rcf-lite 0.27.0 → 0.28.0

package/blueprints/delivery-ci-workflows/CHANGELOG.md

@@ -1,5 +1,25 @@
+# Changelog
+
+## 2.3.5 - 2026-09-11
+
+probe-utils.writeReport no longer promotes an all-accountBoundSkipped row set to PASS via a separate override; aggregate() already returns PASS for a pure-skip set on its own and returns WARN when any WARN row is present, so an all-skipped array carrying a WARN row is no longer silently promoted. Anatomy suite tracks the strengthened shared helper.
+
+## 2.3.4 - 2026-09-11
+
+shared anatomy helper tightened; delivery-ci-workflows anatomy test passes shippedAcIds and browserOnlyAcIds into the helper and additionally checks every accountBoundSkipped row names exactly one declared env variable.
+
 # Changelog: delivery-ci-workflows blueprint
 
+## 2.3.3 - 2026-09-11
+
+Adds a contributions/probes/ pack (workflow-template-shape, node-gate-entrypoint, real-account-github-actions-run-record) with a fixture-side workflow-lint helper under packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows/. Probes run against the shipped workflow templates on Node 24 and against real GitHub Actions on the account-bound branch (CI_HAS_GITHUB_ACTIONS gate + RCF_FIXTURE_CIW_REPO, one variable per skip row).
+
+Anchoring: every row is de-claimed (conformanceOnly, anchorAcId=null) with a limitation naming a shipped AC id:
+- workflow-template-shape: template shape row -> AC-6101-1 (materialiser wiring not observed); actionlint row -> AC-6101-3 (materialiser refusal not observed; honest accountBoundSkipped naming RCF_FIXTURE_CIW_ACTIONLINT_PATH when the binary is not runnable); branch-protection row -> AC-6101-2 (repository merge-policy not observable at shelf without a probe-controlled repository).
+- node-gate-entrypoint: single-line invocation row -> AC-6102-2 (absence of gate-specific logic elsewhere in the job not observed); entry-point unique row -> AC-6102-1 (runtime aggregate report and project tree unavailable).
+- real-account-github-actions-run-record: every row -> AC-6101-1 (a gh run list record is not evidence of the configured trigger set nor of the aggregate pipeline report's `trigger` field); accountBoundSkipped rows name exactly one declared variable; a gh auth failure with the gate set is a FAIL.
+probe-utils aggregate follows the standard fail>warn>pass rule with no warn-to-pass promotion; every warn-shaped row was converted to a conformanceOnly or accountBoundSkipped row so aggregate=pass carries only pass rows. probe-utils fallback anchor is null.
+
 ## 2.3.1 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
@@ -7,22 +27,22 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the blueprint version is semver per the authoring standard section 8.
 
 
-## 2.3.0 (hardening pass, 2026-09-09)
+## 2.3.0 (2026-09-09)
 
 - Adds `elicits[]` with seven apply-time answers: `branch-model` (enum feature/trunk, default feature; ADR-706), `check-set` (string JSON of booleans; REQs 016-020), `release-mode` (enum none/tagOnly/tagPlusArtefact/deployHandoff, default none; ADR-707), `scheduled-audit` (enum off/on, default off; ADR-710), `provider-hint` (enum githubActions, default githubActions; ADR-708), `report-dir` (string, default .rcf/reports; ADR-704), `deploy-handoff-target` (string, blank when not deployHandoff; REQ-022).
-- Adds `deliveredBy` to all 23 REQs pointing at TAC-701/702/703/704/705/706 responsibility-carrying interfaces. Closes 14 pass-2 lint findings.
-- Closes the pass-1 lint finding on AC-6109-2: adds ownerRef pointing at TAC-701-delivery-ci-workflows-gate-runner.interfaces[2].name (the entry-point CLI it restates).
-- Closes F-1 (interrupted report writes could leave stale success): adds AC-6105-3 and AC-6108-3 asserting an interrupted per-gate and aggregate rewrite never leaves a stale-success from a previous run; the pipeline refuses pass on absent aggregate per REQ-008.
-- Closes F-2 (release entity creation and artefact publication had only success cases): adds AC-6121-4 (RELEASE_CREATE_FAILED naming step + provider status; no downstream publication or promote) and AC-6122-4 (RELEASE_PUBLISH_FAILED naming artefact + provider response; no promote step).
-- Closes F-3 (missing/malformed workflow config): adds AC-6112-3 (absent .rcf/config/delivery-ci-workflows.json -> WORKFLOW_CONFIG_MISSING; no workflow file written) and AC-6112-4 (unparseable JSON -> WORKFLOW_CONFIG_UNPARSEABLE naming file + parser error).
+- Adds `deliveredBy` to all 23 REQs pointing at TAC-701/702/703/704/705/706 responsibility-carrying interfaces.
+- Adds the missing coverage on AC-6109-2: adds ownerRef pointing at TAC-701-delivery-ci-workflows-gate-runner.interfaces[2].name (the entry-point CLI it restates).
+- The interrupted report writes could leave stale success gap is fixed: adds AC-6105-3 and AC-6108-3 asserting an interrupted per-gate and aggregate rewrite never leaves a stale-success from a previous run; the pipeline refuses pass on absent aggregate per REQ-008.
+- The release entity creation and artefact publication had only success cases gap is fixed: adds AC-6121-4 (RELEASE_CREATE_FAILED naming step + provider status; no downstream publication or promote) and AC-6122-4 (RELEASE_PUBLISH_FAILED naming artefact + provider response; no promote step).
+- The missing/malformed workflow config gap is fixed: adds AC-6112-3 (absent .rcf/config/delivery-ci-workflows.json -> WORKFLOW_CONFIG_MISSING; no workflow file written) and AC-6112-4 (unparseable JSON -> WORKFLOW_CONFIG_UNPARSEABLE naming file + parser error).
 - Re-sweeps every existing AC's `disposition` per section 7b: ACs referencing workflowShape values, provider hint, elicited check catalogue, report directory, and deployHandoff target flipped to `template` with `templateFillIns`; the remaining ACs stay `fixed`.
-- Review fix pass (F-1): flips AC-6104-3, AC-6106-3, AC-6119-2 to `disposition: fixed` (three ACs describe blueprint-invariant semantics with no elicited substitution in the assertion); adds the section 7b fill-in sentence naming the elicited values the applying agent sets to the remaining eight template ACs (AC-6111-3, AC-6113-3, AC-6115-3, AC-6116-2, AC-6118-3, AC-6120-2, AC-6123-3, AC-6124-2).
-- Review fix pass (F-6): extends REQ-011 description with a runtime clause naming the literal `providerHint: githubActions` value (the one shipped-asset provider hint in v2 per ADR-708); AC-6113-1 already binds the four-field expansion including `providerHint: githubActions`.
-- Review fix pass (F-8): adds section 7a coverage-note descriptions to US-6109, US-6116, US-6117, US-6119, US-6120, US-6124 recording the guide-and-TAC trace outcome per story (none had mechanism-specific failure paths named in the guide or TAC beyond the ACs each story already binds; runner-missing and gate-aggregation gaps route generically through AC-6102-3 and AC-6108-1).
+- flips AC-6104-3, AC-6106-3, AC-6119-2 to `disposition: fixed` (three ACs describe blueprint-invariant semantics with no elicited substitution in the assertion); adds the section 7b fill-in sentence naming the elicited values the applying agent sets to the remaining eight template ACs (AC-6111-3, AC-6113-3, AC-6115-3, AC-6116-2, AC-6118-3, AC-6120-2, AC-6123-3, AC-6124-2).
+- extends REQ-011 description with a runtime clause naming the literal `providerHint: githubActions` value (the one shipped-asset provider hint in v2 per ADR-708); AC-6113-1 already binds the four-field expansion including `providerHint: githubActions`.
+- adds section 7a coverage-note descriptions to US-6109, US-6116, US-6117, US-6119, US-6120, US-6124 recording the guide-and-TAC trace outcome per story (none had mechanism-specific failure paths named in the guide or TAC beyond the ACs each story already binds; runner-missing and gate-aggregation gaps route generically through AC-6102-3 and AC-6108-1).
 
