rcf-lite 0.28.1 → 0.28.4

package/rcf/test-suites/ts-214.json

@@ -0,0 +1,74 @@
+{
+  "createdAt": "2026-09-24T12:00:00Z",
+  "updatedAt": "2026-09-24T12:00:00Z",
+  "purpose": "Cover the delta-detection primitives (hashDocument, computeTreeHash, computeDelta) and the freeze record I/O (load, save, validate) against AC-17201-1..4 on US-17201.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-17201-1",
+    "AC-17201-2",
+    "AC-17201-3",
+    "AC-17201-4"
+  ],
+  "id": "TS-214",
+  "usId": "US-17201",
+  "title": "Delta detection and freeze record primitives",
+  "testCases": [
+    {
+      "id": "TC-214-delta-shape",
+      "acId": "AC-17201-1",
+      "description": "computeDelta returns the shape proposal section 2.2 pins: frozen / frozenAt / treeHash / currentTreeHash / changed / added / removed / briefSince / unchanged, and classifies changed / added / removed correctly against a divergent freeze record.",
+      "status": "pending",
+      "testPointer": "test/query/delta.test.js::delta: changed / added / removed classify against the freeze record"
+    },
+    {
+      "id": "TC-214-unchanged",
+      "acId": "AC-17201-1",
+      "description": "A tree that matches the freeze record produces empty changed / added / removed lists and unchanged equal to the docHashes count.",
+      "status": "pending",
+      "testPointer": "test/query/delta.test.js::delta: an unchanged tree against a matching freeze reports empty changed/added/removed"
+    },
+    {
+      "id": "TC-214-canonical",
+      "acId": "AC-17201-2",
+      "description": "hashDocument is invariant under a whitespace-only reformat: two documents that parse to the same object hash identically and produce zero changed entries in the delta.",
+      "status": "pending",
+      "testPointer": "test/query/delta.test.js::delta: a whitespace-only reformat of a document produces zero changed ids"
+    },
+    {
+      "id": "TC-214-hash-shape",
+      "acId": "AC-17201-2",
+      "description": "hashDocument returns a sha256:<64-hex> string over the canonical JSON form of the parsed document.",
+      "status": "pending",
+      "testPointer": "test/query/delta.test.js::delta: hashDocument returns a sha256:<64-hex> string over the canonical form"
+    },
+    {
+      "id": "TC-214-freeze-missing",
+      "acId": "AC-17201-3",
+      "description": "loadFreezeRecord returns null when rcf/define/freeze.json is absent; a malformed body raises FreezeRecordError with the parseFailure code.",
+      "status": "pending",
+      "testPointer": "test/define/freeze-record.test.js::freeze-record: a malformed JSON body raises FreezeRecordError with parseFailure code"
+    },
+    {
+      "id": "TC-214-freeze-schema",
+      "acId": "AC-17201-3",
+      "description": "A body with a non-sha256 docHashes value is refused with a FreezeRecordError naming the failing docHashes.<id> field.",
+      "status": "pending",
+      "testPointer": "test/define/freeze-record.test.js::freeze-record: docHashes with a non-sha256 value is refused"
+    },
+    {
+      "id": "TC-214-roundtrip",
+      "acId": "AC-17201-4",
+      "description": "saveFreezeRecord followed by loadFreezeRecord round-trips every field including unknown extension fields (counts, litmus, versions, note).",
+      "status": "pending",
+      "testPointer": "test/define/freeze-record.test.js::freeze-record: unknown top-level fields survive a save/load round trip"
+    },
+    {
+      "id": "TC-214-refuse-invalid-write",
+      "acId": "AC-17201-4",
+      "description": "saveFreezeRecord refuses an invalid record and writes nothing to disk.",
+      "status": "pending",
+      "testPointer": "test/define/freeze-record.test.js::freeze-record: saveFreezeRecord refuses to write an invalid record"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-215.json

