rcf-lite 0.28.2 → 0.29.0

package/rcf/test-suites/ts-225.json

@@ -0,0 +1,78 @@
+{
+  "createdAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T00:00:00Z",
+  "purpose": "Cover US-205 (engineer jumps to any document or AC by id): id-first ranking (exact / prefix / contains), word-match title above snippet, single-char ids-only, hash pick lands and expands the entity, mount URL round-trip, embed/theme preservation, empty-state on fetch failure, no outbound postMessage / storage / cookies. Points at the 22 new unit tests under test/view/id-lookup.test.js.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-205-1",
+    "AC-205-2",
+    "AC-205-3",
+    "AC-205-4",
+    "AC-205-5",
+    "AC-205-6",
+    "AC-205-7",
+    "AC-205-8"
+  ],
+  "id": "TS-225",
+  "usId": "US-205",
+  "title": "ID lookup: ranking, hash pick, embed/theme round-trip, empty state, no outbound side effects",
+  "testCases": [
+    {
+      "id": "TC-225-id-exact-prefix-first",
+      "acId": "AC-205-1",
+      "description": "rankLookupRows ranks an exact id match first, a prefix match second and a contains match third; the first ranked row is pre-highlighted in the LookupModal shell.",
+      "status": "pending",
+      "testPointer": "test/view/id-lookup.test.js::rankLookupRows: exact id ranks first (AC-205-1)"
+    },
+    {
+      "id": "TC-225-word-title-above-snippet",
+      "acId": "AC-205-2",
+      "description": "rankLookupRows ranks a word match in the title above a word match in the snippet when the id does not match; every query word must match title or snippet.",
+      "status": "pending",
+      "testPointer": "test/view/id-lookup.test.js::rankLookupRows: a title match ranks above a snippet-only match (AC-205-2)"
+    },
+    {
+      "id": "TC-225-single-char-ids-only",
+      "acId": "AC-205-3",
+      "description": "rankLookupRows with a one-character query returns only id matches; the title / snippet word-match pass is skipped.",
+      "status": "pending",
+      "testPointer": "test/view/id-lookup.test.js::rankLookupRows: single-character queries search ids only (AC-205-3)"
+    },
+    {
+      "id": "TC-225-pick-writes-hash",
+      "acId": "AC-205-4",
+      "description": "wireLookup pick writes `#tab=<tab>&entity=<id>` through writeHash; the Router activates the tab, opens every ancestor DocRow and the entity, scrolls into view and flashes the target.",
+      "status": "pending",
+      "testPointer": "test/view/id-lookup.test.js::page-init.js carries the wireLookup contract: Cmd/Ctrl+F binding, lazy fetch, up/down/Enter/Esc"
+    },
+    {
+      "id": "TC-225-mount-url-round-trip",
+      "acId": "AC-205-5",
+      "description": "A mount URL of `?tab=requirements&entity=US-304` lands on the same position at first paint via the Router (PR 1 contract), independent of the LookupModal.",
+      "status": "pending",
+      "testPointer": "test/view/id-lookup.test.js::page-init.js urlWithHash preserves ?tab=&entity= + any other query at mount (AC-205-5)"
+    },
+    {
+      "id": "TC-225-embed-theme-preserved",
+      "acId": "AC-205-6",
+      "description": "A pick with `?embed=1&theme=dark` on the URL leaves both query params in place; only the hash fragment changes. Verified against writeHash + the hash-preservation helpers.",
+      "status": "pending",
+      "testPointer": "test/view/id-lookup.test.js::page-init.js writeHash preserves ?embed= and ?theme= through every pick (AC-205-6)"
+    },
+    {
+      "id": "TC-225-empty-state-on-fetch-failure",
+      "acId": "AC-205-7",
+      "description": "A non-2xx / malformed `./index.json` response renders the empty state (The index could not be loaded.) with a visible Reload index button; no result rows show; the reload affordance re-fetches on click.",
+      "status": "pending",
+      "testPointer": "test/view/id-lookup.test.js::renderLookupModal carries the empty-state + reload affordance markers (AC-205-7)"
+    },
+    {
+      "id": "TC-225-no-outbound-side-effects",
+      "acId": "AC-205-8",
+      "description": "wireLookup never calls window.postMessage, never writes to localStorage / sessionStorage / document.cookie, and makes no outbound fetch other than `./index.json`; asserted by a source-level scan of page-init.js (no postMessage, no storage, no cookie writes in wireLookup).",
+      "status": "pending",
+      "testPointer": "test/view/id-lookup.test.js::page-init.js does not add outbound postMessage, localStorage, sessionStorage or cookies in the lookup wiring (AC-205-8)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-226.json