 ## [2.0.0] - 2026-08-31
 
-Rename from `ci-pipeline` and redesign into a workflow SET the operator declares via a `workflowShape` block; introduces the elicited-check tier (linter, formatter, typecheck, unitTest, securityScan) alongside the preserved v1 RCF-gate mandatory tier; introduces the release workflow scaled across four modes; introduces the optional scheduled-audit workflow; mints one new global topic (`releaseArtefacts`). Ratified 2026-08-31 (Q1 one-blueprint-the-set; Q6-B releaseMode-optional; all other section-12 questions accepted as recommended).
+Rename from `ci-pipeline` and redesign into a workflow SET the operator declares via a `workflowShape` block; introduces the elicited-check tier (linter, formatter, typecheck, unitTest, securityScan) alongside the preserved v1 RCF-gate mandatory tier; introduces the release workflow scaled across four modes; introduces the optional scheduled-audit workflow; mints one new global topic (`releaseArtefacts`). Shipped shape: the blueprint owns the whole set (one-blueprint-the-set), `releaseMode` is optional, and other choices default per the shipped recommendations.
 
 ### Changed (BREAKING)
 
@@ -34,7 +54,7 @@ Rename from `ci-pipeline` and redesign into a workflow SET the operator declares
 ### Added
 
 - Six new REQs covering the elicitation surface (REQ-011, REQ-012, REQ-013), branch model (REQ-014, REQ-015), the elicited check catalogue (REQ-016..020), the release workflow (REQ-021), the deploy handoff (REQ-022), and the scheduled-audit dimension (REQ-023). Total REQ count: 23 (up from 10 at v1).
-- Corresponding new user stories US-6111..US-6123 (23 total) with additive ACs; the aggregate AC count sits inside the ratified 6101-6899 band.
+- Corresponding new user stories US-6111..US-6123 (23 total) with additive ACs; the aggregate AC count sits inside the shipped 6101-6899 band.
 - Three new TACs: TAC-704 (workflow-materialiser), TAC-705 (release-workflow orchestrator), TAC-706 (scheduled-audit runner). The v1 three TACs (gate-runner, per-gate report, aggregate report) are preserved verbatim except for the report-writer picking up the v2 `checkKind` field.
 - Six new ADRs: ADR-705 (elicitation-surface location), ADR-706 (branch-model defaults), ADR-707 (release-workflow shape), ADR-708 (provider-hint shape), ADR-709 (`releaseArtefacts` global), ADR-710 (scheduled-audit dimension). The v1 four ADRs are preserved with content updated for v2 broadened scope.
 - Per-gate report shape gains a `checkKind` field naming the elicited-check kind (`validate`, `coverage-strict`, `linter`, `formatter`, `typecheck`, `unitTest`, `securityScan`, `custom:<name>`). The v1 fixed key set is preserved as a strict subset.

