rcf-lite 0.28.4 → 0.29.0

package/rcf/user-stories/us-18202.json

@@ -0,0 +1,40 @@
+{
+  "usId": "US-18202",
+  "prdId": "PRD-001",
+  "reqId": "REQ-182",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "the DEFINE-stage guidance pack",
+  "description": "User story under REQ-182. The guidance pack prints its slugs through `rcf guidance`, the MCP server advertises every argument-free DEFINE prompt, the register scan protects every new file from em-dashes, and the managed block regeneration never removes an existing rule.",
+  "asA": "harness",
+  "iWant": "the DEFINE-stage guidance pack served through one surface",
+  "soThat": "the loop reads one slug per topic and the register scans and managed-block rules apply everywhere",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-18202-1",
+      "description": "[happy] given the pack, when rcf guidance define-intent and rcf guidance discovery-prototypes run, then each prints its file.",
+      "testable": true
+    },
+    {
+      "id": "AC-18202-2",
+      "description": "[happy] given the manifest, when the MCP server lists prompts, then rcf_define_intent, rcf_define_intake, rcf_define_draft_shapes, rcf_define_litmus and rcf_discover_prototype are present and argument-free.",
+      "testable": true
+    },
+    {
+      "id": "AC-18202-3",
+      "description": "[failure] given a new guidance file containing an em-dash, when the register scan runs, then it fails.",
+      "testable": true
+    },
+    {
+      "id": "AC-18202-4",
+      "description": "[must-not] given the managed block, when regenerated, then no existing rule is removed.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4128-define-guidance"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T00:00:00Z"
+}

package/rcf/user-stories/us-18601.json

@@ -0,0 +1,55 @@
+{
+  "usId": "US-18601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-186",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "the question set",
+  "description": "User story under REQ-186. computeQuestions turns every failing product-owner item into one plain question with its write-back, so the harness can ask without reading gate internals.",
+  "asA": "harness serving a product owner",
+  "iWant": "computeQuestions to turn every failing product-owner item into one plain question with its write-back",
+  "soThat": "I can ask without reading gate internals",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-18601-1",
+      "description": "[happy] given a tree where brief:openQuestions, skeleton:resolvedBy and stories:reqHasUs each fail at least one item, when computeQuestions runs with persona productOwner, then questions[] holds exactly one entry per failing item with id, stage, check, itemId, heading, ask, answerKinds, writeBack and blocks intent.",
+      "testable": true
+    },
+    {
+      "id": "AC-18601-2",
+      "description": "[happy] given the same tree, when computeQuestions runs twice, then the two questions[] arrays are deep-equal and ordered D1, D2, D4, D7 then by source span.",
+      "testable": true
+    },
+    {
+      "id": "AC-18601-3",
+      "description": "[happy] given an open decision with two options and a default, when computeQuestions runs, then it appears in optional[] with blocks build and not in questions[].",
+      "testable": true
+    },
+    {
+      "id": "AC-18601-4",
+      "description": "[happy] given a tree where levels.intentComplete.ok is true, when computeQuestions runs with persona productOwner, then questions[] is empty and ok is true.",
+      "testable": true
+    },
+    {
+      "id": "AC-18601-5",
+      "description": "[happy] given persona engineer, when computeQuestions runs, then questions[] holds one entry per failing engineer item in failing stages and blocks is build.",
+      "testable": true
+    },
+    {
+      "id": "AC-18601-6",
+      "description": "[failure] given a persona value outside productOwner and engineer, when computeQuestions runs, then it throws a usage error naming the accepted values.",
+      "testable": true
+    },
+    {
+      "id": "AC-18601-7",
+      "description": "[must-not] given any tree, when computeQuestions runs, then no file under rcf/ is created or modified and no question carries a writeBack command whose verb is not registered in the CLI help.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4129-define-questions"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-02T18:00:00Z",
+  "updatedAt": "2026-10-02T18:00:00Z"
+}

