rcf-lite 0.26.0 → 0.28.0

package/blueprints/delivery-ci-workflows/contributions/probes/probe-utils.mjs

@@ -0,0 +1,56 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/delivery-ci-workflows');
+export const DECLARED_ENV = new Set(['RCF_FIXTURE_CIW_ACTIONLINT_PATH', 'CI_HAS_GITHUB_ACTIONS', 'RCF_FIXTURE_CIW_REPO']);
+
+// Standard aggregate: any fail -> fail; any warn -> warn; else pass.
+// Rows that cannot be observed here are declared as `conformanceOnly`
+// (naming the shipped AC id whose property the row does not observe)
+// or `accountBoundSkipped` (naming exactly one declared unset env
+// variable). Neither shape emits a warn.
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  // the strict-evidence contract tightening: an all-skipped row set aggregates as
+  // whatever aggregate() returns (skip is neither fail nor warn, so
+  // aggregate() returns 'pass' for the pure-skip case on its own).
+  // The previous isSkipped ? 'pass' : raw override could promote an
+  // all-skipped WARN row set to PASS; it is removed. WARN rows always
+  // survive; all-skipped rows still pass via aggregate() directly.
+  const aggregateVerdict = aggregate(normalised);
+  const report = { slug: 'delivery-ci-workflows', probeName, runAt: new Date().toISOString(), engine, results: normalised, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: `probe threw: ${err?.message ?? err}`, evidence: { thrown: true, message: err?.message ?? String(err), name: err?.name ?? 'Error', probeName, runAt: new Date().toISOString(), engine } }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err?.stack ?? err}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/delivery-ci-workflows/contributions/probes/real-account-github-actions-run-record.mjs

