rcf-lite 0.29.0 → 0.30.0

package/rcf/tacs/tac-006.json

@@ -16,53 +16,53 @@
   "interfaces": [
     {
       "name": "rcf.read",
-      "kind": "mcpTool",
-      "description": "Read any RCF document by id over MCP."
+      "kind": "other",
+      "description": "Read any RCF document by id over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf.create",
-      "kind": "mcpTool",
-      "description": "Create a document with parent linkage over MCP."
+      "kind": "other",
+      "description": "Create a document with parent linkage over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf.update",
-      "kind": "mcpTool",
-      "description": "Update fields on a document over MCP."
+      "kind": "other",
+      "description": "Update fields on a document over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf.delete",
-      "kind": "mcpTool",
-      "description": "Delete a document with reference safety over MCP."
+      "kind": "other",
+      "description": "Delete a document with reference safety over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf.coverage",
-      "kind": "mcpTool",
-      "description": "Report coverage gaps over MCP."
+      "kind": "other",
+      "description": "Report coverage gaps over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf.trace",
-      "kind": "mcpTool",
-      "description": "Trace forward or back over MCP."
+      "kind": "other",
+      "description": "Trace forward or back over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf.impact",
-      "kind": "mcpTool",
-      "description": "Report impact over MCP."
+      "kind": "other",
+      "description": "Report impact over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf.view",
-      "kind": "mcpTool",
-      "description": "Generate the diagram and the static page over MCP."
+      "kind": "other",
+      "description": "Generate the diagram and the static page over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf.build.assemble",
-      "kind": "mcpTool",
-      "description": "Assemble a build prompt over MCP."
+      "kind": "other",
+      "description": "Assemble a build prompt over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf.build.markDone",
-      "kind": "mcpTool",
-      "description": "Mark a slice done over MCP."
+      "kind": "other",
+      "description": "Mark a slice done over MCP. [legacy kind: mcpTool; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -100,5 +100,5 @@
   "tradeoffs": "Local stdio sacrifices the convenience of a hosted MCP but is the only transport that preserves filesystem access; the trade is locked by the differentiator.",
   "notes": "The MCP surface mirrors the CLI verb set so behaviour is identical across surfaces.",
   "createdAt": "2026-06-25T00:00:00Z",
-  "updatedAt": "2026-06-25T00:00:00Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-007.json

@@ -16,23 +16,23 @@
   "interfaces": [
     {
       "name": "RcfError",
-      "kind": "type",
-      "description": "The structured error type used throughout the tool."
+      "kind": "recordShape",
+      "description": "The structured error type used throughout the tool. [legacy kind: type; mapped to recordShape per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "renderForTerminal",
-      "kind": "function",
-      "description": "Render an RcfError as human-readable terminal output."
+      "kind": "other",
+      "description": "Render an RcfError as human-readable terminal output. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "renderForMcp",
-      "kind": "function",
-      "description": "Serialise an RcfError as a structured object for an MCP client."
+      "kind": "other",
+      "description": "Serialise an RcfError as a structured object for an MCP client. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [],
   "tradeoffs": "A single error type across surfaces costs a small loss of surface-specific detail but guarantees that error reporting does not drift between CLI and MCP.",
   "notes": "Validation failures aggregate; the renderers preserve the full list, not just the first.",
   "createdAt": "2026-06-25T00:00:00Z",
-  "updatedAt": "2026-06-25T00:00:00Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-008.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-07-20T17:01:52.768Z",
-  "updatedAt": "2026-07-20T17:01:52.768Z",
+  "updatedAt": "2026-10-03T18:30:00Z",
   "purpose": "Ship the agent-facing method layer - the elicitation and build-cycle playbooks, the reference docs and the harness fragment - that teaches an AI agent how to run the RCF method well, served over MCP as resources and prompts and readable in place under guidance/.",
   "responsibilities": [
     "Carry the elicitation method (question frames, AC-depth bar, deploy-target elicitation, hosting-choice guidance) the eliciting agent runs with a human",
@@ -12,18 +12,18 @@
   "interfaces": [
     {
       "name": "rcf_elicit_requirements",
-      "kind": "prompt",
-      "description": "The elicitation playbook, served as an MCP prompt to the eliciting agent."
+      "kind": "other",
+      "description": "The elicitation playbook, served as an MCP prompt to the eliciting agent. [legacy kind: prompt; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "rcf_execute_build_cycle",
-      "kind": "prompt",
-      "description": "The build-cycle playbook, served as an MCP prompt to the operating agent."
+      "kind": "other",
+      "description": "The build-cycle playbook, served as an MCP prompt to the operating agent. [legacy kind: prompt; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "harness fragment",
-      "kind": "artifact",
-      "description": "The RULE-bearing block rcf init writes into CLAUDE.md and AGENTS.md."
+      "kind": "fileFormat",
+      "description": "The RULE-bearing block rcf init writes into CLAUDE.md and AGENTS.md. [legacy kind: artifact; mapped to fileFormat per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [

