and a two-identity JWT probe for the access-gated sub-case (activated only when CI_HAS_CLOUDFLARE_ACCESS is also set), and manifest-schema-validate to fail with a fixture-setup pointer when the credentials placeholder is missing rather than warn",
+  "soThat": "the real-account tunnel run proves connectors are up and routes actually serve on Cloudflare, the warn-on-env-set branches never again mask a broken driver, and a missing fixture pointer surfaces as a clear failure not a warning",
+  "description": "Part of H-2. connector-healthy consumes the hetzner fixture as-is; its defects are H-1 scope at HQ; if the fixture path fails locally the driver fails with a pointer naming the fixture step, never warn. hostname-routes: the public-hostname sub-case fetches the scratch subdomain via undici; the access-gated sub-case obtains an Access Service Token identity, exchanges it for a JWT and asserts an authenticated fetch succeeds AND an unauthenticated fetch is denied; the AUD sub-case stays pass-with-skip when CI_HAS_CLOUDFLARE_ACCESS is unset (HQ note: Access is not enabled on the HQ account today, so at gate time the AUD sub-case stays pass-with-skip until HQ enables Access, expected not a driver defect). Env-absent branch keeps pass-with-skip on both probes; a pass must never again be reachable from account-flag presence alone.",
+  "usId": "US-15301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-153",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 tunnel real drivers: connector-healthy exercises cloudflared tunnel info against the throwaway hetzner server; hostname-routes drives undici and (when Access is enabled) a two-identity JWT probe; manifest-schema-validate placeholder becomes fail-with-pointer",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15301-1",
+      "description": "When both CI_HAS_CLOUDFLARE_ACCOUNT and CI_HAS_HETZNER_ACCOUNT are set with the required credentials, real-account-connector-healthy provisions the throwaway hetzner server via the T-1 hetzner fixture surface, brings a named cloudflared tunnel connector up on it, runs cloudflared tunnel info <name> through a cloudflared control shim, asserts the reported healthy connector count is at least one, captures a tunnelConnectorUp event on the injected event sink, and tears the connector and server down on exit. If the hetzner fixture path fails locally the driver fails with a pointer naming the failed fixture step (hetzner fixture defects are H-1 scope at HQ, never a warn on this driver). Env-absent branch keeps section 3.5 pass-with-skip.",
+      "testable": true
+    },
+    {
+      "id": "AC-15301-2",
+      "description": "When CI_HAS_CLOUDFLARE_ACCOUNT is set with the required tunnel credentials, real-account-tunnel-hostname-routes drives an undici fetch against the configured scratch subdomain for the public-hostname sub-case, asserts an HTTP 200 with expected body signature. When CI_HAS_CLOUDFLARE_ACCESS is ALSO set with Access service-token identities, the same probe drives a two-identity JWT sub-case: identity A obtains a JWT via the Service Token exchange and an authenticated fetch to the access-gated hostname succeeds; identity B without a JWT is denied (HTTP 302 to Access or HTTP 401). accountBoundSkipped is never set on the account-set branch; a pass is unreachable from CI_HAS_CLOUDFLARE_ACCOUNT presence alone on this probe. The access-gated sub-case remains pass-with-skip when CI_HAS_CLOUDFLARE_ACCESS is unset (HQ note: not enabled on HQ account today, expected). Env-absent branch keeps pass-with-skip.",
+      "testable": true
+    },
+    {
+      "id": "AC-15301-3",
+      "description": "manifest-schema-validate.mjs returns aggregateVerdict fail (not warn) with a detail string naming the missing credentials placeholder file and the fixture-setup step that would create it when the credentials placeholder is absent. The warn-on-missing-credentials-placeholder branch is removed.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-15401.json