@@ -0,0 +1,139 @@
+// Real-account GitHub Actions run-record probe for delivery-ci-workflows.
+//
+// Live branch: read-only. Uses ambient `gh` auth (checked via
+// `gh auth status`). Queries the last N run records from the target
+// repo and records what was observed.
+//
+// AC-6101-1 requires the CI provider's jobs for the commit-triggered
+// workflows to trigger on the branch-model events AND the aggregate
+// pipeline report's `trigger` field to record the specific triggering
+// event. A `gh run list` record carries event, workflowName and
+// conclusion but is not evidence of the CONFIGURED trigger set
+// (branch-model coverage) and the aggregate report `trigger` field is
+// a runtime pipeline-report property this probe does not read. Row
+// de-claimed (conformanceOnly) with the limitation naming AC-6101-1.
+//
+// Skip contract:
+// - CI_HAS_GITHUB_ACTIONS unset: accountBoundSkipped naming the var.
+// - RCF_FIXTURE_CIW_REPO unset while the gate is on: accountBoundSkipped
+//   naming that var.
+// - gh auth status failure when the gate IS set: FAIL with the error
+//   excerpt, not a passing skip.
+//
+// Vendor citation: GitHub Actions REST API,
+// https://docs.github.com/en/rest/actions/workflow-runs
+// (verified 2026-09-11).
+import { spawn } from 'node:child_process';
+
+export const anchorAcId = 'AC-6101-1';
+export const accountBound = true;
+
+// Commit-triggered workflows only per user story 6101.
+const BLUEPRINT_COMMIT_WORKFLOW_NAMES = new Set([
+  'default-branch-checks',
+  'pull-request-checks',
+]);
+
+const LIMITATION = "AC-6101-1: requires observation of the CONFIGURED trigger set (branch-model push and pull-request events) on the workflow AND the aggregate pipeline report's `trigger` field. A gh run list record carries event, workflowName and conclusion but is not evidence of configured branch-model triggers, and the aggregate report is a runtime pipeline-report property this probe does not read.";
+
+function commonExtra(base = {}) {
+  return {
+    envDeclared: ['CI_HAS_GITHUB_ACTIONS', 'RCF_FIXTURE_CIW_REPO'],
+    vendorFact: { url: 'https://docs.github.com/en/rest/actions/workflow-runs', verifiedOn: '2026-09-11' },
+    commitTriggeredWorkflowNames: [...BLUEPRINT_COMMIT_WORKFLOW_NAMES],
+    ...base,
+  };
+}
+function runCmd(cmd, args, timeoutMs = 30000) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    const out = []; const err = [];
+    const timer = setTimeout(() => { try { child.kill('SIGKILL'); } catch {} resolve({ ran: false, reason: 'timeout' }); }, timeoutMs);
+    child.stdout.on('data', (b) => out.push(b.toString('utf8')));
+    child.stderr.on('data', (b) => err.push(b.toString('utf8')));
+    child.on('error', (e) => { clearTimeout(timer); resolve({ ran: false, reason: `spawn: ${e.code || e.message}` }); });
+    child.on('exit', (code) => { clearTimeout(timer); resolve({ ran: true, exitCode: code, stdout: out.join(''), stderr: err.join('') }); });
+  });
+}
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_GITHUB_ACTIONS !== 'true') {
+    return {
+      results: [{
+        anchorAcId: null,
+        accountBoundSkipped: true,
+        reason: 'CI_HAS_GITHUB_ACTIONS',
+        verdict: 'pass',
+        detail: `accountBoundSkipped: CI_HAS_GITHUB_ACTIONS not set to true; the probe did not query gh.`,
+        evidence: { reason: 'CI_HAS_GITHUB_ACTIONS', declared: 'gate variable' },
+      }],
+      extra: commonExtra({ accountBoundSkipped: true, reason: 'CI_HAS_GITHUB_ACTIONS' }),
+    };
+  }
+  const preflight = await runCmd('gh', ['auth', 'status']);
