rcf-lite 0.28.0 → 0.28.1

package/CHANGELOG.md

@@ -6,6 +6,22 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.28.1] - 2026-09-17
+
+Feedback defects surfaced by the first WSD-lens round-trip on 0.28.0. Fixes both a destination bug that silently misrouted library-owned findings to `Stravica/rcf-lite`, and a redactor over-fold that mangled the docs URL and any prose using the canonical noun `agent`. Includes a package-rename disclosure banner in the README so a colleague hitting `npm i -g @stravica-ai/rcf-build-lite` on the retired scoped name knows what to do.
+
+### Fixed
+
+- **Feedback destination for bare-slug library-owned blueprints (AC-15801-4).** A `--kind blueprint` entry whose manifest record has no `libraryPrefix` now cross-checks the blueprint-library registry BEFORE the shelf-constant fall-through: if exactly one registered library owns a blueprint with the applied slug AND that library resolves to a destination (`issuesRepo`, or a derivable `git+https://github.com/...` sourceRef), the resolver routes to that library's destination with `source: 'library-slug-inference'`. Two or more owners return `unresolved` with `reason: 'ambiguous-library-slug'` and a `candidates[]` array of library prefixes. Zero owners keep the shelf-constant fall-through unchanged. This never overrides an existing `libraryPrefix` resolution (AC-15801-2's path is untouched). Before 0.28.1, a WSD colleague who ran `rcf define blueprint add application-spa` from a project with a registered WSD library that also owned `application-spa` saw their feedback routed to `Stravica/rcf-lite` instead of the WSD blueprints repo the library declared. Chain: US-15801 AC-15801-4; design amendment R5a; TS-189 gains three test cases; TAC-4106 responsibility extended.
+
+- **Operator-identity redactor no longer folds the canonical noun `agent` (AC-15601-5).** The operator-identity substitution now consults a `RESERVED_IDENTITY_TOKENS` stopword set (agent, user, admin, api, code, system, and the rest of the guarded common nouns) before folding each whitespace-separated token of the identity `## Name`. Before 0.28.1, an identity such as `The Agent Alice` caused the redactor to fold the literal `agent` throughout the body: the docs URL `how-the-agent-files-feedback` became `how-the-<operator>-files-feedback` (no longer resolvable), the canon phrase `when the agent stops` mangled, and every RULE 17 example was affected. Real given names (Alice, Smith) still fold; only common-noun tokens are guarded. When the identity string is ENTIRELY stopwords (a placeholder in disguise), the full-literal substitution is also skipped so the docs and canon phrases survive. Chain: US-15601 AC-15601-5; design amendment R5c; TS-188 gains one test case; TAC-4103 responsibility extended.
+
+- **`rcf feedback add --evidence` help text now names its requiredness explicitly.** Header line `'rcf feedback add' options (all required unless noted)` was preserved and truthful, but `--evidence <pointer>` did not itemise its required-and-repeatable behaviour, so a reader could take the line-item shape alone as "optional." Help text now reads `Required, repeatable: a command, a path:line inside the project, or an id. At least one --evidence is required (AC-15501-1); absence exits 2.` No behaviour change; AC-15501-1 already required at least one `--evidence`.
+
+### Changed
+
+- **Package rename disclosure surfaced in the README and CHANGELOG.** The scoped name `@stravica-ai/rcf-build-lite` was frozen at 0.7.0 and the suite consolidated into the unscoped `rcf-lite` at 0.7.1; the 0.28.0 line ships ONLY on `rcf-lite`. The README already carried the rename note under "Where this came from" and pointed at the packaging runbook, but there was no in-CLI hint: a colleague running `npm i -g @stravica-ai/rcf-build-lite@0.28.0` saw a bare "no matching version" from npm with no rcf-lite context. 0.28.1 adds a callout box at the top of the README naming the rename explicitly and the CHANGELOG carries this note so a search for the retired name lands somewhere useful. The npm-side deprecate notice on the retired scoped name is a Dave operator step (needs npm auth) tracked separately from this release. No behaviour change.
+
 ## [0.28.0] - 2026-09-17
 