@@ -0,0 +1,67 @@
+{
+  "createdAt": "2026-09-24T12:00:00Z",
+  "updatedAt": "2026-09-24T12:00:00Z",
+  "purpose": "Cover the four sidecar ledgers, the rcf define ledger CLI (add / resolve / list with --json) and the walker-invisibility invariant on rcf/define/ against AC-17301-1..4 on US-17301.",
+  "testLevel": "integration",
+  "acIds": [
+    "AC-17301-1",
+    "AC-17301-2",
+    "AC-17301-3",
+    "AC-17301-4"
+  ],
+  "id": "TS-215",
+  "usId": "US-17301",
+  "title": "Sidecar ledgers, rcf define ledger and walker invisibility",
+  "testCases": [
+    {
+      "id": "TC-215-brief-add-text",
+      "acId": "AC-17301-1",
+      "description": "rcf define ledger brief add --text mints id 1 with status open, kind capability by default, and writes rcf/define/brief-ledger.json.",
+      "status": "pending",
+      "testPointer": "test/cli/ledger.test.js::ledger CLI: brief add --text appends a numbered statement"
+    },
+    {
+      "id": "TC-215-brief-refuse-mixed",
+      "acId": "AC-17301-1",
+      "description": "rcf define ledger brief add refuses conflicting --text and --from with a usage-class error (exit 2).",
+      "status": "pending",
+      "testPointer": "test/cli/ledger.test.js::ledger CLI: brief add refuses conflicting --text and --from with a usage error"
+    },
+    {
+      "id": "TC-215-decisions-list-241",
+      "acId": "AC-17301-2",
+      "description": "rcf define ledger decisions list prints the numbered #241 format: question, options as 'letter) text', default and blocks labelled on their own lines.",
+      "status": "pending",
+      "testPointer": "test/cli/ledger.test.js::ledger CLI: decisions list prints the numbered #241 format"
+    },
+    {
+      "id": "TC-215-list-json",
+      "acId": "AC-17301-2",
+      "description": "rcf define ledger <name> list --json emits { ledger, <arrayKey>: [...] } with the same body loadLedger returns.",
+      "status": "pending",
+      "testPointer": "test/cli/ledger.test.js::ledger CLI: list --json emits the machine-readable envelope"
+    },
+    {
+      "id": "TC-215-brief-from-file",
+      "acId": "AC-17301-3",
+      "description": "rcf define ledger brief add --from <file> splits by non-empty lines, mints sequential ids and writes every statement with the resolved kind.",
+      "status": "pending",
+      "testPointer": "test/cli/ledger.test.js::ledger CLI: brief add --from <file> splits by non-empty line"
+    },
+    {
+      "id": "TC-215-parse-brief-bullets",
+      "acId": "AC-17301-3",
+      "description": "parseBriefFromFile strips leading '- ', '* ' and '<n>. ' bullets so drafts match the raw statement text.",
+      "status": "pending",
+      "testPointer": "test/define/ledgers.test.js::ledgers: parseBriefFromFile splits by non-empty lines and strips bullets"
+    },
+    {
+      "id": "TC-215-walker-invisible",
+      "acId": "AC-17301-4",
+      "description": "walkTree run over a project seeded with rcf/define/freeze.json, the four ledger files and a bug-bait req-999.json under rcf/define/ never surfaces any rcf/define/ path in errors or byId.",
+      "status": "pending",
+      "testPointer": "test/store/walker-invisible-define.test.js::walkTree never surfaces rcf/define/ files as documents in byId"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-216.json

@@ -0,0 +1,78 @@
+{
+  "createdAt": "2026-09-24T14:30:00Z",
+  "updatedAt": "2026-09-24T14:30:00Z",
+  "purpose": "Cover the DEFINE stage-gate check functions D1..D8 (AC-17401-1..8) with unit tests over hand-built TreeModel and ledger fixtures.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-17401-1",
+    "AC-17401-2",
+    "AC-17401-3",
+    "AC-17401-4",
+    "AC-17401-5",
+    "AC-17401-6",
+    "AC-17401-7",
+    "AC-17401-8"
+  ],
+  "id": "TS-216",
+  "usId": "US-17401",
+  "title": "Stage gates D1..D8 check functions",
+  "testCases": [
+    {
+      "id": "TC-216-shape",
+      "acId": "AC-17401-1",
+      "description": "Every check function returns { stage, gate, state, checks[] } and every entry in checks[] is { name, ok, over: 'delta'|'tree', pass, total, failing }; failing is empty when ok is true.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates: every check function returns the section 2.4 shape"
+    },
+    {
+      "id": "TC-216-blocking-vs-warn",
+      "acId": "AC-17401-2",
+      "description": "Blocking stages fold to failing on any check.ok false; warn-with-ack stages (D3, D5, D6) also fold to failing on any check.ok false unless freeze.gates[<gate>].state === 'acknowledged' AND at.hash === currentTreeHash.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates: warn-with-ack fold honours freeze.gates acknowledgement at the current hash"
+    },
+    {
+      "id": "TC-216-not-applicable",
+      "acId": "AC-17401-3",
+      "description": "notApplicable is decided per stage per section 3.2: D2 with no statement of a resolving kind and no REQ/PRD/TAD in scope; D3 with no TAC and no shaped REQ in scope; D5 with no REQ in scope; D7 with no open decisions and profile.skipReviewFor 'singleDocument' and one-document delta.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates: notApplicable decision per stage"
+    },
+    {
+      "id": "TC-216-d4-floors",
+      "acId": "AC-17401-4",
+      "description": "checkD4Stories enforces every REQ has US, every US has testable AC + failure AC (parsed by [failure] prefix or opt-out with baselineKey 'defineD4:failure') + must-not AC (or opt-out with 'defineD4:mustNot'), tacIds non-empty and resolving, no TODO placeholder in AC.description.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates: D4 floors and per-class opt-outs"
+    },
+    {
+      "id": "TC-216-d3-shapes",
+      "acId": "AC-17401-5",
+      "description": "checkD3Shapes runs only the cheap data-backed checks: every TAC in scope has at least one interface, and every interface kind is in the closed vocabulary. Unknown kinds show up in failing[].",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates: D3 interface presence and kind vocabulary"
+    },
+    {
+      "id": "TC-216-d5-crosscut",
+      "acId": "AC-17401-6",
+      "description": "checkD5Crosscut checks TAD.securityArchitecture presence when any REQ has shape 'auth' or 'httpApi'; TAD.operationalConcerns when any AC has '[deployed]' marker; no dangling 'open' concerns on in-scope REQs.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates: D5 crosscut cheap checks"
+    },
+    {
+      "id": "TC-216-d6-consistency",
+      "acId": "AC-17401-7",
+      "description": "checkD6Consistency asserts validateErrors is empty tree-wide and probeOpenCount is zero; the richer scans are named seams (0.30).",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates: D6 consistency validate + probe count"
+    },
+    {
+      "id": "TC-216-d8-freeze",
+      "acId": "AC-17401-8",
+      "description": "checkD8Freeze asserts prior stages passed/acknowledged, every AC owned by exactly one FBS, computeQueue nextActionable not null, validateErrors empty.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates: D8 tree-wide freeze checks"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-217.json