+  if (!preflight.ran || preflight.exitCode !== 0) {
+    return {
+      results: [{
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMITATION,
+        verdict: 'fail',
+        detail: `observed gh auth status FAILED with CI_HAS_GITHUB_ACTIONS=true: exit=${preflight.exitCode ?? 'n/a'} reason=${preflight.reason ?? ''} stderr='${preflight.stderr?.trim().slice(0, 200) ?? ''}'.`,
+        evidence: { ghAuthExitCode: preflight.exitCode, ghAuthStderr: preflight.stderr, spawnReason: preflight.reason },
+      }],
+      extra: commonExtra({}),
+    };
+  }
+  const repo = process.env.RCF_FIXTURE_CIW_REPO;
+  if (!repo) {
+    return {
+      results: [{
+        anchorAcId: null,
+        accountBoundSkipped: true,
+        reason: 'RCF_FIXTURE_CIW_REPO',
+        verdict: 'pass',
+        detail: `accountBoundSkipped: RCF_FIXTURE_CIW_REPO unset. Set to a repo whose workflows the probe may query read-only; no default repository is embedded.`,
+        evidence: { reason: 'RCF_FIXTURE_CIW_REPO', declared: 'target repository slug' },
+      }],
+      extra: commonExtra({ accountBoundSkipped: true, reason: 'RCF_FIXTURE_CIW_REPO' }),
+    };
+  }
+
+  const list = await runCmd('gh', ['run', 'list', '-R', repo, '--limit', '30', '--json', 'databaseId,conclusion,event,name,workflowName,url,createdAt,headBranch']);
+  const results = [];
+  if (!list.ran || list.exitCode !== 0) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
+      verdict: 'fail',
+      detail: `observed gh run list -R ${repo} FAILED exit=${list.exitCode ?? 'n/a'} stderr='${list.stderr?.trim().slice(0, 200) ?? list.reason}'.`,
+      evidence: { exitCode: list.exitCode, stderr: list.stderr, spawnReason: list.reason },
+    });
+    return { results, extra: commonExtra({}) };
+  }
+  const runs = JSON.parse(list.stdout || '[]');
+  const anchored = runs.filter((r) => BLUEPRINT_COMMIT_WORKFLOW_NAMES.has(r.workflowName) || BLUEPRINT_COMMIT_WORKFLOW_NAMES.has(r.name));
+  const most = anchored[0];
+  if (!most) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
+      verdict: 'pass',
+      detail: `observed no recent run of the blueprint's commit-triggered workflow templates (${[...BLUEPRINT_COMMIT_WORKFLOW_NAMES].join(', ')}) in the last ${runs.length} runs of the queried repo. The probe never cites an unrelated repository run as evidence.`,
+      evidence: { runsScanned: runs.length, commitTriggeredWorkflowNames: [...BLUEPRINT_COMMIT_WORKFLOW_NAMES], mostRecentByWorkflow: runs.slice(0, 5).map((r) => ({ workflowName: r.workflowName, conclusion: r.conclusion })), workflowName: 'none', conclusion: 'none', bodyExcerpt: `no anchored workflow run in ${runs.length} scanned` },
+    });
+  } else {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
+      verdict: most.databaseId && most.conclusion === 'success' ? 'pass' : 'fail',
+      detail: `observed the most recent run of a blueprint-anchored commit-triggered workflow: runId=${most.databaseId} workflowName='${most.workflowName}' conclusion=${most.conclusion} event=${most.event} branch=${most.headBranch}.`,
+      evidence: { runId: most.databaseId, workflowName: most.workflowName, conclusion: most.conclusion, event: most.event, headBranch: most.headBranch, url: most.url, createdAt: most.createdAt, bodyExcerpt: `runId=${most.databaseId} conclusion=${most.conclusion}` },
+    });
+  }
+
+  return { results, extra: commonExtra({ latestRunId: anchored[0]?.databaseId, latestRunConclusion: anchored[0]?.conclusion, latestRunWorkflow: anchored[0]?.workflowName }) };
+}