 rcf-lite 0.28.0 lands two referee-facing trains together. The `rcf feedback` verb family lets an agent record what a blueprint or rcf-lite did that contradicts its own docs, fails, or forces a workaround, redact it to the eight rules of the design plus a whole-body residual scan, and, after one operator yes at a natural pause, file each finding as a GitHub issue under the operator's own `gh` login (or a pastable outbox bundle on the fallback path). The referee-guarantees train tightens the three sentences the docs page makes about `rcf define validate`, `rcf audit coverage` and `rcf build finalise`: validate now walks ADR `supersededBy`, coverage is strict-by-default with `--mode shallow-any` as the deliberate opt-out, and finalise refuses on the three per-AC verdicts (UI-BASELINE-UNMET, BROWSER-VERIFICATION-MISSING, SCOPE-MISMATCH), gates the manual `verified` override behind `--acknowledge-verified-override`, and adds a merge-state precondition with `--allow-pre-merge` as the deliberate pre-merge dry-run opt-out. `rcf init` now merges three hook entries into `.claude/settings.json` and `.codex/hooks.json` so the feedback ask fires once per session at idle; RULE 17 lands in the managed instructions block as the belt-and-braces path. Coverage-strict-by-default is the single migration surface: downstream projects that ran plain `rcf audit coverage` and treated its exit code as passing will see the same tree exit 4; the fix is either to close the coverage gap or to run `rcf audit coverage --mode shallow-any` when the intent is a printed gap report.

package/README.md

@@ -7,6 +7,15 @@
 
 Build software with an AI coding agent without losing the plot.
 
+> **Package name note (0.7.1+).** This tool ships as `rcf-lite` on npm. The retired scoped name `@stravica-ai/rcf-build-lite` was frozen at 0.7.0 in August 2026 and every release from 0.7.1 onwards lives here. If `npm install -g @stravica-ai/rcf-build-lite@<version>` returns "no matching version" for any version above 0.7.0, uninstall the scoped name and install `rcf-lite` at the same version instead:
+>
+> ```sh
+> npm uninstall -g @stravica-ai/rcf-build-lite
+> npm install -g rcf-lite
+> ```
+>
+> The `rcf` and `rcf-verify` bin names are unchanged.
+
 Anyone who has shipped with a coding agent knows the failure mode: the code arrives fast, but what the product is supposed to do lives in prompt history, and prompt history is not a spec. Three weeks later nobody can say what is covered, what is tested, or what breaks when something changes.
 
 RCF Lite keeps those answers machine-checkable. It maintains a live chain from what you asked for, through requirements, user stories, acceptance criteria and tests, into the code itself, as plain JSON files in your own repository. Your agent works the chain instead of improvising; `rcf define validate` catches drift the moment it happens; and when your app is deployed, `rcf verify` sends an independent verifier at it before anything gets called done.

package/fixtures/canary-manifest.json

@@ -2,8 +2,8 @@
   "registerCanary": [
     {
       "id": "rc-2026-09-17-001",
-      "createdAt": "2026-09-17T10:17:51.151Z",
-      "buildVersion": "0.28.0-mockdriver",
+      "createdAt": "2026-09-17T14:42:00.660Z",
+      "buildVersion": "0.28.1-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -35,8 +35,8 @@
     },
     {
       "id": "rc-2026-09-17-002",
-      "createdAt": "2026-09-17T10:17:51.152Z",
-      "buildVersion": "0.28.0-mockdriver",
+      "createdAt": "2026-09-17T14:42:00.661Z",
+      "buildVersion": "0.28.1-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -68,8 +68,8 @@
     },
     {
       "id": "rc-2026-09-17-003",
-      "createdAt": "2026-09-17T10:17:51.152Z",
-      "buildVersion": "0.28.0-mockdriver",
+      "createdAt": "2026-09-17T14:42:00.661Z",
+      "buildVersion": "0.28.1-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",

package/rcf/code-nodes/cn-600.json

@@ -17,6 +17,7 @@
     "AC-15601-4",
     "AC-15701-2",
     "AC-15701-3",
+    "AC-15801-4",
     "AC-15901-1",
     "AC-15901-2",
     "AC-15902-1",
@@ -41,5 +42,5 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T14:58:28Z",
-  "updatedAt": "2026-09-17T03:30:00Z"
+  "updatedAt": "2026-09-17T14:14:49Z"
 }

package/rcf/code-nodes/cn-602.json

@@ -5,11 +5,12 @@
     "AC-15601-1",
     "AC-15601-2",
     "AC-15601-3",
-    "AC-15601-4"
+    "AC-15601-4",
+    "AC-15601-5"
   ],
   "dependencies": [],
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T15:27:35Z",
-  "updatedAt": "2026-09-16T20:28:13Z"
+  "updatedAt": "2026-09-17T14:14:49Z"
 }

package/rcf/code-nodes/cn-605.json

@@ -4,6 +4,7 @@
   "implementsAcIds": [
     "AC-15801-2",
     "AC-15801-3",
+    "AC-15801-4",
     "AC-15802-1",
     "AC-15802-2"
   ],
@@ -13,5 +14,5 @@
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-16T16:20:01Z",
-  "updatedAt": "2026-09-16T16:20:01Z"
+  "updatedAt": "2026-09-17T14:14:49Z"
 }

