rcf-lite 0.29.0 → 0.30.0

package/blueprints/security-secrets-management/contributions/tacs/tac-901-security-secrets-management-manager-client.json

@@ -19,23 +19,23 @@
   "interfaces": [
     {
       "name": "vendorAdapter",
-      "kind": "read-write-api",
-      "description": "Project-supplied vendor binding implementing `readMany({ paths, credentials, environment })` returning `{ [name]: { value, lastRotatedAt } }` or an entry-level not-found marker, and `materialiseCredentials({ slicePaths, environment })` returning per-slice credentials the vendor deny-by-default enforces."
+      "kind": "other",
+      "description": "Project-supplied vendor binding implementing `readMany({ paths, credentials, environment })` returning `{ [name]: { value, lastRotatedAt } }` or an entry-level not-found marker, and `materialiseCredentials({ slicePaths, environment })` returning per-slice credentials the vendor deny-by-default enforces. (legacy kind: read-write-api)"
     },
     {
       "name": "manifest",
-      "kind": "read-api",
-      "description": "The manifest loader (TAC-902) resolving the current deployable's slice, per-environment paths, and `required` flags."
+      "kind": "other",
+      "description": "The manifest loader (TAC-902) resolving the current deployable's slice, per-environment paths, and `required` flags. (legacy kind: read-api)"
     },
     {
       "name": "auditSink",
-      "kind": "callback",
-      "description": "Structured-event sink invoked with `{ name, path, environment, principal, outcome, at }` on every fetch attempt; never invoked with the secret value."
+      "kind": "other",
+      "description": "Structured-event sink invoked with `{ name, path, environment, principal, outcome, at }` on every fetch attempt; never invoked with the secret value. (legacy kind: callback)"
     },
     {
       "name": "envSelector",
-      "kind": "read-api",
-      "description": "The boot-input resolver for the active environment: a process variable, a boot flag, or a project-authored selector. Returns exactly one environment string or refuses ambiguity."
+      "kind": "other",
+      "description": "The boot-input resolver for the active environment: a process variable, a boot flag, or a project-authored selector. Returns exactly one environment string or refuses ambiguity. (legacy kind: read-api)"
     }
   ],
   "dependencies": [

package/blueprints/security-secrets-management/contributions/tacs/tac-902-security-secrets-management-manifest.json

@@ -18,13 +18,13 @@
   "interfaces": [
     {
       "name": "fileSystem",
-      "kind": "read-api",
-      "description": "Project-supplied file reader accepting a repo-root-relative path and returning UTF-8 bytes; injected for test surface."
+      "kind": "other",
+      "description": "Project-supplied file reader accepting a repo-root-relative path and returning UTF-8 bytes; injected for test surface. (legacy kind: read-api)"
     },
     {
       "name": "yamlParser",
-      "kind": "read-api",
-      "description": "YAML parser accepting bytes and returning a plain object; injected so the project supplies its own dependency."
+      "kind": "other",
+      "description": "YAML parser accepting bytes and returning a plain object; injected so the project supplies its own dependency. (legacy kind: read-api)"
     }
   ],
   "dependencies": [],

package/blueprints/security-secrets-management/contributions/tacs/tac-903-security-secrets-management-env-reflector.json

@@ -17,13 +17,13 @@
   "interfaces": [
     {
       "name": "fileSystem",
-      "kind": "read-write-api",
-      "description": "Project-supplied file reader-writer supporting temp-file creation and atomic rename."
+      "kind": "other",
+      "description": "Project-supplied file reader-writer supporting temp-file creation and atomic rename. (legacy kind: read-write-api)"
     },
     {
       "name": "gitignoreCheck",
-      "kind": "read-api",
-      "description": "Project-supplied predicate answering whether a given path is gitignored (usually a shell-out to `git check-ignore`)."
+      "kind": "other",
+      "description": "Project-supplied predicate answering whether a given path is gitignored (usually a shell-out to `git check-ignore`). (legacy kind: read-api)"
     }
   ],
   "dependencies": [

package/blueprints/security-secrets-management/contributions/tacs/tac-904-security-secrets-management-rotation-gate.json