package/rcf/user-stories/us-18602.json

@@ -0,0 +1,50 @@
+{
+  "usId": "US-18602",
+  "prdId": "PRD-001",
+  "reqId": "REQ-186",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "the verb and the tools",
+  "description": "User story under REQ-186. `rcf define questions` and `rcf_define_questions` return the same object, so the CLI loop and the MCP loop cannot disagree.",
+  "asA": "operator or harness",
+  "iWant": "the verb and the MCP tool to return the same object",
+  "soThat": "the two loops cannot disagree",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-18602-1",
+      "description": "[happy] given a failing tree, when rcf define questions --json runs, then stdout is the computeQuestions object and the exit code is 0.",
+      "testable": true
+    },
+    {
+      "id": "AC-18602-2",
+      "description": "[happy] given no --persona, when the verb runs on a profile whose register is engineer, then persona is engineer; with no profile it is productOwner.",
+      "testable": true
+    },
+    {
+      "id": "AC-18602-3",
+      "description": "[happy] given --stage skeleton and --limit 2, when the verb runs, then questions[] holds at most two D2 entries and remaining counts every D2 item.",
+      "testable": true
+    },
+    {
+      "id": "AC-18602-4",
+      "description": "[happy] given the MCP tool rcf_define_questions with the same arguments, when it is called, then structuredContent deep-equals the verb's --json output.",
+      "testable": true
+    },
+    {
+      "id": "AC-18602-5",
+      "description": "[failure] given --persona architect, when the verb runs, then it exits 2 with the usage line naming productOwner and engineer.",
+      "testable": true
+    },
+    {
+      "id": "AC-18602-6",
+      "description": "[must-not] given any invocation of rcf define questions, when it completes, then no file under rcf/ has been created or modified.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4129-define-questions"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-02T18:00:00Z",
+  "updatedAt": "2026-10-02T18:00:00Z"
+}

package/rcf/user-stories/us-18603.json

@@ -0,0 +1,45 @@
+{
+  "usId": "US-18603",
+  "prdId": "PRD-001",
+  "reqId": "REQ-186",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "write-back and termination",
+  "description": "User story under REQ-186. Every answer lands through a verb and the loop ends at the computed verdict, so nothing about intent lives only in a chat.",
+  "asA": "product owner",
+  "iWant": "every answer to land through a verb and the loop to end at the computed verdict",
+  "soThat": "nothing about my intent lives only in a chat",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-18603-1",
+      "description": "[happy] given the scripted loop fixture, when every writeBack the question set returns is applied and readiness recomputed each turn, then the question count strictly decreases every turn and reaches zero.",
+      "testable": true
+    },
+    {
+      "id": "AC-18603-2",
+      "description": "[happy] given a statement resolved to a newly created REQ carrying description and domain, when readiness recomputes, then skeleton:reqIntent passes that REQ and stories:reqHasUs asks for it once.",
+      "testable": true
+    },
+    {
+      "id": "AC-18603-3",
+      "description": "[happy] given a tree at L1, when [draft] entities, TAC stubs and interfaces are added, then levels.intentComplete.ok stays true and the product-owner question set stays empty.",
+      "testable": true
+    },
+    {
+      "id": "AC-18603-4",
+      "description": "[failure] given an openQuestion promoted to a decision with one option and no default, when readiness recomputes, then decisions:wellFormed asks once and brief:openQuestions does not.",
+      "testable": true
+    },
+    {
+      "id": "AC-18603-5",
+      "description": "[must-not] given any product-owner check, when readiness recomputes after an engineer-only edit, then no product-owner check changes from ok to failing.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4129-define-questions"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-02T18:00:00Z",
+  "updatedAt": "2026-10-02T18:00:00Z"
+}

package/rcf/user-stories/us-18701.json

@@ -0,0 +1,50 @@
+{
+  "usId": "US-18701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-187",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "the statement file",
+  "description": "User story under REQ-187. The harness writes a statement file beside each source with a leading bracketed kind and a trailing (source: ...) marker; `brief add --from` parses the markers and mints the statements.",
+  "asA": "harness",
+  "iWant": "a line grammar for kind and source",
+  "soThat": "the split I propose to the owner is what gets minted",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-18701-1",
+      "description": "[happy] given a line \"- [constraint] A loan on hold must not accrue late fees. (source: briefs/x.md:15)\", when brief add --from runs, then one statement is minted with kind constraint, that text and that source.",
+      "testable": true
+    },
+    {
+      "id": "AC-18701-2",
+      "description": "[happy] given a line with no markers under --kind actor --source doc.md, when brief add --from runs, then the statement has kind actor and source doc.md.",
+      "testable": true
+    },
+    {
+      "id": "AC-18701-3",
+      "description": "[happy] given a line ending with \"?\" and no kind marker, when brief add --from runs, then the statement has kind openQuestion.",
+      "testable": true
+    },
+    {
+      "id": "AC-18701-4",
+      "description": "[happy] given a 0.29.0 line-per-statement file, when brief add --from runs, then the minted statements equal the 0.29.0 output.",
+      "testable": true
+    },
+    {
+      "id": "AC-18701-5",
+      "description": "[failure] given a line \"[gadget] text\", when brief add --from runs, then it exits 2 naming the accepted kinds and writes nothing.",
+      "testable": true
+    },
+    {
+      "id": "AC-18701-6",
+      "description": "[must-not] given --dry-run, when brief add --from runs, then rcf/define/brief-ledger.json is not created or modified.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4130-define-intake-brief"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-02T16:40:00Z",
+  "updatedAt": "2026-10-02T16:40:00Z"
+}