package/rcf/fbs/fbs-181.json

@@ -12,6 +12,7 @@
     "AC-15601-2",
     "AC-15601-3",
     "AC-15601-4",
+    "AC-15601-5",
     "AC-15701-1"
   ],
   "dependsOnFbsIds": [
@@ -41,5 +42,5 @@
   "estimatedHours": 16,
   "notes": "Fingerprint decision confined to this slice via ADR-4102; the labels half of that ADR pays off in slice 4.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-17T14:14:56Z"
 }

package/rcf/fbs/fbs-182.json

@@ -11,6 +11,7 @@
     "AC-15801-1",
     "AC-15801-2",
     "AC-15801-3",
+    "AC-15801-4",
     "AC-15802-1",
     "AC-15802-2"
   ],
@@ -38,5 +39,5 @@
   "estimatedHours": 8,
   "notes": "Extends the library manifest surface; downstream library owners can adopt at their own cadence.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T16:20:01Z"
+  "updatedAt": "2026-09-17T14:14:56Z"
 }

package/rcf/tacs/tac-4103-feedback-redact.json

@@ -10,7 +10,8 @@
     "Apply the eight redaction rules from design section 5 to title, body and evidence strings",
     "Return a ledger of { rule, before, after, count } entries for the operator disclosure",
     "Refuse on residual-secret matches (second pass) with a line pointer so the offending body is not sent",
-    "Ship a bundled allowlist of vendor hosts and honour the extension array on rcf/feedback-settings.json"
+    "Ship a bundled allowlist of vendor hosts and honour the extension array on rcf/feedback-settings.json",
+    "Guard operator-identity substitution with a RESERVED_IDENTITY_TOKENS stopword list (agent, user, admin, api, code, system, etc.) so a common noun in the operator's identity name never folds; substitution still fires for real given names in the identity"
   ],
   "internalStructure": "src/feedback/redact.js is a pure module: redact(text, context) -> { text, ledger[] } plus small per-rule helpers. src/feedback/redact-allowlist.json ships the vendor host set; the extension array is merged at call time.",
   "interfaces": [
@@ -35,5 +36,5 @@
   "tradeoffs": "Rule-based redaction is testable with a fixture corpus and deterministic under review; the cost is that it will occasionally over-redact (a benign name that matches an entropy rule), which is what the disclosure ledger exists to catch.",
   "notes": "The stored entry is never mutated by redaction; the rendered output is what leaves.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-17T13:47:09Z"
 }

package/rcf/tacs/tac-4106-feedback-destination.json

@@ -10,7 +10,8 @@
     "Walk entry.target -> manifest.blueprints[] -> registry entry -> issuesRepo, with sourceRef derivation as fallback",
     "Return a { repo, visibility, derived, reason } shape; unresolved carries a reason for the doctor row",
     "Route --kind core and shelf blueprints to the constant sourced from package.json:bugs.url (a test pins the constant)",
-    "Report the doctor feedback-destinations warn row for every registered library without a resolvable destination"
+    "Report the doctor feedback-destinations warn row for every registered library without a resolvable destination",
+    "Cross-check the registry BEFORE the shelf-constant fall-through for --kind blueprint entries with no libraryPrefix on the manifest record: one library owns the slug and resolves -> library destination (source: library-slug-inference); two-or-more libraries own the slug and resolve -> unresolved with reason ambiguous-library-slug and a candidates[] array; zero libraries own the slug -> shelf constant"
   ],
   "internalStructure": "src/feedback/destination.js is a pure resolver; the constant lives at the top of the module and is exported for the test to compare against package.json.",
   "interfaces": [
@@ -35,5 +36,5 @@
   "tradeoffs": "A declared destination on library.json requires library owners to author one field; the cost is a one-time PR per library, in exchange for correctness on every consuming project.",
   "notes": "A library mirrored from a fork would have derivation pointing at the fork; the declared issues field is why derivation is only a fallback.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-17T13:46:24.000Z"
 }