@@ -18,23 +18,23 @@
   "interfaces": [
     {
       "name": "vendorAdapter",
-      "kind": "read-api",
-      "description": "The same vendor binding the Secrets Manager client uses (TAC-901), scoped to a rotation-metadata read (no value fetch is required for the gate's own operation)."
+      "kind": "other",
+      "description": "The same vendor binding the Secrets Manager client uses (TAC-901), scoped to a rotation-metadata read (no value fetch is required for the gate's own operation). (legacy kind: read-api)"
     },
     {
       "name": "overrideStore",
-      "kind": "read-api",
-      "description": "Reads the operator-authored override file (project-authored path; a JSON or YAML file listing per-name `{ author, expiresAt, reason }` entries)."
+      "kind": "other",
+      "description": "Reads the operator-authored override file (project-authored path; a JSON or YAML file listing per-name `{ author, expiresAt, reason }` entries). (legacy kind: read-api)"
     },
     {
       "name": "clock",
-      "kind": "clock",
-      "description": "Injectable millisecond wall clock for the elapsed-days arithmetic."
+      "kind": "other",
+      "description": "Injectable millisecond wall clock for the elapsed-days arithmetic. (legacy kind: clock)"
     },
     {
       "name": "auditSink",
-      "kind": "callback",
-      "description": "The same sink shape TAC-901 uses; the gate emits override-applied and rotation-expired events through it."
+      "kind": "other",
+      "description": "The same sink shape TAC-901 uses; the gate emits override-applied and rotation-expired events through it. (legacy kind: callback)"
     }
   ],
   "dependencies": [

package/blueprints/security-secrets-management/contributions/tacs/tac-905-security-secrets-management-agent-cli.json

@@ -18,13 +18,13 @@
   "interfaces": [
     {
       "name": "process",
-      "kind": "read-api",
-      "description": "The host process's argv, stdin, stdout, stderr, and env; the CLI reads argv and stdin, writes to stdout and stderr, and reads a small allow-listed env slice (audit principal id, active environment)."
+      "kind": "other",
+      "description": "The host process's argv, stdin, stdout, stderr, and env; the CLI reads argv and stdin, writes to stdout and stderr, and reads a small allow-listed env slice (audit principal id, active environment). (legacy kind: read-api)"
     },
     {
       "name": "logSink",
-      "kind": "callback",
-      "description": "The CLI's own log destination (stderr by default; a file when `--log-file` is set); every write passes through the redactor."
+      "kind": "other",
+      "description": "The CLI's own log destination (stderr by default; a file when `--log-file` is set); every write passes through the redactor. (legacy kind: callback)"
     }
   ],
   "dependencies": [

package/fixtures/canary-manifest.json

@@ -2,8 +2,8 @@
   "registerCanary": [
     {
       "id": "rc-2026-10-03-001",
-      "createdAt": "2026-10-03T12:16:10.630Z",
-      "buildVersion": "0.29.0-mockdriver",
+      "createdAt": "2026-10-03T21:47:34.735Z",
+      "buildVersion": "0.30.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -35,8 +35,8 @@
     },
     {
       "id": "rc-2026-10-03-002",
-      "createdAt": "2026-10-03T12:16:10.631Z",
-      "buildVersion": "0.29.0-mockdriver",
+      "createdAt": "2026-10-03T21:47:34.736Z",
+      "buildVersion": "0.30.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -68,8 +68,8 @@
     },
     {
       "id": "rc-2026-10-03-003",
-      "createdAt": "2026-10-03T12:16:10.631Z",
-      "buildVersion": "0.29.0-mockdriver",
+      "createdAt": "2026-10-03T21:47:34.736Z",
+      "buildVersion": "0.30.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/guidance/define-litmus.md