@@ -0,0 +1,158 @@
+{
+  "createdAt": "2026-10-02T18:00:00Z",
+  "updatedAt": "2026-10-02T18:00:00Z",
+  "purpose": "Cover US-18601 (the question set), US-18602 (the verb and the tools) and US-18603 (write-back and termination): computeQuestions turns every failing PO item into a question carrying its write-back; the CLI verb and the MCP tool emit the same object; the scripted loop converges; engineer edits never re-open the PO loop.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-18601-1",
+    "AC-18601-2",
+    "AC-18601-3",
+    "AC-18601-4",
+    "AC-18601-5",
+    "AC-18601-6",
+    "AC-18601-7",
+    "AC-18602-1",
+    "AC-18602-2",
+    "AC-18602-3",
+    "AC-18602-4",
+    "AC-18602-5",
+    "AC-18602-6",
+    "AC-18603-1",
+    "AC-18603-2",
+    "AC-18603-3",
+    "AC-18603-4",
+    "AC-18603-5"
+  ],
+  "id": "TS-226",
+  "usId": "US-18601",
+  "title": "DEFINE step 3 PR 2: computeQuestions, the questions verb, MCP tools and loop convergence",
+  "testCases": [
+    {
+      "id": "TC-226-q-shape",
+      "acId": "AC-18601-1",
+      "description": "On a fixture failing brief:openQuestions, skeleton:resolvedBy and stories:reqHasUs, computeQuestions(persona=productOwner) returns one entry per failing item with id, stage, check, itemId, heading, ask, answerKinds, writeBack and blocks intent.",
+      "status": "pending",
+      "testPointer": "test/query/questions.test.js::AC-18601-1: openQuestions + resolvedBy + reqHasUs failing items each produce one question with the full shape"
+    },
+    {
+      "id": "TC-226-q-deterministic",
+      "acId": "AC-18601-2",
+      "description": "Two consecutive computeQuestions runs on the same tree return deep-equal questions[] ordered D1, D2, D4, D7 then by source span.",
+      "status": "pending",
+      "testPointer": "test/query/questions.test.js::AC-18601-2: two runs are deep-equal and ordered D1, D2, D4, D7 then by source span"
+    },
+    {
+      "id": "TC-226-q-optional-decisions",
+      "acId": "AC-18601-3",
+      "description": "An open decision with two options and a default appears in optional[] with blocks build and not in questions[].",
+      "status": "pending",
+      "testPointer": "test/query/questions.test.js::AC-18601-3: a two-option decision with a default appears in optional[], not questions[]"
+    },
+    {
+      "id": "TC-226-q-empty-when-ok",
+      "acId": "AC-18601-4",
+      "description": "On a tree where levels.intentComplete.ok, computeQuestions(persona=productOwner) returns ok:true and empty questions[].",
+      "status": "pending",
+      "testPointer": "test/query/questions.test.js::AC-18601-4: ok tree returns ok:true and empty questions[]"
+    },
+    {
+      "id": "TC-226-q-engineer-persona",
+      "acId": "AC-18601-5",
+      "description": "computeQuestions(persona=engineer) returns one entry per failing engineer item in failing stages with blocks build.",
+      "status": "pending",
+      "testPointer": "test/query/questions.test.js::AC-18601-5: persona engineer returns engineer blockers in failing stages, blocks: build"
+    },
+    {
+      "id": "TC-226-q-usage-error",
+      "acId": "AC-18601-6",
+      "description": "computeQuestions throws a usage error naming productOwner and engineer when given any other persona value.",
+      "status": "pending",
+      "testPointer": "test/query/questions.test.js::AC-18601-6: unknown persona throws naming the accepted values"
+    },
+    {
+      "id": "TC-226-q-writes-nothing",
+      "acId": "AC-18601-7",
+      "description": "computeQuestions never creates or modifies a file under rcf/ (mtime guard); every writeBack.command names a verb registered in the CLI help.",
+      "status": "pending",
+      "testPointer": "test/query/questions.test.js::AC-18601-7: computeQuestions is pure; every writeBack.command names a registered verb"
+    },
+    {
+      "id": "TC-226-cli-json",
+      "acId": "AC-18602-1",
+      "description": "rcf define questions --json on a failing tree prints the computeQuestions object to stdout and exits 0.",
+      "status": "pending",
+      "testPointer": "test/cli/questions.test.js::AC-18602-1: --json on a failing tree prints the questions object and exits 0"
+    },
+    {
+      "id": "TC-226-cli-persona-default",
+      "acId": "AC-18602-2",
+      "description": "Without --persona, the verb picks engineer on a profile whose register is engineer, else productOwner.",
+      "status": "pending",
+      "testPointer": "test/cli/questions.test.js::AC-18602-2: persona defaults from profile register"
+    },
+    {
+      "id": "TC-226-cli-stage-limit",
+      "acId": "AC-18602-3",
+      "description": "--stage skeleton --limit 2 caps questions[] to two D2 entries and reports remaining counting every D2 item.",
+      "status": "pending",
+      "testPointer": "test/cli/questions.test.js::AC-18602-3: --stage brief --limit 1 caps the output but keeps remaining honest"
+    },
+    {
+      "id": "TC-226-mcp-parity",
+      "acId": "AC-18602-4",
+      "description": "MCP tool rcf_define_questions returns structuredContent deep-equal to the verb's --json output on the same tree.",
+      "status": "pending",
+      "testPointer": "test/mcp/define-questions.test.js::AC-18602-4: rcf_define_questions structuredContent deep-equals the verb --json"
+    },
+    {
+      "id": "TC-226-cli-usage-persona",
+      "acId": "AC-18602-5",
+      "description": "--persona architect exits 2 with the usage line naming productOwner and engineer.",
+      "status": "pending",
+      "testPointer": "test/cli/questions.test.js::AC-18602-5: --persona architect exits 2 naming productOwner and engineer"
+    },
+    {
+      "id": "TC-226-cli-writes-nothing",
+      "acId": "AC-18602-6",
+      "description": "No file under rcf/ is created or modified during any invocation of rcf define questions.",
+      "status": "pending",
+      "testPointer": "test/cli/questions.test.js::AC-18602-6: questions writes nothing under rcf/"
+    },
+    {
+      "id": "TC-226-loop-convergence",
+      "acId": "AC-18603-1",
+      "description": "Scripted loop fixture: applying each writeBack and recomputing drives questions count strictly down each turn and to zero.",
+      "status": "pending",
+      "testPointer": "test/query/questions-loop.test.js::AC-18603-1: scripted loop converges strictly to zero within a bounded number of turns"
+    },
+    {
+      "id": "TC-226-loop-new-req",
+      "acId": "AC-18603-2",
+      "description": "A statement resolved to a new REQ carrying description and domain passes skeleton:reqIntent and raises stories:reqHasUs once.",
+      "status": "pending",
+      "testPointer": "test/query/questions-loop.test.js::AC-18603-2: a new REQ with description and domain passes reqIntent and asks reqHasUs once"
+    },
+    {
+      "id": "TC-226-loop-l1-draft-stable",
+      "acId": "AC-18603-3",
+      "description": "At L1, adding [draft] entities, TAC stubs and interfaces leaves intentComplete.ok true and the PO question set empty.",
+      "status": "pending",
+      "testPointer": "test/query/questions-loop.test.js::AC-18603-3: at L1 adding engineer-only draft entities keeps the PO question set empty"
+    },
+    {
+      "id": "TC-226-loop-decision-wellformed",
+      "acId": "AC-18603-4",
+      "description": "An openQuestion promoted to a decision with one option and no default makes decisions:wellFormed ask once and brief:openQuestions pass.",
+      "status": "pending",
+      "testPointer": "test/query/questions-loop.test.js::AC-18603-4: an openQuestion promoted to a one-option decision asks decisions:wellFormed once"
+    },
+    {
+      "id": "TC-226-loop-engineer-isolation",
+      "acId": "AC-18603-5",
+      "description": "No product-owner check changes from ok to failing after an engineer-only edit.",
+      "status": "pending",
+      "testPointer": "test/query/questions-loop.test.js::AC-18603-5: an engineer-only edit never changes the PO question set"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-227.json