package/rcf/test-suites/ts-188.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-16T15:27:35Z",
-  "updatedAt": "2026-09-17T01:30:00Z",
+  "updatedAt": "2026-09-17T13:47:28Z",
   "purpose": "Cover AC-15601-1 (rcf feedback preview renders each pending entry as the title and body that would be filed, lists the destination, and prints the redaction ledger over the full eight-rule vocabulary), AC-15601-2 (preview marks residual-secret findings so the operator sees before consenting; the submit half of AC-15601-2 lands with slice 4), AC-15601-3 (preview never mutates the stored entries.jsonl), AC-15601-4 (a final whole-text residual-secret pass on the fully rendered and normalised issue body and each bundle refuses submit on any hit) and AC-15701-1 (a stable 12-hex fingerprint is attached per entry, folds across blueprint versions when the anchor+class match, and falls back to normalised-title tokens with a warning when the anchor is absent).",
   "testLevel": "integration",
   "acIds": [
@@ -8,7 +8,8 @@
     "AC-15601-2",
     "AC-15601-3",
     "AC-15601-4",
-    "AC-15701-1"
+    "AC-15701-1",
+    "AC-15601-5"
   ],
   "id": "TS-188",
   "usId": "US-15601",
@@ -160,6 +161,13 @@
       "description": "Cover AC-15601-1 (fix round 5, R4 negative case) via the unit test: ordinary prose that carries a vocabulary word (`the password field is required`, `the password is required`, `see commit abc1234 at HEAD`, `keyword=abcdef`, `authors=joe,jane`) does NOT fold because the value-shape gate rejects single-class values and values under 8 characters.",
       "status": "pending",
       "testPointer": "test/cli/feedback-fix-round-5.test.js::F-05 (round 5, R4 guard): a vocabulary word in ordinary prose (single-class value, or short value) does NOT fold"
+    },
+    {
+      "id": "TC-188-redact-operator-identity-stopword-guard",
+      "acId": "AC-15601-5",
+      "description": "Cover AC-15601-5 via the unit test: redact runs over a body containing the docs URL 'https://stravica.ai/docs/rcf/how-the-agent-files-feedback', the prose 'when the agent stops the queue' and the personal name 'Alice reviewed this', with operatorName seeded as 'The Agent Alice'; the docs URL is emitted verbatim; the prose 'when the agent stops the queue' is emitted verbatim; 'Alice' folds to <operator>; no operator-identity ledger row names 'agent' or 'the'.",
+      "status": "pending",
+      "testPointer": "test/feedback/redact.test.js::AC-15601-5 operator-identity stopword guard: common nouns in the identity string are never folded; real given names still fold"
     }
   ],
   "status": "draft"

package/rcf/test-suites/ts-189.json

@@ -1,12 +1,13 @@
 {
   "createdAt": "2026-09-16T16:20:01Z",
-  "updatedAt": "2026-09-16T16:20:01Z",
+  "updatedAt": "2026-09-17T13:46:16Z",
   "purpose": "Cover AC-15801-1 (library.json:issues object snapshotted onto rcf/blueprint-libraries.json:entries[] as issuesRepo and issuesVisibility on rcf library add; the review-on-add card prints the Feedback destination line naming repo and visibility), AC-15801-2 (destination.resolve walks entry -> manifest -> registry issuesRepo, falls back to sourceRef derivation for github URLs with derived:true, returns unresolved when neither is available; shelf and core route to Stravica/rcf-lite) and AC-15801-3 (rcf doctor --check feedback-destinations lists every registered library with no resolvable destination as a warn-only row with refusedByFix:true; exit stays 0).",
   "testLevel": "integration",
   "acIds": [
     "AC-15801-1",
     "AC-15801-2",
-    "AC-15801-3"
+    "AC-15801-3",
+    "AC-15801-4"
   ],
   "id": "TS-189",
   "usId": "US-15801",
@@ -32,6 +33,27 @@
       "description": "Cover AC-15801-3 via the CLI test: rcf doctor --check feedback-destinations --json against a project with two registered libraries (one with issues, one without) returns exactly one drift row of item unresolved-library naming the second library, whose message includes the publisher.contact from the registry entry and whose refusedByFix flag is true; the overall doctor exit code stays 0 because the check is warn-only.",
       "status": "pending",
       "testPointer": "test/cli/feedback-destinations.test.js::AC-15801-3: rcf doctor --check feedback-destinations warns on a library without a resolvable destination and exits 0"
+    },
+    {
+      "id": "TC-189-resolver-library-slug-inference-single",
+      "acId": "AC-15801-4",
+      "description": "Cover AC-15801-4 (single-library slug match) via the unit test: a bare-slug manifest record (no libraryPrefix) for 'application-spa' plus exactly one registered library ('wsd') that owns 'application-spa' and declares issuesRepo resolves to that library's declared destination with source 'library-slug-inference', derived false, kind library.",
+      "status": "pending",
+      "testPointer": "test/feedback/destination.test.js::AC-15801-4 library-slug-inference: bare-slug apply routes to the single library owning the slug when it declares issuesRepo"
+    },
+    {
+      "id": "TC-189-resolver-library-slug-inference-ambiguous",
+      "acId": "AC-15801-4",
+      "description": "Cover AC-15801-4 (multi-library slug ambiguity) via the unit test: a bare-slug manifest record for 'application-spa' plus two registered libraries ('wsd' and 'ally') that both own 'application-spa' and both declare issuesRepo resolves to unresolved, reason 'ambiguous-library-slug', with candidates ['ally','wsd'] (sorted).",
+      "status": "pending",
+      "testPointer": "test/feedback/destination.test.js::AC-15801-4 library-slug-inference: two libraries owning the same slug return unresolved with reason ambiguous-library-slug"
+    },
+    {
+      "id": "TC-189-resolver-library-slug-inference-none",
+      "acId": "AC-15801-4",
+      "description": "Cover AC-15801-4 (no-library fall-through) via the unit test: a bare-slug manifest record for 'security-auth-magic-link' plus registered libraries that do NOT own the slug falls through to the shelf constant unchanged from AC-15801-2.",
+      "status": "pending",
+      "testPointer": "test/feedback/destination.test.js::AC-15801-4 library-slug-inference: no library owns the slug -> shelf constant fall-through"
     }
   ],
   "status": "draft"