@@ -0,0 +1,102 @@
+# Litmus: landing n fresh-context readings at the current hash
+
+This document is the content of the `rcf_define_litmus` MCP prompt
+served argument-free by the server. The agent reads it once per
+session and runs the litmus pass when the operator or the readiness
+verb asks for it.
+
+## What a litmus reading is
+
+A litmus reading is a probe-ledger entry whose `finding` field begins
+`litmus:<reader>:` and whose text includes the current litmus hash.
+It is written by `rcf define ledger probes add` just like any other
+probe-ledger entry; the `litmus:` prefix is what the verb reads back
+when it counts "distinct readers at this hash".
+
+The litmus hash is the current tree hash computed with the probes
+ledger excluded (ADR-4131 extended, 0.30.0 PR 7 R9). The probes
+ledger is inside `tree.currentTreeHash` by ADR-4120, so a reader
+writing an entry that references `currentTreeHash` would shift the
+hash the reader just attested to. The litmus hash is the content-
+stable version: writing to the probes ledger does not change it, so n
+readers can land their entries at the same hash. Writes to the brief,
+decisions or concerns ledgers do change the litmus hash the same way
+they change `currentTreeHash`; those changes mean the content under
+review has changed and stale litmus readings fall out of the count.
+This trade-off is intentional: litmus readings do not attest to
+probe findings written after them, because probe entries are
+themselves readings.
+
+The number of distinct readers is counted across the probe ledger; a
+reader id appears at most once in the count regardless of how many
+`litmus:<reader>:*` entries it has written.
+
+## When to run
+
+Run this prompt whenever a verb reports the shortfall:
+
+- `rcf define readiness --litmus <n>` exits 4 and prints a `[warn]`
+  line naming the current hash and the number of distinct readers
+  found. The shortfall is the number of fresh-context readers you
+  still owe before the verb will exit 0.
+- `rcf define freeze --litmus <n>` refuses (exit 4) with the same
+  reason and writes nothing. The freeze is only legal when n distinct
+  readers have attested at the hash the verb was asked to freeze.
+
+The harness is the runner. rcf-lite does not spawn processes and does
+not make network calls at runtime. You spawn the readers; they land
+the entries.
+
+## The shape
+
+Each reading is one `rcf define ledger probes add` call:
+
+```
+rcf define ledger probes add \
+  --req <reqId> \
+  --finding "litmus:<reader>: <one-line observation at hash <hash>>" \
+  --severity low
+```
+
+Fill in:
+
+- `<reader>` is a short id for this reader. Make it unique per fresh
+  context (for example `reader-01`, `reader-02`). The verb counts
+  distinct readers by this id.
+- `<reqId>` is the REQ the reader is probing. On a readiness pass this
+  is typically the first failing REQ or a REQ the operator named; on a
+  freeze the ids come from the brief.
+- `<hash>` is the current litmus hash. Read it from
+  `rcf define readiness --json` under `tree.litmusHash` (or from the
+  `[warn]` line the verb printed; the warn line names the litmus hash
+  explicitly).
+
+A reading is "at the hash" when the `hash` substring appears anywhere
+in the finding text, not in a separate field. Keep the hash in the
+finding text so the entry is self-describing.
+
+## The loop
+
+1. Read `tree.litmusHash` from `rcf define readiness --json`.
+2. Spawn n fresh-context readers (one claude session per reader is
+   enough; a reader must not share context with another).
+3. Each reader lands one `litmus:<reader>:` probe-ledger entry at the
+   litmus hash. The entry's finding text includes the litmus hash and
+   one observation; the reader does not edit the tree.
+4. Re-run the verb that asked for `--litmus <n>`. The count is now
+   n and the verb exits 0 (readiness) or writes the freeze record
+   (freeze).
+
+Writes to the probes ledger (adding litmus readings is itself one)
+do not shift the litmus hash, so n readers landing their entries in
+sequence all pin to the same hash and all count. A write to the
+brief, decisions or concerns ledgers (changing the content under
+review) does shift the litmus hash and makes earlier readings stale.
+Hand the readers a hash that will still be current when the last
+reading lands; a short freeze-prep window is the common case.
+
+## When n distinct readers have attested
+
+The verb exits 0. Nothing else is said; the readings stay in the probe
+ledger. A later tree change makes them stale and the next invocation
+of the verb will require fresh readings at the new hash.

package/guidance/manifest.json

@@ -16,7 +16,8 @@
     {"name": "rcf_define_intent", "file": "define-intent.md", "description": "Drive the product-owner intent-complete loop with rcf_define_questions, write-backs through existing verbs, and the readiness verdict. Argument-free; starts with --persona productOwner and ends at levels.intentComplete.ok."},
     {"name": "rcf_define_intake", "file": "define-intake.md", "description": "Walk a document folder brief-first, write one statement file per source with [kind] and (source: ...) markers, run brief add --from once per source, and report the scan findings as open questions. Argument-free."},
     {"name": "rcf_define_draft_shapes", "file": "define-draft-shapes.md", "description": "Run the draft pass after L1 is green: pre-populate [draft] core entities per entity statement, [draft] TAC stubs per surface or externalSystem cluster, [draft] interfaces with real kinds inside each stub, and rcf discover req-classify over every REQ created in the loop. Argument-free."},
-    {"name": "rcf_discover_prototype", "file": "discover-prototype.md", "description": "Record a prototype in DISCOVERY as evidence: classification, brief statements with prototype:<name>:<observation> source spans, the burn statement, and the salvage-by-re-derivation path. Argument-free."}
+    {"name": "rcf_discover_prototype", "file": "discover-prototype.md", "description": "Record a prototype in DISCOVERY as evidence: classification, brief statements with prototype:<name>:<observation> source spans, the burn statement, and the salvage-by-re-derivation path. Argument-free."},
+    {"name": "rcf_define_litmus", "file": "define-litmus.md", "description": "Spawn n fresh-context readers at the current tree hash and land their readings as probe-ledger entries whose finding begins litmus:<reader>:. Required by rcf define readiness --litmus and rcf define freeze --litmus. Argument-free."}
   ],
   "platformInvariants": [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",