package/blueprints/delivery-ci-workflows/README.md

@@ -20,7 +20,7 @@ Projects on the v1 `ci-pipeline` slug follow the migration path in the CHANGELOG
 | Doc set | `contributions/` | 23 REQs, 23 USs, 6 TACs, 10 ADRs, all schema-valid and namespaced (`delivery-ci-workflows-REQ-NNN` prefix family; `ADR-70N-delivery-ci-workflows-<tail>` suffix family) |
 | GitHub Actions assets | `assets/ci-provider-examples/github-actions/` | One illustrative workflow file per workflow the matrix materialises (`pull-request-checks.yml`, `default-branch-checks.yml`, `release.yml`, `scheduled-audit.yml`) |
 | Alternate-provider notes | `assets/ci-provider-examples/notes.md` | The four-point mapping (job trigger, Node setup, single-line entry-point invocation, artefact upload) applied per workflow for GitLab CI, CircleCI, Buildkite, and Jenkins |
-| Report-shape samples | `assets/report-samples/per-gate.json`, `assets/report-samples/pipeline.json` | Worked examples of a per-gate report (with the v2 `checkKind` field) and an aggregate report at the ratified schemas |
+| Report-shape samples | `assets/report-samples/per-gate.json`, `assets/report-samples/pipeline.json` | Worked examples of a per-gate report (with the v2 `checkKind` field) and an aggregate report at the shipped schemas |
 | Guide | `guide/delivery-ci-workflows.md` | Operator-facing: workflow-shape declaration, elicited-check catalogue, the four release modes, the deploy handoff contract, the scheduled-audit cadence |
 | Coordination vocabulary | `docs/topics.md` | The three global-topic strings this blueprint contributes and the shared id band registry |
 
@@ -28,9 +28,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision preserved from v1) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy preserved from v1) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint. The blueprint contributes the WHAT (the workflow-materialiser contract, the gate-runner contract, the release-workflow contract, the scheduled-audit contract, the check-catalogue AC contracts, the report shapes); the implementing agent derives the HOW-tasks in the host project against those contracts.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint. The blueprint contributes the WHAT (the workflow-materialiser contract, the gate-runner contract, the release-workflow contract, the scheduled-audit contract, the check-catalogue AC contracts, the report shapes); the implementing agent derives the HOW-tasks in the host project against those contracts.
 
 Deliberately not contributed: a matrix of provider-specific configuration files (v2.0.0 ships GHA only; alternate providers wire the same entry points per the guide's four-point mapping applied per workflow); provider-specific pipeline plugins or actions; the linter, formatter, typechecker, unit-test runner, or security scanner (the elicited checks name the kind; the project picks the tool); a code-formatting style guide or a security-scan severity threshold (project decisions); a release-mechanism (no `standard-version` invocation, no `release-please` config, no `changesets` schema; the workflow reacts to a tag or dispatch, does not create it); a merge-queue integration; a coverage-trend dashboard.
 

package/blueprints/delivery-ci-workflows/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "delivery-ci-workflows",
-  "version": "2.3.1",
+  "version": "2.3.5",
   "category": "delivery",
   "elicits": [
     {
@@ -385,5 +385,6 @@
       "kind": "adr",
       "path": "adrs/adr-710-delivery-ci-workflows-scheduled-audit.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11"
 }

package/blueprints/delivery-ci-workflows/contributions/adrs/adr-702-delivery-ci-workflows-strict-coverage-gate.json

@@ -5,14 +5,14 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Coverage runs as per-AC strict; shallow-any is not accepted as a substitute in the required gate set",
-  "context": "The `rcf audit coverage` CLI runs in two modes: the default `shallow-any` (a REQ counts as covered when any AC on any US has any resolving TC) and the opt-in `--strict` (per-AC: every AC on every US must have a resolving TC). Shallow-any is useful for author-time exploration; it is the wrong mode for a merge-blocking gate because it hides the failure mode watchpost run4 caught in categories 5, 6, and 11 (an AC bound but no TC resolves it, and the REQ still reads as covered because some other AC's TC resolved). Choosing which coverage mode the pipeline runs is a policy decision distinct from choosing whether coverage runs at all.",
+  "context": "The `rcf audit coverage` CLI runs in two modes: the default `shallow-any` (a REQ counts as covered when any AC on any US has any resolving TC) and the opt-in `--strict` (per-AC: every AC on every US must have a resolving TC). Shallow-any is useful for author-time exploration; it is the wrong mode for a merge-blocking gate because it hides the concrete failure mode where an AC is bound but no TC resolves it and the REQ still reads as covered because some other AC's TC resolved. Choosing which coverage mode the pipeline runs is a policy decision distinct from choosing whether coverage runs at all.",
   "decision": "The required-gate coverage invocation is `rcf audit coverage --strict`. Every AC on every US must resolve to a TC whose testPointer points at a real test; a `covered-unresolved` or uncovered AC fails the gate. Shallow-any is not accepted as a substitute in the required-gate set. A project that needs an author-time shallow-any view for exploration runs `rcf audit coverage` locally without `--strict`; the pipeline's gate is unaffected. Composing blueprints that ship a coverage gate hold this topic (`strictCoverageGate`) and conflict here by design: a hypothetical `delivery-ci-workflows-shallow` blueprint or a project that wants the shallow-any mode as its floor supersedes this ADR with a project-level ADR stating the reasoning.",
   "consequences": "Every AC the RCF chain contributes must have a TC bound in the project's own build cycle before the pipeline turns green. That is the mechanism-reach discipline the strict mode enforces: shipping an AC without a TC is caught here, not in production. Composing blueprints (this one and any coverage-shipping blueprint the ecosystem grows) conflict on `strictCoverageGate` for one project-level ADR to fix. A project that thoughtfully accepts a shallow-any floor (small project, exploration phase, no operator-facing surface yet) authors that ADR and the pipeline follows.\n\nBootstrap consequence (loud): a fresh apply of the delivery-ci-workflows blueprint alongside any doc-heavy companion (an application-* blueprint plus a persistence-* blueprint contributes tens to hundreds of ACs and zero TCs) means the very first commit-triggered workflow the materialiser produces is guaranteed to refuse on this gate until either every AC has a resolving TC OR a project-level ADR demotes the gate. The guide's \"Bootstrap posture\" section names the two ratified paths (author-every-TC-first, or demote-to-advisory-with-exit-criterion) and points at the template ADR at `assets/bootstrap/adr-bootstrap-coverage-supersession.template.json` that expresses the demotion posture. A first-time operator who reaches this ADR through the aggregate-report refusal at their first PR has hit the trap; a first-time operator who reads the guide's bootstrap section before running the materialiser makes the posture choice at apply time.",
   "alternativesConsidered": [
     {
       "name": "Run shallow-any as the required mode with strict as a warning gate",
       "summary": "The pipeline runs `rcf audit coverage` in shallow-any mode as required and `rcf audit coverage --strict` as a soft advisory gate whose outcome does not block merge.",
-      "reasonNotChosen": "A warning gate people learn to ignore is a gate that does not exist. The strict-mode failures watchpost run4 caught were exactly the ones a warning-only gate would have surfaced and been dismissed. Strict as required is the shape that makes the mechanism useful in review."
+      "reasonNotChosen": "A warning-only gate permits the same failures and is ineffective."
     },
     {
       "name": "Run strict only after a grace period per REQ / US",

package/blueprints/delivery-ci-workflows/contributions/probes/node-gate-entrypoint.mjs