package/rcf/user-stories/us-18702.json

@@ -0,0 +1,50 @@
+{
+  "usId": "US-18702",
+  "prdId": "PRD-001",
+  "reqId": "REQ-187",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "scans into open questions",
+  "description": "User story under REQ-187. The intake scans run inside `brief add --from` over the new statements against every existing statement, and every finding becomes an openQuestion statement with source `scan:<name>:<ids>`.",
+  "asA": "product owner",
+  "iWant": "contradictions and gaps the tool can see to reach me as questions",
+  "soThat": "the first readiness run tells me what is still mine",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-18702-1",
+      "description": "[happy] given two new statements the contradiction scan flags, when brief add --from runs with scans on, then one openQuestion statement is appended with source scan:contradiction:<id>,<id> and brief:openQuestions fails it.",
+      "testable": true
+    },
+    {
+      "id": "AC-18702-2",
+      "description": "[happy] given a --findings file with two findings, when brief add --from runs, then two openQuestion statements are appended with source scan:<name>.",
+      "testable": true
+    },
+    {
+      "id": "AC-18702-3",
+      "description": "[happy] given a frozen tree, when brief add --from runs, then the scans compare the new statements against every existing statement.",
+      "testable": true
+    },
+    {
+      "id": "AC-18702-4",
+      "description": "[happy] given --json, when brief add --from runs, then stdout holds added[] and findings[].",
+      "testable": true
+    },
+    {
+      "id": "AC-18702-5",
+      "description": "[failure] given --no-scan together with --findings, when brief add runs, then it exits 2.",
+      "testable": true
+    },
+    {
+      "id": "AC-18702-6",
+      "description": "[must-not] given --text, when brief add runs, then no scan runs and no openQuestion statement is appended.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4130-define-intake-brief"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-02T16:40:00Z",
+  "updatedAt": "2026-10-02T16:40:00Z"
+}

package/rcf/user-stories/us-18801.json

@@ -0,0 +1,45 @@
+{
+  "usId": "US-18801",
+  "prdId": "PRD-001",
+  "reqId": "REQ-188",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "the draft homes",
+  "description": "User story under REQ-188. Every pre-populated shape across the three draft homes (`TAC.purpose`, `coreEntities[].description`, `TAC.interfaces[].description`) carries the `[draft]` marker; `shapes:draftSettled` reports all three id forms so nothing drafted reads as settled.",
+  "asA": "engineer picking up an intent-complete tree",
+  "iWant": "every pre-populated shape marked",
+  "soThat": "nothing drafted reads as settled",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-18801-1",
+      "description": "[happy] given a coreEntities entry whose description starts with [draft], when D3 runs, then shapes:draftSettled fails TAD.entity:<name>.",
+      "testable": true
+    },
+    {
+      "id": "AC-18801-2",
+      "description": "[happy] given a TAC whose purpose starts with [draft], when D3 runs, then shapes:draftSettled fails <tacId> and shapes:tacHasInterface treats the TAC as present.",
+      "testable": true
+    },
+    {
+      "id": "AC-18801-3",
+      "description": "[happy] given the three marker homes cleared, when D3 runs, then shapes:draftSettled passes.",
+      "testable": true
+    },
+    {
+      "id": "AC-18801-4",
+      "description": "[failure] given a [draft] recordShape without fields:, when D3 runs, then shapes:templateMarkers fails it exactly as a settled one.",
+      "testable": true
+    },
+    {
+      "id": "AC-18801-5",
+      "description": "[must-not] given any [draft] content, when readiness runs, then no productOwner check reads it.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4122-define-gates"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T00:00:00Z"
+}

