rcf-lite 0.28.4 → 0.30.0

package/rcf/adrs/adr-4133-dag-dependency-depth-layout.json

@@ -0,0 +1,40 @@
+{
+  "createdAt": "2026-10-02T18:00:00Z",
+  "updatedAt": "2026-10-02T18:00:00Z",
+  "adrId": "ADR-4133-dag-dependency-depth-layout",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "The Build/DAG canvas lays FBS by dependency depth, orders rows by buildOrder, measures the critical path by node count and parks unconnected FBS in a hidden lane with a count",
+  "context": "The viewer UI refresh (design doc section 7) names a DAG for the Build tab's second sub-tab. The dogfood tree has 87 FBS: 46 declare no dependency, 36 are unconnected both ways, 1 is in progress and `estimatedHours` is sparse. A force-directed layout is unstable across reloads (the review surface is a diff-worthy artefact; identical trees must render identical pages), and grouping purely by `domain` hides the thing the DAG exists to show (which FBS feeds which). The v1 rcf-tools DAG proved the tiered layout works for the engineer audience the Build tab serves (decision 14); its gaps - dark-only palette, no inspector, orphan pile-up swamping the graph, no deep links, horizontal page scroll - are the ones this PR fixes.",
+  "decision": "Columns in the DAG are dependency-depth tiers computed from `dependsOnFbsIds` (0 for an FBS that declares no dependency; max over `depth(dep) + 1` otherwise). Rows inside a column are `buildOrder` ascending with `fbsId` lexicographic tie-break. Critical path is the longest chain by node count across the DAG, because `estimatedHours` is sparse on the dogfood tree (section 7 gap b); the critical-path chip highlights every member of that longest chain. Unconnected FBS - no incoming and no outgoing `dependsOnFbsIds` edge - sit in a lane below the main graph, hidden by default, with the count on the toggle. Cycle members (should any appear) are excluded from the depth layout and surfaced as a shared `findings-list` finding on the toolbar; non-cycle FBS still render so one bad edge never blocks the view (AC-204-6). The selection round-trips `#tab=build&sub=dag&entity=<id>` through the existing writeHash so a node is a link (decision 11, extended).",
+  "consequences": "The DAG is deterministic across reloads: same tree, same page. The depth tiers reflect what actually gates work, so the leftmost column is the \"start here\" set and buildable-now items concentrate on its right edge. Hiding unconnected FBS by default stops the 36-row pile-up swamping the dogfood tree - the toggle count makes them discoverable. Choosing node count for the critical path means the chip stays meaningful on the dogfood tree today and will only sharpen when `estimatedHours` fills in; the ADR explicitly leaves the hours-weighted critical path to a later change. Deep-link parity with Specs (`#tab=build&sub=specs&entity=<id>`) lets the inspector's Open-in-Specs link move cleanly across the two sub-tabs.",
+  "alternativesConsidered": [
+    {
+      "name": "Force-directed layout",
+      "summary": "Lay nodes with a physics simulation and let the dependency edges settle.",
+      "reasonNotChosen": "Position jitters across reloads so screenshots and visual diffs are noisy; the review surface is diff-worthy by contract, and a layout that is not deterministic cannot be screenshotted into design evidence or compared across runs."
+    },
+    {
+      "name": "Group by domain only",
+      "summary": "Columns are areas (view, cli, build, ...) and rows are FBS in each area.",
+      "reasonNotChosen": "Hides the dependency structure that the DAG exists to show. Area is already a FilterBar facet on the Specs sub-tab and a badge on each node; adding a second encoding of it costs the dependency axis."
+    },
+    {
+      "name": "Hours-weighted critical path",
+      "summary": "Measure critical path by sum of `estimatedHours` along a chain.",
+      "reasonNotChosen": "`estimatedHours` is sparse on the dogfood tree (section 7 gap b); a weight that is missing on most nodes would silently bias the chip toward whichever subtree happens to have estimates. Node count is the honest signal today; the hours-weighted path becomes an opt-in once estimates are populated across the tree."
+    },
+    {
+      "name": "Render unconnected FBS inline (no lane)",
+      "summary": "Lay unconnected FBS as a 36-row column 0 alongside the connected tier 0.",
+      "reasonNotChosen": "Doubles the visual height of the leftmost column with nodes that have no edges, swamping the dependency graph the DAG exists to show. The toggled lane with the count keeps them one click away without the pile-up."
+    },
+    {
+      "name": "Block the DAG on any cycle",
+      "summary": "If the tree carries a `dependsOnFbsIds` cycle, refuse to render the DAG and show an error.",
+      "reasonNotChosen": "A bad edge on a 90-node graph should not take the view down; the `rcf validate` CLI is the enforcement surface. The DAG reports the cycle as a shared finding and renders the rest so the engineer can see what still composes."
+    }
+  ]
+}

