rcf-lite 0.26.0 → 0.28.0

package/rcf/test-suites/ts-197.json

@@ -0,0 +1,66 @@
+{
+  "createdAt": "2026-09-16T19:20:00Z",
+  "updatedAt": "2026-09-17T03:30:00Z",
+  "purpose": "Cover AC-16103-1 (rcf feedback hook session-end writes a byte-idempotent outbox bundle for the pending set and completes in well under the shared Claude Code 1.5s SessionEnd budget), AC-16103-2 (rcf feedback hook session-start on Claude Code prints a single carry-over context line; on Codex emits the additionalContext JSON shape; state.json is not mutated on session-start; with no carried-over entries the hook is silent) and AC-16103-3 (defer means \"not now, ask again next session\": deferredUntilSession entries carried over from a prior sessionId return to pending on SessionStart and on Stop; idempotent per session).",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-16103-1",
+    "AC-16103-2",
+    "AC-16103-3"
+  ],
+  "id": "TS-197",
+  "usId": "US-16103",
+  "title": "Slice 5 (FBS-184): SessionEnd flushes a bundle idempotently, SessionStart re-surfaces a carried-over ask per harness, and defer requeues on the next session",
+  "testCases": [
+    {
+      "id": "TC-197-session-end-writes-idempotent-bundle",
+      "acId": "AC-16103-1",
+      "description": "Cover AC-16103-1 via the CLI test: rcf feedback hook session-end with one pending entry writes a single .rcf/feedback/outbox/<ISO>-session-end.md file with the design section 4.2 header; a re-run with the same pending set does not create a second file (byte-idempotent); the two-call round trip completes in well under the SessionEnd budget.",
+      "status": "pending",
+      "testPointer": "test/cli/feedback-hook.test.js::AC-16103-1: SessionEnd writes one bundle and is byte-idempotent on a re-run"
+    },
+    {
+      "id": "TC-197-session-start-claude-code-line",
+      "acId": "AC-16103-2",
+      "description": "Cover AC-16103-2 (Claude Code shape) via the CLI test: rcf feedback hook session-start --harness claude-code with a pending entry recorded under a different sessionId prints the exact carry-over line naming the count and citing RULE 17 to stdout; exit 0; state.json is not created (the ledger is set on Stop, not on session-start).",
+      "status": "pending",
+      "testPointer": "test/cli/feedback-hook.test.js::AC-16103-2: SessionStart on Claude Code prints the carry-over line for a new session"
+    },
+    {
+      "id": "TC-197-session-start-codex-additional-context",
+      "acId": "AC-16103-2",
+      "description": "Cover AC-16103-2 (Codex shape) via the CLI test: rcf feedback hook session-start --harness codex emits a stdout JSON with additionalContext carrying the same carry-over line.",
+      "status": "pending",
+      "testPointer": "test/cli/feedback-hook.test.js::AC-16103-2: SessionStart on Codex emits the additionalContext JSON shape"
+    },
+    {
+      "id": "TC-197-session-start-silent-when-nothing-carried-over",
+      "acId": "AC-16103-2",
+      "description": "Cover AC-16103-2 (silence branch) via the CLI test: rcf feedback hook session-start on a project with no pending entries writes nothing on stdout and exits 0.",
+      "status": "pending",
+      "testPointer": "test/cli/feedback-hook.test.js::AC-16103-2: SessionStart with no carried-over entries is silent"
+    },
+    {
+      "id": "TC-197-session-start-requeues-deferred-then-stop-asks",
+      "acId": "AC-16103-3",
+      "description": "Cover AC-16103-3 (SessionStart-path requeue) via the CLI test: add one entry and defer it in session A; run rcf feedback hook session-start --harness claude-code with session_id B; the entry is written back to pending (a { status: pending } state line appended, no sessionId field so the fold preserves A) and rcf feedback list shows it as pending; the stdout prints the carry-over line naming the count and RULE 17; a subsequent rcf feedback hook stop --harness claude-code with session_id B exits 2 with the ask on stderr and appends exactly one asked record for session B.",
+      "status": "pending",
+      "testPointer": "test/cli/feedback-hook.test.js::AC-16103-3: SessionStart requeues a deferred entry from a prior session and Stop asks in the new session"
+    },
+    {
+      "id": "TC-197-stop-only-path-requeues-deferred",
+      "acId": "AC-16103-3",
+      "description": "Cover AC-16103-3 (Stop-only fallback) via the CLI test: add one entry and defer it in session A; skip the SessionStart hook entirely and run rcf feedback hook stop --harness claude-code with session_id B directly; the Stop hook requeues the deferred entry back to pending, exits 2 with the ask on stderr and appends one asked record for session B (the carried-over trigger fires the quiet rule regardless of age).",
+      "status": "pending",
+      "testPointer": "test/cli/feedback-hook.test.js::AC-16103-3: Stop without a prior SessionStart still requeues a deferred entry and asks"
+    },
+    {
+      "id": "TC-197-session-start-idempotent-same-session",
+      "acId": "AC-16103-3",
+      "description": "Cover AC-16103-3 (idempotency per session) via the CLI test: add one entry and defer it in session A; run rcf feedback hook session-start --harness claude-code with session_id A (same as the defer's session); no requeue transition is written and stdout is empty. A second SessionStart in session B requeues once; a third SessionStart also in session B is a no-op (no new transition, silent stdout).",
+      "status": "pending",
+      "testPointer": "test/cli/feedback-hook.test.js::AC-16103-3: SessionStart is a no-op when the deferred session id matches the incoming session id"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-198.json