package/rcf/user-stories/us-204.json

@@ -0,0 +1,59 @@
+{
+  "usId": "US-204",
+  "prdId": "PRD-001",
+  "reqId": "REQ-002",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "An engineer sees the FBS DAG",
+  "description": "The Build tab's DAG sub-tab lays FBS out by dependency depth from `dependsOnFbsIds` with click-to-highlight closure, a dependency inspector, status/area/Buildable-now/Critical-path/Show-unconnected filters, a hidden unconnected lane with a count, and `#tab=build&sub=dag&entity=<id>` deep links so a node is a link. The canvas scrolls inside its own box and the viewer never scrolls horizontally. See viewer UI refresh design doc section 7.",
+  "asA": "an engineer looking at the build sequence",
+  "iWant": "a dependency DAG of the FBS with click-to-highlight closure, an inspector and filters",
+  "soThat": "I can see what feeds what, pick the next buildable work and spot the critical path without reading JSON",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-204-1",
+      "description": "[happy] Given the Build tab's DAG sub-tab, when it renders, then every connected FBS sits in a column whose index equals its longest dependency depth from `dependsOnFbsIds` (0 for no dependency) and rows inside a column are ordered by `buildOrder` ascending.",
+      "testable": true
+    },
+    {
+      "id": "AC-204-2",
+      "description": "[happy] Given the DAG canvas, when a node is clicked, then it is selected, its upstream closure outlines in the link colour and its downstream closure outlines in the warning colour; a second click on the same node clears the selection.",
+      "testable": true
+    },
+    {
+      "id": "AC-204-3",
+      "description": "[happy] Given a selected FBS, when the inspector renders, then it lists status, area, AC count, size, build order, a buildable-now flag, direct and transitive needs, direct and transitive waits-on and an \"Open in Specs\" link that moves to `#tab=build&sub=specs&entity=<id>`.",
+      "testable": true
+    },
+    {
+      "id": "AC-204-4",
+      "description": "[happy] Given a selection, when it is set or cleared, then the hash becomes `#tab=build&sub=dag&entity=<id>` (or drops the entity key when cleared) and a reload with that hash restores the selection and scrolls the node into view.",
+      "testable": true
+    },
+    {
+      "id": "AC-204-5",
+      "description": "[happy] Given the DAG toolbar, when the Status, Area, Buildable-now, Critical-path or Show-unconnected filter changes, then the visible nodes update and the current selection is kept.",
+      "testable": true
+    },
+    {
+      "id": "AC-204-6",
+      "description": "[failure] Given a `dependsOnFbsIds` cycle on disk, when the DAG renders, then the cycle is reported as a finding in the toolbar area and the remaining non-cycle FBS still render.",
+      "testable": true
+    },
+    {
+      "id": "AC-204-7",
+      "description": "[must-not] Given the DAG canvas, when a node is clicked, filtered or inspected, then no `postMessage` is sent to the parent window and no outbound network request is made.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4131-build-dag-view"
+  ],
+  "tags": [
+    "view",
+    "build",
+    "dag"
+  ],
+  "createdAt": "2026-10-02T18:00:00Z",
+  "updatedAt": "2026-10-02T18:00:00Z"
+}