package/rcf/adrs/adr-4134-index-json-route.json

@@ -0,0 +1,35 @@
+{
+  "createdAt": "2026-10-02T19:00:00Z",
+  "updatedAt": "2026-10-02T19:00:00Z",
+  "adrId": "ADR-4134-index-json-route",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "The ID lookup index is served as a new ./index.json route, built from BuiltTreeModel on every rewalk and fetched lazily on first open",
+  "context": "The viewer UI refresh (design doc section 6) adds a type-ahead ID lookup over every document id plus every AC. On the dogfood tree that is roughly 1,600 rows and well under 300 KB of JSON. The viewer is served through wespa's reverse proxy; new routes 404 until wespa's allow-list is extended (Dex, 2026-10-02; design section 9), so every new route must be named in the release notes alongside the version that introduces it. The viewer page is already live-updated through an SSE tree-update event, so an index that mirrors the tree needs to refresh on the same event. The alternatives considered were inlining the index into `./scope.json` or rebuilding the index in the browser; both have load-bearing downsides.",
+  "decision": "The index is a new `./index.json` route served from the viewer, built once per rewalk from BuiltTreeModel and returned as `{ rows: Array<{ id, kind, title, snippet, parent, tab }> }`. The route is fetched lazily on first LookupModal open and refreshed when the next SSE `tree-update` event lands (the client marks its cache dirty and refetches on the next open). The route is named in the release notes so wespa's proxy allow-list is extended before the version pin bump; it is the fourth or later such release-noted viewer route after PR 1's `./page-init.js`.",
+  "consequences": "The browser pays one small fetch on the first lookup and nothing on subsequent opens until the tree changes; the server owns the index projection once per rewalk, so the model-to-rows mapping cannot drift between the viewer's doc renderers and the lookup results. The release-notes contract means every new viewer route the embedding host must allow is discoverable from CHANGELOG. The index body is `{ rows }` rather than a bare array so a future field (version, generatedAt, counts) can be added without a breaking shape change.",
+  "alternativesConsidered": [
+    {
+      "name": "Inline the index into ./scope.json",
+      "summary": "Extend the existing deep-link scope endpoint to carry the lookup rows.",
+      "reasonNotChosen": "`./scope.json` is a hot path on every page load and is parsed by the deep-link client; bloating it with ~1,600 lookup rows pays the fetch cost even for sessions that never open the modal, and couples two independent features."
+    },
+    {
+      "name": "Rebuild the index in the browser from the rendered DOM",
+      "summary": "Walk the DOM after each SSE innerHTML swap to collect every data-doc-id and AC li.",
+      "reasonNotChosen": "Duplicates the BuiltTreeModel projection in the viewer client, misses the kind, parent and tab metadata the DOM does not carry in a canonical shape, and silently drifts when a renderer stops emitting a given document."
+    },
+    {
+      "name": "Inline the index into the shell HTML as a <script type=\"application/json\">",
+      "summary": "Server-render the rows directly inside the page so no second request is needed.",
+      "reasonNotChosen": "Grows every first paint by ~300 KB even when the lookup is never opened and leaks straight into the HTML stream the live client swaps on every SSE tree-update, so the cost is paid again per update. The modal is a cold path; the lazy fetch is cheaper."
+    },
+    {
+      "name": "Keep the index unversioned and refetch on a wall-clock timer",
+      "summary": "Have the client poll `./index.json` every N seconds instead of listening to the SSE event.",
+      "reasonNotChosen": "Breaks the viewer's live-swap discipline: the rest of the surface refreshes on `tree-update` with no polling anywhere, so an index that polls would be the only timer-driven feature and race the SSE swap during edits."
+    }
+  ]
+}