@@ -0,0 +1,87 @@
+{
+  "createdAt": "2026-09-16T19:20:00Z",
+  "updatedAt": "2026-09-16T19:20:00Z",
+  "purpose": "Cover AC-16104-1 (rcf init merges three feedback hook entries into .claude/settings.json and .codex/hooks.json with the design-3.5 shape, the matcher startup|resume on SessionStart, timeouts 10/5/5, is byte-idempotent on re-init, preserves neighbouring hooks and honours --bin-path with the node <path> pinned shape), AC-16104-2 (--no-feedback-hooks writes neither file and prints the RULE 17 fallback line once) and AC-16104-3 (rcf doctor --check feedback-hooks reports missing-hook per file per event when absent, --fix installs them, foreign-hook is refused with the entry left in place, a clean tree exits 0 with no writes, and a parse-error on the settings file is refused).",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-16104-1",
+    "AC-16104-2",
+    "AC-16104-3"
+  ],
+  "id": "TS-198",
+  "usId": "US-16104",
+  "title": "Slice 5 (FBS-184): rcf init installs the feedback hooks and rcf doctor feedback-hooks keeps them honest across clones",
+  "testCases": [
+    {
+      "id": "TC-198-init-writes-both-configs",
+      "acId": "AC-16104-1",
+      "description": "Cover AC-16104-1 via the CLI test: rcf init on a fresh project writes three feedback hook entries into .claude/settings.json (Stop 10s, SessionEnd 5s, SessionStart 5s with matcher startup|resume) and three matching entries into .codex/hooks.json (Codex JSON shape); every command line is 'npx rcf-lite feedback hook <event> --harness <h>'.",
+      "status": "pending",
+      "testPointer": "test/cli/init-feedback-hooks.test.js::AC-16104-1: rcf init writes three feedback hook entries into both harness files"
+    },
+    {
+      "id": "TC-198-init-idempotent",
+      "acId": "AC-16104-1",
+      "description": "Cover AC-16104-1 (idempotency) via the CLI test: a second rcf init against the same tree produces no byte change on either .claude/settings.json or .codex/hooks.json.",
+      "status": "pending",
+      "testPointer": "test/cli/init-feedback-hooks.test.js::AC-16104-1: re-init on the same tree is byte-idempotent"
+    },
+    {
+      "id": "TC-198-init-preserves-existing-hooks",
+      "acId": "AC-16104-1",
+      "description": "Cover AC-16104-1 (preserve) via the CLI test: a pre-existing .claude/settings.json with an unrelated Stop hook AND an unrelated top-level key survives rcf init; the feedback Stop entry is added alongside the unrelated one, not in place of it.",
+      "status": "pending",
+      "testPointer": "test/cli/init-feedback-hooks.test.js::AC-16104-1: pre-existing hooks are preserved; feedback entries added alongside"
+    },
+    {
+      "id": "TC-198-init-bin-path-pins-node",
+      "acId": "AC-16104-1",
+      "description": "Cover AC-16104-1 (--bin-path pinned shape) via the CLI test: rcf init --bin-path /opt/pinned-rcf/rcf.js writes hook commands as 'node /opt/pinned-rcf/rcf.js feedback hook <event> --harness <h>' instead of the npx rcf-lite shape.",
+      "status": "pending",
+      "testPointer": "test/cli/init-feedback-hooks.test.js::AC-16104-1: --bin-path pins the hook command to node <path>"
+    },
+    {
+      "id": "TC-198-init-no-feedback-hooks",
+      "acId": "AC-16104-2",
+      "description": "Cover AC-16104-2 via the CLI test: rcf init --no-feedback-hooks exits 0, writes neither .claude/settings.json nor .codex/hooks.json, and prints the no-feedback-hooks fallback line naming RULE 17.",
+      "status": "pending",
+      "testPointer": "test/cli/init-feedback-hooks.test.js::AC-16104-2: --no-feedback-hooks writes neither file and prints the fallback line"
+    },
+    {
+      "id": "TC-198-doctor-missing-hooks",
+      "acId": "AC-16104-3",
+      "description": "Cover AC-16104-3 (missing-hook detection) via the CLI test: rcf doctor --check feedback-hooks --json against a project scaffolded without hook install reports exactly three missing-hook rows for .claude/settings.json and three for .codex/hooks.json; exit 3.",
+      "status": "pending",
+      "testPointer": "test/cli/doctor-feedback-hooks.test.js::AC-16104-3: doctor reports missing-hook per file per event when both configs are absent"
+    },
+    {
+      "id": "TC-198-doctor-fix-installs-and-reruns-clean",
+      "acId": "AC-16104-3",
+      "description": "Cover AC-16104-3 (--fix repair) via the CLI test: rcf doctor --check feedback-hooks --fix writes the missing entries; a re-run reports clean and exits 0.",
+      "status": "pending",
+      "testPointer": "test/cli/doctor-feedback-hooks.test.js::AC-16104-3: doctor --fix installs the missing entries and re-runs clean"
+    },
+    {
+      "id": "TC-198-doctor-foreign-hook-refused",
+      "acId": "AC-16104-3",
+      "description": "Cover AC-16104-3 (foreign-hook refusal) via the CLI test: after a clean init, mutating the Stop hook's command to add an unknown flag makes doctor --check feedback-hooks --fix --json emit exactly one foreign-hook drift row on .claude/settings.json; the mutated command survives (--fix did not overwrite it) and doctor exits 3.",
+      "status": "pending",
+      "testPointer": "test/cli/doctor-feedback-hooks.test.js::AC-16104-3: doctor refuses a foreign-hook entry and leaves it in place"
+    },
+    {
+      "id": "TC-198-doctor-clean-tree-no-writes",
+      "acId": "AC-16104-3",
+      "description": "Cover AC-16104-3 (clean tree) via the CLI test: rcf doctor --check feedback-hooks --fix on a freshly initialised project makes no byte changes to either config file and exits 0.",
+      "status": "pending",
+      "testPointer": "test/cli/doctor-feedback-hooks.test.js::AC-16104-3: a clean tree makes no writes and stays exit 0"
+    },
+    {
+      "id": "TC-198-doctor-parse-error-refused",
+      "acId": "AC-16104-3",
+      "description": "Cover AC-16104-3 (parse-error refusal) via the CLI test: an unparseable .claude/settings.json makes doctor --check feedback-hooks --fix emit one parse-error drift row on that file, leave the file untouched, and exit 3.",
+      "status": "pending",
+      "testPointer": "test/cli/doctor-feedback-hooks.test.js::AC-16104-3: doctor rejects an unparseable settings file with parse-error and refuses --fix"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-199.json

