rcf-lite 0.27.0 → 0.28.1

package/blueprints/application-spa/contributions/tacs/tac-210-application-spa-external-dependency-provisioning-probe.json

@@ -5,7 +5,7 @@
   "version": "1.0.1",
   "status": "approved",
   "name": "External-service-dependency provisioning adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the deployment-gate class defect the watchpost first-production review caught: the only login path (magic-link email) shipped inert because RESEND_API_KEY was a placeholder, the gap was filed as a 'quirk' in status.md rather than blocked at sign-off, and a real key existed in the estate all along. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md quirk line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for external-service-dependency provisioning discipline. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1132-5, AC-1132-6).",
     "Accept configuration naming (i) the path of the application's external-service-dependency manifest, (ii) how to boot the target server for handshake evidence (a Node module or command that starts the same server instance the production entry point starts, with the same route registration and middleware stack), (iii) the path of the ratified-deferrals store the deferral records live in, and (iv) the report directory (AC-1132-1, AC-1132-3, AC-1132-4).",
@@ -64,7 +64,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a running server booted through the production construction and network reach to real external providers for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: the build cycle ran green, sign-off said DEPLOYED, and the only login path was inert on a placeholder credential. Requiring a manifest is a deliberate load-bearing choice: without the manifest, the enumeration set of runtime-reached externals is invisible to the gate. Requiring the ratified-deferrals store to be a persistent machine-readable artefact (not a README note) is the choice that refuses the 'quirk-in-status.md' pattern the class defect exposed. Extending the detector's ruleset in rcf-lite (rather than per-project) is deliberate: one authoritative catalogue of placeholder shapes serves every downstream project.",
+  "tradeoffs": "The probe requires a running server booted through the production construction and network reach to real external providers for every delivery-ci-workflows invocation. Requiring a manifest is a deliberate load-bearing choice: without the manifest, the enumeration set of runtime-reached externals is invisible to the gate. Requiring the ratified-deferrals store to be a persistent machine-readable artefact (not a README note) makes deferrals durable and machine-checkable rather than prose the gate cannot inspect. Extending the detector's ruleset in rcf-lite (rather than per-project) is deliberate: one authoritative catalogue of placeholder shapes serves every downstream project.",
   "createdAt": "2026-08-24T13:00:00Z",
   "updatedAt": "2026-08-24T13:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-211-application-spa-core-flow-e2e-probe.json

@@ -5,7 +5,7 @@
   "version": "1.0.1",
   "status": "approved",
   "name": "Core-flow end-to-end adherence probe",
-  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. Watchpost first production demonstrated the deployment-gate class defect this probe cures: the app was signed off as DEPLOYED, admin access was reachable only via ssh-minted tokens because magic-link email never worked in production, and the authentication core flow was never proven end-to-end in the shipped runtime. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1133-5, AC-1133-6).",
     "Accept configuration naming (i) the path of the application's core-flow manifest, (ii) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration, the same production security-header stack, and the same middleware), (iii) how to reach real external-service providers (the deferrals-permission is the same shape as TAC-210 accepts for its 'deferred' entries), and (iv) the report directory (AC-1133-1, AC-1133-2, AC-1133-4).",
@@ -64,7 +64,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a real browser, the shipped server construction, and network reach to real external providers for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: sign-off said DEPLOYED, admin login was only reachable via a manually minted token, and no gate demanded the auth flow work end-to-end in the shipped runtime. Requiring an auth-flow-enumeration hard invariant is deliberate: authentication is the flow the class-defect instance exposed, and its enumeration cannot be optional when application-spa-REQ-009 surfaces are present. Refusing to accept a 'documented workaround' as sign-off is the choice that refuses the 'quirk-in-status.md' pattern; the aggregate 'deployed-with-defects' vocabulary is what the probe emits to name the distinction between 'shipped and accepted' and 'shipped with a broken core flow'.",
+  "tradeoffs": "The probe requires a real browser, the shipped server construction, and network reach to real external providers for every delivery-ci-workflows invocation. Requiring an auth-flow-enumeration hard invariant is deliberate: authentication cannot be optional when application-spa-REQ-009 surfaces are present, because a manifest that omits it would silently permit a shipped surface with no proven login path. Refusing to accept a 'documented workaround' as passing is what forces broken or skipped flows into the aggregate; the 'ok' | 'deployed-with-defects' vocabulary is what the probe emits to name the distinction between 'every core flow proved' and 'shipped with a broken or unproven core flow'.",
   "createdAt": "2026-08-24T13:00:00Z",
   "updatedAt": "2026-08-24T13:00:00Z"
 }

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1131.json

@@ -31,7 +31,7 @@
     },
     {
       "id": "AC-1131-3",
-      "description": "Every UI-bearing route renders styled UNDER the shipped strict CSP, AND the probe proves it exercised the requested surface (not a page a redirect would land on). A browser-driven check drives the same server instance that stamps the production security headers, navigates each enumerated UI route, and asserts (a) the browser's final URL path equals the requested route path; a silent redirect (for example an authenticated route 302'ing to /login when the harness session is broken) is a hard refusal because a headless browser follows redirects by default and would otherwise validate the redirect target's styled state seven times over, and (b) the computed body background is NOT the browser default (rgba(0,0,0,0) / transparent) and the computed body font-family resolves to a non-empty value. Verification runs through the production header path; a harness that strips the security headers, injects nonces the CSP does not declare, or invokes the app via app.inject() rather than a real browser fetch does NOT satisfy the AC. Cures the class of harness where a broken session lane silently causes every route assertion to run against /login (styled) and pass (a partial-acceptance class defect a prior review caught). Applying agent sets: the enumerated list of UI-bearing routes to probe, the production boot command the probe invokes, and the strict-CSP header set the production runtime stamps on every response.",
+      "description": "Every UI-bearing route renders styled UNDER the shipped strict CSP, AND the probe proves it exercised the requested surface (not a page a redirect would land on). A browser-driven check drives the same server instance that stamps the production security headers, navigates each enumerated UI route, and asserts (a) the browser's final URL path equals the requested route path; a silent redirect (for example an authenticated route 302'ing to /login when the harness session is broken) is a hard refusal because a headless browser follows redirects by default and would otherwise validate the redirect target's styled state seven times over, and (b) the computed body background is NOT the browser default (rgba(0,0,0,0) / transparent) and the computed body font-family resolves to a non-empty value. Verification runs through the production header path; a harness that strips the security headers, injects nonces the CSP does not declare, or invokes the app via app.inject() rather than a real browser fetch does NOT satisfy the AC. Applying agent sets: the enumerated list of UI-bearing routes to probe, the production boot command the probe invokes, and the strict-CSP header set the production runtime stamps on every response.",
       "given": "a server booted through the project's production entry point with every UI-bearing route registered",
       "when": "a real browser navigates each enumerated route, its final URL is read, and getComputedStyle(document.body) is read",
       "then": "the final URL path equals the requested route (no silent redirect chain to another surface) AND the computed background is not the browser default AND the computed font-family resolves; on any route the check fails, the run refuses ship with a per-route diagnostic naming the requested and landed paths",