package/blueprints/delivery-ci-workflows/contributions/probes/run-node-gate-entrypoint.mjs

@@ -0,0 +1,3 @@
+import runProbe from './node-gate-entrypoint.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('node-gate-entrypoint', { kind: 'lint', driver: 'fixture template scan', healthy: true }, runProbe);

package/blueprints/delivery-ci-workflows/contributions/probes/run-real-account-github-actions-run-record.mjs

@@ -0,0 +1,3 @@
+import runProbe from './real-account-github-actions-run-record.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('real-account-github-actions-run-record', { kind: 'gh', driver: 'gh CLI read-only (workflow runs)', healthy: true }, runProbe);

package/blueprints/delivery-ci-workflows/contributions/probes/run-workflow-template-shape.mjs

@@ -0,0 +1,3 @@
+import runProbe from './workflow-template-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('workflow-template-shape', { kind: 'lint', driver: 'fixture YAML shape scan + actionlint when available', healthy: true }, runProbe);

package/blueprints/delivery-ci-workflows/contributions/probes/workflow-template-shape.mjs

@@ -0,0 +1,94 @@
+// Workflow-template-shape probe for delivery-ci-workflows.
+//
+// The blueprint ships illustrative GitHub Actions workflow files under
+// its assets directory. This probe loads them, scans the top-level
+// name/on/jobs keys and checks for a checkout step. It does NOT observe
+// the full trigger set, package-manager setup, entry-point invocation,
+// or artefact-upload clauses of REQ-009, so every row is de-claimed
+// (conformanceOnly, anchorAcId=null) with a limitation naming the
+// nearest shipped AC id whose property the row does not fully observe.
+//
+// Rows:
+//   - template shape: de-claimed from AC-6101-1 (the AC governing
+//     commit-triggered workflows the materialiser produces; template
+//     shape is one narrow slice of that AC).
+//   - actionlint: de-claimed from AC-6101-3 (the materialiser refusal
+//     contract on missing required triggers; actionlint checks yaml
+//     syntax, not materialiser refusal). Honest skip when the binary
+//     is unavailable, naming RCF_FIXTURE_CIW_ACTIONLINT_PATH.
+//   - branch protection: de-claimed from AC-6101-2 (the merge-policy
+//     block on a non-successful required check; a repository property
+//     no shelf probe can observe without a probe-controlled repository).
+import { loadTemplates, scanTopLevel, findCheckoutStep, actionlintOn } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows/src/workflow-lint.mjs';
+
+export const anchorAcId = 'AC-6101-1';
+export const accountBound = false;
+
+const LIM_TEMPLATE_SHAPE = `AC-6101-1: requires the materialiser to produce commit-triggered workflows wired to the elicited branch model trigger events (pushes and PR events for feature-branch, pushes and optional PRs for trunk). This row observes only name/on/jobs and a checkout step in each shipped illustrative template; it does not observe the trigger set, package-manager setup, entry-point invocation, or artefact-upload clauses.`;
+const LIM_ACTIONLINT = `AC-6101-3: requires the materialiser to refuse a template whose trigger set omits a required event, exit non-zero, emit WORKFLOW_TRIGGER_INCOMPLETE, and leave the workflow directory unchanged. Actionlint observes yaml syntax, not materialiser refusal, error code, or filesystem effect.`;
+const LIM_BRANCH_PROTECTION = `AC-6101-2: requires the platform merge policy to refuse a change whose most recent aggregate pipeline run recorded a failed verdict, with the refusal reason referencing the failed required check. This property requires a probe-controlled repository with branch protection wired and an attempted protected merge; a shelf probe cannot create branch protection or issue a protected merge.`;
+
+export default async function runProbe() {
+  const templates = await loadTemplates();
+  const results = [];
+  if (templates.length === 0) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_TEMPLATE_SHAPE,
+      verdict: 'fail',
+      detail: `observed no workflow templates found under the shipped github-actions assets directory; a v2 blueprint must ship at least one illustrative workflow file.`,
+      evidence: { templateCount: 0, entries: [], bodyExcerpt: 'no templates found' },
+    });
+    return { results, extra: { envDeclared: ['RCF_FIXTURE_CIW_ACTIONLINT_PATH'], templateCount: 0 } };
+  }
+
+  const perFile = [];
+  let allShapeOk = true;
+  for (const t of templates) {
+    const scan = scanTopLevel(t.text);
+    const checkout = findCheckoutStep(t.text);
+    perFile.push({ file: t.name, path: t.path, scan, checkout });
+    if (!scan.name || !scan.on || !scan.jobs || !checkout) allShapeOk = false;
+  }