@@ -0,0 +1,51 @@
+{
+  "createdAt": "2026-09-16T21:06:54Z",
+  "updatedAt": "2026-09-16T21:06:54Z",
+  "purpose": "Cover AC-16201-1 (RULE 17 lands in guidance/managed/agent-instructions-block.md with the wording in design 3.4, byte-exact against test/fixtures/managed/rule-17.md; block hash regenerated; naming and static-wording invariants) and AC-16201-2 (rcf init writes RULE 17 into CLAUDE.md and AGENTS.md between the managed markers; an existing project on the pre-slice block picks up RULE 17 on rcf doctor --fix without --force in non-interactive mode).",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-16201-1",
+    "AC-16201-2"
+  ],
+  "id": "TS-199",
+  "usId": "US-16201",
+  "title": "Slice 6 (FBS-185): RULE 17 landed in the managed block and reaches every project through init and doctor --fix",
+  "testCases": [
+    {
+      "id": "TC-199-rule-17-slice-byte-exact-against-fixture",
+      "acId": "AC-16201-1",
+      "description": "Cover AC-16201-1 via the guidance test: the RULE 17 slice extracted from guidance/managed/agent-instructions-block.md is byte-for-byte identical to the design 3.4 fixture at test/fixtures/managed/rule-17.md.",
+      "status": "pending",
+      "testPointer": "test/guidance/rule-17.test.js::AC-16201-1: the RULE 17 slice of the block is byte-for-byte the fixture"
+    },
+    {
+      "id": "TC-199-rule-17-names-verbs-and-redaction-posture",
+      "acId": "AC-16201-1",
+      "description": "Cover AC-16201-1 (naming clause) via the guidance test: RULE 17 names rcf feedback add, preview, submit --yes, defer, opt-out and carries the redaction posture sentence and the one-ask-per-session posture.",
+      "status": "pending",
+      "testPointer": "test/guidance/rule-17.test.js::AC-16201-1: RULE 17 names all four verbs and the redaction posture"
+    },
+    {
+      "id": "TC-199-rule-17-static-wording-no-em-dash-no-version-no-date",
+      "acId": "AC-16201-1",
+      "description": "Cover AC-16201-1 (static-wording clause) via the guidance test: the RULE 17 fixture carries no em-dash, no ISO date and no semver, so the block hash moves exactly once on the release that ships the rule.",
+      "status": "pending",
+      "testPointer": "test/guidance/rule-17.test.js::AC-16201-1: RULE 17 carries no em-dash and no version or date string"
+    },
+    {
+      "id": "TC-199-init-writes-rule-17-into-both-instructions-files",
+      "acId": "AC-16201-2",
+      "description": "Cover AC-16201-2 (fresh-init path) via the CLI test: rcf init on a fresh project writes CLAUDE.md and AGENTS.md with the managed block; RULE 17 sits between the managed markers on both files and its slice is byte-identical to the fixture.",
+      "status": "pending",
+      "testPointer": "test/cli/init-rule-17.test.js::AC-16201-2: rcf init writes RULE 17 into CLAUDE.md and AGENTS.md between the managed markers"
+    },
+    {
+      "id": "TC-199-existing-project-picks-up-rule-17-on-doctor-fix",
+      "acId": "AC-16201-2",
+      "description": "Cover AC-16201-2 (upgrade path) via the CLI test: a project initialised on the pre-slice block (block minus RULE 17) reports stale-hash on rcf doctor and picks up RULE 17 on rcf doctor --fix without --force in non-interactive mode, on both CLAUDE.md and AGENTS.md.",
+      "status": "pending",
+      "testPointer": "test/cli/init-rule-17.test.js::AC-16201-2: an existing project on the pre-slice block reports stale-hash and picks up RULE 17 on doctor --fix"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-200.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-09-16T22:20:45Z",
+  "updatedAt": "2026-09-16T22:20:45Z",
+  "purpose": "Cover AC-16301-1 (supersededBy broken pointer surfaces as brokenReference with field=supersededBy) and AC-16301-2 (relatedAdrs unknown entry stays SILENT; the compatibility carry keeps the ratified `rcf define blueprint supersede` workflow unbroken). The tests scaffold a fresh RCF project with initProject, mutate adr-001.json's cross-links, then walkTree and assert the presence / absence of brokenReference entries accordingly.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-16301-1",
+    "AC-16301-2"
+  ],
+  "id": "TS-200",
+  "usId": "US-16301",
+  "title": "referee-validate ADR cross-link walker: AC-16301-1 supersededBy broken, AC-16301-2 relatedAdrs unknown",
+  "testCases": [
+    {
+      "id": "TC-200-superseded-by-broken",
+      "acId": "AC-16301-1",
+      "description": "Fresh project via initProject; set adr-001.json supersededBy to ADR-999; walkTree; assert errors contain a brokenReference with documentId=ADR-001 and field=supersededBy.",
+      "status": "pending",
+      "testPointer": "test/store/walker.test.js::walkTree flags an ADR with a broken supersededBy pointer as brokenReference (REQ-163 AC-16301-1)"
+    },
+    {
+      "id": "TC-200-related-adrs-silent",
+      "acId": "AC-16301-2",
+      "description": "Fresh project via initProject; set adr-001.json relatedAdrs to [ADR-777]; walkTree; assert NO brokenReference targets the relatedAdrs field on ADR-001 (compatibility carry: the ratified `rcf define blueprint supersede` workflow leaves a transient unresolved relatedAdrs pointer between the supersede write and the closing re-add step).",
+      "status": "pending",
+      "testPointer": "test/store/walker.test.js::walkTree stays silent on an ADR with an unknown id in relatedAdrs (referee-guarantee C-7 compatibility carry: soft-reference half deferred)"
+    }
+  ],
+  "status": "approved"
+}