package/rcf/adrs/adr-4131-gates-bite-ack-recorded-override.json

@@ -0,0 +1,30 @@
+{
+  "createdAt": "2026-10-03T10:50:00Z",
+  "updatedAt": "2026-10-03T10:50:00Z",
+  "adrId": "ADR-4131-gates-bite-ack-recorded-override",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.0",
+  "status": "accepted",
+  "title": "The gates bite with --ack as the recorded override for D3, D5, D6",
+  "context": "DEFINE step 3 train (spec 2026-10-01) brings the substantive checks of proposal 3.2 into D3, D5 and D6 across PRs 5, 6 and 7. The 0.29.0 posture left those stages warn-with-ack: --check exits 0 with a stderr [warn] line, --ack as the recorded override. The spec section 4 gates-bite intro and decision 9 both pin the biting posture: --check exits 4 on D3, D5 and D6 as it does on blocking stages; --ack stays as the recorded override for those three because the ruleset's recordedInChain channel needs it (decision 8's pattern applied to gates, not retired with the verb). The compute remains pure; readiness.js collects candidate paths and the CLI resolves them on disk so the gate functions see a resolvedPaths map in the stage context. PR 5 lands the three D3 bite checks (shapes:templateMarkers, shapes:entityJoin, shapes:pathsResolve), the ackable(stage) companion to stagePolicy, and the --check shapes exit 4 policy; PRs 6 and 7 bite D5 and D6 on the same shape.",
+  "decision": "The gates bite with --ack as the recorded override for D3, D5 and D6. stagePolicy keeps returning blocking for every stage (ADR-4122 posture) and gains a sibling helper ackable(stage) that returns true for exactly D3, D5 and D6 and false otherwise. The readiness CLI --check <stage> policy follows that split: on a blocking stage without ackable, a failing state exits 4 (today's behaviour); on a stage with ackable, a failing state exits 4 unless the freeze record acknowledges that gate at the current tree hash, in which case it exits 0. --ack on any stage without ackable stays a usage refusal with exit 2 (D1, D2, D4, D7, D8). The three D3 bite checks ship as pure engineer checks on src/query/gates.js: shapes:templateMarkers over delta (per-kind marker presence on interfaces[].description, ids <tacId>:<name>, why names the missing marker, drafts included), shapes:entityJoin over tree (every coreEntities[].name named by exactly one recordShape, ids TAD.entity:<name>), shapes:pathsResolve over delta (any path:-like token resolves on disk against the resolvedPaths map in the stage context or the description carries authoredAt: D3). Validate findings only where a legacy tree can comply; the dogfood tree records any residual failure in KNOWN GAPS rather than weakening the check.",
+  "consequences": "A failing D3 bite now blocks CI unless the engineer either fixes the tree or writes a recorded override with --ack --reason at the current hash; the record stays visible in the freeze record (the chain of recordedInChain the ruleset reads). The ackable companion keeps stagePolicy legible: the policy stays 'blocking' for every stage (the readyToBuild fold is unchanged), with ackable the separate signal the CLI reads to decide whether a failing stage honours an acknowledgement. The gate functions stay pure: the CLI is the module that resolves candidate paths on disk and the stage context carries the resolved map. The D3 bite surfaces three new engineer checks on the readiness tab and the text report; nothing on the productOwner side moves. --level intent and --level build exits are unchanged because the levels fold is already a derived view. The dogfood tree keeps CI green by scoping its own readiness call as it already does; the three new checks pass on the dogfood chain because the shipped TACs name their markers truthfully.",
+  "alternativesConsidered": [
+    {
+      "name": "Retire --ack (make D3, D5, D6 plain blocking)",
+      "summary": "Drop the --ack verb everywhere and let a failing D3, D5 or D6 simply block CI with no override.",
+      "reasonNotChosen": "The ruleset's recordedInChain channel exists so a refuse at a hash can be acknowledged with a reason that becomes part of the chain. The gates bite is decision 8's pattern applied to gates (refuse with a recorded override), and retiring --ack removes the channel the ruleset depends on. The spec decision 9 pins this; this ADR records it in-chain."
+    },
+    {
+      "name": "Keep warn-with-ack: --check exits 0 with a [warn] on D3, D5, D6",
+      "summary": "Leave the 0.29.0 posture in place; let the bite only surface in validate and the viewer.",
+      "reasonNotChosen": "The whole point of the DEFINE step 3 train is to make D3, D5 and D6 bite: the substantive checks of proposal 3.2 land here, and CI must refuse on them for the engineer to feel the gate. Warn-with-ack kept them a soft signal; the spec moves them to blocking with --ack as the recorded override."
+    },
+    {
+      "name": "Make the gate functions impure and resolve paths inline",
+      "summary": "Let shapes:pathsResolve open the filesystem directly so the gate module decides path existence on its own.",
+      "reasonNotChosen": "gates.js is the one pure module every surface composes; folding I/O into it would re-couple the viewer and the CLI through disk access. The CLI already owns the project-root resolve for the walker and the ledgers; adding one more resolve step for candidate paths is a one-pass walk, and the stage context grows by one map. The viewer uses the same seam when it renders the Readiness tab server-side."
+    }
+  ]
+}