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_TEMPLATE_SHAPE,
+    verdict: allShapeOk ? 'pass' : 'fail',
+    detail: `observed ${templates.length} github-actions templates scanned; every one has name/on/jobs + a checkout step (illustrative-file shape only).`,
+    evidence: { perFile, bodyExcerpt: `templates=${templates.length} allShapeOk=${allShapeOk}` },
+  });
+
+  const actionlint = await actionlintOn(templates.map((t) => t.path));
+  if (actionlint.ran) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_ACTIONLINT,
+      verdict: actionlint.exitCode === 0 ? 'pass' : 'fail',
+      detail: `observed actionlint (binary=${actionlint.binaryUsed}, override=${actionlint.overrideProvided}) exit=${actionlint.exitCode}; stdout='${actionlint.stdout.trim().slice(0, 500)}' stderr='${actionlint.stderr.trim().slice(0, 500)}'.`,
+      evidence: { binaryUsed: actionlint.binaryUsed, overrideProvided: actionlint.overrideProvided, exitCode: actionlint.exitCode, stdoutExcerpt: actionlint.stdout.slice(0, 800), stderrExcerpt: actionlint.stderr.slice(0, 800), perFile },
+    });
+  } else {
+    results.push({
+      anchorAcId: null,
+      accountBoundSkipped: true,
+      reason: 'RCF_FIXTURE_CIW_ACTIONLINT_PATH',
+      verdict: 'pass',
+      detail: `accountBoundSkipped: actionlint not runnable (${actionlint.reason}). Set RCF_FIXTURE_CIW_ACTIONLINT_PATH to an actionlint binary to run this observation.`,
+      evidence: { reason: actionlint.reason, binaryTried: actionlint.binaryUsed, overrideProvided: actionlint.overrideProvided },
+    });
+  }
+
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_BRANCH_PROTECTION,
+    verdict: 'pass',
+    detail: `AC-6101-2 branch-protection merge-policy refusal is not observable from a shelf probe without a probe-controlled repository; row de-claimed with the limitation naming AC-6101-2.`,
+    evidence: { suggestedFollowUp: 'move AC-6101-2 verification to a repository-scoped harness', bodyExcerpt: 'not observable at shelf' },
+  });
+
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_CIW_ACTIONLINT_PATH'], templateCount: templates.length, actionlintRan: actionlint.ran, actionlintBinaryUsed: actionlint.binaryUsed, actionlintOverrideProvided: actionlint.overrideProvided } };
+}

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-001.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The materialised commit-triggered workflows run the required check set on every trigger event the branch model defines",
   "description": "The commit-triggered workflows the materialiser produces (per REQ-014 for feature-branch and REQ-015 for trunk-based) run the required check set on every trigger event the elicited branch model defines: for feature-branch, pushes to the default branch and pull requests targeting the default branch; for trunk-based, pushes to the trunk branch (and, in the sub-shape where `trunkPullRequests: sometimes`, pull requests targeting the trunk branch). The workflows' aggregate exit status is the merge criterion: the branch protection or equivalent policy refuses to admit a change whose most recent aggregate run did not exit zero, per the merge-policy AC binding for the branch model in play (AC-6114-3, AC-6115-1, AC-6115-2). No manual override path bypasses the required check set; a hotfix that skips it requires a documented ADR trail.",
+  "deliveredBy": {
+    "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+    "field": "interfaces.materialise"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The gate suite is invoked as one Node entry point that is CI-provider-neutral",
   "description": "The project realises a single Node entry point script that runs every RCF gate in order. The entry point is a plain Node process invoked by whatever runner the project's CI provider ships (GitHub Actions job step, GitLab job script, CircleCI step, Buildkite command, Jenkins stage). The CI-provider job definition contains one invocation line and the standard Node and package-manager setup steps; every gate-specific piece of logic lives in the Node entry point.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "technical",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The suite runs the schema-and-reference validation gate and refuses on non-zero exit",
   "description": "The Node entry point invokes `rcf define validate` as a required gate. The gate runs with the project's tree at the pull request's head commit. A non-zero exit code from `rcf define validate` terminates the suite and marks the aggregate result as failed. The failing invocation's stdout and stderr are captured to the gate report file so the reviewer can read the specific schema or reference issue without re-running the gate.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-004.json