@@ -0,0 +1,38 @@
+{
+  "createdAt": "2026-10-03T09:30:00Z",
+  "updatedAt": "2026-10-03T09:30:00Z",
+  "purpose": "Cover US-18002 (the Readiness tab renders question cards grouped by source span): the questions block lists each group with its asks and every id is in the JSON (AC-18002-1), the empty questions set renders the intent-complete verdict line (AC-18002-2), and engineer blockers are never removed from the DOM in any register (AC-18002-3). Points at the three AC tests under test/view/readiness-po-layer.test.js.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-18002-1",
+    "AC-18002-2",
+    "AC-18002-3"
+  ],
+  "id": "TS-227",
+  "usId": "US-18002",
+  "title": "Readiness PO question cards: groups and asks, intent-complete empty state, engineer DOM preserved across registers",
+  "testCases": [
+    {
+      "id": "TC-227-groups-and-asks",
+      "acId": "AC-18002-1",
+      "description": "renderReadinessPO is given a readiness object with questions[] non-empty; every group label, every ask and every question id appears in the panel, and data-rcf-source=\"readiness.questions\" is stamped so the source path is unambiguous.",
+      "status": "pending",
+      "testPointer": "test/view/readiness-po-layer.test.js::PO layer: AC-18002-1 given questions[] non-empty, the block lists each group with its asks and every id is in the JSON"
+    },
+    {
+      "id": "TC-227-empty-questions-verdict",
+      "acId": "AC-18002-2",
+      "description": "renderReadinessPO is given a clean readiness object with both levels ok and no blockers; the panel renders the exact intent-complete verdict line (formatVerdictLines(result).intentComplete) inside the questions block and marks the section data-rcf-empty=\"yes\".",
+      "status": "pending",
+      "testPointer": "test/view/readiness-po-layer.test.js::PO layer: AC-18002-2 given questions[] empty, the block shows the intent-complete verdict line"
+    },
+    {
+      "id": "TC-227-engineer-dom-preserved",
+      "acId": "AC-18002-3",
+      "description": "renderReadinessPanel across every register (null / productOwner / engineer) keeps every engineer blocker id in the DOM, keeps every PO blocker id in the DOM and renders the CLI verdict strings verbatim inside the For-engineers DocRow; the For-engineers DocRow is closed under productOwner / unstated and open under engineer.",
+      "status": "pending",
+      "testPointer": "test/view/readiness-po-layer.test.js::PO layer: AC-18002-3 engineer blockers are not removed from the DOM in any register"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-228.json