package/rcf/tacs/tac-4101-feedback-cli.json

@@ -17,13 +17,13 @@
   "interfaces": [
     {
       "name": "feedbackMain",
-      "kind": "function",
-      "description": "Argv-driven main; matches the core-verb signature the top-level dispatcher expects."
+      "kind": "other",
+      "description": "Argv-driven main; matches the core-verb signature the top-level dispatcher expects. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "HELP",
-      "kind": "constant",
-      "description": "Static help text asserted by the help-parity test."
+      "kind": "other",
+      "description": "Static help text asserted by the help-parity test. [legacy kind: constant; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -73,5 +73,5 @@
   "tradeoffs": "A single core verb keeps the surface easy to reference in RULE 17 and in docs; the cost is a moderately sized sub-dispatcher, matched by preflight and other multi-verb families already in the tree.",
   "notes": "The verb is core, not grouped, because it spans discover-to-audit and is invoked from harness hooks; OLD_FLAT_MAP is untouched (no legacy form existed). Design section 9 decision: no MCP tool for feedback in v1 (rejected: an rcf_feedback_add MCP tool, adds a second code path to test before the first has users; add when an MCP-only harness appears).",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T14:14:36Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4102-feedback-store.json

@@ -17,23 +17,23 @@
   "interfaces": [
     {
       "name": "readEntries",
-      "kind": "function",
-      "description": "Load and fold the JSONL log to current-state entries."
+      "kind": "other",
+      "description": "Load and fold the JSONL log to current-state entries. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "appendEntry",
-      "kind": "function",
-      "description": "Append one entry object as a JSONL line."
+      "kind": "other",
+      "description": "Append one entry object as a JSONL line. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "appendState",
-      "kind": "function",
-      "description": "Append one state-transition line for an existing id."
+      "kind": "other",
+      "description": "Append one state-transition line for an existing id. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "feedbackGitignoreEntry",
-      "kind": "constant",
-      "description": "Managed-gitignore contribution consumed by src/setup/managed-gitignore.js."
+      "kind": "other",
+      "description": "Managed-gitignore contribution consumed by src/setup/managed-gitignore.js. [legacy kind: constant; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -46,5 +46,5 @@
   "tradeoffs": "Append-only JSONL is trivial to write correctly and to inspect by eye; the cost is a fold on every read, which is negligible at the entry counts a single project will ever see.",
   "notes": "Gitignored, not committed. Raw entries can hold what redaction removes; committing them would leak on the next push for a public project.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4103-feedback-redact.json

@@ -17,13 +17,13 @@
   "interfaces": [
     {
       "name": "redact",
-      "kind": "function",
-      "description": "Redact one string with the eight rules; return the redacted text and the ledger."
+      "kind": "other",
+      "description": "Redact one string with the eight rules; return the redacted text and the ledger. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "RedactionContext",
-      "kind": "type",
-      "description": "projectRoot, projectName, operatorName, gitRemote, allowHosts."
+      "kind": "recordShape",
+      "description": "projectRoot, projectName, operatorName, gitRemote, allowHosts. [legacy kind: type; mapped to recordShape per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -36,5 +36,5 @@
   "tradeoffs": "Rule-based redaction is testable with a fixture corpus and deterministic under review; the cost is that it will occasionally over-redact (a benign name that matches an entropy rule), which is what the disclosure ledger exists to catch.",
   "notes": "The stored entry is never mutated by redaction; the rendered output is what leaves.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-22T00:00:00Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4104-feedback-fingerprint.json

@@ -15,8 +15,8 @@
   "interfaces": [
     {
       "name": "fingerprint",
-      "kind": "function",
-      "description": "Compute the entry fingerprint from its canonical input."
+      "kind": "other",
+      "description": "Compute the entry fingerprint from its canonical input. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -29,5 +29,5 @@
   "tradeoffs": "A tiny fingerprint (12 hex = 48 bits) risks a collision at very large corpuses; at the scale of a single blueprint tracker it is safe, and issues carry the full-anchor context in the body so a maintainer resolves a rare collision by hand.",
   "notes": "The fingerprint appears twice in the body (visible line and HTML comment) so maintainer edits do not lose it.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4105-feedback-render.json