package/rcf/test-suites/ts-201.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-16T22:28:54Z",
+  "updatedAt": "2026-09-16T22:28:54Z",
+  "purpose": "Cover the strict-by-default default (AC-16401-1), the --mode shallow-any opt-out (AC-16401-2), and the conflict / unknown-mode usage refusals (AC-16401-3). Every test scaffolds a fresh RCF project and invokes the coverage bin as an out-of-process subprocess, matching the pattern the rest of `test/cli/coverage.test.js` uses.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-16401-1",
+    "AC-16401-2",
+    "AC-16401-3"
+  ],
+  "id": "TS-201",
+  "usId": "US-16401",
+  "title": "coverage --mode selector: strict-by-default, shallow-any opt-out, conflict refusal",
+  "testCases": [
+    {
+      "id": "TC-201-strict-by-default-exit-4",
+      "acId": "AC-16401-1",
+      "description": "Fresh project via initProject (AC-101-1 uncovered by construction); invoke `rcf audit coverage` with no flag; assert exit code 4.",
+      "status": "pending",
+      "testPointer": "test/cli/coverage.test.js::rcf coverage (strict-by-default) with a gap exits 4"
+    },
+    {
+      "id": "TC-201-shallow-any-opt-out",
+      "acId": "AC-16401-2",
+      "description": "Fresh project via initProject; invoke `rcf audit coverage --mode shallow-any`; assert exit code 0 and stdout matches /Coverage mode: shallow-any/.",
+      "status": "pending",
+      "testPointer": "test/cli/coverage.test.js::rcf coverage --mode shallow-any prints gaps and exits 0 (explicit opt-out)"
+    },
+    {
+      "id": "TC-201-conflicting-flags-exit-2",
+      "acId": "AC-16401-3",
+      "description": "Fresh project via initProject; invoke `rcf audit coverage --mode shallow-any --strict`; assert exit code 2 and stderr matches /--mode shallow-any conflicts with --strict/.",
+      "status": "pending",
+      "testPointer": "test/cli/coverage.test.js::rcf coverage --mode shallow-any --strict exits 2 (conflicting flags)"
+    }
+  ],
+  "status": "approved"
+}