@@ -0,0 +1,86 @@
+{
+  "createdAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T00:00:00Z",
+  "purpose": "Cover US-18801 (the draft homes) and US-18202 (the DEFINE-stage guidance pack): parseInterfaceDraft and shapes:draftSettled extended to TAC.purpose, coreEntities[].description and TAC.interfaces[].description with the three id forms; a draft-only tree is L1-neutral; the guidance manifest advertises the two new slugs and five prompts; the register scan rejects an em-dash in any new guidance file; the managed block regeneration keeps every existing rule.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-18801-1",
+    "AC-18801-2",
+    "AC-18801-3",
+    "AC-18801-4",
+    "AC-18801-5",
+    "AC-18202-1",
+    "AC-18202-2",
+    "AC-18202-3",
+    "AC-18202-4"
+  ],
+  "id": "TS-228",
+  "usId": "US-18801",
+  "title": "DEFINE step 3 PR 3: draft marker extension, DISCOVERY prototypes guidance and prompts",
+  "testCases": [
+    {
+      "id": "TC-228-draft-coreentity",
+      "acId": "AC-18801-1",
+      "description": "A coreEntities entry whose description starts with [draft] fails shapes:draftSettled with id TAD.entity:<name>.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (REQ-188, AC-18801-1): draft on coreEntity description fails draftSettled with TAD.entity:<name>"
+    },
+    {
+      "id": "TC-228-draft-tac-purpose",
+      "acId": "AC-18801-2",
+      "description": "A TAC whose purpose starts with [draft] fails shapes:draftSettled with id <tacId>; shapes:tacHasInterface counts the TAC as present.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (REQ-188, AC-18801-2): draft on TAC.purpose fails draftSettled with <tacId>, tacHasInterface counts it present"
+    },
+    {
+      "id": "TC-228-draft-cleared",
+      "acId": "AC-18801-3",
+      "description": "When every [draft] marker across the three homes is cleared, shapes:draftSettled passes.",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (REQ-188, AC-18801-3): three draft homes cleared, draftSettled passes"
+    },
+    {
+      "id": "TC-228-draft-template-markers",
+      "acId": "AC-18801-4",
+      "description": "A [draft] recordShape without fields: fails shapes:templateMarkers exactly as a settled one. (shapes:templateMarkers lands in PR 5; this TC is pending PR 5.)",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (REQ-188, AC-18801-4 pending PR 5): draft recordShape without fields fails templateMarkers"
+    },
+    {
+      "id": "TC-228-draft-no-po-read",
+      "acId": "AC-18801-5",
+      "description": "No productOwner check reads any [draft] content: every productOwner check on a draft-only tree is ok (L1-neutral).",
+      "status": "pending",
+      "testPointer": "test/query/gates.test.js::gates (REQ-188, AC-18801-5): draft-only tree keeps every productOwner check ok (L1-neutral)"
+    },
+    {
+      "id": "TC-228-guidance-prints",
+      "acId": "AC-18202-1",
+      "description": "rcf guidance define-intent and rcf guidance discovery-prototypes each print their file byte-faithfully.",
+      "status": "pending",
+      "testPointer": "test/guidance/verbs.test.js::guidance (REQ-182, AC-18202-1): rcf guidance define-intent and discovery-prototypes each print their file"
+    },
+    {
+      "id": "TC-228-manifest-prompts",
+      "acId": "AC-18202-2",
+      "description": "The manifest lists rcf_define_intent, rcf_define_intake, rcf_define_draft_shapes and rcf_discover_prototype as argument-free; rcf_define_litmus is recorded as pending PR 7.",
+      "status": "pending",
+      "testPointer": "test/guidance/inventory.test.js::guidance (REQ-182, AC-18202-2): four argument-free DEFINE prompts present, litmus pending PR 7"
+    },
+    {
+      "id": "TC-228-register-scan-em-dash",
+      "acId": "AC-18202-3",
+      "description": "A new guidance file containing an em-dash fails the register scan.",
+      "status": "pending",
+      "testPointer": "test/guidance/canonical-text-lint.test.js::guidance (REQ-182, AC-18202-3): em-dash in a new guidance file fails the register scan"
+    },
+    {
+      "id": "TC-228-managed-block-preserves-rules",
+      "acId": "AC-18202-4",
+      "description": "The managed block regeneration keeps every existing rule: regenerating never removes a line.",
+      "status": "pending",
+      "testPointer": "test/guidance/fragment.test.js::guidance (REQ-182, AC-18202-4): managed-block regeneration keeps every existing rule"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-229.json