@@ -0,0 +1,76 @@
+// Node-gate-entrypoint probe for delivery-ci-workflows.
+//
+// AC-6102-2 requires the CI job's step to be a single-line node
+// invocation of the gate runner AND every gate-level branching,
+// timing, and report-writing responsibility to live inside the Node
+// runner rather than the CI configuration. This probe observes only
+// the single-line invocation half; it cannot cheaply prove absence of
+// branching/timing/report-writing logic elsewhere in the job. The row
+// is de-claimed (conformanceOnly) with the limitation naming AC-6102-2.
+//
+// AC-6102-1 requires the aggregate report's runner.entryPoint field
+// (a runtime property the project's rcf runner writes into
+// .rcf/reports/ci/pipeline.json) and requires the field's project-
+// relative path to exist in the tree. Neither the aggregate report
+// nor a project tree is available to a shelf probe; row de-claimed.
+import { loadTemplates, splitJobs, findJobEntries } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows/src/workflow-lint.mjs';
+
+export const anchorAcId = 'AC-6102-2';
+export const accountBound = false;
+
+const LIM_6102_2 = `AC-6102-2: requires the CI job step to be a single-line node invocation AND every gate-level branching, timing, and report-writing responsibility to live inside the Node runner rather than the CI configuration. This row observes only the single-line invocation; it does not prove absence of gate-specific logic elsewhere in the job.`;
+const LIM_6102_1 = `AC-6102-1: requires the aggregate report's runner.entryPoint field (a runtime property the project's rcf runner writes into .rcf/reports/ci/pipeline.json) to record a project-relative .js/.mjs path AND that path to exist in the tree. Neither the runtime aggregate report nor a project tree is available to a shelf probe.`;
+
+export default async function runProbe() {
+  const templates = await loadTemplates();
+  const results = [];
+  if (templates.length === 0) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_6102_2,
+      verdict: 'fail',
+      detail: `observed no workflow templates found under the shipped github-actions assets directory; the single-line invocation observation cannot be made without at least one file.`,
+      evidence: { templateCount: 0, entries: [], bodyExcerpt: 'no templates' },
+    });
+    return { results, extra: { envDeclared: [], templateCount: 0 } };
+  }
+
+  const perFile = [];
+  let jobsScanned = 0;
+  let jobsWithExactlyOne = 0;
+  const violations = [];
+  for (const t of templates) {
+    const jobs = splitJobs(t.text);
+    const jobShapes = jobs.map((j) => {
+      const entries = findJobEntries(j.text);
+      const ok = entries.length === 1;
+      jobsScanned += 1;
+      if (ok) jobsWithExactlyOne += 1;
+      if (!ok) violations.push({ file: t.name, job: j.name, entries });
+      return { job: j.name, entries, oneEntryPoint: ok };
+    });
+    perFile.push({ file: t.name, jobCount: jobs.length, jobs: jobShapes });
+  }
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_6102_2,
+    verdict: jobsScanned > 0 && jobsWithExactlyOne === jobsScanned ? 'pass' : 'fail',
+    detail: `observed ${templates.length} workflow templates scanned; ${jobsScanned} jobs; ${jobsWithExactlyOne} jobs run exactly one 'node scripts/rcf-*.js' invocation; violations=${JSON.stringify(violations)}. Absence of gate-specific branching/timing/report-writing logic elsewhere in the job not observed.`,
+    evidence: { perFile, jobsScanned, jobsWithExactlyOne, violations, entries: perFile.flatMap((f) => f.jobs.flatMap((j) => j.entries)), bodyExcerpt: `jobs=${jobsScanned} oneEntry=${jobsWithExactlyOne}` },
+  });
+
+  const flat = perFile.flatMap((f) => f.jobs.flatMap((j) => j.entries));
+  const uniqueEntries = [...new Set(flat)];
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_6102_1,
+    verdict: 'pass',
+    detail: `observed ${flat.length} 'node scripts/rcf-*.{js,mjs}' entries across all jobs; uniqueEntries=${JSON.stringify(uniqueEntries)}. Each shipped template names its own canonical entry per workflow; the shelf cannot observe the runtime aggregate report's runner.entryPoint field or its path existence in a downstream tree.`,
+    evidence: { entries: flat, uniqueEntries, bodyExcerpt: `entries=${flat.length} unique=${uniqueEntries.length}` },
+  });
+
+  return { results, extra: { envDeclared: [], templateCount: templates.length, perFile } };
+}