package/rcf/test-suites/ts-202.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-16T22:38:04Z",
+  "updatedAt": "2026-09-16T22:38:04Z",
+  "purpose": "Cover AC-16501-1 (UI-BASELINE-UNMET refusal, C-28 + C-36), AC-16501-2 (BROWSER-VERIFICATION-MISSING refusal, C-29) and AC-16501-3 (SCOPE-MISMATCH refusal, C-30). Each test scaffolds a fresh RCF project with initProject, wires a stub verify subprocess that writes a passing report carrying the named per-AC verdict, invokes rcf build finalise, and asserts exit 4 with the expected stderr message.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-16501-1",
+    "AC-16501-2",
+    "AC-16501-3"
+  ],
+  "id": "TS-202",
+  "usId": "US-16501",
+  "title": "finalise per-AC refusals: UI-BASELINE-UNMET, BROWSER-VERIFICATION-MISSING, SCOPE-MISMATCH",
+  "testCases": [
+    {
+      "id": "TC-202-ui-baseline-unmet-refusal",
+      "acId": "AC-16501-1",
+      "description": "Fresh project via initProject with FBS-001 at complete; stub verify writes a passing report with perAcVerdicts = [{acId: AC-101-1, verdict: UI-BASELINE-UNMET}]; invoke rcf build finalise; assert exit 4, FBS at complete, stderr matches /UI-BASELINE-UNMET/ and /Referee-guarantees claims C-28 and C-36/.",
+      "status": "pending",
+      "testPointer": "test/cli/finalise-referee-refusals.test.js::finalise refuses to promote on a passing verify report that carries UI-BASELINE-UNMET (referee-guarantees C-28, C-36)"
+    },
+    {
+      "id": "TC-202-browser-verification-missing-refusal",
+      "acId": "AC-16501-2",
+      "description": "Same scaffold; perAcVerdicts = [{acId: AC-101-1, verdict: BROWSER-VERIFICATION-MISSING}]; assert exit 4, FBS at complete, stderr matches /BROWSER-VERIFICATION-MISSING/ and /Referee-guarantees claim C-29/.",
+      "status": "pending",
+      "testPointer": "test/cli/finalise-referee-refusals.test.js::finalise refuses to promote on a passing verify report that carries BROWSER-VERIFICATION-MISSING (referee-guarantees C-29)"
+    },
+    {
+      "id": "TC-202-scope-mismatch-refusal",
+      "acId": "AC-16501-3",
+      "description": "Same scaffold; perAcVerdicts = [{acId: AC-101-1, verdict: SCOPE-MISMATCH}]; assert exit 4, FBS at complete, stderr matches /SCOPE-MISMATCH/ and /Referee-guarantees claim C-30/.",
+      "status": "pending",
+      "testPointer": "test/cli/finalise-referee-refusals.test.js::finalise refuses to promote on a passing verify report that carries SCOPE-MISMATCH (referee-guarantees C-30)"
+    }
+  ],
+  "status": "approved"
+}

package/rcf/test-suites/ts-203.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-09-16T22:38:04Z",
+  "updatedAt": "2026-09-16T22:38:04Z",
+  "purpose": "Cover AC-16502-1 (writer refuses executionStatus=verified without allowVerifiedOverride, C-22), AC-16502-2 (writer accepts when allowVerifiedOverride:true, C-22 opt-out seam), and AC-16502-3 (finalise refuses on a non-default branch, --allow-pre-merge is the opt-out, C-26). AC-16502-1 and AC-16502-2 drive the writer directly through updateDocument; AC-16502-3 drives the finalise CLI end-to-end with a spawn seam that returns the branch name.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-16502-1",
+    "AC-16502-2",
+    "AC-16502-3"
+  ],
+  "id": "TS-203",
+  "usId": "US-16502",
+  "title": "finalise verified-invariant: writer refusal and merge-state precondition",
+  "testCases": [
+    {
+      "id": "TC-203-writer-refuses-manual-verified",
+      "acId": "AC-16502-1",
+      "description": "Fresh project via initProject with FBS-001 at complete; call updateDocument with sets=[{path:'executionStatus', value:'verified'}] and options={}; assert result is RcfError kind='usage' matching /verified is written only by the finalise gate/; FBS on disk still at complete.",
+      "status": "pending",
+      "testPointer": "test/cli/finalise-referee-refusals.test.js::define update FBS.executionStatus=verified is refused without --acknowledge-verified-override (referee-guarantees C-22)"
+    },
+    {
+      "id": "TC-203-writer-accepts-with-override",
+      "acId": "AC-16502-2",
+      "description": "Same scaffold; call updateDocument with options={allowVerifiedOverride:true}; assert result carries an id and FBS on disk reads status verified.",
+      "status": "pending",
+      "testPointer": "test/cli/finalise-referee-refusals.test.js::define update FBS.executionStatus=verified proceeds with allowVerifiedOverride:true (finalise seam, C-22 opt-out)"
+    },
+    {
+      "id": "TC-203-merge-state-refusal-and-opt-out",
+      "acId": "AC-16502-3",
+      "description": "Fresh scaffold with a stub verify subprocess and a spawn seam that returns 'feature/x' as the git branch. First invocation: rcf build finalise <fbs> --url ...; assert exit 4 and stderr matches /git working tree is on branch 'feature\\/x'/. Second invocation: add --allow-pre-merge; assert exit 0, FBS at verified, and stdout matches /Referee-guarantees claim C-26 records the pre-merge decision here/.",
+      "status": "pending",
+      "testPointer": "test/cli/finalise-referee-refusals.test.js::finalise refuses promotion when git is not on a default branch (referee-guarantees C-26)"
+    }
+  ],
+  "status": "approved"
+}