@@ -0,0 +1,83 @@
+{
+  "createdAt": "2026-10-03T09:55:00Z",
+  "updatedAt": "2026-10-03T10:00:00Z",
+  "purpose": "Cover US-206 (wespa's embedding contract is proved by a CI host fixture): the fixture renders a 56px header + resizable sidebar around an iframe pointed at ./?embed=1&theme=light with no inline script (AC-206-1), theme flips via postMessage without a reload (AC-206-2, source invariants + Playwright live proof in the lane evidence), embed and theme survive a hash-only in-iframe navigation (AC-206-3, source invariants + Playwright live proof), cross-origin messages are ignored by the viewer listener (AC-206-4), the three lints keep framing headers, target=_top and localStorage namespace in place (AC-206-5), and no new outbound postMessage shape is introduced by the viewer or the fixture (AC-206-6). All TCs resolve to node tests under test/view/wespa-host-fixture.test.js.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-206-1",
+    "AC-206-2",
+    "AC-206-3",
+    "AC-206-4",
+    "AC-206-5",
+    "AC-206-6"
+  ],
+  "id": "TS-229",
+  "usId": "US-206",
+  "title": "Wespa host fixture: iframe shell, theme postMessage, hash-nav embed preservation, cross-origin refusal, three lints, no new outbound postMessage shape",
+  "testCases": [
+    {
+      "id": "TC-229-fixture-shell",
+      "acId": "AC-206-1",
+      "description": "renderTestHostPage returns an HTML5 document with a 56px wespa-header, data-rcf-host-sidebar + data-rcf-host-sidebar-drag markers, data-rcf-host-theme light/dark toggles, an iframe whose src is literally './?embed=1&theme=light' (HTML-entity encoded), a '<script src=./test-host.js defer>' line and zero inline <script> blocks.",
+      "status": "pending",
+      "testPointer": "test/view/wespa-host-fixture.test.js::renderTestHostPage: HTML5 document, no inline script, iframe src is ./?embed=1&theme=light"
+    },
+    {
+      "id": "TC-229-test-host-http-roundtrip",
+      "acId": "AC-206-1",
+      "description": "The router serves /test-host.html with the fixture body (iframe src + script tag) and /test-host.js with application/javascript when testHost: true; both routes return 404 by default so wespa's reverse-proxy allow-list is unaffected.",
+      "status": "pending",
+      "testPointer": "test/view/wespa-host-fixture.test.js::/test-host.html is served when testHost: true; iframe src and no inline script round-trip over HTTP"
+    },
+    {
+      "id": "TC-229-theme-postmessage-source",
+      "acId": "AC-206-2",
+      "description": "src/view/test-host/embed-client.js posts { type: 'rcf-view-theme', theme } to iframe.contentWindow targeting window.location.origin, and its code (comments stripped) contains no localStorage/sessionStorage write (ADR-4136 does-not-persist invariant). The live postMessage round-trip is captured in Playwright evidence (agents/dave/remote-lane/inbox/r-20261002-161325-e2a2/output/evidence/test-host-dark-iframe-flipped.png).",
+      "status": "pending",
+      "testPointer": "test/view/wespa-host-fixture.test.js::AC-206-2: embed-client posts { type: rcf-view-theme, theme } to the iframe targeting window.location.origin"
+    },
+    {
+      "id": "TC-229-hash-nav-embed-preserved",
+      "acId": "AC-206-3",
+      "description": "src/view/page-init.js exposes writeHash (reassigns location.hash only, preserving the search string by construction) and stamps data-embed + data-theme on load. Live hash-nav proof lives in Playwright evidence (hash-nav-proof.txt + test-host-iframe-hash-nav-embed-preserved.png).",
+      "status": "pending",
+      "testPointer": "test/view/wespa-host-fixture.test.js::AC-206-3: page-init preserves embed=1 and theme= across hash writes (urlWithHash + writeHash)"
+    },
+    {
+      "id": "TC-229-cross-origin-ignored",
+      "acId": "AC-206-4",
+      "description": "src/view/page-init.js registers an addEventListener('message', ...) whose first guard returns early when ev.origin !== window.location.origin; cross-origin messages never reach the applyTheme path and <html data-theme> is unchanged.",
+      "status": "pending",
+      "testPointer": "test/view/wespa-host-fixture.test.js::AC-206-4: page-init theme message listener rejects messages whose origin differs from window.location.origin"
+    },
+    {
+      "id": "TC-229-lint-framing",
+      "acId": "AC-206-5",
+      "description": "assertFramingHeaders over GET / returns ok: true (no X-Frame-Options; no CSP frame-ancestors forbidding same-origin). Positive + negative unit cases also pass (refuses on X-Frame-Options present, refuses on frame-ancestors 'none', accepts frame-ancestors 'self').",
+      "status": "pending",
+      "testPointer": "test/view/wespa-host-fixture.test.js::lint 1 (framing): GET / carries no X-Frame-Options and no CSP frame-ancestors that forbids same-origin"
+    },
+    {
+      "id": "TC-229-lint-no-target-top",
+      "acId": "AC-206-5",
+      "description": "assertNoTargetTop returns count: 0 across every rendered page (renderPage shell, renderComponentsFixturePage, renderTestHostPage). Also lints the populated dogfood tree render (renderModelToPage) so per-document conditional output cannot smuggle a target=\"_top\" past the test. Positive + negative unit cases cover target=\"_top\" / target='_top' / target=_top.",
+      "status": "pending",
+      "testPointer": "test/view/wespa-host-fixture.test.js::lint 2 (target=\"_top\"): zero occurrences across every rendered page (shell, components fixture, test-host fixture, populated dogfood tree)"
+    },
+    {
+      "id": "TC-229-lint-localstorage-namespace",
+      "acId": "AC-206-5",
+      "description": "assertLocalStorageNamespace over the src/view tree returns ok: true; every localStorage/sessionStorage call site resolves to a key starting with 'rcf-view:v1:'.",
+      "status": "pending",
+      "testPointer": "test/view/wespa-host-fixture.test.js::lint 3 (localStorage namespace): every storage call site under src/view uses an rcf-view:v1: key"
+    },
+    {
+      "id": "TC-229-no-new-outbound-postmessage-shape",
+      "acId": "AC-206-6",
+      "description": "A grep over src/view/** (excluding test-host/embed-client.js, the sanctioned emitter) finds zero .postMessage( call sites; the embed-client itself posts exactly one shape, 'rcf-view-theme'.",
+      "status": "pending",
+      "testPointer": "test/view/wespa-host-fixture.test.js::AC-206-6: no outbound postMessage shape beyond rcf-view-theme is introduced by the viewer or the fixture"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-15601.json

