rcf-lite 0.26.0 → 0.28.0

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8108.json

@@ -16,7 +16,8 @@
       "when": "the process boots",
       "then": "the process exits with a stable-coded `SECRETS_REQUIRED_ABSENT` error naming `R` and the active environment, and a subsequent port scan on the process's declared listen ports returns closed on every port",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8108-2",
@@ -25,7 +26,8 @@
       "when": "the process boots and a caller invokes `secretsClient.get('O')`",
       "then": "the process comes up normally, the call returns null, and no `SECRETS_REQUIRED_ABSENT` error is emitted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8108-3",
@@ -34,7 +36,8 @@
       "when": "boot runs against instrumented vendor code that counts read attempts for that entry",
       "then": "the read is attempted once (plus any vendor-level automatic retry the SDK does internally within a single call), the process exits, and the read counter is one",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8109.json

@@ -16,7 +16,8 @@
       "when": "the rotation gate runs in CI",
       "then": "CI fails with `SECRETS_ROTATION_EXPIRED` naming `S`, the environment, the `lastRotatedAt` value, and the number `120`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8109-2",
@@ -25,7 +26,8 @@
       "when": "the rotation gate runs",
       "then": "CI fails with `SECRETS_ROTATION_UNKNOWN` naming `S` and the environment, whether `required` is true or false",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8109-3",
@@ -34,7 +36,8 @@
       "when": "the rotation gate runs against `S` past its rotation budget",
       "then": "the run does not fail on `S`, and a `SECRETS_ROTATION_OVERRIDE_APPLIED` audit event is emitted naming `S`, the override author, the override expiry, and the wall-clock at gate time",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/contributions/user-stories/security-secrets-management-us-8110.json

@@ -16,7 +16,8 @@
       "when": "the working agent elicits the choice and writes the manifest",
       "then": "the manifest's `uiIntegration.mode` string equals one of `integrate`, `admin-spa`, or `none` and no other value passes manifest validation",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8110-2",
@@ -25,7 +26,8 @@
       "when": "the operator fetches the deployed Secrets page and inspects its rendered content",
       "then": "every row carries the fields above and byte-equality checks against the vendor-resolved secret values return no match anywhere on the rendered page",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-8110-3",
@@ -34,7 +36,8 @@
       "when": "the deployed application is scanned for a Secrets page under any admin path",
       "then": "no path returns a page whose contents identify as the Secrets Management surface (no page metadata declaring it, no HTML fragment matching the TAC-905 shape)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/security-secrets-management/docs/topics.md

@@ -14,7 +14,7 @@ Rules for new topics (inherited from the application-spa, application-api-rest,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -59,8 +59,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 8101-8110 sit at the LOW end of the 8101-8899 band on purpose. A project-side story that mechanically derives from a security-secrets-management REQ id into the number `8110` would collide against security-secrets-management-US-8110 in this package; the band leaves headroom at the HIGH end (US 8181-8899) so a project's own stories anchored to security-secrets-management REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 8101-8110 sit at the LOW end of the 8101-8899 band on purpose. A project-side story that mechanically derives from a security-secrets-management REQ id into the number `8110` would collide against security-secrets-management-US-8110 in this package; the band leaves headroom at the HIGH end (US 8181-8899) so a project's own stories anchored to security-secrets-management REQs can allocate without conflict.
 ## Shared expectations for future composing blueprints
 
 - Reuse `secretsSource` exactly as spelled here when your blueprint holds an opinion on the project's secrets source-of-truth model; contribute your own scope:global ADR on that string and let composition surface the pairing. A vendor-committed opinionated blueprint (a Vault-specific blueprint, an AWS Secrets Manager blueprint, a Doppler blueprint) will conflict here by design and expect a project-level ADR resolution.

package/fixtures/canary-manifest.json

@@ -1,9 +1,9 @@
 {
   "registerCanary": [
     {
-      "id": "rc-2026-09-09-001",
-      "createdAt": "2026-09-09T16:11:26.221Z",
-      "buildVersion": "0.26.0-mockdriver",
+      "id": "rc-2026-09-17-001",
+      "createdAt": "2026-09-17T10:17:51.151Z",
+      "buildVersion": "0.28.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -34,9 +34,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-09-002",
-      "createdAt": "2026-09-09T16:11:26.222Z",
-      "buildVersion": "0.26.0-mockdriver",
+      "id": "rc-2026-09-17-002",
+      "createdAt": "2026-09-17T10:17:51.152Z",
+      "buildVersion": "0.28.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -67,9 +67,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-09-003",
-      "createdAt": "2026-09-09T16:11:26.222Z",
-      "buildVersion": "0.26.0-mockdriver",
+      "id": "rc-2026-09-17-003",
+      "createdAt": "2026-09-17T10:17:51.152Z",
+      "buildVersion": "0.28.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/guidance/harness-template.md

@@ -319,6 +319,31 @@ env var that was unset), never fabricate a pass on the strength of
 absence. This rule mirrors RULE 15's active-disposition posture: an
 absent check is a skip you name, an actual check is a claim you cite.
 