package/rcf/user-stories/us-205.json

@@ -0,0 +1,64 @@
+{
+  "usId": "US-205",
+  "prdId": "PRD-001",
+  "reqId": "REQ-002",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "An engineer jumps to any document or AC by id",
+  "description": "A SearchButton to the right of the tabstrip and the Cmd/Ctrl+F keyboard binding open a LookupModal with type-ahead over a server-built `./index.json` carrying every document id and every AC. Id matches rank first (exact, prefix, contains), then every query word must match title or snippet, title above snippet; a single character searches ids only; 20 results. A pick sets `#tab=<tab>&entity=<id>`; the Router activates the tab, opens every ancestor DocRow and flashes the target. `embed` and `theme` survive every hash write. See viewer UI refresh design doc section 6.",
+  "asA": "an engineer looking at any tab of the review surface",
+  "iWant": "a modal that lets me jump to any document or AC by typing part of its id or title",
+  "soThat": "I can navigate the tree by id without hunting through the tabs",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-205-1",
+      "description": "[happy] Given the review surface, when the SearchButton is pressed or Cmd/Ctrl+F is typed from any tab, then the LookupModal opens; typing an exact id (`REQ-002`) or a prefix (`REQ-00`) ranks that id first and the first result row is pre-highlighted.",
+      "testable": true
+    },
+    {
+      "id": "AC-205-2",
+      "description": "[happy] Given the LookupModal, when a word query matches a document's title and another document's snippet, then the title match ranks above the snippet match.",
+      "testable": true
+    },
+    {
+      "id": "AC-205-3",
+      "description": "[happy] Given the LookupModal, when a query of exactly one character is typed, then only ids whose identifier contains that character rank, and the title / snippet word-match pass is skipped.",
+      "testable": true
+    },
+    {
+      "id": "AC-205-4",
+      "description": "[happy] Given a pre-highlighted result for `US-304`, when Enter is pressed, then the hash becomes `#tab=requirements&entity=US-304`, the Router activates the Requirements tab, opens the REQ-003 ancestor DocRow and the US-304 row, scrolls the target into view and flashes it.",
+      "testable": true
+    },
+    {
+      "id": "AC-205-5",
+      "description": "[happy] Given a mount URL `?tab=requirements&entity=US-304`, when the shell first paints, then the Router lands on the same position: Requirements tab active, REQ-003 and US-304 DocRows open, US-304 scrolled into view.",
+      "testable": true
+    },
+    {
+      "id": "AC-205-6",
+      "description": "[happy] Given `?embed=1&theme=dark` on the viewer URL, when a result is picked from the LookupModal, then the resulting URL still carries `embed=1` and `theme=dark` in the query string and the hash is `#tab=<tab>&entity=<id>`.",
+      "testable": true
+    },
+    {
+      "id": "AC-205-7",
+      "description": "[failure] Given a `./index.json` fetch that returns a non-2xx status or a malformed body, when the LookupModal is opened, then an empty state renders with a reload affordance that re-fetches the index, and no result rows show.",
+      "testable": true
+    },
+    {
+      "id": "AC-205-8",
+      "description": "[must-not] Given the LookupModal, when the user types a query, picks a result or closes the modal, then no `postMessage` is sent to the parent window, no outbound network request beyond the `./index.json` fetch is made, and no search term is written to `localStorage` / `sessionStorage` / cookies.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4132-id-lookup"
+  ],
+  "tags": [
+    "view",
+    "lookup",
+    "navigation"
+  ],
+  "createdAt": "2026-10-02T19:00:00Z",
+  "updatedAt": "2026-10-02T19:00:00Z"
+}