@@ -0,0 +1,62 @@
+{
+  "createdAt": "2026-09-24T14:30:00Z",
+  "updatedAt": "2026-09-24T14:30:00Z",
+  "purpose": "Cover computeReadiness and the rcf define readiness CLI (AC-17501-1..6) with unit tests over fixture trees + a CLI spawn, plus a targeted test of the P3 loadAllLedgers fix.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-17501-1",
+    "AC-17501-2",
+    "AC-17501-3",
+    "AC-17501-4",
+    "AC-17501-5",
+    "AC-17501-6"
+  ],
+  "id": "TS-217",
+  "usId": "US-17501",
+  "title": "computeReadiness and rcf define readiness CLI",
+  "testCases": [
+    {
+      "id": "TC-217-shape",
+      "acId": "AC-17501-1",
+      "description": "computeReadiness returns { tree, delta, stages, nextAction, coverage, decisions, freezeable } and freezeable is true when every stage state is in { passed, acknowledged, notApplicable }.",
+      "status": "pending",
+      "testPointer": "test/query/readiness.test.js::readiness: returns the section 2.4 shape and freezeable folds correctly"
+    },
+    {
+      "id": "TC-217-fanout",
+      "acId": "AC-17501-2",
+      "description": "Fan-out: computeImpact runs once per id in changed union added; impacted is the deduplicated union; impactedFbs is the subset with kind 'fbs' AND actionNeeded 're-execute'.",
+      "status": "pending",
+      "testPointer": "test/query/readiness.test.js::readiness: fan-out impacted / impactedFbs (frozen delta)"
+    },
+    {
+      "id": "TC-217-coverage",
+      "acId": "AC-17501-3",
+      "description": "coverage.tree is a tree-wide CoverageResult; coverage.delta is one CoverageResult per unique REQ ancestor of the delta ids.",
+      "status": "pending",
+      "testPointer": "test/query/readiness.test.js::readiness: coverage tree-wide and per REQ ancestor"
+    },
+    {
+      "id": "TC-217-next-action",
+      "acId": "AC-17501-4",
+      "description": "nextAction picks the first failing stage in D1..D8 order and the first failing check inside it, listing ids and a rcf define readiness --check <short-name> command; null when no stage is failing.",
+      "status": "pending",
+      "testPointer": "test/query/readiness.test.js::readiness: nextAction picks first failing stage and check"
+    },
+    {
+      "id": "TC-217-cli",
+      "acId": "AC-17501-5",
+      "description": "The CLI prints text summary by default and JSON with --json; --check <stage> exits 4 on blocking failure, 0 with a [warn] on warn-with-ack unacknowledged failure, 0 otherwise; admissibility refusal exits 4.",
+      "status": "pending",
+      "testPointer": "test/cli/readiness.test.js::readiness cli: text output shape and --check exit codes"
+    },
+    {
+      "id": "TC-217-load-all-ledgers",
+      "acId": "AC-17501-6",
+      "description": "loadAllLedgers omits ledgers whose files are absent so computeDelta records no docHash for absent ledgers; a project with only brief-ledger.json sees exactly one ledger:brief docHash.",
+      "status": "pending",
+      "testPointer": "test/define/ledgers.test.js::ledgers: loadAllLedgers omits absent ledger files"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-15601.json