+### RULE 17: Log what misbehaves; ask once before anything leaves.
+
+When a blueprint or rcf-lite itself does something contrary to its own
+docs, fails, or forces you into a workaround (a validate finding on
+freshly applied content, a contribution that references a piece the
+blueprint does not ship, a stale vendor citation, a verb that errors or
+hangs, output that contradicts `rcf help`), record it at once with
+`rcf feedback add` (kind, target, anchor id, symptom class, severity,
+a plain title and a body that says what happened, what the docs say,
+and the command or file that shows it). Recording is silent and local;
+nothing is sent. Never put customer data, credentials, operator names
+or absolute paths in the body: the tool redacts, you do not rely on it.
+
+Ask exactly once per session. The harness hook, or your own judgement
+at a natural pause (the queue reports complete, the operator says they
+are wrapping up), triggers it: run `rcf feedback preview`, show the
+operator the exact titles and bodies it prints and where they would be
+filed (name the repo and whether it is public), and ask in one sentence
+whether to send them. Yes: `rcf feedback submit --yes`, then relay the
+issue links. Not now: `rcf feedback defer`. Never for this project:
+`rcf feedback opt-out`. Do not ask again in the same session, do not
+submit without a yes, and do not describe the mechanism unless asked.
+If submit reports a bundle instead of a link, give the operator the
+bundle path and the repo URL in one line and move on.
+
 ### Session start
 
 Run `rcf define validate`. A broken tree is fixed or reported before anything

package/guidance/managed/agent-instructions-block.hash

@@ -1 +1 @@
-d35bd2dfec14db5567c2bcfa2934ce58ac5d7c23fd24e47776501660e06063eb
+b13d34856570798bf8cced82f5d79998408fe6b30d41a65ba3d3a356c46beef5

package/guidance/managed/agent-instructions-block.md

@@ -306,6 +306,31 @@ env var that was unset), never fabricate a pass on the strength of
 absence. This rule mirrors RULE 15's active-disposition posture: an
 absent check is a skip you name, an actual check is a claim you cite.
 
+### RULE 17: Log what misbehaves; ask once before anything leaves.
+
+When a blueprint or rcf-lite itself does something contrary to its own
+docs, fails, or forces you into a workaround (a validate finding on
+freshly applied content, a contribution that references a piece the
+blueprint does not ship, a stale vendor citation, a verb that errors or
+hangs, output that contradicts `rcf help`), record it at once with
+`rcf feedback add` (kind, target, anchor id, symptom class, severity,
+a plain title and a body that says what happened, what the docs say,
+and the command or file that shows it). Recording is silent and local;
+nothing is sent. Never put customer data, credentials, operator names
+or absolute paths in the body: the tool redacts, you do not rely on it.
+
+Ask exactly once per session. The harness hook, or your own judgement
+at a natural pause (the queue reports complete, the operator says they
+are wrapping up), triggers it: run `rcf feedback preview`, show the
+operator the exact titles and bodies it prints and where they would be
+filed (name the repo and whether it is public), and ask in one sentence
+whether to send them. Yes: `rcf feedback submit --yes`, then relay the
+issue links. Not now: `rcf feedback defer`. Never for this project:
+`rcf feedback opt-out`. Do not ask again in the same session, do not
+submit without a yes, and do not describe the mechanism unless asked.
+If submit reports a bundle instead of a link, give the operator the
+bundle path and the repo URL in one line and move on.
+
 ### Session start
 
 Run `rcf define validate`. A broken tree is fixed or reported before anything

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",
@@ -60,7 +60,7 @@
     "#admissibility": "./src/admissibility/index.js"
   },
   "dependencies": {
-    "@stravica-ai/rcf-schemas": "0.6.2",
+    "@stravica-ai/rcf-schemas": "0.6.3",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1"
   },