@@ -56,14 +56,14 @@
     },
     {
       "id": "AC-15601-6",
-      "description": "The rule-4 bare-hostname redactor treats filename tokens carrying a known file extension as NOT hostnames. A candidate hostname match whose trailing dot-label is in a bundled FILE_EXTENSIONS set (initially md, mdx, json, yml, yaml, txt, js, mjs, cjs, ts, tsx, html, css, png, svg, sh, csv, log, lock) is left intact and no ledger row is written for it (design amendment R5d). The negative lookbehind on the hostname regex additionally excludes '-' so that filename fragments embedded in a larger identifier (`Backstory-product-brief.md`) cannot start a match after a hyphen. The extension shortlist is merged at call time from an `extensions` array on src/feedback/redact-allowlist.json alongside the existing `hosts` field, so operators can extend it the same way they extend hosts.",
-      "given": "a fixture project with a body containing the tokens 'Backstory-product-brief.md', 'intake.json', 'report.log', 'foo.example.com', 'foo.example.com/path', 'Backstory-example.com', and 'a.b.c'",
+      "description": "The rule-4 bare-hostname redactor treats filename tokens carrying a known file extension as NOT hostnames. A candidate hostname match whose trailing dot-label is in a bundled FILE_EXTENSIONS set (initially md, mdx, json, yml, yaml, txt, js, mjs, cjs, ts, tsx, html, css, png, svg, sh, csv, log, lock) is left intact and no ledger row is written for it (design amendment R5d). The negative lookbehind on the hostname regex additionally excludes '-' so that filename fragments embedded in a larger identifier (`Backstory-product-brief.md`) cannot start a match after a hyphen. The extension shortlist is merged at call time from an `extensions` array on src/feedback/redact-allowlist.json alongside the existing `hosts` field, so operators can extend it the same way they extend hosts. Design amendment R5e (added 0.28.3 per HQ 2026-09-22 ruling on Codex P1-5 deferred from PR #242): candidate hostnames whose trailing dot-label is a single letter are also treated as filename fragments, not hostnames. Rationale: single-letter TLDs are not registrable domains in normal prose and folding them yields more false positives (short identifiers, abbreviated references) than legitimate hostname redactions. Design amendment R5f (added 0.28.3, #243): the rule-3 email regex is bounded so it does not consume the git protocol sentinel `git@<host>` inside a URL whose scheme is `git+ssh://`, `ssh://` or `git://`, nor the bare git-remote shape `git@<host>:<owner>/<repo>` (colon followed by a non-space path). Rationale: `git@<host>` is a URI userinfo construct, not an email; folding it destroys evidence pointers copied from git remotes and clone URLs. Real email addresses in surrounding prose still fold. Design amendment R5g (added 0.28.3, #246): when the operator identity Name (rcf/.identity/profile.md ## Name) is empty, whitespace only, or contains only reserved-noun tokens (RESERVED_IDENTITY_TOKENS from AC-15601-5), buildRedactionContext emits a one-line visible warning to stderr naming the file and stating that identity folding is disabled. The warning is emitted once per redaction context build. Folding still skips (per AC-15601-5) but the operator is no longer left thinking their identity is in force.",
+      "given": "a fixture project with a body containing the tokens 'Backstory-product-brief.md', 'intake.json', 'report.log', 'foo.example.com', 'foo.example.com/path', 'Backstory-example.com', 'a.b.c', the URL 'git+ssh://git@github.com/owner/repo.git#v1.0.0', the URL 'ssh://git@example.internal/owner/repo.git', the bare git remote 'git@github.com:owner/repo.git', and a prose email 'alice@example.com'; and a rcf/.identity/profile.md whose ## Name line is either absent, whitespace only, or reads 'The Agent Operator' (stopword-only)",
       "when": "the redactor runs over the body with the default allowlist",
-      "then": "'Backstory-product-brief.md', 'intake.json' and 'report.log' survive verbatim with no ledger row for a hostname substitution on their basename; 'foo.example.com' folds to <host> via rule 4; 'foo.example.com/path' folds via the URL rule; 'Backstory-example.com' folds to '<host>' (the trailing label is not in the extension set); 'a.b.c' folds to <host>. Extending the allowlist with `extensions: [\"xyz\"]` in redact-allowlist.json (or the operator overlay) makes 'file.xyz' also survive.",
+      "then": "'Backstory-product-brief.md', 'intake.json' and 'report.log' survive verbatim with no ledger row for a hostname substitution on their basename; 'foo.example.com' folds to <host> via rule 4; 'foo.example.com/path' folds via rule 4 bare-host (the URL rule requires a scheme; the token here has none); 'Backstory-example.com' folds to '<host>' (the trailing label is not in the extension set); 'a.b.c' survives verbatim with no hostname ledger row (single-letter trailing label per R5e); 'git+ssh://git@github.com/owner/repo.git#v1.0.0' survives verbatim - the `git@` sentinel is NOT rewritten by the email rule (R5f) and github.com is on the allowlist; 'ssh://git@example.internal/owner/repo.git' has the `git@` sentinel preserved (R5f stash) and the host `example.internal` folded to '<host>' by the extended URL rule 4 which now matches ssh/git+ssh/git schemes with optional userinfo; 'git@github.com:owner/repo.git' has the `git@` sentinel preserved (R5f) and github.com is on the allowlist so it survives verbatim; 'alice@example.com' in surrounding prose still folds to '<email>' (rule 3 email); and when the identity Name is empty/whitespace/stopword-only, stderr carries exactly one visible warning line naming rcf/.identity/profile.md and stating that identity folding is disabled. Extending the allowlist with `extensions: [\"xyz\"]` in redact-allowlist.json (or the operator overlay) makes 'file.xyz' also survive.",
       "testable": true,
       "scope": "runtime"
     }
   ],
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-17T13:47:03Z"
+  "updatedAt": "2026-09-22T13:07:00Z"
 }