package/blueprints/application-spa/docs/topics.md

@@ -79,4 +79,4 @@ Suffix-family ids (ADR, TAC) are string-distinct once slug-suffixed. SPA numbers
 
 ## v1.0.0 US-1101 collision note (preserved)
 
-In run4 of the watchpost case study, a project-side `US-1101` derived mechanically from `REQ-011` (leading `11` + sequence `01`) collided with the application-spa blueprint's `application-spa-us-1101` at the AC-id-scoping bucket. The seat allocated the project story as `US-1181` and moved on. Lesson: keep contributions on the LOW end of the band and leave headroom at the HIGH end for project-side stories that mechanically derive to your numbers. v1.1 preserves this lesson: US-1129 and US-1130 remain at the low end.
+A project-side `US-1101` derived mechanically from `REQ-011` (leading `11` + sequence `01`) collides with the application-spa blueprint's `application-spa-us-1101` at the AC-id-scoping bucket; the project story is allocated as `US-1181` instead. Rule: keep contributions on the LOW end of the band and leave headroom at the HIGH end for project-side stories that mechanically derive to your numbers. v1.1 preserves this rule: US-1129 and US-1130 remain at the low end.

package/blueprints/delivery-ci-workflows/CHANGELOG.md

@@ -1,5 +1,25 @@
+# Changelog
+
+## 2.3.5 - 2026-09-11
+
+probe-utils.writeReport no longer promotes an all-accountBoundSkipped row set to PASS via a separate override; aggregate() already returns PASS for a pure-skip set on its own and returns WARN when any WARN row is present, so an all-skipped array carrying a WARN row is no longer silently promoted. Anatomy suite tracks the strengthened shared helper.
+
+## 2.3.4 - 2026-09-11
+
+shared anatomy helper tightened; delivery-ci-workflows anatomy test passes shippedAcIds and browserOnlyAcIds into the helper and additionally checks every accountBoundSkipped row names exactly one declared env variable.
+
 # Changelog: delivery-ci-workflows blueprint
 
+## 2.3.3 - 2026-09-11
+
+Adds a contributions/probes/ pack (workflow-template-shape, node-gate-entrypoint, real-account-github-actions-run-record) with a fixture-side workflow-lint helper under packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows/. Probes run against the shipped workflow templates on Node 24 and against real GitHub Actions on the account-bound branch (CI_HAS_GITHUB_ACTIONS gate + RCF_FIXTURE_CIW_REPO, one variable per skip row).
+
+Anchoring: every row is de-claimed (conformanceOnly, anchorAcId=null) with a limitation naming a shipped AC id:
+- workflow-template-shape: template shape row -> AC-6101-1 (materialiser wiring not observed); actionlint row -> AC-6101-3 (materialiser refusal not observed; honest accountBoundSkipped naming RCF_FIXTURE_CIW_ACTIONLINT_PATH when the binary is not runnable); branch-protection row -> AC-6101-2 (repository merge-policy not observable at shelf without a probe-controlled repository).
+- node-gate-entrypoint: single-line invocation row -> AC-6102-2 (absence of gate-specific logic elsewhere in the job not observed); entry-point unique row -> AC-6102-1 (runtime aggregate report and project tree unavailable).
+- real-account-github-actions-run-record: every row -> AC-6101-1 (a gh run list record is not evidence of the configured trigger set nor of the aggregate pipeline report's `trigger` field); accountBoundSkipped rows name exactly one declared variable; a gh auth failure with the gate set is a FAIL.
+probe-utils aggregate follows the standard fail>warn>pass rule with no warn-to-pass promotion; every warn-shaped row was converted to a conformanceOnly or accountBoundSkipped row so aggregate=pass carries only pass rows. probe-utils fallback anchor is null.
+
 ## 2.3.1 (register-sweep patch, 2026-09-10)
 
 - Register: neutral wording in shipped prose (no capability change).
@@ -7,22 +27,22 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); the blueprint version is semver per the authoring standard section 8.
 
 
-## 2.3.0 (hardening pass, 2026-09-09)
+## 2.3.0 (2026-09-09)
 