package/rcf/adrs/adr-4101-feedback-store-gitignored.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-4101-feedback-store-gitignored",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Feedback log lives at .rcf/feedback/ and is gitignored",
+  "context": "Raw feedback entries are written before redaction runs and may hold absolute paths, hostnames and pasted error output. The store is per-clone and per-person, like rcf/.identity/ and .rcf/preflight-secrets.local.json, both already gitignored through the managed block.",
+  "decision": "The store lives under .rcf/feedback/ and is added to the managed gitignore aggregator via src/feedback/store.js:feedbackGitignoreEntry. src/setup/managed-gitignore.js:managedGitignoreEntries() imports it. rcf feedback add refuses on a project whose .gitignore does not cover the path unless --force is passed, printing the rcf doctor --fix line.",
+  "consequences": "Unredacted content cannot ride a git push, even accidentally. Existing projects need a rcf doctor --fix (or a rcf init on a fresh clone) to pick up the ignore entry. The shareable, durable record is the GitHub issue; the outbox bundle exists for cases where that record could not be made.",
+  "alternativesConsidered": [
+    {
+      "name": "Commit rcf/feedback/ so a team can see it",
+      "summary": "Store entries under the committed rcf/ tree so any team member can browse the log.",
+      "reasonNotChosen": "Leaks a public-repo user's unredacted findings on the next push, which is the exact failure the redaction step exists to prevent."
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/adrs/adr-4102-fingerprint-and-labels.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-4102-fingerprint-and-labels",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Fingerprint from anchor plus symptom class; labels best-effort with a six-label bootstrap",
+  "context": "Same-defect folding needs a deterministic key and a triage discipline for both signed-in and outside reporters. Fingerprint from title-similarity folds wrong across unrelated findings on the same blueprint. Labels are triage handles that break for outside reporters on a public repo.",
+  "decision": "The fingerprint is sha-256(kind|targetKey|anchor|symptomClass) truncated to 12 hex characters (design section 6). Blueprint version is not part of the fingerprint. Labels are best-effort, with a fixed six-label bootstrap catalogue on every destination repo: rcf-feedback, severity:blocker, severity:major, severity:minor, area:blueprint, area:core. A repo admin runs scripts/bootstrap-feedback-labels.mjs once per destination. Title prefix (\"[<slug>] \" or \"[rcf-lite] \") and the visible rcf-feedback-fingerprint: <fp> line stay load-bearing when labels are missing. Per-slug labels are refused (forty-plus labels to bootstrap and outside reporters cannot apply them).\n\nOperator default (pending, adjustable): Six-label bootstrap accepted as the operator default pending, adjustable. Baz can widen or narrow the catalogue at any time and library owners choose whether to add area or severity labels beyond the six on their own repos; the tool always intersects with the destination label list at submit time.",
+  "consequences": "Two agents describing the same defect on the same AC fold correctly. A defect that persists across blueprint versions produces one issue with versions in the comments. A minimal fixed label catalogue serves triage without inflating the label list per blueprint. Outside contributors on the public Stravica/rcf-lite repo still land readable issues because label absence is a soft degrade.",
+  "alternativesConsidered": [
+    {
+      "name": "Fuzzy title matching for the fingerprint",
+      "summary": "Compute an edit-distance or token-set score across issue titles instead of the anchor input.",
+      "reasonNotChosen": "False folds across unrelated findings on the same blueprint and non-deterministic to test."
+    },
+    {
+      "name": "Per-slug blueprint:<slug> labels",
+      "summary": "Create one label per blueprint slug on every destination repo for finer triage.",
+      "reasonNotChosen": "Forty-plus labels to bootstrap on every destination and outside users still cannot apply them."
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/adrs/adr-4103-redaction-rule-based.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-4103-redaction-rule-based",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Redaction is deterministic and rule-based; no model, no network",
+  "context": "The subscription-only-LLM estate rule and the requirement that redaction be testable both point away from model-assisted redaction. Every replacement must be defensible under review; every ledger row must be reproducible from the inputs.",
+  "decision": "src/feedback/redact.js applies the eight rules of design section 5 (project root, other absolute paths, emails, non-allowlisted hosts, private IPs, secret-looking strings, operator identity, size and shape). The vendor host allowlist ships as src/feedback/redact-allowlist.json and is extended per project via rcf/feedback-settings.json:redaction.allowHosts[]. A body that still matches rule 5 on the second pass is refused, not sent.",
+  "consequences": "Redaction is testable with a fixture corpus and deterministic under review. Some over-redaction is expected (a benign name matching an entropy rule); the disclosure ledger surfaces every case so the operator can see and the agent can rewrite. The rendered output is what leaves; the stored raw entry is untouched.",
+  "alternativesConsidered": [
+    {
+      "name": "Model-assisted redaction or summarisation",
+      "summary": "Route the body through a model to strip PII and produce a compact narrative.",
+      "reasonNotChosen": "Estate subscription-only rule and non-deterministic output that cannot be unit-tested."
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/adrs/adr-4104-destination-on-library.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-4104-destination-on-library",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Destination is declared on library.json:issues, snapshotted on library add",
+  "context": "A library that ships blueprints across many consuming projects needs one authoritative statement of where reports go. Configuring destination per consuming project means every project has to be told and every project can get it wrong independently. Derivation from the git source picks up forks and mirrors incorrectly.",
+  "decision": "library.json carries an optional issues object with repo (OWNER/REPO or HOST/OWNER/REPO for GHES) and visibility (public or private, advisory). rcf library add snapshots it onto rcf/blueprint-libraries.json:entries[] as issuesRepo and issuesVisibility. src/feedback/destination.js walks entry -> manifest -> registry -> issuesRepo, falling back to git source derivation only when the sourceRef parses as github.com/OWNER/REPO. rcf doctor gains a warn-only feedback-destinations check listing unresolved registrations.",
+  "consequences": "The library owner names where they want reports; the consuming project does not guess. Existing libraries without the field warn on doctor and route to the outbox with the publisher contact until a library update lands. Mirrored libraries no longer risk routing to the mirror.",
+  "alternativesConsidered": [
+    {
+      "name": "Destination configured per consuming project",
+      "summary": "Put the destination in each project's rcf/feedback-settings.json.",
+      "reasonNotChosen": "Every WSD-using project would have to be told and get it right independently."
+    },
+    {
+      "name": "Git-source derivation as the primary route",
+      "summary": "Use the library sourceRef URL as the destination without a declared field.",
+      "reasonNotChosen": "A library mirrored from a fork would route reports to the fork."
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/adrs/adr-4105-gh-ambient-auth.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-4105-gh-ambient-auth",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "gh runs under the reporter ambient auth; visible identity on the public repo",
+  "context": "A relay endpoint would anonymise reporters but requires Stravica to run a service, store submissions and become the abuse surface, and is invisible to WSD for their private library. The gh CLI already carries the reporter identity and the correct permissions on every destination the reporter may reach.",
+  "decision": "Issues are created via the ambient gh CLI, under the operator own GitHub login, visibly on public and private repos alike. The tool never asks for a token, never reads GH_TOKEN or GITHUB_TOKEN itself, never spawns gh auth login. The preview names the destination and the visibility so the operator sees \"under your GitHub login, on the public Stravica/rcf-lite repo\" before consenting.\n\nOperator default (pending, adjustable): Visible reporter identity on Stravica/rcf-lite accepted as the operator default pending, adjustable. Baz can flip this to a relay design later without changing the CLI surface; the tool would swap gh for the relay client behind src/feedback/gh.js.",
+  "consequences": "Reporter identity is honest, which matches the operator ruling and open-source practice. The tool stays out of the credential business. Reports on the private WSD library route to WSD directly without a Stravica-side mirror.",
+  "alternativesConsidered": [
+    {
+      "name": "A Stravica relay endpoint",
+      "summary": "Route every report through a Stravica-hosted API that anonymises before filing.",
+      "reasonNotChosen": "Stravica runs a service and becomes the abuse surface; invisible to WSD for their private library."
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/adrs/adr-4106-bundled-entries-terminal.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-4106-bundled-entries-terminal",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Bundled entries are terminal for the ask loop",
+  "context": "A reporter without gh, without login, or without access to a private repo would otherwise be asked every session about the same entries. Re-asking a batch that cannot land under the reporter identity nags without benefit.",
+  "decision": "When submit falls through to a bundle for an entry, that entry is marked bundled (terminal for the ask loop). rcf feedback list default (pending) hides bundled entries; the SessionStart hook does not count them; the Stop hook does not re-ask. rcf feedback submit <id> re-attempts one entry by hand once access exists.",
+  "consequences": "The operator is never nagged about the same finding. The outbox file and the printed one-line URL are what the operator uses to relay or paste the bundle. A future access change is a hand-driven re-submit, not an automatic retry.",
+  "alternativesConsidered": [
+    {
+      "name": "Re-ask every session until submitted",
+      "summary": "Keep bundled entries pending so the next session asks again.",
+      "reasonNotChosen": "Nags an operator who has no path to access; a hand-driven re-submit is the correct fix."
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/adrs/adr-4107-stop-is-ask-event.json