@@ -53,8 +53,17 @@
       "then": "the docs URL survives verbatim; the prose 'when the agent stops the queue' survives verbatim; the personal name 'Alice' folds to <operator>; the ledger records an operator-identity row for 'Alice' but no row for 'agent' or 'the'",
       "testable": true,
       "scope": "runtime"
+    },
+    {
+      "id": "AC-15601-6",
+      "description": "The rule-4 bare-hostname redactor treats filename tokens carrying a known file extension as NOT hostnames. A candidate hostname match whose trailing dot-label is in a bundled FILE_EXTENSIONS set (initially md, mdx, json, yml, yaml, txt, js, mjs, cjs, ts, tsx, html, css, png, svg, sh, csv, log, lock) is left intact and no ledger row is written for it (design amendment R5d). The negative lookbehind on the hostname regex additionally excludes '-' so that filename fragments embedded in a larger identifier (`Backstory-product-brief.md`) cannot start a match after a hyphen. The extension shortlist is merged at call time from an `extensions` array on src/feedback/redact-allowlist.json alongside the existing `hosts` field, so operators can extend it the same way they extend hosts. Design amendment R5e (added 0.28.3 per HQ 2026-09-22 ruling on Codex P1-5 deferred from PR #242): candidate hostnames whose trailing dot-label is a single letter are also treated as filename fragments, not hostnames. Rationale: single-letter TLDs are not registrable domains in normal prose and folding them yields more false positives (short identifiers, abbreviated references) than legitimate hostname redactions. Design amendment R5f (added 0.28.3, #243): the rule-3 email regex is bounded so it does not consume the git protocol sentinel `git@<host>` inside a URL whose scheme is `git+ssh://`, `ssh://` or `git://`, nor the bare git-remote shape `git@<host>:<owner>/<repo>` (colon followed by a non-space path). Rationale: `git@<host>` is a URI userinfo construct, not an email; folding it destroys evidence pointers copied from git remotes and clone URLs. Real email addresses in surrounding prose still fold. Design amendment R5g (added 0.28.3, #246): when the operator identity Name (rcf/.identity/profile.md ## Name) is empty, whitespace only, or contains only reserved-noun tokens (RESERVED_IDENTITY_TOKENS from AC-15601-5), buildRedactionContext emits a one-line visible warning to stderr naming the file and stating that identity folding is disabled. The warning is emitted once per redaction context build. Folding still skips (per AC-15601-5) but the operator is no longer left thinking their identity is in force.",
+      "given": "a fixture project with a body containing the tokens 'Backstory-product-brief.md', 'intake.json', 'report.log', 'foo.example.com', 'foo.example.com/path', 'Backstory-example.com', 'a.b.c', the URL 'git+ssh://git@github.com/owner/repo.git#v1.0.0', the URL 'ssh://git@example.internal/owner/repo.git', the bare git remote 'git@github.com:owner/repo.git', and a prose email 'alice@example.com'; and a rcf/.identity/profile.md whose ## Name line is either absent, whitespace only, or reads 'The Agent Operator' (stopword-only)",
+      "when": "the redactor runs over the body with the default allowlist",
+      "then": "'Backstory-product-brief.md', 'intake.json' and 'report.log' survive verbatim with no ledger row for a hostname substitution on their basename; 'foo.example.com' folds to <host> via rule 4; 'foo.example.com/path' folds via rule 4 bare-host (the URL rule requires a scheme; the token here has none); 'Backstory-example.com' folds to '<host>' (the trailing label is not in the extension set); 'a.b.c' survives verbatim with no hostname ledger row (single-letter trailing label per R5e); 'git+ssh://git@github.com/owner/repo.git#v1.0.0' survives verbatim - the `git@` sentinel is NOT rewritten by the email rule (R5f) and github.com is on the allowlist; 'ssh://git@example.internal/owner/repo.git' has the `git@` sentinel preserved (R5f stash) and the host `example.internal` folded to '<host>' by the extended URL rule 4 which now matches ssh/git+ssh/git schemes with optional userinfo; 'git@github.com:owner/repo.git' has the `git@` sentinel preserved (R5f) and github.com is on the allowlist so it survives verbatim; 'alice@example.com' in surrounding prose still folds to '<email>' (rule 3 email); and when the identity Name is empty/whitespace/stopword-only, stderr carries exactly one visible warning line naming rcf/.identity/profile.md and stating that identity folding is disabled. Extending the allowlist with `extensions: [\"xyz\"]` in redact-allowlist.json (or the operator overlay) makes 'file.xyz' also survive.",
+      "testable": true,
+      "scope": "runtime"
     }
   ],
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-17T13:47:03Z"
+  "updatedAt": "2026-09-22T13:07:00Z"
 }