package/rcf/user-stories/us-17001.json

@@ -0,0 +1,27 @@
+{
+  "usId": "US-17001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: shape grouping",
+  "description": "User story under REQ-170. a product reader reviewing the requirements chain the Product Map tab to bucket requirements by shapeClassification.shapes[], with an \"Unclassified\" bucket for REQs missing the classification and a \"Business rules\" bucket for the \"none\" shape",
+  "asA": "a product reader reviewing the requirements chain",
+  "iWant": "the Product Map tab to bucket requirements by shapeClassification.shapes[], with an \"Unclassified\" bucket for REQs missing the classification and a \"Business rules\" bucket for the \"none\" shape",
+  "soThat": "I can see at a glance which requirements sit in each surface area (webUi, httpApi, auth, persistence, notifications, business rules) without reading every REQ body",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17001-1",
+      "description": "The rendered review-surface HTML carries a \"product-map\" tab (data-tab=\"product-map\") in tab order after Build sequence, with a hidden tabpanel id \"tab-product-map\" containing a shape-grouping section whose bucket headings enumerate every shape the classified REQs use plus \"Unclassified\" and \"Business rules\". A REQ classified into two shapes appears in both buckets. Rendering does not require a schema change.",
+      "testable": true
+    },
+    {
+      "id": "AC-17001-2",
+      "description": "Selecting the shape grouping drills each bucket to its REQs (rendered with the same doc-details helper and status pill as the Requirements tab), each REQ to its user stories, and each user story to its acceptance criteria, so the reader can go from a shape bucket to an AC in the same tab. Grouping button clicks and status filter changes push a new history entry (Back/Forward traverse them); top-level tab clicks keep their existing behaviour.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:43:06.307Z"
+}

package/rcf/user-stories/us-17002.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17002",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: status filter",
+  "description": "User story under REQ-170. a reviewer preparing a sign-off pass a status filter (all, draft, review, needsRevision, approved, superseded) on the Product Map tab that applies to whichever grouping is active",
+  "asA": "a reviewer preparing a sign-off pass",
+  "iWant": "a status filter (all, draft, review, needsRevision, approved, superseded) on the Product Map tab that applies to whichever grouping is active",
+  "soThat": "I can narrow the tab to just the \"approved\" or just the \"needsRevision\" REQs without switching tabs or scanning by hand",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17002-1",
+      "description": "The Product Map tab carries a status filter control whose options are the five authoring statuses plus \"all\", and applies to every grouping on the tab. When \"approved\" is selected the tab renders only REQs whose status is approved. Buckets that become empty under the current filter are hidden by default with a summary line (\"N empty\" - clicking reveals them), so the map keeps its shape without rendering a wall of empty headings.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T18:36:17.135Z"
+}