package/rcf/adrs/adr-4135-readiness-po-register-and-adapter.json

@@ -0,0 +1,35 @@
+{
+  "createdAt": "2026-10-02T19:30:00Z",
+  "updatedAt": "2026-10-02T19:30:00Z",
+  "adrId": "ADR-4135-readiness-po-register-and-adapter",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "The Readiness tab fixes its two-audience split by the profile register and uses a feature-detected adapter seam for the PO question block",
+  "context": "The viewer UI refresh (design doc section 1 decision 1 and section 8) splits the Readiness tab into a product-owner-first layer and a For-engineers DocRow at the foot. The chain's DEFINE step 3 PR 2 reserves a new `readiness.questions[]` shape built by `computeQuestions`; until that lands the viewer still has to render the PO question block from today's `personas.productOwner.blockers`. The design doc section 11 recommendation 4 asks for the phrasebook now so the pilot does not wait on DEFINE step 3. Baz's amendment 12 of 2026-10-02T13:40Z requires both VerdictCards to render at equal height with the chain term muted beside the plain label on both cards (`intent-complete`, `ready-to-build`).",
+  "decision": "The Readiness tab fixes its two-audience split by the `profile.register`: `productOwner` or absent / unstated opens the four PO blocks and keeps the For-engineers DocRow closed; `engineer` opens the For-engineers DocRow at the foot. No tab changes shape or wording by where the tree sits in DEFINE (decision 14). The phrasebook ships now (one entry per row of design doc section 8's PO question table, keyed by check id) and the adapter seam `toQuestions(readiness)` is a pure module exported from src/view/readiness/question-adapter.js: it reads blockers today and switches to `readiness.questions` when the shape is present (feature-detected via `preferReadinessQuestions(readiness)`); the call site in the tab reads only the adapter output. The engineer DOM is never removed, only collapsed under the DocRow (AC-18002-3). The CLI verdict strings keep rendering inside the For-engineers DocRow verbatim.",
+  "consequences": "The pilot can land PR 8 ahead of DEFINE step 3 PR 2 without a second rewrite when the questions shape arrives; the switch is one feature-detect line and the shape is drop-in. The two-audience split is deterministic (the register alone decides opening state) so the Remi pilot never sees a tab that reshapes under its feet as the tree moves through DEFINE. The engineer DOM invariant guards parity with `rcf define readiness --json`: every id the CLI prints is still in the viewer's DOM, just one level down. Equal-height VerdictCards and the muted chain term land once, from CSS, so no scripted measurement is needed.",
+  "alternativesConsidered": [
+    {
+      "name": "Wait for DEFINE step 3 PR 2 to land `readiness.questions` before shipping PR 8",
+      "summary": "Postpone PR 8 until the questions compute is in place so the viewer never reads blockers directly.",
+      "reasonNotChosen": "Blocks the Remi pilot and the hand-over for a chain PR whose timing is not in this surface's control. The adapter seam is the smallest possible layer that lets both sources flow through one shape, so the extra module today is a one-day cost that buys weeks of parallel progress."
+    },
+    {
+      "name": "Re-render the tab by DEFINE progression state (open For-engineers once the PO blocks pass)",
+      "summary": "Have the Readiness tab change shape based on where the tree sits in DEFINE (so the engineer view only appears when the PO view is empty).",
+      "reasonNotChosen": "Contradicts decision 14 (`two audiences, fixed by tab, never by progression state`). An engineer looking at the tab mid-DEFINE loses the engineer view they rely on, and a product owner who reaches intent-complete suddenly sees a block that was never there before. The register is the audience; the state is not."
+    },
+    {
+      "name": "Remove the engineer blockers from the DOM in the productOwner register",
+      "summary": "Hide the engineer-level findings entirely when `profile.register === 'productOwner'` so the page is quieter.",
+      "reasonNotChosen": "AC-18002-3 is must-not for a reason: hiding a persona breaks parity with `rcf define readiness --json`. A collapsed DocRow carries the signal the diagnostic needs without crowding the PO view."
+    },
+    {
+      "name": "Script equal-height cards with ResizeObserver",
+      "summary": "Measure both VerdictCards after render and copy the taller height onto the shorter one.",
+      "reasonNotChosen": "The relative-script policy (PR 1) keeps the shell free of inline script and keeps the DOM a server render that the SSE path can swap wholesale. CSS grid or flex with `align-items: stretch` on a shared parent gives equal height for free and survives theme swaps."
+    }
+  ]
+}