@@ -16,18 +16,18 @@
   "interfaces": [
     {
       "name": "renderIssue",
-      "kind": "function",
-      "description": "Return { title, body, labels[] } for a create call."
+      "kind": "other",
+      "description": "Return { title, body, labels[] } for a create call. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "renderComment",
-      "kind": "function",
-      "description": "Return the comment body for a +1 add."
+      "kind": "other",
+      "description": "Return the comment body for a +1 add. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "renderBundle",
-      "kind": "function",
-      "description": "Return the markdown bundle string for outbox files."
+      "kind": "other",
+      "description": "Return the markdown bundle string for outbox files. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -41,5 +41,5 @@
   "tradeoffs": "Static templates keep the shape reviewable by eye and byte-comparable in tests; the cost is that template drift requires golden updates, which is exactly the discipline the tests exist for.",
   "notes": "The docs-site \"submit a blueprint idea\" form reuses these templates verbatim so triage sees one shape from both producers.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4106-feedback-destination.json

@@ -17,13 +17,13 @@
   "interfaces": [
     {
       "name": "resolve",
-      "kind": "function",
-      "description": "Given an entry and the manifest+registry, return the destination shape."
+      "kind": "other",
+      "description": "Given an entry and the manifest+registry, return the destination shape. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "CORE_REPO",
-      "kind": "constant",
-      "description": "The Stravica/rcf-lite constant; pinned to package.json:bugs.url in a test."
+      "kind": "other",
+      "description": "The Stravica/rcf-lite constant; pinned to package.json:bugs.url in a test. [legacy kind: constant; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -36,5 +36,5 @@
   "tradeoffs": "A declared destination on library.json requires library owners to author one field; the cost is a one-time PR per library, in exchange for correctness on every consuming project.",
   "notes": "A library mirrored from a fork would have derivation pointing at the fork; the declared issues field is why derivation is only a fallback.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-17T13:46:24.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4107-feedback-gh.json

@@ -15,18 +15,18 @@
   "interfaces": [
     {
       "name": "ghIssueCreate",
-      "kind": "function",
-      "description": "Create one issue on a repo with title, body and labels; return { url, number }."
+      "kind": "other",
+      "description": "Create one issue on a repo with title, body and labels; return { url, number }. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "ghIssueSearch",
-      "kind": "function",
-      "description": "Search issues on a repo by body query; return matches."
+      "kind": "other",
+      "description": "Search issues on a repo by body query; return matches. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "ghIssueComment",
-      "kind": "function",
-      "description": "Comment on an issue; return { url }."
+      "kind": "other",
+      "description": "Comment on an issue; return { url }. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -39,5 +39,5 @@
   "tradeoffs": "gh is a dependency the reporter chooses to install; the cost is a fallback bundle path when gh is missing, which the design considers a feature rather than a bug.",
   "notes": "A future MCP-only harness would call the CLI too; a native gh-lib port is not planned for v1.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4108-feedback-hook.json

@@ -17,18 +17,18 @@
   "interfaces": [
     {
       "name": "shouldAsk",
-      "kind": "function",
-      "description": "Pure decision on the quiet rule; unit-tested across the full table."
+      "kind": "other",
+      "description": "Pure decision on the quiet rule; unit-tested across the full table. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "emit",
-      "kind": "function",
-      "description": "Per-harness output; exit code and shape."
+      "kind": "other",
+      "description": "Per-harness output; exit code and shape. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     },
     {
       "name": "installHooks",
-      "kind": "function",
-      "description": "Merge the hook entries into the two harness config files."
+      "kind": "other",
+      "description": "Merge the hook entries into the two harness config files. [legacy kind: function; mapped to other per DEFINE spec \u00a75.2 closed vocabulary, 0.30.0 PR 8]"
     }
   ],
   "dependencies": [
@@ -42,5 +42,5 @@
   "tradeoffs": "Two harness config files to maintain and one handler; the cost is small (one merge pattern per file) and the benefit is one implementation of the quiet rule for both harnesses.",
   "notes": "The asked record is appended before the emit path, so a crash between emit and reply cannot cause a second ask.",
   "createdAt": "2026-09-16T13:45:23.000Z",
-  "updatedAt": "2026-09-16T13:45:23.000Z"
+  "updatedAt": "2026-10-03T18:30:00Z"
 }