package/rcf/user-stories/us-17003.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17003",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: component-first grouping",
+  "description": "User story under REQ-170. a technical reviewer wanting to see requirements from the architecture down a component grouping rooted at the TAD, showing each TAC (with its dependencies) at level 1, the user stories linked to that TAC at level 2, each story's parent REQ at level 3, and its ACs at level 4, plus an \"Unmapped\" bucket for REQs no component reaches",
+  "asA": "a technical reviewer wanting to see requirements from the architecture down",
+  "iWant": "a component grouping rooted at the TAD, showing each TAC (with its dependencies) at level 1, the user stories linked to that TAC at level 2, each story's parent REQ at level 3, and its ACs at level 4, plus an \"Unmapped\" bucket for REQs no component reaches",
+  "soThat": "I can pivot from a component to the requirements it delivers without leaving the tab",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17003-1",
+      "description": "When the Product Map is grouped by component, the tab renders the TAD as the root, one section per TAC (with a short dependencies[] list drawn from the TAC document), then the user stories under that TAC (from usByTacId), then their parent REQs (from us.reqId), then the ACs. REQs reachable by no TAC are collected under an \"Unmapped\" bucket with a count in its heading.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z"
+}

package/rcf/user-stories/us-17004.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17004",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: trace-coverage grouping",
+  "description": "User story under REQ-170. a reviewer about to sign a chain off a trace-coverage grouping that buckets each REQ by chain completeness (complete, missing stories, missing AC scope or owner, missing component owner, missing tests)",
+  "asA": "a reviewer about to sign a chain off",
+  "iWant": "a trace-coverage grouping that buckets each REQ by chain completeness (complete, missing stories, missing AC scope or owner, missing component owner, missing tests)",
+  "soThat": "I can see which requirements are safe to sign off and which still need work",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17004-1",
+      "description": "The trace-coverage grouping buckets each REQ into one of complete | missing-stories | missing-ac-scope | missing-component | missing-tests, computed from the tree-model maps (storiesByReqId, acIdsByUsId, usByTacId, tsByAcId / tcsByAcId / fbsByAcId). Each REQ row states in plain text exactly what is missing, and links to its own doc anchor so the reader can jump to it.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:00:00.000Z"
+}

package/rcf/user-stories/us-17005.json

@@ -0,0 +1,22 @@
+{
+  "usId": "US-17005",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: capability grouping",
+  "description": "User story under REQ-170. a product reader thinking in capabilities rather than technical shape a capability grouping that reads capability:<slug> entries from REQ.tags[] and buckets requirements per capability",
+  "asA": "a product reader thinking in capabilities rather than technical shape",
+  "iWant": "a capability grouping that reads capability:<slug> entries from REQ.tags[] and buckets requirements per capability",
+  "soThat": "I can see the product as a set of capabilities and drill into each capability's REQs, stories and ACs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17005-1",
+      "description": "The capability grouping enumerates one bucket per distinct capability:<slug> value present on any REQ across the tree. A REQ carrying multiple capability tags appears under each. REQs whose tags carry no capability:<slug> entry are collected under an \"Unclassified\" bucket. Slugs are rendered as their kebab form in the heading; named capability buckets are ordered by REQ count desc, then alphabetically, and the Unclassified bucket is always pinned last.",
+      "testable": true
+    }
+  ],
+  "tags": [],
+  "createdAt": "2026-09-21T17:00:00.000Z",
+  "updatedAt": "2026-09-21T17:43:06.511Z"
+}

package/rcf/user-stories/us-17006.json

@@ -0,0 +1,21 @@
+{
+  "createdAt": "2026-09-21T18:36:23.922Z",
+  "updatedAt": "2026-09-21T18:36:52.280Z",
+  "description": "a product reader who returns to the tab across sessions collapsed-by-default buckets, a jump-nav index across the top, per-bucket status mini-counts, hash-encoded open buckets so a bookmarked URL restores tab plus grouping plus filter plus open buckets, and compact REQ cards with drill-down (raw JSON stays on the Requirements tab), so the tab scans in under a minute and survives a live-refresh with open state intact",
+  "usId": "US-17006",
+  "prdId": "PRD-001",
+  "reqId": "REQ-170",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Product Map: usable interaction model",
+  "asA": "a product reader who returns to the Product Map across sessions",
+  "iWant": "collapsed-by-default buckets, a jump-nav index across the top, per-bucket status mini-counts, hash-encoded open-bucket state and compact REQ cards with drill-down (raw JSON stays on the Requirements tab)",
+  "soThat": "the tab scans in under a minute and a bookmarked URL restores tab, grouping, filter and the buckets I had open, and my open state survives a live refresh",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17006-1",
+      "description": "The Product Map tab renders every bucket collapsed by default, with a summary row carrying the bucket label, its total REQ count and a mini count per authoring status (draft / review / needsRevision / approved / superseded). A jump-nav rail across the top of the panel lists every bucket in the active grouping with its count; clicking a chip scrolls to that bucket and opens it. The hash schema `#tab=product-map&group=<g>&status=<s>&open=<id1>,<id2>` restores tab, grouping, status filter AND the set of open buckets on return, and every bucket-toggle pushes a new history entry so Back/Forward traverse them. Per-bucket <details> nodes carry a stable data-doc-id (\"pm-bucket:<group>:<id>\") so the live-client persists their open state across SSE refreshes.",
+      "testable": true
+    }
+  ]
+}