package/blueprints/delivery-ci-workflows/contributions/probes/probe-utils.mjs

@@ -0,0 +1,56 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/delivery-ci-workflows');
+export const DECLARED_ENV = new Set(['RCF_FIXTURE_CIW_ACTIONLINT_PATH', 'CI_HAS_GITHUB_ACTIONS', 'RCF_FIXTURE_CIW_REPO']);
+
+// Standard aggregate: any fail -> fail; any warn -> warn; else pass.
+// Rows that cannot be observed here are declared as `conformanceOnly`
+// (naming the shipped AC id whose property the row does not observe)
+// or `accountBoundSkipped` (naming exactly one declared unset env
+// variable). Neither shape emits a warn.
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  // the strict-evidence contract tightening: an all-skipped row set aggregates as
+  // whatever aggregate() returns (skip is neither fail nor warn, so
+  // aggregate() returns 'pass' for the pure-skip case on its own).
+  // The previous isSkipped ? 'pass' : raw override could promote an
+  // all-skipped WARN row set to PASS; it is removed. WARN rows always
+  // survive; all-skipped rows still pass via aggregate() directly.
+  const aggregateVerdict = aggregate(normalised);
+  const report = { slug: 'delivery-ci-workflows', probeName, runAt: new Date().toISOString(), engine, results: normalised, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: `probe threw: ${err?.message ?? err}`, evidence: { thrown: true, message: err?.message ?? String(err), name: err?.name ?? 'Error', probeName, runAt: new Date().toISOString(), engine } }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err?.stack ?? err}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/delivery-ci-workflows/contributions/probes/real-account-github-actions-run-record.mjs

@@ -0,0 +1,139 @@
+// Real-account GitHub Actions run-record probe for delivery-ci-workflows.
+//
+// Live branch: read-only. Uses ambient `gh` auth (checked via
+// `gh auth status`). Queries the last N run records from the target
+// repo and records what was observed.
+//
+// AC-6101-1 requires the CI provider's jobs for the commit-triggered
+// workflows to trigger on the branch-model events AND the aggregate
+// pipeline report's `trigger` field to record the specific triggering
+// event. A `gh run list` record carries event, workflowName and
+// conclusion but is not evidence of the CONFIGURED trigger set
+// (branch-model coverage) and the aggregate report `trigger` field is
+// a runtime pipeline-report property this probe does not read. Row
+// de-claimed (conformanceOnly) with the limitation naming AC-6101-1.
+//
+// Skip contract:
+// - CI_HAS_GITHUB_ACTIONS unset: accountBoundSkipped naming the var.
+// - RCF_FIXTURE_CIW_REPO unset while the gate is on: accountBoundSkipped
+//   naming that var.
+// - gh auth status failure when the gate IS set: FAIL with the error
+//   excerpt, not a passing skip.
+//
+// Vendor citation: GitHub Actions REST API,
+// https://docs.github.com/en/rest/actions/workflow-runs
+// (verified 2026-09-11).
+import { spawn } from 'node:child_process';
+
+export const anchorAcId = 'AC-6101-1';
+export const accountBound = true;
+
+// Commit-triggered workflows only per user story 6101.
+const BLUEPRINT_COMMIT_WORKFLOW_NAMES = new Set([
+  'default-branch-checks',
+  'pull-request-checks',
+]);
+
+const LIMITATION = "AC-6101-1: requires observation of the CONFIGURED trigger set (branch-model push and pull-request events) on the workflow AND the aggregate pipeline report's `trigger` field. A gh run list record carries event, workflowName and conclusion but is not evidence of configured branch-model triggers, and the aggregate report is a runtime pipeline-report property this probe does not read.";
+
+function commonExtra(base = {}) {
+  return {
+    envDeclared: ['CI_HAS_GITHUB_ACTIONS', 'RCF_FIXTURE_CIW_REPO'],
+    vendorFact: { url: 'https://docs.github.com/en/rest/actions/workflow-runs', verifiedOn: '2026-09-11' },
+    commitTriggeredWorkflowNames: [...BLUEPRINT_COMMIT_WORKFLOW_NAMES],
+    ...base,
+  };
+}
+function runCmd(cmd, args, timeoutMs = 30000) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    const out = []; const err = [];
+    const timer = setTimeout(() => { try { child.kill('SIGKILL'); } catch {} resolve({ ran: false, reason: 'timeout' }); }, timeoutMs);
+    child.stdout.on('data', (b) => out.push(b.toString('utf8')));
+    child.stderr.on('data', (b) => err.push(b.toString('utf8')));