package/rcf/user-stories/us-15701.json

@@ -20,10 +20,10 @@
     },
     {
       "id": "AC-15701-2",
-      "description": "On submit, per pending entry, gh search issues is called for the destination repo with query \"rcf-feedback-fingerprint: <fp>\", --match body, --state open, --limit 5. Exactly one hit: gh issue comment on that number, comment body carries \"+1 from another reporter\" plus the Environment table and the redacted body only when it differs from the original by more than the environment lines. Zero hits: gh issue create. More than one hit: comment on the lowest number and mention the others.",
-      "given": "a fake gh module (via RCF_FEEDBACK_GH_MODULE) whose search stub yields zero, one and two hits in three sequential invocations, and one pending entry per case",
-      "when": "rcf feedback submit --yes runs three times",
-      "then": "the zero-hit case calls gh issue create; the one-hit case calls gh issue comment on the returned number; the two-hit case calls gh issue comment on the smaller number and includes \"also see #<other>\" in the comment body",
+      "description": "On submit, per pending entry, gh search issues is called for the destination repo with query \"rcf-feedback-fingerprint: <fp>\", --match body, --state open, --limit 5. For every returned candidate, submit re-reads the candidate issue body via gh issue view --json body (ghIssueGetBody) and folds ONLY if the body contains a line exactly matching \"rcf-feedback-fingerprint: <fp>\" on its own; a search hit whose body does not carry that exact line is a NON-MATCH and is discarded. Anchor and target must also match the entry's anchor and target; folding across a differing anchor or target is refused even when the fingerprint lines are equal. Zero verified hits: gh issue create; the stdout row reports \"created #N (<title>)\". One or more verified hits: gh issue comment on the lowest-numbered verified issue, mention any other verified hits in the comment body, and post the FULL rendered report (title as a \"## Report\" heading, then the redacted body, then evidence and environment tables, then the fingerprint line), labelled as \"Apparent duplicate of the issue subject; posting the full report so a human can judge.\" The retired \"+1 from another reporter.\" payload is never posted. The stdout row on the fold path reports \"commented on #N (fingerprint match: <title>)\" so a wrong match is visible on the same line a human already sees.",
+      "given": "a fake gh module (via RCF_FEEDBACK_GH_MODULE) whose ghIssueSearch stub yields zero, one and two hits in three sequential invocations, and one pending entry per case; and a second fixture where ghIssueSearch returns a candidate whose ghIssueGetBody body carries a DIFFERENT fingerprint line to the entry; and a third fixture where the candidate body's fingerprint matches but the candidate's anchor or target field differs from the entry's",
+      "when": "rcf feedback submit --yes runs against each fixture",
+      "then": "the zero-hit case creates and prints \"created #N (<title>)\"; the one-hit case with a verified fingerprint match comments on the returned number, the comment body carries the full rendered report (title + body + evidence + environment + fingerprint), the string \"+1 from another reporter.\" is absent, and the stdout row prints \"commented on #N (fingerprint match: <title>)\"; the two-hit case comments on the smaller number and mentions the other verified number; the different-fingerprint fixture and the differing-anchor/target fixture both fall through to create rather than comment",
       "testable": true,
       "scope": "runtime"
     },

package/rcf/user-stories/us-17001.json

@@ -0,0 +1,27 @@
+{
+  "usId": "US-17001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: shape grouping",
+  "description": "User story under REQ-170. a product reader reviewing the requirements chain the Product Map tab to bucket requirements by shapeClassification.shapes[], with an \"Unclassified\" bucket for REQs missing the classification and a \"Business rules\" bucket for the \"none\" shape",
+  "asA": "a product reader reviewing the requirements chain",
+  "iWant": "the Product Map tab to bucket requirements by shapeClassification.shapes[], with an \"Unclassified\" bucket for REQs missing the classification and a \"Business rules\" bucket for the \"none\" shape",
+  "soThat": "I can see at a glance which requirements sit in each surface area (webUi, httpApi, auth, persistence, notifications, business rules) without reading every REQ body",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17001-1",
+      "description": "The rendered review-surface HTML carries a \"product-map\" tab (data-tab=\"product-map\") in tab order after Build sequence, with a hidden tabpanel id \"tab-product-map\" containing a shape-grouping section whose bucket headings enumerate every shape the classified REQs use plus \"Unclassified\" and \"Business rules\". A REQ classified into two shapes appears in both buckets. Rendering does not require a schema change.",
+      "testable": true
+    },
+    {
+      "id": "AC-17001-2",
+      "description": "Selecting the shape grouping drills each bucket to its REQs (rendered with the same doc-details helper and status pill as the Requirements tab), each REQ to its user stories, and each user story to its acceptance criteria, so the reader can go from a shape bucket to an AC in the same tab. Grouping button clicks and status filter changes push a new history entry (Back/Forward traverse them); top-level tab clicks keep their existing behaviour.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:43:06.307Z"
+}