@@ -0,0 +1,30 @@
+{
+  "adrId": "ADR-4107-stop-is-ask-event",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Stop is the ask event; a 15-minute quiet gate keeps the ask at a pause",
+  "context": "Claude Code SessionEnd output is discarded, cannot speak to the user, and shares a 1.5 second budget across hooks; Stop is the only lifecycle event that can put words in front of the user. A Stop after every rcf feedback add would interrupt the operator mid-task and read as nagging. Wrap-up cues (operator says \"done\", queue complete) miss most single-session users.",
+  "decision": "The ask is triggered from the Stop hook (Claude Code exit 2 + stderr; Codex JSON { decision: \"block\", reason }). The quiet rule (design section 3.5) requires all of: not opted out, pending entries exist, no prior asked record for this session_id, stop_hook_active is false, AND one of: entry carries askNow; the newest pending entry is older than quietMinutes (default 15) minutes; the queue-state cache reports complete or nothing actionable; the entry was carried over. quietMinutes is configurable in rcf/feedback-settings.json; --ask-now on rcf feedback add bypasses the age gate for a blocker-severity entry.\n\nOperator default (pending, adjustable): Fifteen-minute quiet gate with quietMinutes configurable and --ask-now for blocker-severity entries accepted as the operator default pending, adjustable. Baz can widen or shorten quietMinutes in rcf/feedback-settings.json at any time without a code change.",
+  "consequences": "The ask arrives at a natural pause with the exact preview text, exactly once per session_id, with a durable asked ledger that survives a crash between emit and reply. A single-session user is asked; a wrap-up-only design would miss most. quietMinutes is the single knob for anyone who finds 15 too eager or too shy.",
+  "alternativesConsidered": [
+    {
+      "name": "Ask at the first Stop after any add",
+      "summary": "Drop the age and queue gate; the first Stop after any add asks.",
+      "reasonNotChosen": "Interrupts the operator mid-task and reads as nagging even though it is one question."
+    },
+    {
+      "name": "Ask on strict wrap-up cues only",
+      "summary": "Only ask when the operator says \"done\" or the queue reports complete.",
+      "reasonNotChosen": "Many single-session users are never asked."
+    },
+    {
+      "name": "Ask on SessionEnd only",
+      "summary": "Move the ask to SessionEnd so it never fires mid-session.",
+      "reasonNotChosen": "SessionEnd cannot speak to the user in either harness; loses single-session users entirely."
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/adrs/adr-4108-hooks-in-committed-config.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-4108-hooks-in-committed-config",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "proposed",
+  "title": "Hooks live in committed harness config, installed by init and maintained by doctor",
+  "context": "Every clone must get the same feedback ask behaviour. A user-scope hook fires on non-rcf projects and rcf init must never write outside the project. settings.local.json is per-clone and would silently skip the second developer.",
+  "decision": "rcf init merges Stop, SessionEnd and SessionStart entries into <project>/.claude/settings.json (Claude Code) and <project>/.codex/hooks.json (Codex), each pointing at npx rcf-lite feedback hook <event>. The merge respects other hooks (parse, refuse on invalid JSON, add ours only when absent, never clobber). rcf doctor gains a feedback-hooks check that reports missing-hook (fixable) and foreign-hook (a different command under our name; refused). --no-feedback-hooks on rcf init skips both writes.",
+  "consequences": "Every clone gets the ask behaviour without extra setup. doctor keeps the config honest the same way it keeps the managed block honest. Codex asks the operator to trust repo hooks the first time; RULE 17 in AGENTS.md covers the case where they decline.",
+  "alternativesConsidered": [
+    {
+      "name": ".claude/settings.local.json per-clone",
+      "summary": "Write hooks to the per-clone settings file instead of the committed one.",
+      "reasonNotChosen": "The second developer never gets the hook; teams silently diverge."
+    },
+    {
+      "name": "User-scope ~/.claude hooks",
+      "summary": "Install hooks in the user home so they cover every project.",
+      "reasonNotChosen": "Fires on non-rcf projects; rcf init must never write outside the project."
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/adrs/adr-4109-referee-validate-adr-crosslinks.json