package/rcf/user-stories/us-206.json

@@ -0,0 +1,54 @@
+{
+  "usId": "US-206",
+  "prdId": "PRD-001",
+  "reqId": "REQ-002",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "wespa's embedding contract is proved by a CI host fixture",
+  "description": "A same-origin test-host fixture served by the viewer's dev server (route `/test-host.html` behind a `--test-host` flag or an env guard; off by default so wespa's proxy allow-list is unaffected) mimics the wespa shell: a 56px header, a resizable sidebar (64px collapsed, 200-400px expanded, user-resizable live via a drag handle), a content pane carrying an `<iframe src=\"./?embed=1&theme=light\">`. The host posts `{ type: \"rcf-view-theme\", theme: \"light\"|\"dark\" }` on a toggle control; it stores no theme itself so a passing run proves the iframe reads the message. The viewer sends no outbound postMessage. Three lints run in the test suite: (1) framing lint (`GET /` returns no `X-Frame-Options`, no CSP `frame-ancestors` that forbids same-origin, and the fixture loads the iframe without a browser error); (2) target lint (no `target=\"_top\"` string in the server-rendered HTML); (3) localStorage namespace lint (every `localStorage.{setItem,getItem,removeItem}` and shared `storage.*` call site in `src/view/**` uses a key starting with `rcf-view:v1:`). See viewer UI refresh design doc section 9 and Dex's wespa requirements of 2026-10-02.",
+  "asA": "Dex integrating the rcf-lite viewer behind wespa's reverse proxy",
+  "iWant": "a CI host fixture that proves the viewer honours the embedding contract and three lints that keep framing, target='_top' and localStorage namespace in place over time",
+  "soThat": "regressions in the embedding contract are caught in the viewer's own suite before they reach wespa",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-206-1",
+      "description": "[happy] Given the test-host fixture at `/test-host.html`, when the page loads with the viewer served from the same origin, then the iframe `src` is `./?embed=1&theme=light`, the title block and footer of the iframed viewer are hidden (`<html data-embed=\"1\">`), the tab nav is visible and the host's 56px header plus the resizable sidebar render around it.",
+      "testable": true
+    },
+    {
+      "id": "AC-206-2",
+      "description": "[happy] Given the test-host fixture with the iframe loaded, when the host's theme toggle posts `{ type: \"rcf-view-theme\", theme: \"dark\" }` to the iframe's `contentWindow`, then the iframe's `<html data-theme>` flips to `dark` without a reload and the content repaints in the dark token set.",
+      "testable": true
+    },
+    {
+      "id": "AC-206-3",
+      "description": "[happy] Given the test-host fixture with the iframe loaded at `./?embed=1&theme=dark`, when a hash-only navigation inside the iframe writes `#tab=requirements&entity=REQ-002`, then the iframe's query still carries `embed=1` and `theme=dark` and the viewer's inner `<html data-embed=\"1\" data-theme=\"dark\">` is preserved.",
+      "testable": true
+    },
+    {
+      "id": "AC-206-4",
+      "description": "[failure] Given the viewer page listening for `rcf-view-theme` postMessages, when a message with `event.origin` different from `window.location.origin` is delivered, then the message is ignored and `<html data-theme>` is not changed.",
+      "testable": true
+    },
+    {
+      "id": "AC-206-5",
+      "description": "[must-not] Given the viewer's `GET /` response, when the three lints run in the test suite, then (a) no `X-Frame-Options` header is set and no CSP `frame-ancestors` directive forbids same-origin framing, (b) `target=\"_top\"` appears zero times in the rendered HTML across every tab, (c) every `localStorage.{setItem,getItem,removeItem}` and shared `storage.*` call site under `src/view/**` uses a key starting with `rcf-view:v1:`.",
+      "testable": true
+    },
+    {
+      "id": "AC-206-6",
+      "description": "[must-not] Given the test-host fixture and the viewer page, when either is loaded, then neither posts any outbound message beyond the host's `rcf-view-theme`; the viewer sends no `postMessage` of any shape, and the test-host adds no new postMessage shape.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4134-wespa-host-fixture"
+  ],
+  "tags": [
+    "view",
+    "embedding",
+    "lint"
+  ],
+  "createdAt": "2026-10-02T20:00:00Z",
+  "updatedAt": "2026-10-02T20:00:00Z"
+}

package/releases/releases.yaml

@@ -40,8 +40,18 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.28.4"
+latest: "0.29.0"
 releases:
+  - version: "0.29.0"
+    date: "2026-10-03"
+    breaking: true
+    headlines:
+      - "rcf-lite 0.29.0 lands the viewer UI refresh train in one release: a rebuilt shell with the Stravica brand tokens, light and dark theme and an embed contract; shared components across Requirements, Architecture, Build and Readiness; a Build DAG sub-tab with click-to-highlight closure, dependency inspector and an unconnected lane; fast ID lookup over a new ./index.json served from the viewer root (Cmd/Ctrl+F from any tab); the Readiness tab Product Owner redesign; and a same-origin test-host fixture that pins the embedding contract with three in-suite guards. For wespa embedders, the reverse-proxy allow-list for /rcf-viewer/* MUST add /page-init.js and /index.json before the version pin bump; /test-host.html and /test-host.js stay 404 by default so the allow-list is unchanged by the embedding-proof fixture."
+      - "The DEFINE readiness persona split arrives too: every gate check carries a persona (product owner or engineer), two readiness levels (intent-complete, ready-to-build), the Readiness tab moves to tab one, and rcf define readiness gains --level and --persona flags with a persona-grouped text report."
+      - "The first three DEFINE step 3 PRs ship: document intake into the brief ledger via a statement file parser and the mechanical intake scans; a new rcf define ledger <name> update <id> subverb with a closed resolvedBy pointer grammar (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) and the D2 skeleton:resolvedBy title-hit fallback dropped; a rcf define questions verb with three new MCP tools and two argument-free prompts for the harness-driven loop; and the [draft] shapes gate across TAC purpose, interface and core-entity homes with a DISCOVERY prototypes doctrine."
+    minAgentAction: rerun-init
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.28.4"
     date: "2026-09-30"
     breaking: false