package/rcf/adrs/adr-4136-embedding-host-fixture.json

@@ -0,0 +1,35 @@
+{
+  "createdAt": "2026-10-02T20:00:00Z",
+  "updatedAt": "2026-10-02T20:00:00Z",
+  "adrId": "ADR-4136-embedding-host-fixture",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "The embedding contract is pinned by a CI host fixture; three lints keep framing, target='_top' and localStorage namespace in place; the fixture does not persist theme itself so a passing run proves the iframe reads the message",
+  "context": "Dex's wespa requirements (2026-10-02; `docs/2026-10-02_dex-wespa-embedding-requirements.md`) and the viewer UI refresh design section 9 pin the viewer's embedding contract: same-origin iframe behind wespa's reverse proxy under `/rcf-viewer/`, `embed=1` suppresses the title block and footer, `theme=light|dark|auto` on first paint, `{ type: \"rcf-view-theme\", theme }` postMessage with `event.origin` checked for live changes, viewer fills 100% viewport height and owns its scrolling, no framing-blocking headers, no `target=\"_top\"` links, localStorage namespaced under `rcf-view:v1:`, no outbound postMessage from the viewer. Wespa smoke on the live wespa shell is Dex's side; a regression there would reach wespa before the viewer saw it, so the viewer needs its own proof in CI. Unit-testing the message handler without an iframe does not prove framing works (a `X-Frame-Options` or wrong CSP would break the live embed and pass the unit test).",
+  "decision": "Ship a same-origin test-host fixture served by the viewer's own dev server at `/test-host.html` (plus `/test-host.js` for the client-side wiring) that mimics the wespa shell: a 56px header carrying a Light/Dark/Auto theme toggle, a resizable sidebar (64px collapsed, 200-400px expanded, user-resizable live via a drag handle), a content pane carrying a single `<iframe src=\"./?embed=1&theme=light\">`. The fixture is off the default route surface - gated on a `--test-host` CLI flag or the `RCF_VIEW_TEST_HOST=1` env var and 404s otherwise - so wespa's proxy allow-list is unaffected. Three lints run in the test suite: (1) framing lint on `GET /` (no `X-Frame-Options`, no CSP `frame-ancestors` that forbids same-origin); (2) `target=\"_top\"` grep over every rendered page (zero occurrences); (3) localStorage namespace grep over `src/view/**` (every key starts with `rcf-view:v1:`). The fixture does not persist its theme choice to localStorage so a passing run proves the iframe reads the postMessage (and not the host's own storage).",
+  "consequences": "The viewer's suite catches a framing regression (headers, `target=\"_top\"`, un-namespaced localStorage key) before it reaches wespa. The fixture is the first production use of the test-host surface, so a `--test-host` flag plus env guard is established as the pattern for every future embedding-shell fixture (adding a `/test-host/<other>.html` becomes a one-liner on the router). Keeping the fixture off the default route surface means the release notes do not need to extend wespa's proxy allow-list for every lint test; a later PR that wants to ship the host alongside the viewer can do so without re-platforming the fixture itself. The lints run on the dogfood tree today and fail on main if a future PR adds a framing-blocking header or writes to localStorage with a non-namespaced key, so the viewer PR that introduces the regression carries the fix in the same commit.",
+  "alternativesConsidered": [
+    {
+      "name": "Wespa-side-only smoke",
+      "summary": "Let wespa test the viewer's embedding against the live wespa shell; the viewer ships no proof of its own.",
+      "reasonNotChosen": "A regression lands on main before wespa sees it; wespa's smoke runs on a different repo on a different cadence, so a viewer refactor that drops `embed=1` or writes an un-namespaced localStorage key breaks every embedder and the viewer's own CI is clean. The lints run in the viewer's suite catch the regression at the PR that introduces it."
+    },
+    {
+      "name": "Unit-test the message handler without an iframe",
+      "summary": "Drive the viewer's `rcf-view-theme` postMessage handler through `node:vm` or a jsdom shim and assert the handler flips `data-theme`.",
+      "reasonNotChosen": "Does not prove framing. A later PR that adds `X-Frame-Options: DENY` to `GET /` would pass the unit test and break every embedder. The host fixture exercises the whole stack: HTTP headers, iframe mount, postMessage, data-theme stamp."
+    },
+    {
+      "name": "Ship the test host under the default route surface",
+      "summary": "Serve `/test-host.html` unconditionally; a developer can hit it directly to eyeball the embed.",
+      "reasonNotChosen": "Wespa's proxy allow-lists routes; a new default-on route needs an allow-list extension and a release-note version pin. The fixture is a test-suite proof, not a shipped UI; keeping it behind `--test-host` / `RCF_VIEW_TEST_HOST=1` means the production route surface stays `/`, `/events`, `/live-client.js`, `/page-init.js`, `/style.css`, `/mermaid.min.js`, `/product-map/*`, `/scope.json`, `/index.json`, `/_fixtures/components`."
+    },
+    {
+      "name": "Persist the theme in the host fixture itself",
+      "summary": "Store the Light/Dark choice in `localStorage` on the host so a reload keeps the toggle state.",
+      "reasonNotChosen": "A passing run would then not prove the iframe honours the postMessage: the host could set `data-theme` on the iframe URL and the iframe would never need to read the message. By refusing to persist, the fixture forces every theme flip through the postMessage path."
+    }
+  ]
+}

package/rcf/code-nodes/cn-725.json

@@ -11,11 +11,27 @@
     "AC-17401-5",
     "AC-17401-6",
     "AC-17401-7",
-    "AC-17401-8"
+    "AC-17401-8",
+    "AC-17401-9",
+    "AC-17402-1",
+    "AC-17402-2",
+    "AC-17402-3",
+    "AC-17402-4",
+    "AC-17402-5",
+    "AC-17402-6",
+    "AC-17402-7",
+    "AC-17403-1",
+    "AC-17403-2",
+    "AC-17403-3",
+    "AC-17403-4",
+    "AC-17403-5",
+    "AC-17403-6",
+    "AC-17403-7",
+    "AC-17403-8"
   ],
   "dependencies": [],
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-09-24T14:30:00Z"
+  "updatedAt": "2026-10-01T14:30:00Z"
 }

package/rcf/code-nodes/cn-726.json

@@ -7,11 +7,19 @@
     "AC-17501-1",
     "AC-17501-2",
     "AC-17501-3",
-    "AC-17501-4"
+    "AC-17501-4",
+    "AC-17502-1",
+    "AC-17502-2",
+    "AC-17502-3",
+    "AC-17502-4",
+    "AC-17502-5",
+    "AC-17502-6",
+    "AC-17502-7",
+    "AC-17502-8"
   ],
   "dependencies": [],
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-09-24T14:30:00Z"
+  "updatedAt": "2026-10-01T14:30:00Z"
 }