+    child.on('error', (e) => { clearTimeout(timer); resolve({ ran: false, reason: `spawn: ${e.code || e.message}` }); });
+    child.on('exit', (code) => { clearTimeout(timer); resolve({ ran: true, exitCode: code, stdout: out.join(''), stderr: err.join('') }); });
+  });
+}
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_GITHUB_ACTIONS !== 'true') {
+    return {
+      results: [{
+        anchorAcId: null,
+        accountBoundSkipped: true,
+        reason: 'CI_HAS_GITHUB_ACTIONS',
+        verdict: 'pass',
+        detail: `accountBoundSkipped: CI_HAS_GITHUB_ACTIONS not set to true; the probe did not query gh.`,
+        evidence: { reason: 'CI_HAS_GITHUB_ACTIONS', declared: 'gate variable' },
+      }],
+      extra: commonExtra({ accountBoundSkipped: true, reason: 'CI_HAS_GITHUB_ACTIONS' }),
+    };
+  }
+  const preflight = await runCmd('gh', ['auth', 'status']);
+  if (!preflight.ran || preflight.exitCode !== 0) {
+    return {
+      results: [{
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMITATION,
+        verdict: 'fail',
+        detail: `observed gh auth status FAILED with CI_HAS_GITHUB_ACTIONS=true: exit=${preflight.exitCode ?? 'n/a'} reason=${preflight.reason ?? ''} stderr='${preflight.stderr?.trim().slice(0, 200) ?? ''}'.`,
+        evidence: { ghAuthExitCode: preflight.exitCode, ghAuthStderr: preflight.stderr, spawnReason: preflight.reason },
+      }],
+      extra: commonExtra({}),
+    };
+  }
+  const repo = process.env.RCF_FIXTURE_CIW_REPO;
+  if (!repo) {
+    return {
+      results: [{
+        anchorAcId: null,
+        accountBoundSkipped: true,
+        reason: 'RCF_FIXTURE_CIW_REPO',
+        verdict: 'pass',
+        detail: `accountBoundSkipped: RCF_FIXTURE_CIW_REPO unset. Set to a repo whose workflows the probe may query read-only; no default repository is embedded.`,
+        evidence: { reason: 'RCF_FIXTURE_CIW_REPO', declared: 'target repository slug' },
+      }],
+      extra: commonExtra({ accountBoundSkipped: true, reason: 'RCF_FIXTURE_CIW_REPO' }),
+    };
+  }
+
+  const list = await runCmd('gh', ['run', 'list', '-R', repo, '--limit', '30', '--json', 'databaseId,conclusion,event,name,workflowName,url,createdAt,headBranch']);
+  const results = [];
+  if (!list.ran || list.exitCode !== 0) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
+      verdict: 'fail',
+      detail: `observed gh run list -R ${repo} FAILED exit=${list.exitCode ?? 'n/a'} stderr='${list.stderr?.trim().slice(0, 200) ?? list.reason}'.`,
+      evidence: { exitCode: list.exitCode, stderr: list.stderr, spawnReason: list.reason },
+    });
+    return { results, extra: commonExtra({}) };
+  }
+  const runs = JSON.parse(list.stdout || '[]');
+  const anchored = runs.filter((r) => BLUEPRINT_COMMIT_WORKFLOW_NAMES.has(r.workflowName) || BLUEPRINT_COMMIT_WORKFLOW_NAMES.has(r.name));
+  const most = anchored[0];
+  if (!most) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
+      verdict: 'pass',
+      detail: `observed no recent run of the blueprint's commit-triggered workflow templates (${[...BLUEPRINT_COMMIT_WORKFLOW_NAMES].join(', ')}) in the last ${runs.length} runs of the queried repo. The probe never cites an unrelated repository run as evidence.`,
+      evidence: { runsScanned: runs.length, commitTriggeredWorkflowNames: [...BLUEPRINT_COMMIT_WORKFLOW_NAMES], mostRecentByWorkflow: runs.slice(0, 5).map((r) => ({ workflowName: r.workflowName, conclusion: r.conclusion })), workflowName: 'none', conclusion: 'none', bodyExcerpt: `no anchored workflow run in ${runs.length} scanned` },
+    });
+  } else {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
+      verdict: most.databaseId && most.conclusion === 'success' ? 'pass' : 'fail',
+      detail: `observed the most recent run of a blueprint-anchored commit-triggered workflow: runId=${most.databaseId} workflowName='${most.workflowName}' conclusion=${most.conclusion} event=${most.event} branch=${most.headBranch}.`,
+      evidence: { runId: most.databaseId, workflowName: most.workflowName, conclusion: most.conclusion, event: most.event, headBranch: most.headBranch, url: most.url, createdAt: most.createdAt, bodyExcerpt: `runId=${most.databaseId} conclusion=${most.conclusion}` },
+    });
+  }
+
+  return { results, extra: commonExtra({ latestRunId: anchored[0]?.databaseId, latestRunConclusion: anchored[0]?.conclusion, latestRunWorkflow: anchored[0]?.workflowName }) };
+}