package/rcf/code-nodes/cn-753.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-753",
+  "path": "src/query/gates.js",
+  "title": "DEFINE step 3 PR 5: D3 bite checks, parseInterfaceTemplate and ackable on the gates module",
+  "description": "src/query/gates.js grows the three D3 bite checks (shapes:templateMarkers over delta with per-kind marker presence on interfaces[].description; shapes:entityJoin over tree asserting every coreEntities[].name is named by exactly one recordShape with ids TAD.entity:<name>; shapes:pathsResolve over delta asserting any path:-like token resolves against the resolvedPaths map in the stage context or carries authoredAt: D3), the parseInterfaceTemplate(iface) helper that computes per-kind marker presence (exported for validate's step 6 notice), and the ackable(stage) helper that returns true for D3, D5 and D6. The CHECK_PERSONA, CHECK_QUESTION and STAGE_FALLBACK_PERSONA maps grow in step so every new check carries a persona and a question. Drafts are included in templateMarkers. The gate functions stay pure: readiness.js threads the resolvedPaths map through the stage context; the CLI resolves candidate paths on disk.",
+  "implementsAcIds": [
+    "AC-17404-1",
+    "AC-17404-2",
+    "AC-17404-3",
+    "AC-17404-4"
+  ],
+  "dependencies": [
+    "CN-725"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T10:50:00Z",
+  "updatedAt": "2026-10-03T10:50:00Z"
+}

package/rcf/code-nodes/cn-754.json

@@ -0,0 +1,17 @@
+{
+  "cnId": "CN-754",
+  "path": "src/cli/readiness.js",
+  "title": "DEFINE step 3 PR 5: --check shapes exit 4 policy and resolvedPaths resolve-on-disk",
+  "description": "src/cli/readiness.js grows a bite-aware --check policy: --check shapes exits 4 on an unacknowledged D3 failure and 0 when the freeze record acknowledges define.shapes at the current tree hash; the warn-with-ack branch is kept for D5 and D6 until PRs 6 and 7 bite them. Before invoking computeReadiness the CLI collects candidate path tokens from in-scope TAC interface descriptions and passes a resolvedPaths map (local resolve on disk) through the stage context so the pure gate function shapes:pathsResolve can decide path existence without I/O. The decideExitCode helper reads ackable(stage) and the freeze.gates[<gate>] record to pick between 0 (warn-with-ack unacked or acked bite) and 4 (bite unacked at the current hash).",
+  "implementsAcIds": [
+    "AC-17404-5"
+  ],
+  "dependencies": [
+    "CN-727",
+    "CN-753"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T10:50:00Z",
+  "updatedAt": "2026-10-03T10:50:00Z"
+}