@@ -0,0 +1,25 @@
+{
+  "createdAt": "2026-09-16T22:20:45Z",
+  "updatedAt": "2026-09-16T22:20:45Z",
+  "adrId": "ADR-4109-referee-validate-adr-crosslinks",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Walk ADR supersededBy and relatedAdrs at validate time, in the load-then-invert engine, not at ADR write time",
+  "context": "The referee-guarantees docs page promises that `rcf define validate` proves every reference in every document resolves. The 0.27.0 walker's referential-integrity pass (`collectBrokenReferences`) walks the parent-id fields (prdId, tadId, reqId, usId, tacId, bsId) and the child-borne cross-links (fbs.acIds, fbs.contextRequirements, ts.acIds, cn.implementsAcIds / dependencies, eval.usId / acIds), but the two ADR schema fields declared for supersession semantics (`supersededBy`, `relatedAdrs`) are skipped. That leaves an honest gap between the docs promise and the tool: an ADR whose supersededBy names an id with no file on disk passes validate today. Two places are candidates for the check: (a) at ADR write time in `updateDocument` / `createDocument` (reject the write on an unresolved target), (b) at validate time in the load-then-invert walker (raise a brokenReference on the tree pass).",
+  "decision": "Walk both fields inside `collectBrokenReferences`, reusing the existing `check` helper and the `brokenReference` error kind. Two additional call blocks appended to the existing ADR loop: one for `supersededBy` (single id), one for `relatedAdrs[i]` (each entry). Neither field is required by the ADR schema, so an absent or empty field is silent; a present target must resolve to a loaded ADR of the expected kind. This matches the pattern the walker already applies to every other cross-link (fbs.contextRequirements.adrIds is the closest sibling).",
+  "consequences": "The docs-page promise holds by construction from this release. Existing WSD projects that carry stale supersession pointers will surface those failures on the next `rcf define validate` run, with the ADR file and the field named; the fix is a one-line edit or a targeted `define update` write. Choosing validate-time rather than write-time keeps the write path fast and repairable: a broken write path could refuse an operator's legitimate fix mid-repair (write-then-validate is the load-then-invert engine's contract for a reason).",
+  "alternativesConsidered": [
+    {
+      "name": "Reject at ADR write time in createDocument / updateDocument",
+      "summary": "Add a pre-write check that refuses a write whose supersededBy or relatedAdrs entry does not resolve.",
+      "reasonNotChosen": "Breaks the load-then-invert repair pattern that lets `define update` fix a broken chain from the middle. A supersession that references a not-yet-created ADR (mid-refactor) would be blocked; validate is the right seam to enforce whole-tree integrity."
+    },
+    {
+      "name": "Add a separate `rcf define validate --adr-crosslinks` opt-in flag",
+      "summary": "Leave the default validate alone and expose an opt-in mode that checks the ADR cross-links.",
+      "reasonNotChosen": "The docs promise is universal, not opt-in. A flag-gated check is the same failure surface the referee page is being fixed to close."
+    }
+  ]
+}