@@ -3,10 +3,14 @@
   "prdId": "PRD-001",
   "title": "The suite runs the per-AC strict coverage gate and refuses on non-zero exit",
   "description": "The Node entry point invokes `rcf audit coverage --strict` as a required gate. The gate runs against the tree at the pull request's head commit and reports per-AC coverage: every AC on every US must resolve to a TC whose testPointer points at a real test. A non-zero exit code (mechanism exit 4 on gaps) terminates the suite and marks the aggregate result as failed. The strict-flag invocation is the sole coverage mode the suite runs; shallow-any is not accepted as a substitute.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",
-  "rationale": "Shallow-any coverage will declare a REQ covered when any AC on any US has any resolving TC, which is exactly the shape the watchpost run4 icon and token gap slipped through. Per-AC strict coverage is what makes the mechanism refuse to declare a shipped floor met while any AC still floats without a resolving TC.",
+  "rationale": "Shallow-any coverage will declare a REQ covered when any AC on any US has any resolving TC, which is exactly the shape by which an icon or token AC can float without a resolving TC while the REQ still reads as covered. Per-AC strict coverage is what makes the mechanism refuse to declare a shipped floor met while any AC still floats without a resolving TC.",
   "tags": [
     "blueprint:delivery-ci-workflows",
     "category:04-strict-coverage-gate"

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Each gate writes a machine-readable JSON report file at a stable path on every invocation",
   "description": "Every gate the suite invokes writes a JSON report file at a stable relative path under a project-configured report directory (default `.rcf/reports/ci/`). The per-gate report file is written whether the gate passed or failed. The report file carries the gate name, the underlying CLI invocation, the exit code, the start and end ISO-8601 timestamps, the duration in milliseconds, the tool version invoked, the captured stdout and stderr strings, and (v2 addition) a `checkKind` field naming the elicited-check kind (`validate`, `coverage-strict`, `linter`, `formatter`, `typecheck`, `unitTest`, `securityScan`, or `custom:<name>`). The report file's schema is stable within a blueprint major version; v1 additive fields (the `checkKind` addition) are preserved from v1.0.0 to v2.0.0.",
+  "deliveredBy": {
+    "tacId": "TAC-702-delivery-ci-workflows-gate-report",
+    "field": "interfaces.writeGateReport"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The suite emits an aggregate pipeline report summarising every gate's outcome at a stable path",
   "description": "The suite writes a single aggregate JSON report at a stable path under the same report directory (default `.rcf/reports/ci/pipeline.json`). The aggregate report carries the suite's own start and end ISO-8601 timestamps, the total duration, an overall pass/fail verdict, the fixed ordered list of gates the suite ran, and for each gate an entry naming the gate, its outcome, its duration, and the relative path to the per-gate report file. The aggregate schema is stable within a blueprint major version.",
+  "deliveredBy": {
+    "tacId": "TAC-703-delivery-ci-workflows-aggregate-report",
+    "field": "interfaces.writeAggregateReport"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-007.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Gate failures produce operator-readable output naming the failing gate and pointing to the per-gate report",
   "description": "When any gate in the suite fails, the Node entry point writes an operator-readable failure summary to its own stderr and to the aggregate report's `failure` field. The summary names the failing gate, the failing invocation's exit code, the first few lines of the captured stderr, and the relative path to the per-gate report file the reviewer can open for the full detail. The suite continues past a failing gate to run the remaining required gates and record their outcomes; the aggregate exit is non-zero if any gate failed.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-008.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The suite refuses to declare a pipeline pass when any required gate report is missing from the aggregate",
   "description": "The aggregate report's `gates` array lists every required gate in fixed configured order. If the suite completes without a corresponding per-gate report on disk for any required gate (a runner crash, an unhandled exception in a gate invocation, a report directory that was not writable), the aggregate report records the missing gate as `missing` with an explanatory reason, the aggregate verdict is `failed`, and the suite exits non-zero. A missing report is never treated as an implicit pass.",
+  "deliveredBy": {
+    "tacId": "TAC-703-delivery-ci-workflows-aggregate-report",
+    "field": "interfaces.writeAggregateReport"
+  },
   "category": "nonFunctional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-009.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The blueprint ships illustrative GitHub Actions workflow files for every workflow the matrix materialises; alternate providers wire the same entry points per the four-point mapping",
   "description": "The blueprint's package resources include one illustrative GitHub Actions workflow file per workflow the v2 matrix materialises (`pull-request-checks.yml`, `default-branch-checks.yml`, `release.yml`, and `scheduled-audit.yml` under `assets/ci-provider-examples/github-actions/`). Each file names the required trigger set for its workflow, sets up Node and the package manager, installs dependencies, invokes the corresponding Node entry point (gate-runner for the check-set workflows, release orchestrator for the release workflow, scheduled-audit runner for the cron workflow), and uploads the report directory as a workflow artefact. The blueprint's guide names GitLab CI, CircleCI, Buildkite, and Jenkins as equally supported providers, calls out the four-point mapping (job trigger, Node setup, single-line entry-point invocation, artefact upload) applied to each workflow in the matrix, and states that the blueprint does not ship provider-specific configuration for those runners in v2.0.0; sibling asset packs (v2.1 candidate) can ship them without changing the AC contracts.",
+  "deliveredBy": {
+    "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+    "field": "interfaces.materialise"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-010.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The gate suite entry point is the same code path locally and in CI",
   "description": "The Node entry point script is invocable on a developer's machine with the same command the CI provider invokes, against the same tree the developer has checked out, and produces the same per-gate reports and aggregate report at the same stable paths. A developer reproducing a CI failure runs the same one line the CI job ran; no CI-only wrapper or environment shim is on the CI code path but not the developer's.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "nonFunctional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-011.json