 - Adds `elicits[]` with seven apply-time answers: `branch-model` (enum feature/trunk, default feature; ADR-706), `check-set` (string JSON of booleans; REQs 016-020), `release-mode` (enum none/tagOnly/tagPlusArtefact/deployHandoff, default none; ADR-707), `scheduled-audit` (enum off/on, default off; ADR-710), `provider-hint` (enum githubActions, default githubActions; ADR-708), `report-dir` (string, default .rcf/reports; ADR-704), `deploy-handoff-target` (string, blank when not deployHandoff; REQ-022).
-- Adds `deliveredBy` to all 23 REQs pointing at TAC-701/702/703/704/705/706 responsibility-carrying interfaces. Closes 14 pass-2 lint findings.
-- Closes the pass-1 lint finding on AC-6109-2: adds ownerRef pointing at TAC-701-delivery-ci-workflows-gate-runner.interfaces[2].name (the entry-point CLI it restates).
-- Closes F-1 (interrupted report writes could leave stale success): adds AC-6105-3 and AC-6108-3 asserting an interrupted per-gate and aggregate rewrite never leaves a stale-success from a previous run; the pipeline refuses pass on absent aggregate per REQ-008.
-- Closes F-2 (release entity creation and artefact publication had only success cases): adds AC-6121-4 (RELEASE_CREATE_FAILED naming step + provider status; no downstream publication or promote) and AC-6122-4 (RELEASE_PUBLISH_FAILED naming artefact + provider response; no promote step).
-- Closes F-3 (missing/malformed workflow config): adds AC-6112-3 (absent .rcf/config/delivery-ci-workflows.json -> WORKFLOW_CONFIG_MISSING; no workflow file written) and AC-6112-4 (unparseable JSON -> WORKFLOW_CONFIG_UNPARSEABLE naming file + parser error).
+- Adds `deliveredBy` to all 23 REQs pointing at TAC-701/702/703/704/705/706 responsibility-carrying interfaces.
+- Adds the missing coverage on AC-6109-2: adds ownerRef pointing at TAC-701-delivery-ci-workflows-gate-runner.interfaces[2].name (the entry-point CLI it restates).
+- The interrupted report writes could leave stale success gap is fixed: adds AC-6105-3 and AC-6108-3 asserting an interrupted per-gate and aggregate rewrite never leaves a stale-success from a previous run; the pipeline refuses pass on absent aggregate per REQ-008.
+- The release entity creation and artefact publication had only success cases gap is fixed: adds AC-6121-4 (RELEASE_CREATE_FAILED naming step + provider status; no downstream publication or promote) and AC-6122-4 (RELEASE_PUBLISH_FAILED naming artefact + provider response; no promote step).
+- The missing/malformed workflow config gap is fixed: adds AC-6112-3 (absent .rcf/config/delivery-ci-workflows.json -> WORKFLOW_CONFIG_MISSING; no workflow file written) and AC-6112-4 (unparseable JSON -> WORKFLOW_CONFIG_UNPARSEABLE naming file + parser error).
 - Re-sweeps every existing AC's `disposition` per section 7b: ACs referencing workflowShape values, provider hint, elicited check catalogue, report directory, and deployHandoff target flipped to `template` with `templateFillIns`; the remaining ACs stay `fixed`.
-- Review fix pass (F-1): flips AC-6104-3, AC-6106-3, AC-6119-2 to `disposition: fixed` (three ACs describe blueprint-invariant semantics with no elicited substitution in the assertion); adds the section 7b fill-in sentence naming the elicited values the applying agent sets to the remaining eight template ACs (AC-6111-3, AC-6113-3, AC-6115-3, AC-6116-2, AC-6118-3, AC-6120-2, AC-6123-3, AC-6124-2).
-- Review fix pass (F-6): extends REQ-011 description with a runtime clause naming the literal `providerHint: githubActions` value (the one shipped-asset provider hint in v2 per ADR-708); AC-6113-1 already binds the four-field expansion including `providerHint: githubActions`.
-- Review fix pass (F-8): adds section 7a coverage-note descriptions to US-6109, US-6116, US-6117, US-6119, US-6120, US-6124 recording the guide-and-TAC trace outcome per story (none had mechanism-specific failure paths named in the guide or TAC beyond the ACs each story already binds; runner-missing and gate-aggregation gaps route generically through AC-6102-3 and AC-6108-1).
+- flips AC-6104-3, AC-6106-3, AC-6119-2 to `disposition: fixed` (three ACs describe blueprint-invariant semantics with no elicited substitution in the assertion); adds the section 7b fill-in sentence naming the elicited values the applying agent sets to the remaining eight template ACs (AC-6111-3, AC-6113-3, AC-6115-3, AC-6116-2, AC-6118-3, AC-6120-2, AC-6123-3, AC-6124-2).
+- extends REQ-011 description with a runtime clause naming the literal `providerHint: githubActions` value (the one shipped-asset provider hint in v2 per ADR-708); AC-6113-1 already binds the four-field expansion including `providerHint: githubActions`.
+- adds section 7a coverage-note descriptions to US-6109, US-6116, US-6117, US-6119, US-6120, US-6124 recording the guide-and-TAC trace outcome per story (none had mechanism-specific failure paths named in the guide or TAC beyond the ACs each story already binds; runner-missing and gate-aggregation gaps route generically through AC-6102-3 and AC-6108-1).
 
 ## [2.0.0] - 2026-08-31
 
-Rename from `ci-pipeline` and redesign into a workflow SET the operator declares via a `workflowShape` block; introduces the elicited-check tier (linter, formatter, typecheck, unitTest, securityScan) alongside the preserved v1 RCF-gate mandatory tier; introduces the release workflow scaled across four modes; introduces the optional scheduled-audit workflow; mints one new global topic (`releaseArtefacts`). Ratified 2026-08-31 (Q1 one-blueprint-the-set; Q6-B releaseMode-optional; all other section-12 questions accepted as recommended).
+Rename from `ci-pipeline` and redesign into a workflow SET the operator declares via a `workflowShape` block; introduces the elicited-check tier (linter, formatter, typecheck, unitTest, securityScan) alongside the preserved v1 RCF-gate mandatory tier; introduces the release workflow scaled across four modes; introduces the optional scheduled-audit workflow; mints one new global topic (`releaseArtefacts`). Shipped shape: the blueprint owns the whole set (one-blueprint-the-set), `releaseMode` is optional, and other choices default per the shipped recommendations.
 