package/rcf/user-stories/us-17002.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: status filter",
+  "description": "User story under REQ-170. a reviewer preparing a sign-off pass a status filter (all, draft, review, needsRevision, approved, superseded) on the Product Map tab that applies to whichever grouping is active",
+  "asA": "a reviewer preparing a sign-off pass",
+  "iWant": "a status filter (all, draft, review, needsRevision, approved, superseded) on the Product Map tab that applies to whichever grouping is active",
+  "soThat": "I can narrow the tab to just the \"approved\" or just the \"needsRevision\" REQs without switching tabs or scanning by hand",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17002-1",
+      "description": "The Product Map tab carries a status filter control whose options are the five authoring statuses plus \"all\", and applies to every grouping on the tab. When \"approved\" is selected the tab renders only REQs whose status is approved. Buckets that become empty under the current filter are hidden by default with a summary line (\"N empty\" - clicking reveals them), so the map keeps its shape without rendering a wall of empty headings.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T18:36:17.135Z"
+}

package/rcf/user-stories/us-17003.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17003",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: component-first grouping",
+  "description": "User story under REQ-170. a technical reviewer wanting to see requirements from the architecture down a component grouping rooted at the TAD, showing each TAC (with its dependencies) at level 1, the user stories linked to that TAC at level 2, each story's parent REQ at level 3, and its ACs at level 4, plus an \"Unmapped\" bucket for REQs no component reaches",
+  "asA": "a technical reviewer wanting to see requirements from the architecture down",
+  "iWant": "a component grouping rooted at the TAD, showing each TAC (with its dependencies) at level 1, the user stories linked to that TAC at level 2, each story's parent REQ at level 3, and its ACs at level 4, plus an \"Unmapped\" bucket for REQs no component reaches",
+  "soThat": "I can pivot from a component to the requirements it delivers without leaving the tab",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17003-1",
+      "description": "When the Product Map is grouped by component, the tab renders the TAD as the root, one section per TAC (with a short dependencies[] list drawn from the TAC document), then the user stories under that TAC (from usByTacId), then their parent REQs (from us.reqId), then the ACs. REQs reachable by no TAC are collected under an \"Unmapped\" bucket with a count in its heading.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z"
+}

package/rcf/user-stories/us-17004.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17004",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: trace-coverage grouping",
+  "description": "User story under REQ-170. a reviewer about to sign a chain off a trace-coverage grouping that buckets each REQ by chain completeness (complete, missing stories, missing AC scope or owner, missing component owner, missing tests)",
+  "asA": "a reviewer about to sign a chain off",
+  "iWant": "a trace-coverage grouping that buckets each REQ by chain completeness (complete, missing stories, missing AC scope or owner, missing component owner, missing tests)",
+  "soThat": "I can see which requirements are safe to sign off and which still need work",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17004-1",
+      "description": "The trace-coverage grouping buckets each REQ into one of complete | missing-stories | missing-ac-scope | missing-component | missing-tests, computed from the tree-model maps (storiesByReqId, acIdsByUsId, usByTacId, tsByAcId / tcsByAcId / fbsByAcId). Each REQ row states in plain text exactly what is missing, and links to its own doc anchor so the reader can jump to it.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z"
+}

package/rcf/user-stories/us-17005.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17005",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: capability grouping",
+  "description": "User story under REQ-170. a product reader thinking in capabilities rather than technical shape a capability grouping that reads capability:<slug> entries from REQ.tags[] and buckets requirements per capability",
+  "asA": "a product reader thinking in capabilities rather than technical shape",
+  "iWant": "a capability grouping that reads capability:<slug> entries from REQ.tags[] and buckets requirements per capability",
+  "soThat": "I can see the product as a set of capabilities and drill into each capability's REQs, stories and ACs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17005-1",
+      "description": "The capability grouping enumerates one bucket per distinct capability:<slug> value present on any REQ across the tree. A REQ carrying multiple capability tags appears under each. REQs whose tags carry no capability:<slug> entry are collected under an \"Unclassified\" bucket. Slugs are rendered as their kebab form in the heading; named capability buckets are ordered by REQ count desc, then alphabetically, and the Unclassified bucket is always pinned last.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:43:06.511Z"
+}