@@ -2,7 +2,11 @@
   "reqId": "delivery-ci-workflows-REQ-011",
   "prdId": "PRD-001",
   "title": "The project declares its CI workflow shape in a stable in-repo configuration file the workflow-materialiser reads",
-  "description": "The project ships a `workflowShape` declaration at the stable path `.rcf/config/delivery-ci-workflows.json` on the project tree. The declaration carries three required top-level fields (`branchModel`, `checkSet`, `providerHint`), one optional top-level field (`releaseMode`; absent has the same effect as `releaseMode: none`, per Q6-B ratification), one optional fifth field (`scheduledAudit`, default false), and one optional sub-field (`trunkPullRequests`) that qualifies `branchModel: trunk`. The four-field composed form (`branchModel`, `checkSet`, `releaseMode`, `providerHint`, with `releaseMode` defaulted to `none` when absent) is the authoritative representation the downstream workflow-materialiser (TAC-704) and every AC in this blueprint bind against; the profile-alias convenience surface (REQ-013) expands to the same composed form before any consumer reads it. The declaration is a data file, not code; the workflow-materialiser reads it once at the start of every materialisation run and refuses to proceed when the file is absent or malformed.",
+  "description": "The project ships a `workflowShape` declaration at the stable path `.rcf/config/delivery-ci-workflows.json` on the project tree. The declaration carries three required top-level fields (`branchModel`, `checkSet`, `providerHint`), one optional top-level field (`releaseMode`; absent has the same effect as `releaseMode: none`, per Q6-B ratification), one optional fifth field (`scheduledAudit`, default false), and one optional sub-field (`trunkPullRequests`) that qualifies `branchModel: trunk`. The four-field composed form (`branchModel`, `checkSet`, `releaseMode`, `providerHint`, with `releaseMode` defaulted to `none` when absent) is the authoritative representation the downstream workflow-materialiser (TAC-704) and every AC in this blueprint bind against; the profile-alias convenience surface (REQ-013) expands to the same composed form before any consumer reads it. The declaration is a data file, not code; the workflow-materialiser reads it once at the start of every materialisation run and refuses to proceed when the file is absent or malformed. The `providerHint` field currently accepts one shipped-asset value, `githubActions`, whose runtime clause is: the workflow-materialiser reads `githubActions` from the declaration and seeds the shipped illustrative GitHub Actions workflow files from `assets/ci-provider-examples/github-actions/` (per REQ-009 and ADR-708). Other named provider hints are elicit-accepted but do not seed provider assets in v2 (per ADR-708-delivery-ci-workflows-provider-hint-shape); AC-6113-1 binds the four-field expansion including `providerHint: githubActions`.",
+  "deliveredBy": {
+    "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+    "field": "interfaces.materialise"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "2.0.0",
   "status": "approved",
   "createdAt": "2026-08-31T00:00:00Z",
-  "updatedAt": "2026-08-31T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-012.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A missing or unrecognised workflowShape field is refused at boot with a stable-coded error naming the field",
   "description": "The workflow-materialiser performs a boot-check on the `workflowShape` declaration before any workflow file is produced. Any of the three required top-level fields (`branchModel`, `checkSet`, `providerHint`) being absent causes the materialiser to exit non-zero with a stable-coded error message that names the missing field. Any field (required or optional) carrying a value not in the recognised enumeration causes the same failure shape, with the message additionally naming the value it received and the allowed set. `releaseMode` being absent is NOT a failure (Q6-B ratification): the materialiser treats it as `releaseMode: none` and ships no release workflow. A `releaseMode: deployHandoff:<slug>` value additionally triggers a manifest boot-check (REQ-022) that names the required deploy blueprint if it is missing from `manifest.blueprints[]`. The boot-check runs before any workflow file is written; a partial workflow set never lands on disk.",
+  "deliveredBy": {
+    "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+    "field": "interfaces.materialise"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-013.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Named profile aliases expand to the authoritative four-field workflowShape form before any consumer reads it",
   "description": "The elicitation surface accepts a named profile alias (`smallLibrary`, `smallService`, `internalPackage`, `trunkLibrary`) in place of the four-field form. On boot the workflow-materialiser detects the alias, expands it to the shipped four-field composition, and treats the expanded form as authoritative for every downstream. Every AC in this blueprint binds to the four-field form only; the alias layer is a convenience surface, not an authoritative representation. An unrecognised alias name is refused at boot with a stable-coded error naming the alias and listing the shipped set. A project that wants a shape the shipped aliases do not name uses the four-field form.",
+  "deliveredBy": {
+    "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+    "field": "interfaces.materialise"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "should",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-014.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The feature-branch shape materialises pull-request-checks and default-branch-checks workflows against the required check set",
   "description": "When `workflowShape.branchModel` is `feature`, the workflow-materialiser produces two workflows sharing the same required check set: `pull-request-checks` firing on pull requests targeting the default branch, and `default-branch-checks` firing on pushes to the default branch. Both workflows invoke the same Node gate-runner entry point (TAC-701) with the required check set produced by the two-tier catalogue (mandatory tier plus the elicited subset from `checkSet`). Both workflows write their aggregate report to the stable path and preserve the ordering discipline. The blueprint contributes an AC that the project configure default-branch protection to require the `pull-request-checks` aggregate as a merge-blocking check; the configuration itself is a project responsibility on the platform's own surface.",
+  "deliveredBy": {
+    "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+    "field": "interfaces.materialise"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-015.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The trunk-based shape is a first-class option with a sub-shape for optional pull-request use",