package/rcf/code-nodes/cn-727.json

@@ -1,14 +1,23 @@
 {
   "cnId": "CN-727",
   "path": "src/cli/readiness.js",
-  "title": "rcf define readiness [--json] [--check <stage>|all]",
-  "description": "CLI handler. Parses --json / --check / --help; walks the tree; loads freeze + all four ledgers; resolves test pointers; wraps computeReadiness with runWithAdmissibilityGate; emits text or JSON; --check narrows and gates the exit code.",
+  "title": "rcf define readiness [--json] [--check <stage>|all] [--level intent|build] [--persona productOwner|engineer]",
+  "description": "CLI handler. Parses --json / --check / --level / --persona / --help; walks the tree; loads freeze + all four ledgers; resolves test pointers; wraps computeReadiness with runWithAdmissibilityGate; emits text (with the two verdict lines + persona-grouped blocker sections ordered by the profile.md register) or JSON (with _meta.level carrying the invocation); the exit matrix in spec section 3.2 folds --check and --level per decision 4.",
   "implementsAcIds": [
-    "AC-17501-5"
+    "AC-17501-5",
+    "AC-17503-1",
+    "AC-17503-2",
+    "AC-17503-3",
+    "AC-17503-4",
+    "AC-17503-5",
+    "AC-17503-6",
+    "AC-17503-7",
+    "AC-17503-8",
+    "AC-17503-9"
   ],
   "dependencies": [],
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-09-24T14:30:00Z"
+  "updatedAt": "2026-10-01T16:00:00Z"
 }

package/rcf/code-nodes/cn-728.json

@@ -11,11 +11,27 @@
     "AC-17401-5",
     "AC-17401-6",
     "AC-17401-7",
-    "AC-17401-8"
+    "AC-17401-8",
+    "AC-17401-9",
+    "AC-17402-1",
+    "AC-17402-2",
+    "AC-17402-3",
+    "AC-17402-4",
+    "AC-17402-5",
+    "AC-17402-6",
+    "AC-17402-7",
+    "AC-17403-1",
+    "AC-17403-2",
+    "AC-17403-3",
+    "AC-17403-4",
+    "AC-17403-5",
+    "AC-17403-6",
+    "AC-17403-7",
+    "AC-17403-8"
   ],
   "dependencies": [],
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-09-24T14:30:00Z"
+  "updatedAt": "2026-10-01T14:30:00Z"
 }

package/rcf/code-nodes/cn-729.json

@@ -8,11 +8,19 @@
     "AC-17501-2",
     "AC-17501-3",
     "AC-17501-4",
-    "AC-17501-6"
+    "AC-17501-6",
+    "AC-17502-1",
+    "AC-17502-2",
+    "AC-17502-3",
+    "AC-17502-4",
+    "AC-17502-5",
+    "AC-17502-6",
+    "AC-17502-7",
+    "AC-17502-8"
   ],
   "dependencies": [],
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-09-24T14:30:00Z"
+  "updatedAt": "2026-10-01T14:30:00Z"
 }

package/rcf/code-nodes/cn-730.json

@@ -2,13 +2,23 @@
   "cnId": "CN-730",
   "path": "test/cli/readiness.test.js",
   "title": "CLI tests for rcf define readiness",
-  "description": "Covers AC-17501-5: text output, --json emission, --check exit codes (blocking 4, warn-with-ack 0 with [warn]), admissibility refusal path exit 4.",
+  "description": "Covers AC-17501-5 (text output, --json emission, --check exit codes), AC-17502-7 (byte-stable rcf/ tree across a readiness run) and AC-17503-1..9 (default exits 0 + both verdict lines; --level intent exits 4 iff PO fails; --level build exits 4 iff readyToBuild is false, with warn lines emitted; --check all unchanged; --persona filters text and does not change exit; unknown values exit 2; --json --level intent carries _meta.level; text report groups PO before engineer with persona in detail lines; parameterised exit matrix).",
   "implementsAcIds": [
-    "AC-17501-5"
+    "AC-17501-5",
+    "AC-17502-7",
+    "AC-17503-1",
+    "AC-17503-2",
+    "AC-17503-3",
+    "AC-17503-4",
+    "AC-17503-5",
+    "AC-17503-6",
+    "AC-17503-7",
+    "AC-17503-8",
+    "AC-17503-9"
   ],
   "dependencies": [],
   "version": "0.1.0",
   "status": "draft",
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-09-24T14:30:00Z"
+  "updatedAt": "2026-10-01T16:00:00Z"
 }