 ### Changed (BREAKING)
 
@@ -34,7 +54,7 @@ Rename from `ci-pipeline` and redesign into a workflow SET the operator declares
 ### Added
 
 - Six new REQs covering the elicitation surface (REQ-011, REQ-012, REQ-013), branch model (REQ-014, REQ-015), the elicited check catalogue (REQ-016..020), the release workflow (REQ-021), the deploy handoff (REQ-022), and the scheduled-audit dimension (REQ-023). Total REQ count: 23 (up from 10 at v1).
-- Corresponding new user stories US-6111..US-6123 (23 total) with additive ACs; the aggregate AC count sits inside the ratified 6101-6899 band.
+- Corresponding new user stories US-6111..US-6123 (23 total) with additive ACs; the aggregate AC count sits inside the shipped 6101-6899 band.
 - Three new TACs: TAC-704 (workflow-materialiser), TAC-705 (release-workflow orchestrator), TAC-706 (scheduled-audit runner). The v1 three TACs (gate-runner, per-gate report, aggregate report) are preserved verbatim except for the report-writer picking up the v2 `checkKind` field.
 - Six new ADRs: ADR-705 (elicitation-surface location), ADR-706 (branch-model defaults), ADR-707 (release-workflow shape), ADR-708 (provider-hint shape), ADR-709 (`releaseArtefacts` global), ADR-710 (scheduled-audit dimension). The v1 four ADRs are preserved with content updated for v2 broadened scope.
 - Per-gate report shape gains a `checkKind` field naming the elicited-check kind (`validate`, `coverage-strict`, `linter`, `formatter`, `typecheck`, `unitTest`, `securityScan`, `custom:<name>`). The v1 fixed key set is preserved as a strict subset.

package/blueprints/delivery-ci-workflows/README.md

@@ -20,7 +20,7 @@ Projects on the v1 `ci-pipeline` slug follow the migration path in the CHANGELOG
 | Doc set | `contributions/` | 23 REQs, 23 USs, 6 TACs, 10 ADRs, all schema-valid and namespaced (`delivery-ci-workflows-REQ-NNN` prefix family; `ADR-70N-delivery-ci-workflows-<tail>` suffix family) |
 | GitHub Actions assets | `assets/ci-provider-examples/github-actions/` | One illustrative workflow file per workflow the matrix materialises (`pull-request-checks.yml`, `default-branch-checks.yml`, `release.yml`, `scheduled-audit.yml`) |
 | Alternate-provider notes | `assets/ci-provider-examples/notes.md` | The four-point mapping (job trigger, Node setup, single-line entry-point invocation, artefact upload) applied per workflow for GitLab CI, CircleCI, Buildkite, and Jenkins |
-| Report-shape samples | `assets/report-samples/per-gate.json`, `assets/report-samples/pipeline.json` | Worked examples of a per-gate report (with the v2 `checkKind` field) and an aggregate report at the ratified schemas |
+| Report-shape samples | `assets/report-samples/per-gate.json`, `assets/report-samples/pipeline.json` | Worked examples of a per-gate report (with the v2 `checkKind` field) and an aggregate report at the shipped schemas |
 | Guide | `guide/delivery-ci-workflows.md` | Operator-facing: workflow-shape declaration, elicited-check catalogue, the four release modes, the deploy handoff contract, the scheduled-audit cadence |
 | Coordination vocabulary | `docs/topics.md` | The three global-topic strings this blueprint contributes and the shared id band registry |
 
@@ -28,9 +28,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision preserved from v1) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy preserved from v1) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint. The blueprint contributes the WHAT (the workflow-materialiser contract, the gate-runner contract, the release-workflow contract, the scheduled-audit contract, the check-catalogue AC contracts, the report shapes); the implementing agent derives the HOW-tasks in the host project against those contracts.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint. The blueprint contributes the WHAT (the workflow-materialiser contract, the gate-runner contract, the release-workflow contract, the scheduled-audit contract, the check-catalogue AC contracts, the report shapes); the implementing agent derives the HOW-tasks in the host project against those contracts.
 
 Deliberately not contributed: a matrix of provider-specific configuration files (v2.0.0 ships GHA only; alternate providers wire the same entry points per the guide's four-point mapping applied per workflow); provider-specific pipeline plugins or actions; the linter, formatter, typechecker, unit-test runner, or security scanner (the elicited checks name the kind; the project picks the tool); a code-formatting style guide or a security-scan severity threshold (project decisions); a release-mechanism (no `standard-version` invocation, no `release-please` config, no `changesets` schema; the workflow reacts to a tag or dispatch, does not create it); a merge-queue integration; a coverage-trend dashboard.
 

package/blueprints/delivery-ci-workflows/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "delivery-ci-workflows",
-  "version": "2.3.1",
+  "version": "2.3.5",
   "category": "delivery",
   "elicits": [
     {
@@ -385,5 +385,6 @@
       "kind": "adr",
       "path": "adrs/adr-710-delivery-ci-workflows-scheduled-audit.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11"
 }

package/blueprints/delivery-ci-workflows/contributions/adrs/adr-702-delivery-ci-workflows-strict-coverage-gate.json