package/rcf/code-nodes/cn-755.json

@@ -0,0 +1,14 @@
+{
+  "cnId": "CN-755",
+  "path": "src/cli/freeze.js",
+  "title": "DEFINE step 3 PR 5: freeze --ack on D1, D2, D4, D7 or D8 keeps exiting 2",
+  "description": "src/cli/freeze.js already refuses --ack on any gate outside D3, D5 and D6 with exit 2 and the usage line ADR-4124 pins. PR 5 confirms the invariant with AC-17404-6: ackable(stage) in gates.js is the single source of truth for the three ackable gates (freeze reads ACKABLE_GATES = STAGE_GATES.D3 | D5 | D6, which lines up with ackable()). No code change in this PR; this CN anchors the AC against the file that enforces the invariant so a future refactor cannot drop the exit-2 behaviour without flagging the AC.",
+  "implementsAcIds": [
+    "AC-17404-6"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T10:50:00Z",
+  "updatedAt": "2026-10-03T10:50:00Z"
+}

package/rcf/code-nodes/cn-756.json

@@ -0,0 +1,15 @@
+{
+  "cnId": "CN-756",
+  "path": "src/define/concern-catalogue.js",
+  "title": "DEFINE step 3 PR 6: the eight-concern applicability map keyed by REQ shape",
+  "description": "src/define/concern-catalogue.js lands as a new pure module beside ledgers.js. Exports CONCERN_KEYS (the eight concern names in canonical order), CONCERN_APPLICABILITY (the map { concern -> [req-shapes] } that spec section 4 row 'D5 catalogue' pins), and applicableConcernsFor(reqShape) which returns the concern keys that apply to a REQ shape. No I/O, no state. Keys shared with the baseline catalogue where names coincide (auth; the rest are new because the baseline-AC catalog does not name per-concern crosscut keys). Read by crosscut:catalogue in src/query/gates.js (PR 6) to enumerate the applicable (reqShape, concern) pairs for every REQ in scope.",
+  "implementsAcIds": [
+    "AC-17405-3",
+    "AC-17405-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T13:30:00Z",
+  "updatedAt": "2026-10-03T13:30:00Z"
+}

package/rcf/code-nodes/cn-757.json

@@ -0,0 +1,21 @@
+{
+  "cnId": "CN-757",
+  "path": "src/query/gates.js",
+  "title": "DEFINE step 3 PR 6: D4 closed-set and ownerRef findings, D5 catalogue, standards citation on the gates module",
+  "description": "src/query/gates.js grows four new engineer checks: stories:closedSets (over delta; AC description with an enumeration cue and no bracketed list or ownerRef fails, honouring the quoted-cue guard shared with D6); stories:ownerRefResolves (over delta plus tree for ownerRef targets; every ownerRef { tacId, field: interfaces[<name>] } on an AC resolves on that TAC, else fails with 'ownerRef does not resolve'); crosscut:catalogue (over tree; for every REQ in scope, every applicable (reqShape, concern) pair via src/define/concern-catalogue.js has a concern-ledger entry keyed <REQ>:<concern> with disposition applied or waived, else fails <REQ>:<concern>); skeleton:standardsCited (over tree; every manifest.standards[].slug is cited in a REQ rationale or an ADR, or waived by a concern-ledger entry keyed standards:<pack>, else fails standards:<pack> with 'uncited and unwaived'). The CHECK_PERSONA and CHECK_QUESTION maps grow in step. parseAcClass is already exported; closedSets re-uses the quoted-cue guard pattern.",
+  "implementsAcIds": [
+    "AC-17405-1",
+    "AC-17405-2",
+    "AC-17405-3",
+    "AC-17405-4",
+    "AC-17405-5"
+  ],
+  "dependencies": [
+    "CN-753",
+    "CN-756"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T13:30:00Z",
+  "updatedAt": "2026-10-03T13:30:00Z"
+}

package/rcf/code-nodes/cn-758.json

@@ -0,0 +1,16 @@
+{
+  "cnId": "CN-758",
+  "path": "src/cli/readiness.js",
+  "title": "DEFINE step 3 PR 6: --check crosscut rides the D3 --ack fold with exit 4 unacked and 0 acked",
+  "description": "src/cli/readiness.js lifts the hard-coded D3-only bite branch so --check crosscut (and --check D5) honours the same --ack fold as --check shapes: an unacknowledged D5 failure exits 4; a D5 failure acknowledged at the current tree hash exits 0. The decision defers to gates.js's ackable(stage) rather than naming D5 inline, so a future bite on D6 is a one-line change. --check consistency keeps the 0.29.0 warn-with-ack posture until PR 7 bites D6; D1, D2, D4, D7, D8 keep exit 4 on a failure as blocking stages already do.",
+  "implementsAcIds": [
+    "AC-17405-3"
+  ],
+  "dependencies": [
+    "CN-754"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T13:30:00Z",
+  "updatedAt": "2026-10-03T13:30:00Z"
+}