package/rcf/user-stories/us-15501.json

@@ -0,0 +1,60 @@
+{
+  "usId": "US-15501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-155",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Agent records a finding with one command",
+  "asA": "agent that has just seen a blueprint or rcf-lite misbehave",
+  "iWant": "to record the finding with a single rcf feedback add call whose flags cover kind, target, anchor, symptom class, severity, title, body and evidence pointers, and to be told nothing was sent",
+  "soThat": "a finding is captured at the moment I see it, without any user-facing interruption and without any network traffic",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15501-1",
+      "description": "rcf feedback add with the required flags (--kind, --target, --anchor, --class, --severity, --title, --body or --body-file, --evidence at least once, optional --harness and --ask-now) writes exactly one JSONL line to .rcf/feedback/entries.jsonl, stamps environment (harness, rcf-lite version, node version, platform) on the entry, prints \"recorded <id> (<n> pending). Nothing sent.\" on stdout, and exits 0. No network syscall is made (assertable by a stubbed submit path and by absence of gh calls).",
+      "given": "a fixture project whose .gitignore covers .rcf/feedback/",
+      "when": "the agent runs rcf feedback add with every required flag",
+      "then": "entries.jsonl has one line whose fields match the flags and the environment stamp; stdout carries the \"recorded\" line; exit code is 0; the network seam has not been touched",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-15501-2",
+      "description": "rcf feedback add refuses when the project .gitignore does not cover .rcf/feedback/ and no --force flag is passed. The error names the missing gitignore entry and points at rcf doctor --fix. Exit code is 2. No file is created under .rcf/feedback/.",
+      "given": "a fixture project whose .gitignore lacks the .rcf/feedback/ entry",
+      "when": "the agent runs rcf feedback add without --force",
+      "then": "the command exits 2, stderr names the missing gitignore entry and the rcf doctor --fix remedy, and .rcf/feedback/ is not created",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-15501-3",
+      "description": "Ruling R1 (Dave 2026-09-16): --kind blueprint exits 3 ONLY when the target is absent from rcf/manifest.json:blueprints[] (unknown target). A KNOWN blueprint whose registered library carries no resolvable feedback destination (no issuesRepo and no derivable github sourceRef) is exit 0 with the entry stamped destination: unresolved; slice 4 writes the bundle at submit time (design section 7 case 5 wins). In both cases the entry is recorded; stdout carries the recorded line. On the exit-3 branch stderr carries \"destination unresolved: <target>\"; on the exit-0 unresolved branch stderr carries a one-line note naming the library.",
+      "given": "a fixture project whose manifest carries no matching blueprint (exit 3), and a second project whose manifest holds a blueprint from a library with no issuesRepo (exit 0)",
+      "when": "the agent runs rcf feedback add --kind blueprint --target <ref> ... against each",
+      "then": "the unknown-target invocation writes the entry with destination.reason=unresolved, exit code 3, stderr names the target; the known-target-no-destination invocation writes the entry with destination.reason=unresolved, exit code 0, stderr names the library",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-15501-4",
+      "description": "Symptom class must be one of the closed enum (docs-mismatch, validate-fails, apply-fails, internal-contradiction, stale-citation, missing-scenario, verb-error, verb-hang, wrong-output, other). Any other value exits 2 with a usage error naming the enum. Severity must be one of blocker, major, minor. Title is capped at 120 chars, body at 8 KB (either --body or --body-file); over-cap inputs exit 2 with a size error.",
+      "given": "a fixture project whose gitignore is set up correctly",
+      "when": "the agent runs rcf feedback add with an invalid class or severity, an oversize title, or an oversize body",
+      "then": "each invalid invocation exits 2, stderr names the specific violation and the enum or size limit; no entry is written",
+      "testable": true,
+      "scope": "library"
+    },
+    {
+      "id": "AC-15501-5",
+      "description": "When --kind blueprint is passed and the target resolves to a known blueprint in rcf/manifest.json:blueprints[], the recorded entry additionally stamps blueprintVersion, libraryPrefix, libraryRef and resolvedSha (or tarballSha256 when the pin is a tarball) on target, sourced from the manifest record and the matching rcf/blueprint-libraries.json registry entry. Core entries (kind core) carry none of these fields. A shelf blueprint (no libraryPrefix on the manifest record) carries blueprintVersion and resolvedSha but leaves libraryPrefix and libraryRef unset.",
+      "given": "a fixture project with three applied blueprints: one shelf, one library (git pin) and one library (tarball pin), plus one core entry",
+      "when": "the agent runs rcf feedback add --kind blueprint for each blueprint target and --kind core for the core entry",
+      "then": "each blueprint entry carries the expected blueprint-specific stamps sourced from manifest + registry (shelf omits libraryPrefix and libraryRef; git-pin carries resolvedSha; tarball-pin carries tarballSha256); the core entry carries none of the four fields",
+      "testable": true,
+      "scope": "library"
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T14:14:36Z"
+}

package/rcf/user-stories/us-15502.json

@@ -0,0 +1,33 @@
+{
+  "usId": "US-15502",
+  "prdId": "PRD-001",
+  "reqId": "REQ-155",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Operator lists and inspects what has been recorded",
+  "asA": "operator who wants to see what the agent has logged this session",
+  "iWant": "to run rcf feedback list (and rcf feedback status) to see pending entries and their state without triggering any submission",
+  "soThat": "I can decide by hand what to do with the log, and doctor can report the same counts on demand",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15502-1",
+      "description": "rcf feedback list prints one line per pending entry (id, target, symptom class, severity, one-line title) sorted by recordedAt ascending; --all includes submitted, deferred, discarded, bundled entries with their status column; --json emits a stable machine-readable shape. Neither invocation touches the network or writes to entries.jsonl.",
+      "given": "a fixture project with three entries of mixed status",
+      "when": "the operator runs rcf feedback list and then rcf feedback list --all --json",
+      "then": "default output shows only pending entries in order; --all includes every state; --json parses to an array whose length equals total entries; no file mutation, no network calls",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-15502-2",
+      "description": "rcf feedback status prints counts by status, the opt-out state (from rcf/feedback-settings.json or RCF_FEEDBACK_ASK env), a destination table for every applied blueprint (rows: target, resolved repo or unresolved with reason, visibility hint), and gh availability (present, authed, absent, unknown). --json emits the same as machine-readable object. The status shape is the one the SessionStart hook and doctor both consume.",
+      "given": "a fixture project with several blueprints applied and gh present",
+      "when": "the operator runs rcf feedback status --json",
+      "then": "the JSON carries counts, optOut boolean, destinations[] with target/repo/visibility, and gh { present, authed } fields; the text form prints the same as a readable summary",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/user-stories/us-15503.json