package/rcf/adrs/adr-4110-referee-coverage-strict-by-default.json

@@ -0,0 +1,25 @@
+{
+  "createdAt": "2026-09-16T22:28:54Z",
+  "updatedAt": "2026-09-16T22:28:54Z",
+  "adrId": "ADR-4110-referee-coverage-strict-by-default",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Flip `rcf audit coverage` default to strict, keep `--strict` as a no-op alias, add `--mode shallow-any` as the explicit opt-out",
+  "context": "The referee-guarantees docs page (`how-it-works/what-the-referee-guarantees`) states without qualification that a requirement counts as covered only when every acceptance criterion beneath it has a resolving Test Case, and that a stub or stale pointer fails the coverage gate exactly as a missing test does when the displayed command (`rcf audit coverage`) is run. The 0.27.0 default is shallow-any: `rcf audit coverage` prints gaps and exits 0. Strict is opt-in via `--strict`. The docs promise is therefore false against the shipped default, which was the concession made when strict landed (avoid silently failing existing CI on a version bump). The compatibility window has run: the strict flag is baked into every shipped blueprint's CI-gate posture (delivery-ci-workflows ADR-702), into the repo's own CI, into the getting-started walkthrough, and into the referee-guarantees page itself.",
+  "decision": "Flip the shipped default to strict. `--mode shallow-any` becomes the explicit opt-out (prints gaps, exits 0) so author-time exploration on a not-yet-shippable chain still has a documented home. The legacy `--strict` flag stays as a no-op alias for the new default so every existing CI invocation, blueprint README, and dogfood script keeps working byte-forward. `--mode shallow-any --strict` (or `--strict --mode shallow-any`) is a usage refusal (exit 2) so a scripted invocation cannot silently disagree with itself. The migration lands in the CHANGELOG's [Unreleased] section for the release notes.",
+  "consequences": "The referee-guarantees page's coverage sentences hold by construction from this release. Downstream projects on 0.27.0 that ran the plain `rcf audit coverage` and treated its exit code as passing will see that command exit 4 on the same tree; the fix is either to close the coverage gap or to run `rcf audit coverage --mode shallow-any` when the intent is a printed gap report rather than a gate. Existing `rcf audit coverage --strict` invocations (the shipped blueprints' CI gates, the repo's own CI, downstream projects' pipelines) keep working. The CHANGELOG entry names the migration so a version bumper is not surprised.",
+  "alternativesConsidered": [
+    {
+      "name": "Rename the current default: `--mode` required, no default",
+      "summary": "Require callers to name their mode explicitly; refuse the bare command until a mode is passed.",
+      "reasonNotChosen": "Breaks every existing invocation, blueprint, and CI dogfood; the referee-guarantees page itself would need a mode-name for the command it displays. Strict-by-default with a shallow-any opt-out satisfies the docs promise with no rewrite of the shipped invocations."
+    },
+    {
+      "name": "Deprecate --strict; emit a warn line under the new default",
+      "summary": "Print a deprecation warning when --strict is passed so callers move to the new default explicitly.",
+      "reasonNotChosen": "Every shipped blueprint's CI-gate posture is `rcf audit coverage --strict`; a deprecation line at every CI run is noise that hides the report, not a helpful nudge. --strict is a no-op alias, not a warning surface."
+    }
+  ]
+}