package/rcf/code-nodes/cn-731.json

@@ -0,0 +1,20 @@
+{
+  "cnId": "CN-731",
+  "path": "test/cli/freeze.test.js",
+  "title": "CLI tests for rcf define freeze",
+  "description": "Covers AC-17601-1..6 and AC-17601-8: happy freeze, refusal on failing D1, --ack on D3/D5/D6 only, section 2.5 summary line, --status is read-only, admissibility refusal is informational, and the readiness CLI stage header + CHANGELOG line no longer use ' -- '.",
+  "implementsAcIds": [
+    "AC-17601-1",
+    "AC-17601-2",
+    "AC-17601-3",
+    "AC-17601-4",
+    "AC-17601-5",
+    "AC-17601-6",
+    "AC-17601-8"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-24T16:33:15Z",
+  "updatedAt": "2026-09-24T16:33:15Z"
+}

package/rcf/code-nodes/cn-732.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-732",
+  "path": "test/define/freeze-record.test.js",
+  "title": "Extension tests for freeze-record override-nullable-required contract",
+  "description": "Covers AC-17601-7: validateFreezeRecord requires override (nullable), loadFreezeRecord defaults a missing override key to null, saveFreezeRecord refuses to write a body without override.",
+  "implementsAcIds": [
+    "AC-17601-7"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-24T16:33:15Z",
+  "updatedAt": "2026-09-24T16:33:15Z"
+}

package/rcf/code-nodes/cn-733.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-733",
+  "path": "src/setup/identity-seed.js",
+  "title": "Identity-seed template with the ## Surface section",
+  "description": "IDENTITY_TEMPLATE carries a ## Surface section between ## Register and ## Project-scoped notes naming viewer / runningApp / prDiff, seeded to prDiff so a fresh rcf init project satisfies checkD1Brief profile:surface marker without operator edit. writeIdentityTemplate keeps the slice-1 kept contract: an existing profile.md is left byte-identical.",
+  "implementsAcIds": [
+    "AC-17401-10"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-01T13:22:37Z",
+  "updatedAt": "2026-10-01T13:22:37Z"
+}

package/rcf/code-nodes/cn-734.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-734",
+  "path": "test/setup/identity-register.test.js",
+  "title": "Identity-seed Surface section tests",
+  "description": "Covers AC-17401-10: ## Surface heading placement; three value names + prDiff default; writeIdentityTemplate on a fresh dir seeds a profile that satisfies checkD1Brief surfaceMarkers; existing profile.md with no ## Surface is left byte-identical.",
+  "implementsAcIds": [
+    "AC-17401-10"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-01T13:22:37Z",
+  "updatedAt": "2026-10-01T13:22:37Z"
+}

package/rcf/code-nodes/cn-735.json

@@ -0,0 +1,20 @@
+{
+  "cnId": "CN-735",
+  "path": "src/view/readiness.js",
+  "title": "Readiness tab panel renderer",
+  "description": "renderReadinessPanel(result, { profile, freezeRecord }) returns the eleven ordered blocks of spec section 5 for the Readiness tab: tree line, two verdict pills with formatVerdictLines labels, two per-persona next-action lines, D1..D8 state chips, blockers grouped by persona (register orders the pair; the non-register group collapses with its count visible, never omitted), delta list, per-stage check detail, coverage tree-vs-delta, decisions outstanding, Freeze now control (enabled iff levels.readyToBuild.ok), freeze record. Pure: no I/O, no recompute. pickRegister helper mirrors the CLI's contract.",
+  "implementsAcIds": [
+    "AC-18001-1",
+    "AC-18001-2",
+    "AC-18001-3",
+    "AC-18001-4",
+    "AC-18001-5",
+    "AC-18001-6",
+    "AC-18001-7"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-01T18:00:00Z",
+  "updatedAt": "2026-10-01T18:00:00Z"
+}

package/rcf/code-nodes/cn-736.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-736",
+  "path": "src/view/components/pill.js",
+  "title": "Shared pill component",
+  "description": "pill({ value, variant, title?, href? }) emits one markup shape across every vocabulary family (gate state, level verdict, persona, AC class) with class suffixes derived from a normalised value. Pure.",
+  "implementsAcIds": [
+    "AC-18101-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-01T18:00:00Z",
+  "updatedAt": "2026-10-01T18:00:00Z"
+}

package/rcf/code-nodes/cn-737.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-737",
+  "path": "src/view/components/findings-list.js",
+  "title": "Shared findings-list component",
+  "description": "findingsList({ heading, count, items }) emits a heading plus an id-anchor list with per-id why strings; ids are capped at 20 and the tail becomes a `... N more suppressed` line. Pure.",
+  "implementsAcIds": [
+    "AC-18101-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-01T18:00:00Z",
+  "updatedAt": "2026-10-01T18:00:00Z"
+}

package/rcf/code-nodes/cn-738.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-738",
+  "path": "src/view/components/diff.js",
+  "title": "Shared document-level diff component",
+  "description": "diff(before, after) renders a two-column before-and-after of two document bodies for the Readiness delta list. 0.29.0 ships document-level only; criterion-level before-and-after is deferred per ADR-4127. Pure.",
+  "implementsAcIds": [
+    "AC-18101-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-01T18:00:00Z",
+  "updatedAt": "2026-10-01T18:00:00Z"
+}