@@ -5,14 +5,14 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Coverage runs as per-AC strict; shallow-any is not accepted as a substitute in the required gate set",
-  "context": "The `rcf audit coverage` CLI runs in two modes: the default `shallow-any` (a REQ counts as covered when any AC on any US has any resolving TC) and the opt-in `--strict` (per-AC: every AC on every US must have a resolving TC). Shallow-any is useful for author-time exploration; it is the wrong mode for a merge-blocking gate because it hides the failure mode watchpost run4 caught in categories 5, 6, and 11 (an AC bound but no TC resolves it, and the REQ still reads as covered because some other AC's TC resolved). Choosing which coverage mode the pipeline runs is a policy decision distinct from choosing whether coverage runs at all.",
+  "context": "The `rcf audit coverage` CLI runs in two modes: the default `shallow-any` (a REQ counts as covered when any AC on any US has any resolving TC) and the opt-in `--strict` (per-AC: every AC on every US must have a resolving TC). Shallow-any is useful for author-time exploration; it is the wrong mode for a merge-blocking gate because it hides the concrete failure mode where an AC is bound but no TC resolves it and the REQ still reads as covered because some other AC's TC resolved. Choosing which coverage mode the pipeline runs is a policy decision distinct from choosing whether coverage runs at all.",
   "decision": "The required-gate coverage invocation is `rcf audit coverage --strict`. Every AC on every US must resolve to a TC whose testPointer points at a real test; a `covered-unresolved` or uncovered AC fails the gate. Shallow-any is not accepted as a substitute in the required-gate set. A project that needs an author-time shallow-any view for exploration runs `rcf audit coverage` locally without `--strict`; the pipeline's gate is unaffected. Composing blueprints that ship a coverage gate hold this topic (`strictCoverageGate`) and conflict here by design: a hypothetical `delivery-ci-workflows-shallow` blueprint or a project that wants the shallow-any mode as its floor supersedes this ADR with a project-level ADR stating the reasoning.",
   "consequences": "Every AC the RCF chain contributes must have a TC bound in the project's own build cycle before the pipeline turns green. That is the mechanism-reach discipline the strict mode enforces: shipping an AC without a TC is caught here, not in production. Composing blueprints (this one and any coverage-shipping blueprint the ecosystem grows) conflict on `strictCoverageGate` for one project-level ADR to fix. A project that thoughtfully accepts a shallow-any floor (small project, exploration phase, no operator-facing surface yet) authors that ADR and the pipeline follows.\n\nBootstrap consequence (loud): a fresh apply of the delivery-ci-workflows blueprint alongside any doc-heavy companion (an application-* blueprint plus a persistence-* blueprint contributes tens to hundreds of ACs and zero TCs) means the very first commit-triggered workflow the materialiser produces is guaranteed to refuse on this gate until either every AC has a resolving TC OR a project-level ADR demotes the gate. The guide's \"Bootstrap posture\" section names the two ratified paths (author-every-TC-first, or demote-to-advisory-with-exit-criterion) and points at the template ADR at `assets/bootstrap/adr-bootstrap-coverage-supersession.template.json` that expresses the demotion posture. A first-time operator who reaches this ADR through the aggregate-report refusal at their first PR has hit the trap; a first-time operator who reads the guide's bootstrap section before running the materialiser makes the posture choice at apply time.",
   "alternativesConsidered": [
     {
       "name": "Run shallow-any as the required mode with strict as a warning gate",
       "summary": "The pipeline runs `rcf audit coverage` in shallow-any mode as required and `rcf audit coverage --strict` as a soft advisory gate whose outcome does not block merge.",
-      "reasonNotChosen": "A warning gate people learn to ignore is a gate that does not exist. The strict-mode failures watchpost run4 caught were exactly the ones a warning-only gate would have surfaced and been dismissed. Strict as required is the shape that makes the mechanism useful in review."
+      "reasonNotChosen": "A warning-only gate permits the same failures and is ineffective."
     },
     {
       "name": "Run strict only after a grace period per REQ / US",

package/blueprints/delivery-ci-workflows/contributions/probes/node-gate-entrypoint.mjs

@@ -0,0 +1,76 @@
+// Node-gate-entrypoint probe for delivery-ci-workflows.
+//
+// AC-6102-2 requires the CI job's step to be a single-line node
+// invocation of the gate runner AND every gate-level branching,
+// timing, and report-writing responsibility to live inside the Node
+// runner rather than the CI configuration. This probe observes only
+// the single-line invocation half; it cannot cheaply prove absence of
+// branching/timing/report-writing logic elsewhere in the job. The row
+// is de-claimed (conformanceOnly) with the limitation naming AC-6102-2.
+//
+// AC-6102-1 requires the aggregate report's runner.entryPoint field
+// (a runtime property the project's rcf runner writes into
+// .rcf/reports/ci/pipeline.json) and requires the field's project-
+// relative path to exist in the tree. Neither the aggregate report
+// nor a project tree is available to a shelf probe; row de-claimed.
+import { loadTemplates, splitJobs, findJobEntries } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows/src/workflow-lint.mjs';
+
+export const anchorAcId = 'AC-6102-2';
+export const accountBound = false;
+
+const LIM_6102_2 = `AC-6102-2: requires the CI job step to be a single-line node invocation AND every gate-level branching, timing, and report-writing responsibility to live inside the Node runner rather than the CI configuration. This row observes only the single-line invocation; it does not prove absence of gate-specific logic elsewhere in the job.`;
+const LIM_6102_1 = `AC-6102-1: requires the aggregate report's runner.entryPoint field (a runtime property the project's rcf runner writes into .rcf/reports/ci/pipeline.json) to record a project-relative .js/.mjs path AND that path to exist in the tree. Neither the runtime aggregate report nor a project tree is available to a shelf probe.`;
+
+export default async function runProbe() {
+  const templates = await loadTemplates();
+  const results = [];
+  if (templates.length === 0) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_6102_2,
+      verdict: 'fail',
+      detail: `observed no workflow templates found under the shipped github-actions assets directory; the single-line invocation observation cannot be made without at least one file.`,
+      evidence: { templateCount: 0, entries: [], bodyExcerpt: 'no templates' },
+    });
+    return { results, extra: { envDeclared: [], templateCount: 0 } };
+  }
+
+  const perFile = [];
+  let jobsScanned = 0;
+  let jobsWithExactlyOne = 0;
+  const violations = [];
+  for (const t of templates) {
+    const jobs = splitJobs(t.text);
+    const jobShapes = jobs.map((j) => {
+      const entries = findJobEntries(j.text);
+      const ok = entries.length === 1;
+      jobsScanned += 1;
+      if (ok) jobsWithExactlyOne += 1;
+      if (!ok) violations.push({ file: t.name, job: j.name, entries });
+      return { job: j.name, entries, oneEntryPoint: ok };
+    });
+    perFile.push({ file: t.name, jobCount: jobs.length, jobs: jobShapes });
+  }
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_6102_2,
+    verdict: jobsScanned > 0 && jobsWithExactlyOne === jobsScanned ? 'pass' : 'fail',
+    detail: `observed ${templates.length} workflow templates scanned; ${jobsScanned} jobs; ${jobsWithExactlyOne} jobs run exactly one 'node scripts/rcf-*.js' invocation; violations=${JSON.stringify(violations)}. Absence of gate-specific branching/timing/report-writing logic elsewhere in the job not observed.`,
+    evidence: { perFile, jobsScanned, jobsWithExactlyOne, violations, entries: perFile.flatMap((f) => f.jobs.flatMap((j) => j.entries)), bodyExcerpt: `jobs=${jobsScanned} oneEntry=${jobsWithExactlyOne}` },
+  });
+
+  const flat = perFile.flatMap((f) => f.jobs.flatMap((j) => j.entries));
+  const uniqueEntries = [...new Set(flat)];
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_6102_1,
+    verdict: 'pass',
+    detail: `observed ${flat.length} 'node scripts/rcf-*.{js,mjs}' entries across all jobs; uniqueEntries=${JSON.stringify(uniqueEntries)}. Each shipped template names its own canonical entry per workflow; the shelf cannot observe the runtime aggregate report's runner.entryPoint field or its path existence in a downstream tree.`,
+    evidence: { entries: flat, uniqueEntries, bodyExcerpt: `entries=${flat.length} unique=${uniqueEntries.length}` },
+  });
+
+  return { results, extra: { envDeclared: [], templateCount: templates.length, perFile } };
+}