   "description": "When `workflowShape.branchModel` is `trunk`, the workflow-materialiser produces `default-branch-checks` as the always-on workflow firing on every push to the trunk branch. A nested `trunkPullRequests` field qualifies the shape: `never` (default) ships only `default-branch-checks`; `sometimes` additionally ships `pull-request-checks` against the same check set. The merge-policy AC states the property differently per sub-shape: without PRs, the trunk branch's push protection admits only commits whose `default-branch-checks` aggregate passed; with PRs, the trunk branch's protection admits only PRs whose `pull-request-checks` aggregate passed. Every other contract (check catalogue, report shape, ordering) is shared with the feature-branch shape.",
+  "deliveredBy": {
+    "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+    "field": "interfaces.materialise"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-016.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A linter check the project realises produces a stable-shape lint report and fails non-zero on any lint error",
   "description": "The elicited `linter` check, when the project enables it in `workflowShape.checkSet.linter`, runs a lint gate that exits non-zero on any lint error the project treats as blocking. The gate writes its per-gate report to `.rcf/reports/ci/lint.json` in the shared per-gate report shape (with `checkKind: \"linter\"`). The blueprint does not pick the linter tool; the project realises the runner over the tool of its choice and satisfies the runner-contract interface the gate-runner TAC binds. Warnings that the project does not treat as blocking are reported in the per-gate report without flipping the exit code.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-017.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A formatter check the project realises produces a stable-shape formatter report and fails non-zero on any unformatted file",
   "description": "The elicited `formatter` check, when the project enables it in `workflowShape.checkSet.formatter`, runs a formatter check gate (not a formatter write) that exits non-zero when any tracked file would be rewritten by the formatter. The gate writes its per-gate report to `.rcf/reports/ci/format.json` in the shared per-gate report shape (with `checkKind: \"formatter\"`). The blueprint does not pick the formatter; the project realises the runner and satisfies the runner-contract interface.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-018.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A typecheck the project realises produces a stable-shape typecheck report and fails non-zero on any type error",
   "description": "The elicited `typecheck` check, when the project enables it in `workflowShape.checkSet.typecheck`, runs a typechecker gate that exits non-zero on any type error. The gate writes its per-gate report to `.rcf/reports/ci/typecheck.json` in the shared per-gate report shape (with `checkKind: \"typecheck\"`). The check is applicable only when the project uses a typed language or a TypeScript-style build; the workflow-materialiser turns the check on by default when the project tree contains a `tsconfig.json` or an equivalent tool marker, off otherwise. The project overrides the auto-detection by setting the check-set flag explicitly.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-019.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A unit-test check the project realises produces a stable-shape test report and fails non-zero on any failing test",
   "description": "The elicited `unitTest` check, when the project enables it in `workflowShape.checkSet.unitTest`, runs the project unit-test suite as a gate that exits non-zero on any failing test. The gate writes its per-gate report to `.rcf/reports/ci/test.json` in the shared per-gate report shape (with `checkKind: \"unitTest\"`). The blueprint does not pick the test runner; the project realises the runner and satisfies the runner-contract interface. A missing runner (an empty test suite before the project has any tests) is recorded in the per-gate report and does not by itself fail the gate.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-020.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A security-scan check the project realises produces a stable-shape scan report and fails non-zero on findings above the project threshold",
   "description": "The elicited `securityScan` check, when the project enables it in `workflowShape.checkSet.securityScan`, runs a dependency-and-secret scan gate that exits non-zero when the scan finds any advisory at or above the project-configured severity threshold. The gate writes its per-gate report to `.rcf/reports/ci/security.json` in the shared per-gate report shape (with `checkKind: \"securityScan\"`). Findings below the threshold are reported in the per-gate report without flipping the exit code. The severity threshold is a project decision; the blueprint does not opine on the threshold.",
+  "deliveredBy": {
+    "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+    "field": "interfaces.runGates"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-021.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The release workflow shape scales with the releaseMode dimension across four discrete modes",
   "description": "When `workflowShape.releaseMode` is `none`, no release workflow ships. When `tagOnly`, a release workflow fires on the project-declared release trigger (a `release` event, a `workflow_dispatch`, or both) and creates a release entity on the CI provider's own release surface (a GitHub Release, a GitLab release, whatever the provider ships). When `tagPlusArtefact`, the release workflow also runs the project-realised artefact-publish step and uploads its output to the release entity; the AC contract requires the artefact-publish step to produce a verified artefact reachable at a stable identifier. When `deployHandoff:<slug>`, the release workflow additionally invokes the named deploy blueprint's promote workflow per REQ-022. The release workflow does not run the required check set; the check set already ran on the default-branch-checks workflow at the commit the release points at.",
+  "deliveredBy": {
+    "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
+    "field": "interfaces.runRelease"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-022.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The deployHandoff release mode invokes the named deploy blueprint's promote workflow and refuses at boot when that blueprint is absent",
   "description": "When `workflowShape.releaseMode` is `deployHandoff:<slug>`, the release workflow invokes the named deploy blueprint's `promote` workflow via that blueprint's declared invocation contract (a `workflow_dispatch` event carrying the just-published version identifier as the `versionId` input). The release workflow's aggregate outcome is `passed` only when the promote workflow's outcome is `passed`. The workflow-materialiser performs a boot-check that refuses the value when the named deploy blueprint is absent from `manifest.blueprints[]`; the error names the missing blueprint by slug and points at `rcf define blueprint add <deploy-slug>` as the resolution.",
+  "deliveredBy": {
+    "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
+    "field": "interfaces.runRelease"
+  },
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",