package/rcf/code-nodes/cn-739.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-739",
+  "path": "src/view/build-dag.js",
+  "title": "Build/DAG sub-tab pure renderer",
+  "description": "Pure HTML-string renderer for the Build tab's DAG sub-tab: `buildDagLayout(fbsItems, buildableIds)` projects `dependsOnFbsIds` into depth columns, `buildOrder` row ordering, upstream/downstream closures, longest-chain critical path and the no-in-no-out unconnected lane; `renderBuildDag({ layout, inspectorPayload })` emits the toolbar, canvas (HTML button nodes + inline SVG edges with cubic paths and arrowheads) and inspector shell. `buildDagInspectorPayload(layout)` builds the one-row-per-FBS payload (status, area, size, order, AC count, direct and transitive needs/waits, meta) that rides on the inspector shell as `data-rcf-dag-inspector-data` per the PR 1 contract. Cycles are excluded from the depth layout and surfaced as `cycleIds` for the toolbar finding (AC-204-6); the renderer never emits a `postMessage` call (AC-204-7).",
+  "implementsAcIds": [
+    "AC-204-1",
+    "AC-204-2",
+    "AC-204-3",
+    "AC-204-6",
+    "AC-204-7"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-02T19:00:00Z",
+  "updatedAt": "2026-10-02T19:00:00Z"
+}

package/rcf/code-nodes/cn-740.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-740",
+  "path": "src/view/page-init.js",
+  "title": "Build/DAG client wiring (page-init DAG seam)",
+  "description": "`wireBuildDag` and its helpers wire the Build/DAG sub-tab in the browser: `parseDagInspectorPayload` reads the `data-rcf-dag-inspector-data` attribute off the inspector shell (never an inline <script>), click handlers on `.rcf-dag-node` run `selectDagNode` which sets `data-rcf-dag-sel`, auto-presses Show-unconnected when the node is unconnected, outlines upstream/downstream closures via `data-rcf-dag-role` attributes and renders the inspector body from the payload. Filter chips (status, area, Buildable-now, Critical-path, Show-unconnected) run `applyDagFilters` which keeps the current selection intact (AC-204-5). `buildHashFragment` writes `#tab=build&sub=dag&entity=<id>` and `currentDagHashExtras` preserves non-DAG hash params through DAG writes; `applyBuildHash` restores the selection, auto-presses Show-unconnected when the restored node is unconnected and scrolls the node into view (AC-204-4). `renderDagInspector` lists status, area, AC count, size, buildOrder, buildable-now, Needs (direct and transitive total) and Waits (direct and transitive total) with an Open-in-Specs link that moves to `#tab=build&sub=specs&entity=<id>` (AC-204-3).",
+  "implementsAcIds": [
+    "AC-204-2",
+    "AC-204-3",
+    "AC-204-4",
+    "AC-204-5"
+  ],
+  "dependencies": [
+    "CN-739"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-02T19:00:00Z",
+  "updatedAt": "2026-10-02T19:00:00Z"
+}

package/rcf/code-nodes/cn-741.json

@@ -0,0 +1,16 @@
+{
+  "cnId": "CN-741",
+  "path": "src/view/view-index.js",
+  "title": "ID lookup pure projection + rank helper",
+  "description": "`buildViewIndex(model)` projects a BuiltTreeModel into one row per PRD/REQ/US/TAD/TAC/ADR/BS/FBS/TS plus one row per AC under each US, each `{ id, kind, title, snippet, parent, tab }`; `snippet` is the kind-specific prose field whitespace-collapsed and capped at 110 chars; `tab` is the viewer tab that owns the id. `serialiseViewIndex(model)` returns the exact JSON string the server serves (so Content-Length matches). `rankLookupRows(query, rows)` implements the design doc section 6 ranking: single-char id-only, otherwise id first (exact / prefix / contains), then every word must match title or snippet, title weighted above snippet, stable on ties by id, 20-result cap. This is the pure projection the server renders into `./index.json` on every rewalk (AC-205-1 to AC-205-3).",
+  "implementsAcIds": [
+    "AC-205-1",
+    "AC-205-2",
+    "AC-205-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T00:00:00Z"
+}

package/rcf/code-nodes/cn-742.json

@@ -0,0 +1,16 @@
+{
+  "cnId": "CN-742",
+  "path": "src/server/routes.js",
+  "title": "GET /index.json route for the viewer ID lookup",
+  "description": "`GET /index.json` returns the server-side ID index as `application/json; charset=utf-8` with `cache-control: no-store`. The handler reads `state.indexJson` (snapshotted per rewalk from `renderModelToPage().indexJson` so bytes match Content-Length) and never touches disk; before the first walk it 503s with `view server initialising`. The route is release-noted (PR 1 relative-script policy, wespa reverse-proxy allow-list adds it before the version pin bump) and is the fourth release-noted viewer route after `./page-init.js` (AC-205-1).",
+  "implementsAcIds": [
+    "AC-205-1"
+  ],
+  "dependencies": [
+    "CN-741"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T00:00:00Z"
+}