package/rcf/user-stories/us-15601.json

@@ -44,8 +44,17 @@
       "then": "preview surfaces the residual line and the tainted entry stays pending; submit exits 3 without a create/comment for that entry and without writing a bundle whose text carries the residual shape",
       "testable": true,
       "scope": "runtime"
+    },
+    {
+      "id": "AC-15601-5",
+      "description": "The operator-identity substitution (design section 5 rule 6) applies word-boundary and stopword guards so a common noun that happens to appear in the operator's identity name is not folded. A RESERVED_IDENTITY_TOKENS constant, exported from src/feedback/redact.js and defence-in-depth applied at every operator-name token loop, blocks the fold when the whitespace-separated token (case-insensitive) is one of: agent, agents, user, users, operator, operators, admin, admins, root, client, clients, server, servers, service, services, system, systems, name, main, test, code, api, apis, anon, anonymous, human, humans, dev, ops, sre, docs, developer, developers, engineer, engineers, team, teams. Substitution still fires for a real given name (Alice, Smith) even when the full identity string contains a stopword. The URL and prose canon phrase 'the agent files feedback' survives unmodified when the identity contains 'agent'. Rationale: the rcf-lite ecosystem uses 'agent' as a canonical noun (RULE 17, docs paths); operator-identity folds must be driven by real identity values, never by a bare common noun.",
+      "given": "a fixture project whose rcf/.identity/profile.md ## Name reads 'The Agent Alice', and a body containing the docs URL 'https://stravica.ai/docs/rcf/how-the-agent-files-feedback', the prose 'when the agent stops the queue', and the personal name 'Alice reviewed this'",
+      "when": "the redactor runs over the body with the seeded operator identity",
+      "then": "the docs URL survives verbatim; the prose 'when the agent stops the queue' survives verbatim; the personal name 'Alice' folds to <operator>; the ledger records an operator-identity row for 'Alice' but no row for 'agent' or 'the'",
+      "testable": true,
+      "scope": "runtime"
     }
   ],
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-17T00:36:18Z"
+  "updatedAt": "2026-09-17T13:47:03Z"
 }

package/rcf/user-stories/us-15801.json

@@ -35,8 +35,17 @@
       "then": "doctor output carries one feedback-destinations warn row naming the second library, --fix is not offered on that row, exit code stays 0",
       "testable": true,
       "scope": "runtime"
+    },
+    {
+      "id": "AC-15801-4",
+      "description": "The destination resolver cross-checks the registry BEFORE falling through to the shelf constant for `--kind blueprint` entries whose manifest record has no `libraryPrefix`. If exactly one registered library owns a blueprint with the applied slug AND that library resolves to a destination (issuesRepo, or a derivable git+https://github.com/... sourceRef), the resolver returns that library's destination with source: 'library-slug-inference' (derived: false for the declared case, derived: true for the sourceRef case). Two-or-more matches return unresolved with reason: 'ambiguous-library-slug' and a candidates[] array of library prefixes. Zero matches keep the current shelf-constant fall-through. This never overrides an existing libraryPrefix resolution: it only fires where the resolver would have picked the shelf constant.",
+      "given": "a fixture with three registered libraries and a bare-slug manifest record for 'application-spa'; case A: only library 'wsd' owns application-spa and declares issuesRepo 'wsd-team-dev/rcf-lite-blueprints'; case B: libraries 'wsd' and 'ally' both own application-spa and both declare issuesRepo; case C: no registered library owns application-spa",
+      "when": "destination.resolve() is called for each case",
+      "then": "case A resolves to 'wsd-team-dev/rcf-lite-blueprints' with source 'library-slug-inference' and derived false; case B resolves to unresolved with reason 'ambiguous-library-slug' and candidates ['ally','wsd']; case C resolves to Stravica/rcf-lite (shelf-constant fall-through), unchanged from AC-15801-2 shelf behaviour",
+      "testable": true,
+      "scope": "library"
     }
   ],
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-09-17T13:46:02.000Z"
 }