package/blueprints/delivery-ci-workflows/contributions/probes/probe-utils.mjs

@@ -0,0 +1,56 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/delivery-ci-workflows');
+export const DECLARED_ENV = new Set(['RCF_FIXTURE_CIW_ACTIONLINT_PATH', 'CI_HAS_GITHUB_ACTIONS', 'RCF_FIXTURE_CIW_REPO']);
+
+// Standard aggregate: any fail -> fail; any warn -> warn; else pass.
+// Rows that cannot be observed here are declared as `conformanceOnly`
+// (naming the shipped AC id whose property the row does not observe)
+// or `accountBoundSkipped` (naming exactly one declared unset env
+// variable). Neither shape emits a warn.
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  // the strict-evidence contract tightening: an all-skipped row set aggregates as
+  // whatever aggregate() returns (skip is neither fail nor warn, so
+  // aggregate() returns 'pass' for the pure-skip case on its own).
+  // The previous isSkipped ? 'pass' : raw override could promote an
+  // all-skipped WARN row set to PASS; it is removed. WARN rows always
+  // survive; all-skipped rows still pass via aggregate() directly.
+  const aggregateVerdict = aggregate(normalised);
+  const report = { slug: 'delivery-ci-workflows', probeName, runAt: new Date().toISOString(), engine, results: normalised, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: `probe threw: ${err?.message ?? err}`, evidence: { thrown: true, message: err?.message ?? String(err), name: err?.name ?? 'Error', probeName, runAt: new Date().toISOString(), engine } }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err?.stack ?? err}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/delivery-ci-workflows/contributions/probes/real-account-github-actions-run-record.mjs