@@ -0,0 +1,31 @@
+{
+  "createdAt": "2026-09-08T12:17:35.792Z",
+  "updatedAt": "2026-09-08T12:19:48.599Z",
+  "asA": "rcf-lite maintainer applying the four Cloudflare-platform blueprints",
+  "iWant": "no SIMULATE_ read anywhere in a shipped probe body on the four blueprints, no fail envelope committed under .rcf/reports on the four blueprints, and every committed envelope reflecting a shipped-code pass run against the re-anchored probes",
+  "soThat": "the mutation-purity rule holds at the probe boundary, envelopes are trusted evidence rather than stale fail records, and honest labelling of local test doubles restores probe-comment credibility",
+  "description": "Part of H-2. All SIMULATE_ branches in shipped probe bodies (kv cache-aside-hit-then-miss, kv event-secrecy, DO sole-reader-scan, DO storage-round-trip, DO websocket-hub-broadcast) move to fixture-side shim modules under packages/rcf-lite/test/fixtures/cf-platform/ or .../cf-edge/. New shim files carry the h2-cf-platform-probe-integrity slug prefix (short form h2-cf acceptable). Every driver's negative path is proven by firing the fixture-side mutation switch and observing the FAIL tail; only shipped-code pass envelopes are committed. The committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json is deleted and a shipped-code pass envelope committed in its place; the other four kv envelopes are regenerated so committed envelopes reflect re-anchored shipped-code runs. Probe comments labelling doubles as fake state / fake WebSocket pair / fake clock are reworded to name the local double honestly, or adjudicated acceptable with reason in the PR body.",
+  "usId": "US-15401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-154",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "H-2 cross-cutting probe hygiene: SIMULATE_ branches out of probe bodies into fixture shims; no fail envelope committed; probe comments name test doubles honestly",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15401-1",
+      "description": "A grep for the token SIMULATE_ across every shipped probe module (contributions/probes/*.mjs) on the four Cloudflare-platform blueprints (platform-cloudflare-kv, platform-cloudflare-durable-objects, messaging-queue-cloudflare, edge-cloudflare-tunnel) returns zero hits. Every mutation switch previously read from a probe body is now read from a fixture-side shim module under packages/rcf-lite/test/fixtures/cf-platform/ or .../cf-edge/ whose file name carries the h2-cf-platform-probe-integrity slug prefix (short form h2-cf acceptable). For each moved switch, a corresponding FAIL tail is observed and recorded in the PR provenance transcript when the shims switch is on.",
+      "testable": true
+    },
+    {
+      "id": "AC-15401-2",
+      "description": "No committed report under .rcf/reports/blueprints/{platform-cloudflare-kv, platform-cloudflare-durable-objects, messaging-queue-cloudflare, edge-cloudflare-tunnel}/ carries aggregateVerdict fail or warn. Every committed envelope on the four blueprints reflects a shipped-code pass run against the re-anchored probes; the previously committed fail envelope at .rcf/reports/blueprints/platform-cloudflare-kv/event-secrecy.json is replaced with a shipped-code pass envelope.",
+      "testable": true
+    },
+    {
+      "id": "AC-15401-3",
+      "description": "Every probe-comment or probe-utils-comment surfaced by stage-1 marker rows (kv fake clock; DO fake state; DO probe-utils lines 73 and 75; DO websocket-hub-broadcast fake WebSocket pair; kv not-yet elicit-gating wording) is either reworded to name the local test double honestly on its terms (a fixture in-memory driver realises the Workers KV binding shape; a synthetic WebSocket pair; an elicited fake wall-clock advanced deterministically by the fixture; a follow-up work-item note in place of not-yet) or adjudicated acceptable in the PR body with a stated reason. No shipped probe comment on the four blueprints carries a bare fake / not-yet marker without either honest naming or an adjudication row.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-7701.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-07T14:11:54.740Z",
-  "updatedAt": "2026-09-07T14:13:26.508Z",
+  "updatedAt": "2026-09-09T23:00:00.000Z",
   "usId": "US-7701",
   "prdId": "PRD-001",
   "reqId": "REQ-077",
@@ -13,9 +13,9 @@
   "acceptanceCriteria": [
     {
       "id": "AC-7701-1",
-      "description": "The fixture wrangler.toml carries at least two [[durable_objects.bindings]] blocks (one binding named CELL with class_name SingleCellObject; one binding named HUB with class_name HubObject) and at least one [[migrations]] block with tag \"v1\" and new_classes = [\"SingleCellObject\", \"HubObject\"]. The anatomy assertion greps the toml for each literal string and the migrations pair.",
+      "description": "The fixture wrangler.toml carries at least two [[durable_objects.bindings]] blocks (one binding named CELL with class_name SingleCellObject; one binding named HUB with class_name HubObject) and at least one [[migrations]] block with tag \"v1\" and new_sqlite_classes = [\"SingleCellObject\", \"HubObject\"]. The anatomy assertion greps the toml for each literal string and the migrations pair.",
       "given": "the cf-platform fixture wrangler.toml",
-      "when": "the anatomy assertion greps for the four literal strings and the migrations pair",
+      "when": "the anatomy assertion greps for the four literal strings and the migrations pair (new_sqlite_classes plus the two class names)",
       "then": "every string is present and the migrations tag \"v1\" carries the two class names",
       "testable": true,
       "scope": "runtime"

package/releases/releases.yaml

@@ -40,8 +40,28 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.25.0"
+latest: "0.27.0"
 releases:
+  - version: "0.27.0"
+    date: "2026-09-11"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.27.0 is a shelf-wide hardening release. Every shipped blueprint has been re-verified against the 2026-09-08 authoring criteria, so every requirement is backed at the REQ layer, every user story carries a sufficient acceptance-criteria set with disposition and owner references, and chain-consistency lint reports zero on every slug."
+      - "Shipped prose is now customer-facing throughout, with internal workflow labels, operator names, work-item and dispatch identifiers, and long dashes removed. CI adds a hard register-scan gate and flips the chain-consistency lint gate to hard mode over the monorepo-root shelf."
+      - "One CLI reliability fix rides along: the rcf audit view SIGINT handler is now installed before the readiness line is written, closing a race with Node's default signal disposition."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.26.0"
+    date: "2026-09-09"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.26.0 is a hardening and authoring release. The Cloudflare-platform blueprints on the shelf pick up real-account probe drivers with positive evidence and one shared account-token env matrix."
+      - "The blueprint authoring standard gains three new sections (7c REQ-layer sufficiency, 7d positive-evidence verification, 7e single-definition ownership), ten checklist rows and RULE 16 in the managed agent block."
+      - "The rcf define blueprint verb group gains a lint-consistency subverb, a per-slug disposition ledger with an apply-time prompt and a read-only dispositions view, and the identity seed grows a register field. The schema floor moves to rcf-schemas 0.6.2."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.25.0"
     date: "2026-09-08"
     breaking: false