package/releases/releases.yaml

@@ -40,8 +40,18 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.28.0"
+latest: "0.28.1"
 releases:
+  - version: "0.28.1"
+    date: "2026-09-17"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.28.1 fixes three defects the first WSD-lens round-trip surfaced on 0.28.0. Feedback on a library-owned blueprint now reaches the library owner even when the blueprint was applied by its bare slug, so a colleague running rcf define blueprint add application-spa against a project with a registered WSD library that also owns application-spa no longer sees the finding silently routed to Stravica/rcf-lite."
+      - "The operator-identity redactor no longer folds the canonical noun agent when it appears in an operator's ## Name line. The docs URL how-the-agent-files-feedback and prose like when the agent stops survive; real given names still fold. A common-noun stopword set (agent, user, admin, api, code, system, and the rest) is exported as RESERVED_IDENTITY_TOKENS."
+      - "The rcf feedback add help text now names --evidence as required and repeatable, matching the shipped behaviour and AC-15501-1. A README callout box discloses the rename from the retired @stravica-ai/rcf-build-lite name to rcf-lite so a colleague hitting no matching version on the old name has a paste-ready recovery command."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.28.0"
     date: "2026-09-17"
     breaking: false

package/src/cli/feedback.js

@@ -136,8 +136,10 @@ Common options:
   --body <text> | --body-file <path>
                                 Body markdown, <= ${BODY_CAP_BYTES / 1024} KB
                                 after UTF-8 encoding.
-  --evidence <pointer>          Repeatable: a command, a path:line
-                                inside the project, or an id.
+  --evidence <pointer>          Required, repeatable: a command, a
+                                path:line inside the project, or an id.
+                                At least one --evidence is required
+                                (AC-15501-1); absence exits 2.
   --harness claude-code|codex|other
                                 Optional; inferred from env when absent.
   --ask-now                     Blocker shortcut; flags the batch so the
@@ -954,6 +956,13 @@ async function handlePreview(argv, ctx) {
       const reason = p.destination.reason ?? 'unresolved';
       const contact = p.destination.publisherContact ? ` (library contact: ${p.destination.publisherContact})` : '';
       stdout.write(`  no issue destination declared${p.destination.reason ? ` (${reason})` : ''}; bundle will be written${contact}\n`);
+      // AC-15801-4 / design amendment R5b: for ambiguous-library-slug
+      // surface the candidate library prefixes so the operator sees
+      // exactly which qualified refs would resolve it.
+      if (Array.isArray(p.destination.candidates) && p.destination.candidates.length > 0) {
+        const qualified = p.destination.candidates.map((prefix) => `${prefix}:<slug>`).join(', ');
+        stdout.write(`  candidate libraries owning this slug: ${p.destination.candidates.join(', ')} (re-apply with a qualified ref, e.g. ${qualified})\n`);
+      }
     }
     stdout.write(`fingerprint: ${p.fingerprint}\n`);
     if (p.fingerprintFallback) {

package/src/feedback/destination.js

@@ -7,7 +7,14 @@
 //
 // Resolution order (design section 3.3):
 //   1. --kind core                        -> CORE_REPO (public)
-//   2. --kind blueprint, no libraryPrefix -> CORE_REPO (shelf; public)
+//   2. --kind blueprint, no libraryPrefix -> library-slug inference
+//      (AC-15801-4 / design amendment R5a): if the applied slug is
+//      owned by exactly one registered library that resolves to a
+//      destination (issuesRepo or derivable sourceRef), route there
+//      with source: 'library-slug-inference'; if two or more libraries
+//      own the slug and resolve, return unresolved with reason
+//      'ambiguous-library-slug' and a candidates[] array of prefixes;
+//      otherwise fall through to CORE_REPO (shelf; public).
 //   3. --kind blueprint, libraryPrefix    -> registry entry issuesRepo
 //                                            (declared destination wins;
 //                                            visibility from the entry)
@@ -210,9 +217,10 @@ function recordEffectiveSlug(record) {
  * @property {'public' | 'private' | 'unresolved'} visibility
  * @property {'core' | 'shelf' | 'library'} kind
  * @property {boolean} derived            true when repo came from sourceRef derivation
- * @property {string} [reason]            filled on unresolved: 'no-issues-field' | 'no-github-source' | 'no-libraryprefix-record' | 'unknown-target'
+ * @property {string} [reason]            filled on unresolved: 'no-issues-field' | 'no-github-source' | 'no-libraryprefix-record' | 'unknown-target' | 'ambiguous-library-slug'
+ * @property {string[]} [candidates]      filled on unresolved with reason 'ambiguous-library-slug': sorted library prefixes owning the slug
  * @property {string} [publisherContact]  registry entry's publisher.contact (bundle uses it)
- * @property {string} [source]            'library-manifest' | 'sourceRef-derivation' | 'package-bugs-url' | 'shelf-constant'
+ * @property {string} [source]            'library-manifest' | 'sourceRef-derivation' | 'package-bugs-url' | 'shelf-constant' | 'library-slug-inference'
  */
 