package/blueprints/delivery-ci-workflows/contributions/probes/run-node-gate-entrypoint.mjs

@@ -0,0 +1,3 @@
+import runProbe from './node-gate-entrypoint.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('node-gate-entrypoint', { kind: 'lint', driver: 'fixture template scan', healthy: true }, runProbe);

package/blueprints/delivery-ci-workflows/contributions/probes/run-real-account-github-actions-run-record.mjs

@@ -0,0 +1,3 @@
+import runProbe from './real-account-github-actions-run-record.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('real-account-github-actions-run-record', { kind: 'gh', driver: 'gh CLI read-only (workflow runs)', healthy: true }, runProbe);

package/blueprints/delivery-ci-workflows/contributions/probes/run-workflow-template-shape.mjs

@@ -0,0 +1,3 @@
+import runProbe from './workflow-template-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('workflow-template-shape', { kind: 'lint', driver: 'fixture YAML shape scan + actionlint when available', healthy: true }, runProbe);

package/blueprints/delivery-ci-workflows/contributions/probes/workflow-template-shape.mjs

@@ -0,0 +1,94 @@
+// Workflow-template-shape probe for delivery-ci-workflows.
+//
+// The blueprint ships illustrative GitHub Actions workflow files under
+// its assets directory. This probe loads them, scans the top-level
+// name/on/jobs keys and checks for a checkout step. It does NOT observe
+// the full trigger set, package-manager setup, entry-point invocation,
+// or artefact-upload clauses of REQ-009, so every row is de-claimed
+// (conformanceOnly, anchorAcId=null) with a limitation naming the
+// nearest shipped AC id whose property the row does not fully observe.
+//
+// Rows:
+//   - template shape: de-claimed from AC-6101-1 (the AC governing
+//     commit-triggered workflows the materialiser produces; template
+//     shape is one narrow slice of that AC).
+//   - actionlint: de-claimed from AC-6101-3 (the materialiser refusal
+//     contract on missing required triggers; actionlint checks yaml
+//     syntax, not materialiser refusal). Honest skip when the binary
+//     is unavailable, naming RCF_FIXTURE_CIW_ACTIONLINT_PATH.
+//   - branch protection: de-claimed from AC-6101-2 (the merge-policy
+//     block on a non-successful required check; a repository property
+//     no shelf probe can observe without a probe-controlled repository).
+import { loadTemplates, scanTopLevel, findCheckoutStep, actionlintOn } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows/src/workflow-lint.mjs';
+
+export const anchorAcId = 'AC-6101-1';
+export const accountBound = false;
+
+const LIM_TEMPLATE_SHAPE = `AC-6101-1: requires the materialiser to produce commit-triggered workflows wired to the elicited branch model trigger events (pushes and PR events for feature-branch, pushes and optional PRs for trunk). This row observes only name/on/jobs and a checkout step in each shipped illustrative template; it does not observe the trigger set, package-manager setup, entry-point invocation, or artefact-upload clauses.`;
+const LIM_ACTIONLINT = `AC-6101-3: requires the materialiser to refuse a template whose trigger set omits a required event, exit non-zero, emit WORKFLOW_TRIGGER_INCOMPLETE, and leave the workflow directory unchanged. Actionlint observes yaml syntax, not materialiser refusal, error code, or filesystem effect.`;
+const LIM_BRANCH_PROTECTION = `AC-6101-2: requires the platform merge policy to refuse a change whose most recent aggregate pipeline run recorded a failed verdict, with the refusal reason referencing the failed required check. This property requires a probe-controlled repository with branch protection wired and an attempted protected merge; a shelf probe cannot create branch protection or issue a protected merge.`;
+
+export default async function runProbe() {
+  const templates = await loadTemplates();
+  const results = [];
+  if (templates.length === 0) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_TEMPLATE_SHAPE,
+      verdict: 'fail',
+      detail: `observed no workflow templates found under the shipped github-actions assets directory; a v2 blueprint must ship at least one illustrative workflow file.`,
+      evidence: { templateCount: 0, entries: [], bodyExcerpt: 'no templates found' },
+    });
+    return { results, extra: { envDeclared: ['RCF_FIXTURE_CIW_ACTIONLINT_PATH'], templateCount: 0 } };
+  }
+
+  const perFile = [];
+  let allShapeOk = true;
+  for (const t of templates) {
+    const scan = scanTopLevel(t.text);
+    const checkout = findCheckoutStep(t.text);
+    perFile.push({ file: t.name, path: t.path, scan, checkout });
+    if (!scan.name || !scan.on || !scan.jobs || !checkout) allShapeOk = false;
+  }
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_TEMPLATE_SHAPE,
+    verdict: allShapeOk ? 'pass' : 'fail',
+    detail: `observed ${templates.length} github-actions templates scanned; every one has name/on/jobs + a checkout step (illustrative-file shape only).`,
+    evidence: { perFile, bodyExcerpt: `templates=${templates.length} allShapeOk=${allShapeOk}` },
+  });
+
+  const actionlint = await actionlintOn(templates.map((t) => t.path));
+  if (actionlint.ran) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_ACTIONLINT,
+      verdict: actionlint.exitCode === 0 ? 'pass' : 'fail',
+      detail: `observed actionlint (binary=${actionlint.binaryUsed}, override=${actionlint.overrideProvided}) exit=${actionlint.exitCode}; stdout='${actionlint.stdout.trim().slice(0, 500)}' stderr='${actionlint.stderr.trim().slice(0, 500)}'.`,
+      evidence: { binaryUsed: actionlint.binaryUsed, overrideProvided: actionlint.overrideProvided, exitCode: actionlint.exitCode, stdoutExcerpt: actionlint.stdout.slice(0, 800), stderrExcerpt: actionlint.stderr.slice(0, 800), perFile },
+    });
+  } else {
+    results.push({
+      anchorAcId: null,
+      accountBoundSkipped: true,
+      reason: 'RCF_FIXTURE_CIW_ACTIONLINT_PATH',
+      verdict: 'pass',
+      detail: `accountBoundSkipped: actionlint not runnable (${actionlint.reason}). Set RCF_FIXTURE_CIW_ACTIONLINT_PATH to an actionlint binary to run this observation.`,
+      evidence: { reason: actionlint.reason, binaryTried: actionlint.binaryUsed, overrideProvided: actionlint.overrideProvided },
+    });
+  }
+
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_BRANCH_PROTECTION,
+    verdict: 'pass',
+    detail: `AC-6101-2 branch-protection merge-policy refusal is not observable from a shelf probe without a probe-controlled repository; row de-claimed with the limitation naming AC-6101-2.`,
+    evidence: { suggestedFollowUp: 'move AC-6101-2 verification to a repository-scoped harness', bodyExcerpt: 'not observable at shelf' },
+  });
+
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_CIW_ACTIONLINT_PATH'], templateCount: templates.length, actionlintRan: actionlint.ran, actionlintBinaryUsed: actionlint.binaryUsed, actionlintOverrideProvided: actionlint.overrideProvided } };
+}

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-004.json

@@ -10,7 +10,7 @@
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",
-  "rationale": "Shallow-any coverage will declare a REQ covered when any AC on any US has any resolving TC, which is exactly the shape the watchpost run4 icon and token gap slipped through. Per-AC strict coverage is what makes the mechanism refuse to declare a shipped floor met while any AC still floats without a resolving TC.",
+  "rationale": "Shallow-any coverage will declare a REQ covered when any AC on any US has any resolving TC, which is exactly the shape by which an icon or token AC can float without a resolving TC while the REQ still reads as covered. Per-AC strict coverage is what makes the mechanism refuse to declare a shipped floor met while any AC still floats without a resolving TC.",
   "tags": [
     "blueprint:delivery-ci-workflows",
     "category:04-strict-coverage-gate"

package/blueprints/delivery-ci-workflows/docs/topics.md

@@ -28,7 +28,7 @@ Rules for new topics (inherited from the application-spa, application-api-rest,
 
 ## Id number bands (registry bootstrap)
 
-AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is ratified policy (2026-08-19); this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
+AC ids (and therefore US numeric ids, which anchor them) are NOT namespaced by the 0.4.4 schema grammar; the band allocation IS the AC-collision enforcement mechanism. Composing blueprints take a fresh band rather than proposing namespaced AC ids. Band allocation is policy; this table is the shared registry-bootstrap replicated across every shipped and forthcoming blueprint's `docs/topics.md` until a mechanism-side central registry lands (v1.1 candidate).
 