package/rcf/code-nodes/cn-759.json

@@ -0,0 +1,21 @@
+{
+  "cnId": "CN-759",
+  "path": "src/query/gates.js",
+  "title": "DEFINE step 3 PR 7: four D6 scans (consistency:contradictions/unsatisfiable/duplicates/orphanInterfaces)",
+  "description": "src/query/gates.js gains four new engineer checks on checkD6Consistency: contradictions (two ACs on one story sharing a when clause with a negated then, honouring the shared quoted-substring guard with D4), unsatisfiable (a then naming a field no recordShape defines; a field defined in a [draft] recordShape counts as defined), duplicates (identical AC descriptions across stories fail both ACs), and orphanInterfaces (an interface on any TAC that no AC ownerRef points at and that no REQ deliveredBy reaches fails). The four checks are registered in CHECK_PERSONA and CHECK_QUESTION; they ride the existing D6 ackable fold.",
+  "implementsAcIds": [
+    "AC-17406-1",
+    "AC-17406-2",
+    "AC-17406-3",
+    "AC-17406-4",
+    "AC-17406-5",
+    "AC-17406-6"
+  ],
+  "dependencies": [
+    "CN-757"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-760.json

@@ -0,0 +1,19 @@
+{
+  "cnId": "CN-760",
+  "path": "src/query/readiness.js",
+  "title": "DEFINE step 3 PR 7: probeRunner seam, parseLitmusFlag and countLitmusReadersAtHash",
+  "description": "src/query/readiness.js accepts an injectable `probeRunner` ({ reqId, tree }) => findings[], default null; when set, computeReadiness calls it once per REQ in scope and merges the returned findings into ledgers.probes.probes[] as open probe entries so consistency:probeCount reports them. With no runner the result equals the 0.29.0 result on the same fixture (AC-17504-2). Also exports parseLitmusFlag (positive-integer validator) and countLitmusReadersAtHash (reads distinct <reader> ids from probe-ledger entries whose finding begins litmus:<reader>: and whose text includes the given hash). Pure.",
+  "implementsAcIds": [
+    "AC-17504-1",
+    "AC-17504-2",
+    "AC-17504-3",
+    "AC-17504-4"
+  ],
+  "dependencies": [
+    "CN-761"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-761.json

@@ -0,0 +1,16 @@
+{
+  "cnId": "CN-761",
+  "path": "src/define/probe-runner.js",
+  "title": "DEFINE step 3 PR 7: probe-runner seam (no shipped runner)",
+  "description": "src/define/probe-runner.js is a seam only: it exports the ProbeRunner typedef, a NO_PROBE_RUNNER sentinel and an isProbeRunner guard. No runner ships. rcf-lite has no LLM at runtime and does not spawn processes or make network calls; the harness is the runner through `rcf define ledger probes add` or a test harness that passes a stub into computeReadiness. Keeps the extension point named rather than monkey-patched (ADR-4131 extended).",
+  "implementsAcIds": [
+    "AC-17504-1",
+    "AC-17504-2",
+    "AC-17504-5"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-762.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-762",
+  "path": "src/cli/readiness.js",
+  "title": "DEFINE step 3 PR 7: --litmus <n> and D6 in the biting-stages set",
+  "description": "src/cli/readiness.js adds the --litmus <n> flag with usage help, parses it via parseLitmusFlag, counts distinct litmus readers at the current tree hash via countLitmusReadersAtHash, and exits 4 with a stderr warn line naming the shortfall when fewer than n have attested. D6 joins the BITING_STAGES set so --check consistency now exits 4 on an unacknowledged D6 failure and 0 when acked at the current hash. --help documents the new flag. No process is spawned and no network call is made.",
+  "implementsAcIds": [
+    "AC-17504-3",
+    "AC-17504-4",
+    "AC-17504-5"
+  ],
+  "dependencies": [
+    "CN-760"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-763.json