@@ -0,0 +1,33 @@
+{
+  "usId": "US-15503",
+  "prdId": "PRD-001",
+  "reqId": "REQ-155",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Operator defers or discards recorded findings",
+  "asA": "operator who has decided not to submit some findings",
+  "iWant": "to mark the pending batch deferred for this session, or discard specific entries entirely, without any network activity",
+  "soThat": "a \"not now\" or \"never for this one\" answer is honoured immediately and the state is durable across the next boot",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15503-1",
+      "description": "rcf feedback defer appends a state line for every currently pending entry stamping status: deferredUntilSession with the current sessionId; the entries stay in the log so the next session sees them; the current session-end hook does not re-ask. Exit 0. Nothing is sent.",
+      "given": "a fixture project with two pending entries and a known sessionId",
+      "when": "the operator runs rcf feedback defer",
+      "then": "entries.jsonl grows by two lines each carrying the deferred status and sessionId; a folded read shows both entries at status deferredUntilSession; no network call was made",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-15503-2",
+      "description": "rcf feedback discard <id> marks only the named entries discarded (kept in the log for 30 days, then pruned on the next add). --all discards every pending entry. Discarded entries are excluded from list default output, hidden from the SessionStart carry-over count, and never appear in a submit or bundle. Exit 0.",
+      "given": "a fixture project with three pending entries",
+      "when": "the operator runs rcf feedback discard fb-<a> fb-<b> then rcf feedback list",
+      "then": "the two named entries are folded to status discarded; list shows only the remaining entry; the next add older than 30 days prunes them",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}

package/rcf/user-stories/us-15601.json

@@ -0,0 +1,51 @@
+{
+  "usId": "US-15601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-156",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Operator sees the exact issue text and what was stripped before consenting",
+  "asA": "operator being asked to submit findings",
+  "iWant": "rcf feedback preview to print the exact rendered issue title and body, the destination repo and its visibility, and a redaction ledger that lists every rule-triggered replacement so I can see what was stripped",
+  "soThat": "my yes is informed and nothing surprising leaves the machine",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15601-1",
+      "description": "rcf feedback preview renders each pending entry as the title and body that would be filed on GitHub (using src/feedback/render.js templates from section 4.3 of the design), lists the destination repo and its declared visibility (public, private, or unresolved), and prints the redaction ledger as diff-style lines (\"- before  + after\") with the rule name. --json emits the same as a machine-readable object per entry. No network calls. The kv-secret rule (design section 5 rule 5) is driven by the shared SECRET_KEY_VOCABULARY constant exported from src/feedback/redact.js (design amendment R3a) so the first-pass redactor, the residual safeguard pass and the rule-9 URL-credential scanner cover exactly the same open vocabulary of key stems (secret, token, password, passwd, passphrase, pw, pwd, pass, key, apikey/api_key/api-key, privatekey/private_key/private-key, accesskey/access_key/access-key, clientsecret/client_secret/client-secret, bearer, credential/credentials/cred/creds, session, cookie, signature, sig, salt; hash carries a 16+-value length guard); the match is right-bounded at a word edge so `keyword` and `authors` do not fold but `dbpassword` still does. Design amendment R4 (round 5) extends the rule-5 pass so a vocabulary key labelling a value-shape token of 8+ chars with any separator (markdown table pipes, whitespace runs, tabs, hyphens, arrows, HTML numeric entities, or the prose bridges is / was / set to) also folds, with a mixed-classes gate on the value that keeps ordinary prose (`the password is required`, `the password field is required`) intact.",
+      "given": "a fixture project with one entry whose body contains an absolute path, an email, a non-allowlisted hostname, a token-shaped string, a private IPv4 (10.0.5.7), an em-dash, an oversize body block, an operator name that matches a seeded rcf/.identity/profile.md ## Name line, AND at least one shortname-key secret (`pw=`), one URL-embedded credential (a Slack webhook path), one markdown-table row with a vocabulary key and a mixed-class value (`| password | Sup3rSecretV@lue!! |`) and one prose bridge (`the password Sup3rSecretV@lue1234 is bad`)",
+      "when": "the operator runs rcf feedback preview --json",
+      "then": "the JSON output carries titleRendered, bodyRendered, destination { repo, visibility }, and ledger[] entries whose rule names include project-root, absolute-path, email, hostname, secret-token, private-ip, operator-identity, size-shape and url-credential; the rendered body contains none of the original secret substrings (including the shortname-key value, the webhook path segment, the markdown-table value and the prose-bridge value), none of the private IP, none of the operator-name tokens, no em-dash, and is at most 8 KB",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-15601-2",
+      "description": "When a body still matches a rule-5 secret pattern on the second redaction pass, preview marks the entry as \"residual secret at line N\" and submit refuses that entry. Other pending entries are unaffected. The exact refusing line is shown to the operator so the agent can rewrite the body.",
+      "given": "a fixture project with two entries, one containing a token that survives the first pass through obfuscation and one clean",
+      "when": "the operator runs rcf feedback preview then rcf feedback submit --yes",
+      "then": "the tainted entry is shown with the residual-secret line; submit does not send the tainted entry; the clean entry is submitted (or fallbacks to bundle if that path applies); exit code is 3 while any residual-secret entry is still pending",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-15601-3",
+      "description": "The stored entries.jsonl body is never mutated by preview. A byte-for-byte comparison of entries.jsonl before and after preview is identical; the redaction lives only in the rendered output.",
+      "given": "a fixture project with entries whose bodies contain redactable content",
+      "when": "the operator runs rcf feedback preview repeatedly",
+      "then": "a sha-256 of entries.jsonl before and after each preview run matches",
+      "testable": true,
+      "scope": "library"
+    },
+    {
+      "id": "AC-15601-4",
+      "description": "After rendering and normalising the fully assembled issue body (and, for the bundle path, each bundle file), a final whole-text residual-secret pass runs findResidualSecrets over the whole text with multiline patterns. Any hit means the entry stays pending (preview marks it refused-residual and submit refuses that entry with exit 3) and no create/comment/bundle-write occurs for it. The safeguard is defence-in-depth: it catches multiline shapes (e.g. an em-dash-delimited PEM block that survives per-field redaction of a slice-2-style body) that a per-line scan could not see. The safeguard shares the SECRET_KEY_VOCABULARY constant with the first-pass redactor and the rule-9 URL-credential scanner (design amendment R3a), so a shortname-key value (`pw=...`, `pwd=...`) or a webhook-path shape (`/services/<token>`, `/api/webhooks/<token>`, `/bot<token>/method`) that reappears after per-field normalisation is caught by the same set the first pass used.",
+      "given": "a fixture project with an entry whose body assembles into a rendered issue body containing a shape a per-line residual scan would miss (a multiline PEM block or a token buried inside a longer identifier)",
+      "when": "the operator runs rcf feedback preview then rcf feedback submit --yes",
+      "then": "preview surfaces the residual line and the tainted entry stays pending; submit exits 3 without a create/comment for that entry and without writing a bundle whose text carries the residual shape",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-17T00:36:18Z"
+}