package/rcf/user-stories/us-17006.json

@@ -0,0 +1,21 @@
+{
+  "createdAt": "2026-09-21T18:36:23.922Z",
+  "updatedAt": "2026-09-21T18:36:52.280Z",
+  "description": "a product reader who returns to the tab across sessions collapsed-by-default buckets, a jump-nav index across the top, per-bucket status mini-counts, hash-encoded open buckets so a bookmarked URL restores tab plus grouping plus filter plus open buckets, and compact REQ cards with drill-down (raw JSON stays on the Requirements tab), so the tab scans in under a minute and survives a live-refresh with open state intact",
+  "usId": "US-17006",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: usable interaction model",
+  "asA": "a product reader who returns to the Product Map across sessions",
+  "iWant": "collapsed-by-default buckets, a jump-nav index across the top, per-bucket status mini-counts, hash-encoded open-bucket state and compact REQ cards with drill-down (raw JSON stays on the Requirements tab)",
+  "soThat": "the tab scans in under a minute and a bookmarked URL restores tab, grouping, filter and the buckets I had open, and my open state survives a live refresh",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17006-1",
+      "description": "The Product Map tab renders every bucket collapsed by default, with a summary row carrying the bucket label, its total REQ count and a mini count per authoring status (draft / review / needsRevision / approved / superseded). A jump-nav rail across the top of the panel lists every bucket in the active grouping with its count; clicking a chip scrolls to that bucket and opens it. The hash schema `#tab=product-map&group=<g>&status=<s>&open=<id1>,<id2>` restores tab, grouping, status filter AND the set of open buckets on return, and every bucket-toggle pushes a new history entry so Back/Forward traverse them. Per-bucket <details> nodes carry a stable data-doc-id (\"pm-bucket:<group>:<id>\") so the live-client persists their open state across SSE refreshes.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-17007.json

@@ -0,0 +1,21 @@
+{
+  "createdAt": "2026-09-21T18:36:34.519Z",
+  "updatedAt": "2026-09-21T18:36:52.512Z",
+  "description": "a reviewer opening the review surface on a slow link the initial HTML payload well under 3 MB by rendering only the active grouping fully; the other three groupings emit only their bucket headings (label + count) and hydrate the REQ list on demand when the reader switches grouping or opens a bucket, so first paint is fast and the tab stays interactive on 100+ REQ trees",
+  "usId": "US-17007",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: lazy first-load payload",
+  "asA": "a reviewer opening the review surface on a slow link",
+  "iWant": "an initial HTML payload well under 3 MB by rendering only the active grouping fully and hydrating the other groupings on demand from a partial endpoint",
+  "soThat": "first paint is fast and the tab stays interactive on 100-plus REQ trees",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17007-1",
+      "description": "The Product Map first-load payload target is well under 3 MB. The server emits the shape (default) grouping fully; the other three groupings emit only their bucket headings (label + total count + per-status mini counts) and each bucket carries a data-pm-lazy marker naming its grouping and bucket id. When the reader switches to a lazy grouping OR opens a lazy bucket, the client fetches that grouping fully once (from a partial endpoint the server exposes) and hydrates the bucket into the DOM; subsequent switches use the cached partial. The pass doc states the before/after first-load bytes.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-17008.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17008",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: blueprint badge and by-blueprint grouping",
+  "description": "User story under REQ-170. a product reader auditing what came from applied blueprints vs the project's own requirements a visible blueprint badge on every REQ row an applied blueprint contributed, plus a sixth grouping that buckets requirements by contributing blueprint (with an Application bucket for the project's own (non-blueprint) REQs) and a second-level capability split inside each bucket.",
+  "asA": "a product reader auditing what came from applied blueprints vs the project's own requirements",
+  "iWant": "a blueprint badge on every REQ row that was contributed by a blueprint plus a by-blueprint grouping (one bucket per applied blueprint plus an Application bucket) with capability as the second level inside each bucket",
+  "soThat": "I can see at a glance which parts of the tree ride on shared blueprints and which the project owns, and drill from a blueprint to the capabilities it contributed",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17008-1",
+      "description": "Every REQ row inside the Product Map tab that was contributed by an applied blueprint carries a compact blueprint badge (class pm-blueprint-badge) in its summary row, in every grouping (shape, component, trace coverage, capability, and the new by-blueprint grouping itself). The GROUPINGS list on the panel additionally includes 'blueprint'; the by-blueprint grouping enumerates one bucket per entry in manifest.blueprints[] (label: the blueprint's display name or slug, count: number of contributed REQs) plus an Application bucket for the project's own (non-blueprint) REQs (REQs with no blueprint attribution). Inside each blueprint or Application bucket, requirements are split by capability (existing capability:<slug> convention) as a second level, then the usual REQ->US->AC drill-down. The source of truth for blueprint attribution is manifest.blueprints[].contributions[] (parsed by scope.contributionsForBlueprint); the id-prefix fallback (kebab-slug prefix on reqId) is used only when the manifest carries no contributions record for a given blueprint. The hash schema round-trips as #tab=product-map&group=blueprint&status=<s>&open=<ids>, and the /product-map/blueprint partial endpoint serves the grouping body for the client's lazy-render fetch. A project with no applied blueprints renders a single Application bucket cleanly (not an error, not an empty tab).",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-22T11:59:39Z",
+  "updatedAt": "2026-09-22T15:00:00Z"
+}