@@ -0,0 +1,18 @@
+{
+  "cnId": "CN-763",
+  "path": "src/cli/freeze.js",
+  "title": "DEFINE step 3 PR 7: --litmus <n> on rcf define freeze",
+  "description": "src/cli/freeze.js adds the --litmus <n> flag with usage help, parses it via parseLitmusFlag, and after the gate check (and any --ack folding) refuses (exit 4) and writes nothing when fewer than n distinct litmus readings exist at the current tree hash. --litmus-attested remains the default attestation path and is unchanged.",
+  "implementsAcIds": [
+    "AC-17504-3",
+    "AC-17504-4",
+    "AC-17504-5"
+  ],
+  "dependencies": [
+    "CN-760"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-764.json

@@ -0,0 +1,15 @@
+{
+  "cnId": "CN-764",
+  "path": "guidance/define-litmus.md",
+  "title": "DEFINE step 3 PR 7: rcf_define_litmus prompt content",
+  "description": "guidance/define-litmus.md: the argument-free markdown served as the rcf_define_litmus MCP prompt (spec section 6 row). Walks the harness through spawning n fresh-context readers at the current tree hash and landing their readings as probe-ledger entries whose finding begins litmus:<reader>: and whose text includes the hash. Registered through guidance/manifest.json. No new resource URI (the markdown is the prompt content itself, not a doc).",
+  "implementsAcIds": [
+    "AC-17504-3",
+    "AC-17504-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/code-nodes/cn-765.json

@@ -0,0 +1,23 @@
+{
+  "cnId": "CN-765",
+  "path": "src/cli/build.js",
+  "title": "DEFINE step 3 PR 8: rcf build bundle --next freeze gate, --override write and impacted-FBS skip",
+  "description": "src/cli/build.js grows the `--override <reason>` flag, the pre-emit freeze gate (`enforceBundleNextFreezeGate`) that loads the freeze record and the computed delta, writes `freeze.override { reason, by, at }` through `applyOverrideToFreezeRecord` when a non-empty reason is supplied, refuses with exit 4 naming `rcf define readiness` and the override channel when no freeze record exists and no override is given, and passes `impactedFbsIds` into `selectNext`. The next-item path reports every skipped FBS on stderr; when every actionable FBS is impacted and no override is given, the verb refuses with exit 4 and the same message.",
+  "implementsAcIds": [
+    "AC-17702-1",
+    "AC-17702-2",
+    "AC-17702-3",
+    "AC-17702-4",
+    "AC-17702-5",
+    "AC-17902-2",
+    "AC-17902-3"
+  ],
+  "dependencies": [
+    "CN-720",
+    "CN-721"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}

package/rcf/code-nodes/cn-766.json

@@ -0,0 +1,17 @@
+{
+  "cnId": "CN-766",
+  "path": "src/define/freeze-record.js",
+  "title": "DEFINE step 3 PR 8: applyOverrideToFreezeRecord writer",
+  "description": "src/define/freeze-record.js grows `applyOverrideToFreezeRecord({ projectRoot, reason, by, at })` which loads or creates a freeze record (stamped `frozenAt=now`, `treeHash=currentTreeHash` of the live tree, `docHashes` empty when no prior freeze), sets `override: { reason, by, at }` and writes through saveFreezeRecord. Reuses the existing SHA256 schema and canonical-JSON contract so the output is identical in shape to a freeze-verb write.",
+  "implementsAcIds": [
+    "AC-17702-2",
+    "AC-17902-3"
+  ],
+  "dependencies": [
+    "CN-721"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}

package/rcf/code-nodes/cn-767.json

@@ -0,0 +1,17 @@
+{
+  "cnId": "CN-767",
+  "path": "src/define/validate-findings.js",
+  "title": "DEFINE step 3 PR 8: collectDefineValidateFindings module",
+  "description": "src/define/validate-findings.js exports `collectDefineValidateFindings(tree)`: a pure walker-tree function returning walker-shaped error entries for an interface kind outside INTERFACE_KINDS, an AC description's leading bracketed prefix outside the five known classes, a `tacIds` naming a non-TAC, and an unresolving `ownerRef` or `deliveredBy`. Reuses INTERFACE_KINDS and parseAcClass from src/query/gates.js so the vocabularies cannot diverge. Absence of a bracketed prefix is not a finding (decision 10, kept).",
+  "implementsAcIds": [
+    "AC-17802-1",
+    "AC-17802-2",
+    "AC-17802-3",
+    "AC-17802-4"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}