package/rcf/adrs/adr-4111-referee-finalise-refusals.json

@@ -0,0 +1,20 @@
+{
+  "createdAt": "2026-09-16T22:38:04Z",
+  "updatedAt": "2026-09-16T22:38:04Z",
+  "adrId": "ADR-4111-referee-finalise-refusals",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "finalise refuses on UI-BASELINE-UNMET / BROWSER-VERIFICATION-MISSING / SCOPE-MISMATCH with no sister opt-out",
+  "context": "The referee-guarantees docs page names three per-AC verdicts that finalise refuses on top of the 0.7.0 MOCK-ONLY / BLOCKED-BY-DECLARATION and rcf-eval-node EVAL-MISSING / EVAL-BELOW-THRESHOLD refusals: UI-BASELINE-UNMET (docs claim C-28; a block-severity probe-pack failure aggregates into the same verdict, C-36), BROWSER-VERIFICATION-MISSING (C-29) and SCOPE-MISMATCH (C-30). The verdict layer already emits all three (see `uiPerAcVerdict` and `scopePerAcVerdict` in `src/verify/verdict/index.js`); the aggregator in `src/browser-verify/manifest-writer.js` produces UI-BASELINE-UNMET for a block-severity probe-pack failure. The gap is at finalise: the 0.27.0 CLI branched on MOCK-ONLY / EVAL but not on the three new verdicts, so a report that passed the top-level verdict with a UI-BASELINE-UNMET on a per-AC verdict silently promoted. The docs page also names two sister opt-outs (--ship-without-verified, --ship-without-eval) for the existing refusals; it does NOT spell an opt-out for the three new verdicts.",
+  "decision": "Refuse promotion (exit 4) on any of the three per-AC verdicts, in the order UI-BASELINE-UNMET, BROWSER-VERIFICATION-MISSING, SCOPE-MISMATCH, appended after the EVAL refusal branch in finalise.js. No --ship-without-* opt-out is added for these three: the docs page names none, and the underlying failures (broken UI baseline, missing browser check, scope-mismatched TC) are exactly the shape the referee is chartered to refuse. If a project needs to ship anyway, the fix is on the tree (widen the TC, land the browser-verify record, fix the baseline). Each refusal message names the referee-guarantees claim ids so a downstream reader can trace back to the docs promise.",
+  "consequences": "The referee-guarantees page's three sentences hold by construction. Verify reports on existing WSD projects that already emit these verdicts will now fail finalise where they previously silently promoted; that is the point. Adding a --ship-without-* opt-out later remains open (would follow the ship-without-verified shape with a schema addition for the new verdict enum), but is not landed here because the docs page has not named one and the failure classes are the kind that should be fixed on the tree, not acked away.",
+  "alternativesConsidered": [
+    {
+      "name": "Add a single --ship-without-referee flag for all three",
+      "summary": "Introduce a catch-all acknowledgement flag that acks any of the three new verdicts and records the ack on the manifest under a new shipWithoutRefereeChecks[] section.",
+      "reasonNotChosen": "Requires a rcf-schemas manifest bump (a new shipWithoutRefereeChecksRecord shape), the docs page has not spelled such an opt-out, and the failure classes (broken baseline, missing browser check, scope mismatch) are not the kind that operators legitimately ship over. Refusing without an opt-out matches the docs promise as written."
+    }
+  ]
+}