@@ -0,0 +1,139 @@
+// Real-account GitHub Actions run-record probe for delivery-ci-workflows.
+//
+// Live branch: read-only. Uses ambient `gh` auth (checked via
+// `gh auth status`). Queries the last N run records from the target
+// repo and records what was observed.
+//
+// AC-6101-1 requires the CI provider's jobs for the commit-triggered
+// workflows to trigger on the branch-model events AND the aggregate
+// pipeline report's `trigger` field to record the specific triggering
+// event. A `gh run list` record carries event, workflowName and
+// conclusion but is not evidence of the CONFIGURED trigger set
+// (branch-model coverage) and the aggregate report `trigger` field is
+// a runtime pipeline-report property this probe does not read. Row
+// de-claimed (conformanceOnly) with the limitation naming AC-6101-1.
+//
+// Skip contract:
+// - CI_HAS_GITHUB_ACTIONS unset: accountBoundSkipped naming the var.
+// - RCF_FIXTURE_CIW_REPO unset while the gate is on: accountBoundSkipped
+//   naming that var.
+// - gh auth status failure when the gate IS set: FAIL with the error
+//   excerpt, not a passing skip.
+//
+// Vendor citation: GitHub Actions REST API,
+// https://docs.github.com/en/rest/actions/workflow-runs
+// (verified 2026-09-11).
+import { spawn } from 'node:child_process';
+
+export const anchorAcId = 'AC-6101-1';
+export const accountBound = true;
+
+// Commit-triggered workflows only per user story 6101.
+const BLUEPRINT_COMMIT_WORKFLOW_NAMES = new Set([
+  'default-branch-checks',
+  'pull-request-checks',
+]);
+
+const LIMITATION = "AC-6101-1: requires observation of the CONFIGURED trigger set (branch-model push and pull-request events) on the workflow AND the aggregate pipeline report's `trigger` field. A gh run list record carries event, workflowName and conclusion but is not evidence of configured branch-model triggers, and the aggregate report is a runtime pipeline-report property this probe does not read.";
+
+function commonExtra(base = {}) {
+  return {
+    envDeclared: ['CI_HAS_GITHUB_ACTIONS', 'RCF_FIXTURE_CIW_REPO'],
+    vendorFact: { url: 'https://docs.github.com/en/rest/actions/workflow-runs', verifiedOn: '2026-09-11' },
+    commitTriggeredWorkflowNames: [...BLUEPRINT_COMMIT_WORKFLOW_NAMES],
+    ...base,
+  };
+}
+function runCmd(cmd, args, timeoutMs = 30000) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    const out = []; const err = [];
+    const timer = setTimeout(() => { try { child.kill('SIGKILL'); } catch {} resolve({ ran: false, reason: 'timeout' }); }, timeoutMs);
+    child.stdout.on('data', (b) => out.push(b.toString('utf8')));
+    child.stderr.on('data', (b) => err.push(b.toString('utf8')));
+    child.on('error', (e) => { clearTimeout(timer); resolve({ ran: false, reason: `spawn: ${e.code || e.message}` }); });
+    child.on('exit', (code) => { clearTimeout(timer); resolve({ ran: true, exitCode: code, stdout: out.join(''), stderr: err.join('') }); });
+  });
+}
+
+export default async function runProbe() {
+  if (process.env.CI_HAS_GITHUB_ACTIONS !== 'true') {
+    return {
+      results: [{
+        anchorAcId: null,
+        accountBoundSkipped: true,
+        reason: 'CI_HAS_GITHUB_ACTIONS',
+        verdict: 'pass',
+        detail: `accountBoundSkipped: CI_HAS_GITHUB_ACTIONS not set to true; the probe did not query gh.`,
+        evidence: { reason: 'CI_HAS_GITHUB_ACTIONS', declared: 'gate variable' },
+      }],
+      extra: commonExtra({ accountBoundSkipped: true, reason: 'CI_HAS_GITHUB_ACTIONS' }),
+    };
+  }
+  const preflight = await runCmd('gh', ['auth', 'status']);
+  if (!preflight.ran || preflight.exitCode !== 0) {
+    return {
+      results: [{
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: LIMITATION,
+        verdict: 'fail',
+        detail: `observed gh auth status FAILED with CI_HAS_GITHUB_ACTIONS=true: exit=${preflight.exitCode ?? 'n/a'} reason=${preflight.reason ?? ''} stderr='${preflight.stderr?.trim().slice(0, 200) ?? ''}'.`,
+        evidence: { ghAuthExitCode: preflight.exitCode, ghAuthStderr: preflight.stderr, spawnReason: preflight.reason },
+      }],
+      extra: commonExtra({}),
+    };
+  }
+  const repo = process.env.RCF_FIXTURE_CIW_REPO;
+  if (!repo) {
+    return {
+      results: [{
+        anchorAcId: null,
+        accountBoundSkipped: true,
+        reason: 'RCF_FIXTURE_CIW_REPO',
+        verdict: 'pass',
+        detail: `accountBoundSkipped: RCF_FIXTURE_CIW_REPO unset. Set to a repo whose workflows the probe may query read-only; no default repository is embedded.`,
+        evidence: { reason: 'RCF_FIXTURE_CIW_REPO', declared: 'target repository slug' },
+      }],
+      extra: commonExtra({ accountBoundSkipped: true, reason: 'RCF_FIXTURE_CIW_REPO' }),
+    };
+  }
+
+  const list = await runCmd('gh', ['run', 'list', '-R', repo, '--limit', '30', '--json', 'databaseId,conclusion,event,name,workflowName,url,createdAt,headBranch']);
+  const results = [];
+  if (!list.ran || list.exitCode !== 0) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
+      verdict: 'fail',
+      detail: `observed gh run list -R ${repo} FAILED exit=${list.exitCode ?? 'n/a'} stderr='${list.stderr?.trim().slice(0, 200) ?? list.reason}'.`,
+      evidence: { exitCode: list.exitCode, stderr: list.stderr, spawnReason: list.reason },
+    });
+    return { results, extra: commonExtra({}) };
+  }
+  const runs = JSON.parse(list.stdout || '[]');
+  const anchored = runs.filter((r) => BLUEPRINT_COMMIT_WORKFLOW_NAMES.has(r.workflowName) || BLUEPRINT_COMMIT_WORKFLOW_NAMES.has(r.name));
+  const most = anchored[0];
+  if (!most) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
+      verdict: 'pass',
+      detail: `observed no recent run of the blueprint's commit-triggered workflow templates (${[...BLUEPRINT_COMMIT_WORKFLOW_NAMES].join(', ')}) in the last ${runs.length} runs of the queried repo. The probe never cites an unrelated repository run as evidence.`,
+      evidence: { runsScanned: runs.length, commitTriggeredWorkflowNames: [...BLUEPRINT_COMMIT_WORKFLOW_NAMES], mostRecentByWorkflow: runs.slice(0, 5).map((r) => ({ workflowName: r.workflowName, conclusion: r.conclusion })), workflowName: 'none', conclusion: 'none', bodyExcerpt: `no anchored workflow run in ${runs.length} scanned` },
+    });
+  } else {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIMITATION,
+      verdict: most.databaseId && most.conclusion === 'success' ? 'pass' : 'fail',
+      detail: `observed the most recent run of a blueprint-anchored commit-triggered workflow: runId=${most.databaseId} workflowName='${most.workflowName}' conclusion=${most.conclusion} event=${most.event} branch=${most.headBranch}.`,
+      evidence: { runId: most.databaseId, workflowName: most.workflowName, conclusion: most.conclusion, event: most.event, headBranch: most.headBranch, url: most.url, createdAt: most.createdAt, bodyExcerpt: `runId=${most.databaseId} conclusion=${most.conclusion}` },
+    });
+  }
+
+  return { results, extra: commonExtra({ latestRunId: anchored[0]?.databaseId, latestRunConclusion: anchored[0]?.conclusion, latestRunWorkflow: anchored[0]?.workflowName }) };
+}

package/blueprints/delivery-ci-workflows/contributions/probes/run-node-gate-entrypoint.mjs

@@ -0,0 +1,3 @@
+import runProbe from './node-gate-entrypoint.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('node-gate-entrypoint', { kind: 'lint', driver: 'fixture template scan', healthy: true }, runProbe);

package/blueprints/delivery-ci-workflows/contributions/probes/run-real-account-github-actions-run-record.mjs

@@ -0,0 +1,3 @@
+import runProbe from './real-account-github-actions-run-record.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('real-account-github-actions-run-record', { kind: 'gh', driver: 'gh CLI read-only (workflow runs)', healthy: true }, runProbe);

package/blueprints/delivery-ci-workflows/contributions/probes/run-workflow-template-shape.mjs

@@ -0,0 +1,3 @@
+import runProbe from './workflow-template-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('workflow-template-shape', { kind: 'lint', driver: 'fixture YAML shape scan + actionlint when available', healthy: true }, runProbe);

package/blueprints/delivery-ci-workflows/contributions/probes/workflow-template-shape.mjs