package/rcf/code-nodes/cn-743.json

@@ -0,0 +1,15 @@
+{
+  "cnId": "CN-743",
+  "path": "src/view/html-page.js",
+  "title": "SearchButton + LookupModal shell markup",
+  "description": "`renderSearchButton()` emits a `<button data-rcf-search>` inside the shell `<div class=\"tools\">` to the right of the tabstrip, carrying the Cmd/Ctrl+F mnemonic on `aria-label` + `title`. `renderLookupModal()` emits the modal shell once in the shell outside `#rcf-live-content` so the SSE innerHTML swap never blows it away: `<aside role=\"dialog\" aria-modal=\"true\" aria-labelledby=...>` with `<section>`, `<header>`, labelled `<input>`, aria-live status region, `<ul role=\"listbox\">` results, empty-state block and `Reload index` affordance. No `<div>` tags inside the modal, so the Phase 3.8 D13a shell invariant (`lastIndexOf(\"</div>\")` resolves to the live-content wrapper close) stays intact (AC-205-1, AC-205-7).",
+  "implementsAcIds": [
+    "AC-205-1",
+    "AC-205-7"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T00:00:00Z"
+}

package/rcf/code-nodes/cn-744.json

@@ -0,0 +1,22 @@
+{
+  "cnId": "CN-744",
+  "path": "src/view/page-init.js",
+  "title": "wireLookup client (ID lookup wiring)",
+  "description": "`wireLookup` lazily XHR-fetches `./index.json` on first modal open, refetches once when `window.__rcfLookupDirty` is set by live-client (SSE tree-update), ranks via a mirror of `rankLookupRows`, cycles the active row with Up / Down, picks with Enter and closes with Esc. The Router's `resolveHash` honours `?tab=&entity=` at mount so a landed URL (`?tab=requirements&entity=US-304`) opens the same position at first paint without the LookupModal (AC-205-5). Pick writes `#tab=<tab>&entity=<id>` via `writeHash` so `?embed=` and `?theme=` survive (PR 1 contract); the Router's hashchange listener activates the tab, opens ancestor DocRows and flashes the target. Cmd/Ctrl+F opens the modal from any tab; Cmd/Ctrl+Shift+F is deliberately NOT intercepted so the browser find still works. Marks every id / title / snippet substring hit by a query word (`<mark>`, escaped). Empty state shows `The index could not be loaded.` + `Reload index` on fetch failure; never calls `postMessage`, never writes to localStorage / sessionStorage / document.cookie, and never makes an outbound fetch other than `./index.json` (AC-205-4, AC-205-6, AC-205-7, AC-205-8).",
+  "implementsAcIds": [
+    "AC-205-4",
+    "AC-205-5",
+    "AC-205-6",
+    "AC-205-7",
+    "AC-205-8"
+  ],
+  "dependencies": [
+    "CN-741",
+    "CN-742",
+    "CN-743"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T00:00:00Z"
+}

package/rcf/code-nodes/cn-745.json

@@ -0,0 +1,16 @@
+{
+  "cnId": "CN-745",
+  "path": "src/view/live-client.js",
+  "title": "SSE tree-update dirties the ID lookup cache",
+  "description": "On every SSE `tree-update` event, live-client sets `window.__rcfLookupDirty = true`. `wireLookup` reads this flag on the next modal open and refetches `./index.json` once, then clears it. This keeps the modal consistent with the live walker without polling (AC-205-4).",
+  "implementsAcIds": [
+    "AC-205-4"
+  ],
+  "dependencies": [
+    "CN-744"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T00:00:00Z"
+}

package/rcf/code-nodes/cn-746.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-746",
+  "path": "src/view/readiness/question-adapter.js",
+  "title": "Readiness PO question adapter: feature-detected questions source + source-span grouping",
+  "description": "`toQuestions(readiness)` is the pure projection the Readiness PO layer reads. `preferReadinessQuestions(readiness)` feature-detects the DEFINE step 3 PR 2 `computeQuestions` output on `readiness.questions`: when present, the adapter reads from there, using `groups[]` labels and the per-question `heading` / `ask` / `hint` with phrasebook fallback per field; the group label falls back to a conservative sourceSpan prose when no `sourceSpanLabel` is given. Otherwise the adapter reads `personas.productOwner.blockers`, groups by source span (brief:<n>, REQ-N, or a plain stage label) and fills asks from the phrasebook. One source of truth for the PO ask text; nothing is fabricated that is not on the tree (AC-18002-1).",
+  "implementsAcIds": [
+    "AC-18002-1"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T09:30:00Z",
+  "updatedAt": "2026-10-03T09:30:00Z"
+}