package/rcf/adrs/adr-4112-referee-finalise-verified-invariant.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-16T22:38:04Z",
+  "updatedAt": "2026-09-16T22:38:04Z",
+  "adrId": "ADR-4112-referee-finalise-verified-invariant",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "Gate the manual verified override behind --acknowledge-verified-override; add a default-branch precondition to finalise with --allow-pre-merge as the opt-out",
+  "context": "The referee-guarantees docs page promises that `rcf build finalise` is the only path to `verified` (docs claim C-22) and that a chain that says `verified` traces to an actual post-merge runtime check by construction (C-26). Two 0.27.0 gaps break those promises: (a) `rcf define update <fbs> --set executionStatus=verified` writes the value directly through the writer, bypassing finalise entirely, and (b) finalise itself has no merge-state precondition, so a mid-branch dev-loop run can stamp verified against a localhost URL. The docs sentence explicitly says both are on the 0.28.0 landing plan: 'The next release removes the manual override and adds the merge-state precondition, so once shipped, a chain that says verified traces to an actual post-merge runtime check by construction.' Two constraints shape the fix: (1) the manifest schema admits `verified` as a valid executionStatus so finalise itself can write it, and (2) the escalation clause on this dispatch: if the fix breaks existing WSD projects, land it behind a flag whose default matches the docs promise.",
+  "decision": "Two symmetric refusals, each with a documented escape flag. (a) The writer refuses FBS.executionStatus=verified when `options.allowVerifiedOverride` is not true; finalise's own updateDocument call passes the flag through, and `rcf define update` exposes `--acknowledge-verified-override` for the deliberate manual override (a logged operator decision). (b) Finalise spawns `git rev-parse --abbrev-ref HEAD` just before the executionStatus write and refuses (exit 4) when the branch is not one of {main, master}; `--allow-pre-merge` is the deliberate pre-merge dry-run opt-out, and the decision is logged on stdout so the operator sees it. Absent a git checkout (bare tarball deploy, container ephemeral CWD), the check degrades to a warn line rather than a hard fail so legitimate non-git deploys are not refused by a git-shape check.",
+  "consequences": "Both docs sentences hold by default from this release. Downstream projects that ran `rcf define update <fbs> --set executionStatus=verified` for a repair scenario keep the escape valve through the new flag; downstream projects that ran finalise on a feature branch for a dev-loop dry run keep the escape valve through --allow-pre-merge. The refusal messages and the log lines name the referee-guarantees claim ids so a downstream reader can trace the behaviour to the docs promise it enforces. The two default-branch names (main, master) are hard-coded rather than read from the git remote's symbolic ref; projects on a non-default trunk name either rename to a listed name or run --allow-pre-merge every time (unusual in modern repos).",
+  "alternativesConsidered": [
+    {
+      "name": "Remove the manual override entirely (no --acknowledge-verified-override flag)",
+      "summary": "Refuse FBS.executionStatus=verified through the writer with no escape flag; force every verified write through finalise.",
+      "reasonNotChosen": "Escalation clause: existing WSD projects may need a manual repair escape (e.g. a finalise gate that promoted then a partial rollback that needs the state re-stamped). A hard removal invalidates that repair path; the flag preserves it with a logged, deliberate operator decision."
+    },
+    {
+      "name": "Merge-state check reads the git remote's symbolic ref for the default branch",
+      "summary": "Instead of hard-coding {main, master}, run `git symbolic-ref refs/remotes/origin/HEAD` and use its value as the default trunk name.",
+      "reasonNotChosen": "Adds a network round-trip on every finalise, fails offline, and depends on the remote's ref being set (many test scaffolds do not set it). The small hard-coded list matches what git init and every hosted git provider default to today; projects on an unusual trunk name pass --allow-pre-merge every time or rename to a listed name."
+    },
+    {
+      "name": "Verify the merge with git merge-base HEAD origin/main",
+      "summary": "Instead of a branch-name check, verify the current commit is an ancestor of origin/main.",
+      "reasonNotChosen": "Requires the operator to `git fetch` before finalise (a silent staleness bug otherwise), depends on the remote name and is slower. The branch-name check is a proxy that catches the common failure (finalise on a feature branch) without a network hop."
+    }
+  ]
+}

package/rcf/code-nodes/cn-600.json

@@ -0,0 +1,45 @@
+{
+  "cnId": "CN-600",
+  "path": "src/cli/feedback.js",
+  "implementsAcIds": [
+    "AC-15501-1",
+    "AC-15501-2",
+    "AC-15501-3",
+    "AC-15501-4",
+    "AC-15501-5",
+    "AC-15502-1",
+    "AC-15502-2",
+    "AC-15503-1",
+    "AC-15503-2",
+    "AC-15601-1",
+    "AC-15601-2",
+    "AC-15601-3",
+    "AC-15601-4",
+    "AC-15701-2",
+    "AC-15701-3",
+    "AC-15901-1",
+    "AC-15901-2",
+    "AC-15902-1",
+    "AC-15902-3",
+    "AC-16001-1",
+    "AC-16001-2",
+    "AC-16001-3",
+    "AC-16001-4",
+    "AC-16101-2",
+    "AC-16101-3",
+    "AC-16102-1",
+    "AC-16102-2",
+    "AC-16103-1",
+    "AC-16103-2",
+    "AC-16103-3"
+  ],
+  "dependencies": [
+    "CN-620",
+    "CN-621",
+    "CN-623"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-16T14:58:28Z",
+  "updatedAt": "2026-09-17T03:30:00Z"
+}