 /**
@@ -263,8 +271,27 @@ export async function resolve(entry, context = {}) {
 
   const libraryPrefix = record.libraryPrefix ?? entry?.target?.libraryPrefix ?? null;
 
-  // Shelf blueprint (no libraryPrefix) -> Stravica/rcf-lite.
+  // Shelf blueprint (no libraryPrefix on the manifest record). Before
+  // falling through to the shelf constant, cross-check the registry:
+  // if exactly one registered library owns a blueprint with the applied
+  // slug AND that library resolves to a destination, route to that
+  // library so a bare-slug apply of a library-shared name still lands
+  // on the library owner's repo (design amendment R5, AC-15801-4).
   if (!libraryPrefix) {
+    const inferred = inferLibraryFromSlug(record, registry);
+    if (inferred.kind === 'single') {
+      return inferred.destination;
+    }
+    if (inferred.kind === 'ambiguous') {
+      return {
+        repo: null,
+        visibility: 'unresolved',
+        kind: 'library',
+        derived: false,
+        reason: 'ambiguous-library-slug',
+        candidates: inferred.candidates,
+      };
+    }
     return {
       repo: CORE_REPO,
       visibility: 'public',
@@ -359,3 +386,70 @@ function findLibraryEntry(registry, libraryPrefix) {
   const libs = Array.isArray(registry?.libraries) ? registry.libraries : [];
   return libs.find((l) => l?.libraryPrefix === libraryPrefix) ?? null;
 }
+
+/**
+ * AC-15801-4 / design amendment R5a: given a manifest record with no
+ * libraryPrefix, cross-check the registry to see whether the applied
+ * slug is owned by exactly one registered library that resolves to a
+ * destination. Returns:
+ *   { kind: 'none' }                                 no library owns the slug (or none resolve)
+ *   { kind: 'single', destination }                  exactly one library owns the slug and resolves
+ *   { kind: 'ambiguous', candidates: string[] }      two or more libraries own the slug and resolve
+ *
+ * The resolver only calls this on the shelf-constant fall-through
+ * branch, so it never overrides an existing libraryPrefix resolution.
+ *
+ * @param {object} record                              manifest.blueprints[] record
+ * @param {object | null | undefined} registry         parsed rcf/blueprint-libraries.json
+ */
+function inferLibraryFromSlug(record, registry) {
+  const slug = typeof record?.slug === 'string' ? record.slug : null;
+  if (!slug) return { kind: 'none' };
+  const libs = Array.isArray(registry?.libraries) ? registry.libraries : [];
+  const owners = [];
+  for (const lib of libs) {
+    if (!lib || typeof lib !== 'object') continue;
+    if (typeof lib.libraryPrefix !== 'string' || lib.libraryPrefix.length === 0) continue;
+    const bps = Array.isArray(lib.blueprints) ? lib.blueprints : [];
+    const owns = bps.some((b) => b && typeof b.slug === 'string' && b.slug === slug);
+    if (!owns) continue;
+    const declared = typeof lib.issuesRepo === 'string' && lib.issuesRepo.length > 0 ? lib.issuesRepo : null;
+    const derivedRepo = declared ? null : parseGithubSource(lib.sourceRef ?? '');
+    if (!declared && !derivedRepo) continue;
+    const contact = typeof lib?.publisher?.contact === 'string' ? lib.publisher.contact : undefined;
+    owners.push({ lib, declared, derivedRepo, contact });
+  }
+  if (owners.length === 0) return { kind: 'none' };
+  if (owners.length === 1) {
+    const [o] = owners;
+    if (o.declared) {
+      const declaredVisibility = o.lib.issuesVisibility === 'private' ? 'private'
+        : o.lib.issuesVisibility === 'public' ? 'public'
+          : 'public';
+      return {
+        kind: 'single',
+        destination: {
+          repo: o.declared,
+          visibility: declaredVisibility,
+          kind: 'library',
+          derived: false,
+          source: 'library-slug-inference',
+          ...(o.contact ? { publisherContact: o.contact } : {}),
+        },
+      };
+    }
+    return {
+      kind: 'single',
+      destination: {
+        repo: o.derivedRepo,
+        visibility: 'public',
+        kind: 'library',
+        derived: true,
+        source: 'library-slug-inference',
+        ...(o.contact ? { publisherContact: o.contact } : {}),
+      },
+    };
+  }
+  const candidates = owners.map((o) => o.lib.libraryPrefix).sort();
+  return { kind: 'ambiguous', candidates };
+}

package/src/feedback/redact.js

@@ -32,6 +32,26 @@ const BUNDLED_ALLOWLIST = JSON.parse(
 /** Body size cap (bytes). Mirrors src/cli/feedback.js:BODY_CAP_BYTES. */
 export const BODY_CAP_BYTES = 8 * 1024;
 