 This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
 
@@ -73,8 +73,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 6101-6110 sit at the LOW end of the 6101-6899 band on purpose. A project-side story that mechanically derives from `delivery-ci-workflows-REQ-011` into the number `6111` would collide against delivery-ci-workflows-US-6111 in this package; the band leaves headroom at the HIGH end (US 6181-6899) so a project's own stories anchored to delivery-ci-workflows REQs can allocate without conflict. The watchpost run4 lesson applies here too.
-
+US 6101-6110 sit at the LOW end of the 6101-6899 band on purpose. A project-side story that mechanically derives from `delivery-ci-workflows-REQ-011` into the number `6111` would collide against delivery-ci-workflows-US-6111 in this package; the band leaves headroom at the HIGH end (US 6181-6899) so a project's own stories anchored to delivery-ci-workflows REQs can allocate without conflict.
 ## Shared expectations for future composing blueprints
 
 - Reuse `ciGates` exactly as spelled here when your blueprint holds an opinion on the required check set every commit-triggered workflow runs; contribute your own scope:global ADR on that string and let composition surface the pairing. An observability-essentials blueprint that ships health-probe or status-page gates as required will conflict here by design.

package/blueprints/deploy-cloudflare-workers/CHANGELOG.md

@@ -10,7 +10,7 @@
 
 ## 1.3.0 - 2026-09-09
 
-Adds deliveredBy on nine REQs (001, 003, 005, 006, 007, 010, 011, 013, 014). Adds ownerRef on AC-12102-2/3 and AC-12109-1 (deployAdapter) and AC-12105-1 (productionUrl). Closes chain-contradiction specimens F-1 (AC-12101-4 rewritten around the boolean run_worker_first = true form; vendor citation https://developers.cloudflare.com/workers/static-assets/binding/ verified 2026-09-09), F-2 (TAC-1302 gains responsibilities for the [assets].directory branches, the boolean and array-of-patterns run_worker_first mappings, and the pages_build_output_dir mutual-exclusion refusal), and F-5 (REQ-002 and TAC-1301 gain the stable deployStatus verb that composes production URL, preview alias URL, and currently serving version id). Closes chain-contradiction on per-version-id (ADR-1303 spelling aligned with TAC-1303). Adds disposition to every AC.
+Adds deliveredBy on nine REQs (001, 003, 005, 006, 007, 010, 011, 013, 014). Adds ownerRef on AC-12102-2/3 and AC-12109-1 (deployAdapter) and AC-12105-1 (productionUrl). AC-12101-4 rests on the boolean `run_worker_first = true` form with vendor citation https://developers.cloudflare.com/workers/static-assets/binding/. TAC-1302 carries responsibilities for the `[assets].directory` branches, the boolean and array-of-patterns `run_worker_first` mappings, and the `pages_build_output_dir` mutual-exclusion refusal. REQ-002 and TAC-1301 carry the stable `deployStatus` verb that composes production URL, preview alias URL, and currently serving version id. ADR-1303 spelling aligns with TAC-1303. Adds disposition to every AC.
 
 All notable changes to the `deploy-cloudflare-workers` blueprint are recorded here.
 The format follows Keep a Changelog. Versions are semver, per
@@ -19,7 +19,7 @@ The format follows Keep a Changelog. Versions are semver, per
 ## 1.2.0 - 2026-09-07
 
 Additive minor bump. Blesses the Workers-with-static-assets shape as the
-ratified SPA-on-Workers deploy shape, per the Cloudflare Pages
+shipped SPA-on-Workers deploy shape, per the Cloudflare Pages
 landing-page recommendation (2026-09-06). Seven new contributions in the
 existing 12xx US band and 13xx suffix block; every shipped v1.1.0
 contribution carries through unchanged.
@@ -42,7 +42,7 @@ Added
 - US `-US-12115`: migrate-from-Pages guidance. Guide section links
   Cloudflare's own migrate-from-Pages walkthrough.
 - ADR `ADR-1306-deploy-cloudflare-workers-spa-shape`: Workers-with-
-  static-assets as the ratified SPA-on-Workers deploy shape.
+  static-assets as the shipped SPA-on-Workers deploy shape.
   Contribution entry carries `recommendedDefault: true` and
   `standardsTraceClause: Cloudflare Pages landing-page recommendation
   (2026-09-06)`. Body quotes the landing-page recommendation verbatim
@@ -81,4 +81,4 @@ Notes
   cron and Durable Objects blueprints, and the Turnstile sub-fixture,
   extend the same fixture later.
 
-Review-fix (2026-09-09): Widens the run-worker-first elicit from kind boolean to kind string so both wrangler-side shapes accepted by the Cloudflare Workers static-assets binding (the boolean form and the array-of-patterns form) round-trip through the operator surface without silent narrowing. TAC-1302 responsibility 8 is rewritten to name both shapes with the emitted wrangler literal for each. Adds AC-12113-4 binding the array-of-patterns form on US-12113 with vendorCitation, and adds vendorCitation to AC-12113-2 (boolean form). README and guide teach both shapes. Adds deliveredBy on REQ-002, REQ-004, REQ-008, REQ-009, REQ-012. Sweeps vendorCitation onto fixed ACs resting on vendor facts (AC-12102-2, AC-12102-3, AC-12108-1, AC-12108-3, AC-12111-1, AC-12112-3).
+Widens the run-worker-first elicit from kind boolean to kind string so both wrangler-side shapes accepted by the Cloudflare Workers static-assets binding (the boolean form and the array-of-patterns form) round-trip through the operator surface without silent narrowing. TAC-1302 responsibility 8 is rewritten to name both shapes with the emitted wrangler literal for each. Adds AC-12113-4 binding the array-of-patterns form on US-12113 with vendorCitation, and adds vendorCitation to AC-12113-2 (boolean form). README and guide teach both shapes. Adds deliveredBy on REQ-002, REQ-004, REQ-008, REQ-009, REQ-012. AC-12102-2, AC-12102-3, AC-12108-1, AC-12108-3, AC-12111-1, and AC-12112-3 carry vendorCitation.