package/rcf/user-stories/us-17101.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-171",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Dogfood chain carries capability tags on every requirement",
+  "description": "User story under REQ-171. the maintainer of the rcf-lite dogfood chain every REQ under rcf-lite/rcf to carry at least one capability:<slug> tag drawn from the documented taxonomy",
+  "asA": "the maintainer of the rcf-lite dogfood chain",
+  "iWant": "every REQ under rcf-lite/rcf to carry at least one capability:<slug> tag drawn from the documented taxonomy",
+  "soThat": "the by-capability Product Map view has something to bucket on, and the trial can be evaluated against real data rather than a fixture",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17101-1",
+      "description": "Every REQ under packages/rcf-lite/rcf/requirements/ carries at least one tag matching the regex ^capability:[a-z0-9]+(-[a-z0-9]+)*$, and every slug used maps to an entry in the documented capability taxonomy.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z"
+}

package/rcf/user-stories/us-17102.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17102",
+  "prdId": "PRD-001",
+  "reqId": "REQ-171",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Capability taxonomy is documented in the rcf-lite docs",
+  "description": "User story under REQ-171. a reader of the rcf-lite docs deciding whether to adopt the convention the capability:<slug> convention, the initial taxonomy and the rule for adding a new capability documented alongside the rest of the rcf-lite docs",
+  "asA": "a reader of the rcf-lite docs deciding whether to adopt the convention",
+  "iWant": "the capability:<slug> convention, the initial taxonomy and the rule for adding a new capability documented alongside the rest of the rcf-lite docs",
+  "soThat": "a new capability is added deliberately rather than by drift, and a reader can look up what each slug means",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17102-1",
+      "description": "packages/rcf-lite/docs contains a capability tags section listing every slug in the initial taxonomy with a one-line meaning, plus the rule for adding a new capability (single-word verb or noun, kebab-case, must map to a product surface). The section is linked from docs/README.md so it is reachable from the docs entry point.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z"
+}

package/rcf/user-stories/us-17201.json

@@ -0,0 +1,38 @@
+{
+  "usId": "US-17201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-172",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Delta detection and freeze record land as reusable primitives",
+  "description": "User story under REQ-172. The detection-model foundation lands as pure, importable modules and one durable local record.",
+  "asA": "the maintainer of a rcf-lite tree",
+  "iWant": "hashDocument, computeTreeHash, computeDelta and the rcf/define/freeze.json reader/writer to land as pure modules exposed on the query surface, with a documented return shape that later DEFINE slices can call unchanged",
+  "soThat": "the gates, readiness view, freeze verb and bundle-side read all consume the same detection primitives, and a hand reformat of a document never surfaces as a change",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17201-1",
+      "description": "computeDelta(tree, freeze, ledgers) returns the exact object shape proposal 2026-09-22 v3 section 2.2 specifies (frozen, frozenAt, treeHash, currentTreeHash, changed, added, removed, briefSince, unchanged); given a matching freeze the delta reports empty changed / added / removed and unchanged equal to the number of docHashes; given divergent tree state changed / added / removed classify every id correctly against the freeze record.",
+      "testable": true
+    },
+    {
+      "id": "AC-17201-2",
+      "description": "hashDocument returns a sha256:<64-hex> string over the canonical JSON form of the parsed document (keys sorted recursively, no whitespace), and is invariant under a whitespace-only reformat or a key reorder: two documents that parse to the same object hash identically.",
+      "testable": true
+    },
+    {
+      "id": "AC-17201-3",
+      "description": "Loading rcf/define/freeze.json when the file is absent returns null; loading a malformed file (bad JSON, missing docHashes, non-sha256 hash value, negative briefStatements) raises FreezeRecordError with a code (parseFailure or schemaFailure) and a named field so a caller can log the exact failure.",
+      "testable": true
+    },
+    {
+      "id": "AC-17201-4",
+      "description": "Saving then loading a freeze record round-trips every documented field including extension fields the schema does not police (counts, litmus, versions, note), and saveFreezeRecord refuses to persist an invalid record: no file is written on validation failure.",
+      "testable": true
+    }
+  ],
+  "tacIds": ["TAC-4120-define-delta-and-freeze"],
+  "tags": [],
+  "createdAt": "2026-09-24T12:00:00Z",
+  "updatedAt": "2026-09-24T12:00:00Z"
+}