+/**
+ * Common-noun stopwords the operator-identity substitution never folds
+ * (AC-15601-5 / design amendment R5c). The rcf-lite ecosystem uses
+ * `agent` as a canonical noun (RULE 17, docs paths such as
+ * `how-the-agent-files-feedback`); if the operator's identity name
+ * happens to contain one of these words, the token loop skips it so
+ * the docs URL and prose like `when the agent stops` survive. Real
+ * given names in the identity still fold. The list is intentionally
+ * conservative: anything a normal profile.md ## Name line might carry
+ * as a common English or engineering noun.
+ */
+export const RESERVED_IDENTITY_TOKENS = Object.freeze(new Set([
+  'agent', 'agents', 'user', 'users', 'operator', 'operators',
+  'admin', 'admins', 'root', 'client', 'clients', 'server', 'servers',
+  'service', 'services', 'system', 'systems', 'name', 'main', 'test',
+  'code', 'api', 'apis', 'anon', 'anonymous', 'human', 'humans',
+  'dev', 'ops', 'sre', 'docs', 'developer', 'developers', 'engineer',
+  'engineers', 'team', 'teams',
+]));
+
 /**
  * Open secret-key vocabulary (design amendment R3a). A key/value pair
  * is treated as a secret when the key, right-bounded at a word edge so
@@ -389,9 +409,20 @@ export function redact(input, context = {}) {
   if (context.operatorName) {
     const opName = context.operatorName.trim();
     if (opName.length > 0) {
-      text = replaceAndLog(text, escapedLiteral(opName), '<operator>', 'operator-identity', ledger);
-      for (const tok of opName.split(/\s+/)) {
-        if (tok.length > 3) {
+      // AC-15601-5 / design amendment R5c: never fold a common noun
+      // that happens to appear in the identity string. The rcf-lite
+      // ecosystem uses 'agent' as a canonical noun (RULE 17, docs
+      // paths); folding it as operator-identity mangles the docs URL
+      // `how-the-agent-files-feedback` and prose like `when the
+      // agent stops`. Substitution still fires for a real given name
+      // (Alice, Smith) even when the full identity string carries a
+      // stopword. When the identity contains ONLY stopwords (a
+      // placeholder-in-disguise), skip identity folds entirely.
+      const rawTokens = opName.split(/\s+/);
+      const foldable = rawTokens.filter((t) => t.length > 3 && !RESERVED_IDENTITY_TOKENS.has(t.toLowerCase()));
+      if (foldable.length > 0) {
+        text = replaceAndLog(text, escapedLiteral(opName), '<operator>', 'operator-identity', ledger);
+        for (const tok of foldable) {
           text = replaceAndLog(text, `\\b${escapeRe(tok)}\\b`, '<operator>', 'operator-identity', ledger);
         }
       }
@@ -399,7 +430,7 @@ export function redact(input, context = {}) {
   }
   if (context.projectName) {
     const pn = context.projectName.trim();
-    if (pn.length > 0) {
+    if (pn.length > 0 && !RESERVED_IDENTITY_TOKENS.has(pn.toLowerCase())) {
       text = replaceAndLog(text, `\\b${escapeRe(pn)}\\b`, '<project>', 'operator-identity', ledger);
     }
   }
@@ -846,6 +877,15 @@ function looksHighEntropyPath(value) {
   if (typeof value !== 'string') return false;
   if (value.length < 16) return false;
   if (!/^[A-Za-z0-9._~+/=-]+$/.test(value)) return false;
+  // AC-15601-5 canon-phrase guard: a lowercase kebab-case segment with
+  // three or more hyphen-separated word parts is a documentation slug,
+  // not a credential. The rcf-lite docs URL
+  // `how-the-agent-files-feedback` is 28 chars, 2 classes (lowercase
+  // and separator), and would otherwise trip the 16-char, 2-class rule
+  // and produce `<url-credential>` inside the docs URL. Real credential
+  // segments in URL paths (webhook tokens, session ids, presigned
+  // credentials) are mixed-case-alphanumeric, not kebab-case English.
+  if (/^[a-z]+(-[a-z]+){2,}$/.test(value)) return false;
   let classes = 0;
   if (/[A-Z]/.test(value)) classes += 1;
   if (/[a-z]/.test(value)) classes += 1;