package/rcf/user-stories/us-15701.json

@@ -0,0 +1,42 @@
+{
+  "usId": "US-15701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-157",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The same finding from many reporters folds into one issue",
+  "asA": "blueprint maintainer receiving reports",
+  "iWant": "ten reporters hitting the same defect on the same anchor to land as one issue with nine +1 comments carrying their environments, not ten separate issues",
+  "soThat": "triage is cheap and duplicate storms do not swamp the tracker",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15701-1",
+      "description": "fingerprint(entry) returns the first 12 hex chars of sha-256 over \"<kind>|<targetKey>|<anchor>|<symptomClass>\" where targetKey is the effective slug for blueprints (no version) or the verb path for core, anchor is upper-cased or \"-\" when absent, and symptomClass is one of the closed enum. Same fingerprint across two entries whose blueprint versions differ; different fingerprint when the anchor or class differs.",
+      "given": "a fixture corpus of five entries: same-defect different-version, same-defect different-anchor, same-defect different-class, missing-anchor pair (title-only fallback), and one clean",
+      "when": "fingerprint() is called on each entry",
+      "then": "the versioned pair yields identical fingerprints; the anchor and class variants yield different fingerprints; the missing-anchor pair uses the \"<kind>|<targetKey>|<symptomClass>|<normalisedTitle>\" fallback (first eight tokens, punctuation and stop-words stripped, lower-case)",
+      "testable": true,
+      "scope": "library"
+    },
+    {
+      "id": "AC-15701-2",
+      "description": "On submit, per pending entry, gh search issues is called for the destination repo with query \"rcf-feedback-fingerprint: <fp>\", --match body, --state open, --limit 5. Exactly one hit: gh issue comment on that number, comment body carries \"+1 from another reporter\" plus the Environment table and the redacted body only when it differs from the original by more than the environment lines. Zero hits: gh issue create. More than one hit: comment on the lowest number and mention the others.",
+      "given": "a fake gh module (via RCF_FEEDBACK_GH_MODULE) whose search stub yields zero, one and two hits in three sequential invocations, and one pending entry per case",
+      "when": "rcf feedback submit --yes runs three times",
+      "then": "the zero-hit case calls gh issue create; the one-hit case calls gh issue comment on the returned number; the two-hit case calls gh issue comment on the smaller number and includes \"also see #<other>\" in the comment body",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-15701-3",
+      "description": "When gh search issues is unavailable or errors (rate-limit, GHES search off, non-zero exit), submit falls through to gh issue create for that entry and the state line stamps dedupe: unchecked. Closed issues are never matched; if --state closed search finds an issue with the same fingerprint the created new issue body carries \"previously reported and closed as #<n>\".",
+      "given": "a fake gh module whose search stub throws for one call and returns a closed match for the next",
+      "when": "rcf feedback submit --yes runs twice with one pending entry each",
+      "then": "the first entry is created with dedupe: unchecked in state; the second is created with a body reference to the previously closed issue number",
+      "testable": true,
+      "scope": "library"
+    }
+  ],
+  "createdAt": "2026-09-16T13:45:23.000Z",
+  "updatedAt": "2026-09-16T13:45:23.000Z"
+}