@@ -0,0 +1,94 @@
+// Workflow-template-shape probe for delivery-ci-workflows.
+//
+// The blueprint ships illustrative GitHub Actions workflow files under
+// its assets directory. This probe loads them, scans the top-level
+// name/on/jobs keys and checks for a checkout step. It does NOT observe
+// the full trigger set, package-manager setup, entry-point invocation,
+// or artefact-upload clauses of REQ-009, so every row is de-claimed
+// (conformanceOnly, anchorAcId=null) with a limitation naming the
+// nearest shipped AC id whose property the row does not fully observe.
+//
+// Rows:
+//   - template shape: de-claimed from AC-6101-1 (the AC governing
+//     commit-triggered workflows the materialiser produces; template
+//     shape is one narrow slice of that AC).
+//   - actionlint: de-claimed from AC-6101-3 (the materialiser refusal
+//     contract on missing required triggers; actionlint checks yaml
+//     syntax, not materialiser refusal). Honest skip when the binary
+//     is unavailable, naming RCF_FIXTURE_CIW_ACTIONLINT_PATH.
+//   - branch protection: de-claimed from AC-6101-2 (the merge-policy
+//     block on a non-successful required check; a repository property
+//     no shelf probe can observe without a probe-controlled repository).
+import { loadTemplates, scanTopLevel, findCheckoutStep, actionlintOn } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-delivery-ci-workflows/src/workflow-lint.mjs';
+
+export const anchorAcId = 'AC-6101-1';
+export const accountBound = false;
+
+const LIM_TEMPLATE_SHAPE = `AC-6101-1: requires the materialiser to produce commit-triggered workflows wired to the elicited branch model trigger events (pushes and PR events for feature-branch, pushes and optional PRs for trunk). This row observes only name/on/jobs and a checkout step in each shipped illustrative template; it does not observe the trigger set, package-manager setup, entry-point invocation, or artefact-upload clauses.`;
+const LIM_ACTIONLINT = `AC-6101-3: requires the materialiser to refuse a template whose trigger set omits a required event, exit non-zero, emit WORKFLOW_TRIGGER_INCOMPLETE, and leave the workflow directory unchanged. Actionlint observes yaml syntax, not materialiser refusal, error code, or filesystem effect.`;
+const LIM_BRANCH_PROTECTION = `AC-6101-2: requires the platform merge policy to refuse a change whose most recent aggregate pipeline run recorded a failed verdict, with the refusal reason referencing the failed required check. This property requires a probe-controlled repository with branch protection wired and an attempted protected merge; a shelf probe cannot create branch protection or issue a protected merge.`;
+
+export default async function runProbe() {
+  const templates = await loadTemplates();
+  const results = [];
+  if (templates.length === 0) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_TEMPLATE_SHAPE,
+      verdict: 'fail',
+      detail: `observed no workflow templates found under the shipped github-actions assets directory; a v2 blueprint must ship at least one illustrative workflow file.`,
+      evidence: { templateCount: 0, entries: [], bodyExcerpt: 'no templates found' },
+    });
+    return { results, extra: { envDeclared: ['RCF_FIXTURE_CIW_ACTIONLINT_PATH'], templateCount: 0 } };
+  }
+
+  const perFile = [];
+  let allShapeOk = true;
+  for (const t of templates) {
+    const scan = scanTopLevel(t.text);
+    const checkout = findCheckoutStep(t.text);
+    perFile.push({ file: t.name, path: t.path, scan, checkout });
+    if (!scan.name || !scan.on || !scan.jobs || !checkout) allShapeOk = false;
+  }
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_TEMPLATE_SHAPE,
+    verdict: allShapeOk ? 'pass' : 'fail',
+    detail: `observed ${templates.length} github-actions templates scanned; every one has name/on/jobs + a checkout step (illustrative-file shape only).`,
+    evidence: { perFile, bodyExcerpt: `templates=${templates.length} allShapeOk=${allShapeOk}` },
+  });
+
+  const actionlint = await actionlintOn(templates.map((t) => t.path));
+  if (actionlint.ran) {
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_ACTIONLINT,
+      verdict: actionlint.exitCode === 0 ? 'pass' : 'fail',
+      detail: `observed actionlint (binary=${actionlint.binaryUsed}, override=${actionlint.overrideProvided}) exit=${actionlint.exitCode}; stdout='${actionlint.stdout.trim().slice(0, 500)}' stderr='${actionlint.stderr.trim().slice(0, 500)}'.`,
+      evidence: { binaryUsed: actionlint.binaryUsed, overrideProvided: actionlint.overrideProvided, exitCode: actionlint.exitCode, stdoutExcerpt: actionlint.stdout.slice(0, 800), stderrExcerpt: actionlint.stderr.slice(0, 800), perFile },
+    });
+  } else {
+    results.push({
+      anchorAcId: null,
+      accountBoundSkipped: true,
+      reason: 'RCF_FIXTURE_CIW_ACTIONLINT_PATH',
+      verdict: 'pass',
+      detail: `accountBoundSkipped: actionlint not runnable (${actionlint.reason}). Set RCF_FIXTURE_CIW_ACTIONLINT_PATH to an actionlint binary to run this observation.`,
+      evidence: { reason: actionlint.reason, binaryTried: actionlint.binaryUsed, overrideProvided: actionlint.overrideProvided },
+    });
+  }
+
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_BRANCH_PROTECTION,
+    verdict: 'pass',
+    detail: `AC-6101-2 branch-protection merge-policy refusal is not observable from a shelf probe without a probe-controlled repository; row de-claimed with the limitation naming AC-6101-2.`,
+    evidence: { suggestedFollowUp: 'move AC-6101-2 verification to a repository-scoped harness', bodyExcerpt: 'not observable at shelf' },
+  });
+
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_CIW_ACTIONLINT_PATH'], templateCount: templates.length, actionlintRan: actionlint.ran, actionlintBinaryUsed: actionlint.binaryUsed, actionlintOverrideProvided: actionlint.overrideProvided } };
+}

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-004.json

@@ -10,7 +10,7 @@
   "category": "functional",
   "domain": "continuous-integration",
   "priority": "must",
-  "rationale": "Shallow-any coverage will declare a REQ covered when any AC on any US has any resolving TC, which is exactly the shape the watchpost run4 icon and token gap slipped through. Per-AC strict coverage is what makes the mechanism refuse to declare a shipped floor met while any AC still floats without a resolving TC.",
+  "rationale": "Shallow-any coverage will declare a REQ covered when any AC on any US has any resolving TC, which is exactly the shape by which an icon or token AC can float without a resolving TC while the REQ still reads as covered. Per-AC strict coverage is what makes the mechanism refuse to declare a shipped floor met while any AC still floats without a resolving TC.",
   "tags": [
     "blueprint:delivery-ci-workflows",
     "category:04-strict-coverage-gate"