package/src/blueprint/apply.js

@@ -21,6 +21,7 @@ import { updateManifest } from './manifest-writer.js';
 import { stampId } from './namespace.js';
 import { nextResolutionId } from './resolutions.js';
 import { buildRefusalMessage, discoverAppliedCapabilities, runCustomAuthCapabilityElicits, runElicitationPhase, writeSidecar } from './capabilities.js';
+import { APPLY_DISPOSITION_PROMPT, initialiseLedger } from './disposition-ledger.js';
 
 /**
  * @typedef {object} ApplyResult
@@ -410,11 +411,36 @@ export async function applyBlueprint({ projectRoot, tree, source, displaySource,
     });
   }
 
+  // Disposition ledger. On a fresh apply, initialise
+  // rcf/blueprints/<slug>.disposition.json with one record per
+  // contributed AC so the applying agent has a machine-readable walk
+  // list. Reads AC ids and their `disposition` field (rcf-schemas
+  // 0.6.2) from the SOURCE user-story JSON so the record reflects the
+  // authored shape, not the stamped one; `fixed` ACs land as accepted
+  // with the sentinel reason, `template` and unmarked ACs land as
+  // pending-disposition. Re-apply leaves an existing ledger untouched.
+  let ledgerPath = null;
+  let dispositionPrompt = null;
+  let acCount = 0;
+  if (!dryRun) {
+    const acDescriptors = await collectAcDescriptorsFromSource(source, blueprint, namespace);
+    acCount = acDescriptors.length;
+    if (acCount > 0) {
+      const ledgerRes = await initialiseLedger({ projectRoot, slug: appliedSlug, acDescriptors, now });
+      ledgerPath = ledgerRes.path;
+      if (!ledgerRes.alreadyExisted) {
+        dispositionPrompt = APPLY_DISPOSITION_PROMPT(appliedSlug, blueprint.version, acCount);
+      }
+    }
+  }
+
   return {
     applied: true,
     slug: appliedSlug,
     version: blueprint.version,
     contributions: writtenContributions,
+    ...(ledgerPath ? { ledgerPath, dispositionAcCount: acCount } : {}),
+    ...(dispositionPrompt ? { dispositionPrompt } : {}),
     ...(wroteSidecar ? { sidecarPath, appliedCapabilities, appliedElicitations } : {}),
     // Companion-suggestion mechanism (spec 2.6). Bubble the source
     // blueprint's `suggestedCompanions[]` up on the result so the CLI
@@ -428,6 +454,44 @@ export async function applyBlueprint({ projectRoot, tree, source, displaySource,
   };
 }
 
+/**
+ * Walk the blueprint's user-story contributions on-disk and collect
+ * every AC as a { id, storyId, sourceDisposition? } descriptor for the
+ * disposition ledger. AC ids and story ids are stamped with the
+ * applied namespace so they match what the applying agent sees in the
+ * tree (rather than the raw blueprint-slug ids on the source files).
+ *
+ * `disposition` on the AC (rcf-schemas 0.6.2 $defs.acDisposition) is
+ * `fixed` | `template` and is optional; an unmarked AC lands as
+ * pending-disposition with no `sourceDisposition` field so the operator
+ * can decide.
+ */
+async function collectAcDescriptorsFromSource(sourcePath, blueprint, namespace) {
+  const descriptors = [];
+  for (const c of blueprint.contributions ?? []) {
+    if (c.kind !== 'us' || typeof c.path !== 'string') continue;
+    const abs = join(sourcePath, 'contributions', c.path);
+    let doc;
+    try { doc = JSON.parse(await readFile(abs, 'utf8')); } catch { continue; }
+    const rawStoryId = typeof doc.usId === 'string' ? doc.usId : c.id;
+    // Re-stamp under the applied namespace so a library-qualified apply
+    // (namespace differs from the blueprint's own slug) records the
+    // story id the applying agent will actually see on the tree.
+    const storyStamped = stampId(rawStoryId, namespace);
+    const storyId = 'error' in storyStamped ? rawStoryId : storyStamped.id;
+    const acs = Array.isArray(doc.acceptanceCriteria) ? doc.acceptanceCriteria : [];
+    for (const ac of acs) {
+      if (!ac || typeof ac.id !== 'string') continue;
+      const descriptor = { id: ac.id, storyId };
+      if (ac.disposition === 'fixed' || ac.disposition === 'template') {
+        descriptor.sourceDisposition = ac.disposition;
+      }
+      descriptors.push(descriptor);
+    }
+  }
+  return descriptors;
+}
+
 function stampContributions(contributions, namespace) {
   const out = [];
   for (const c of contributions ?? []) {