package/rcf/tacs/tac-4121-define-ledgers.json

@@ -1,6 +1,6 @@
 {
   "createdAt": "2026-09-24T12:00:00Z",
-  "updatedAt": "2026-10-02T16:40:00Z",
+  "updatedAt": "2026-10-03T13:30:00Z",
   "tacId": "TAC-4121-define-ledgers",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
@@ -16,7 +16,8 @@
     "parseBriefFromFile splits by non-empty lines, strips leading '- ', '* ' or '<n>. ' bullets, defaults kind to 'capability', and threads --source through to every draft.",
     "src/cli/ledger.js: `rcf define ledger <name> <verb>` argv parsing; verbs add / resolve / list; ledger-specific flags for each; renderDecisionsList formats the #241 numbered layout; list --json emits { ledger, <arrayKey>: [...] }.",
     "bin/rcf.js: register GROUPS.define.ledger; src/cli/help.js: import LEDGER_HELP and wire into HELP_MAP.define.ledger + DEFINE_HELP + top-level DEFINE listing so per-verb help stays single-sourced.",
-    "`update <id>` subverb patches named fields and re-runs full-body validation; `resolvedBy` is a closed pointer grammar (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) validated by D2."
+    "`update <id>` subverb patches named fields and re-runs full-body validation; `resolvedBy` is a closed pointer grammar (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) validated by D2.",
+    "concern ledger carries `applied`/`waived` entries keyed by `<REQ>:<concern>` (spec section 4 row 'D5 catalogue', 0.30.0 PR 6): `crosscut:catalogue` reads the concern-ledger body and matches each applicable `(reqShape, concern)` pair against an entry with that key. A `standards:<pack>` key names a waiver for `skeleton:standardsCited`. The ledger schema already carries `{ id, concern, reqId, disposition, reason?, addedAt, status, resolvedAt? }`; the `<REQ>:<concern>` key is composed by the gate from `concern` and `reqId` (no schema change)."
   ],
   "internalStructure": "The walker never reads under rcf/define/: subdirFor in src/core/store/loader.js returns null for anything that is not a known child kind (requirements, user-stories, tacs, adrs, fbs, test-suites, code-nodes, evals), so a ledger file sitting under rcf/define/ is never enumerated for schema validation. The walker-invisibility invariant is proved by a dedicated test that seeds the four ledger files plus a bug-bait req-shaped file under rcf/define/ and asserts zero walker error paths starting with rcf/define/ and no matching id in tree.byId. Validation is JSON-schema-shaped inline (no ajv, no @stravica-ai/rcf-schemas dependency) because the sidecars ride outside the shared schema until schemas 0.7 (ADR-4121).",
   "interfaces": [

package/rcf/tacs/tac-4122-define-gates.json

@@ -1,10 +1,10 @@
 {
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-10-03T00:00:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
   "tacId": "TAC-4122-define-gates",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "status": "draft",
   "name": "define stage gates D1..D8",
   "purpose": "src/query/gates.js lands as a new pure module beside delta.js. Every stage has one exported check function that takes (tree, context) and returns the { stage, gate, state, checks[] } shape section 2.4 pins. computeReadiness (TAC-4123) is the composer; every gate function is otherwise consumable in isolation for tests and for future viewers that render one stage. No I/O, no state, no time: the caller supplies ledgers, profile, freeze, delta, validate errors, probe count and coverage rollups.",
@@ -22,7 +22,20 @@
     "ADR-4126 (0.29.0): own the per-check persona and question map; export `CHECK_PERSONA`, `CHECK_QUESTION`, `STAGE_FALLBACK_PERSONA`, `checkPersona(name)`, `checkQuestion(name)` and `parseInterfaceDraft(iface)`. Every entry in `stages[].checks[]` carries `persona` (productOwner | engineer) and a non-empty `question`; the `stage:<D>:scope` placeholder uses `STAGE_FALLBACK_PERSONA`.",
     "ADR-4126 (0.29.0): split `skeleton:reqFields` into `skeleton:reqIntent` (productOwner: description without TODO and domain, evaluated per REQ independently) and `skeleton:reqShape` (engineer: shapeClassification.shapes). Split `decisions:allAnswered` into `decisions:wellFormed` (productOwner: non-empty question + two or more options + a default naming one of them) and `decisions:allAnswered` (engineer: zero open).",
     "ADR-4126 (0.29.0): new D3 check `shapes:draftSettled` fails any interface whose `description` starts with `[draft]` (whitespace tolerated), id `<tacId>:<name>`, over delta, total = interfaces on TACs in scope; `tacHasInterface` counts a draft as present; `kindVocabulary` applies to drafts.",
-    "`shapes:draftSettled` reports `[draft]` on `TAC.purpose`, `coreEntities[].description` and `TAC.interfaces[].description` with ids `<tacId>`, `TAD.entity:<name>` and `<tacId>:<name>` respectively (REQ-188, 0.30.0): `parseInterfaceDraft` reads the marker on all three homes with the same whitespace-tolerant rule; the draft pass enumerates across the three homes; nothing in the draft pass can fail a product-owner check."
+    "`shapes:draftSettled` reports `[draft]` on `TAC.purpose`, `coreEntities[].description` and `TAC.interfaces[].description` with ids `<tacId>`, `TAD.entity:<name>` and `<tacId>:<name>` respectively (REQ-188, 0.30.0): `parseInterfaceDraft` reads the marker on all three homes with the same whitespace-tolerant rule; the draft pass enumerates across the three homes; nothing in the draft pass can fail a product-owner check.",
+    "`shapes:templateMarkers` (per-kind marker presence on `interfaces[].description`) (ADR-4131, 0.30.0 PR 5): engineer, over delta, id `<tacId>:<name>`, `why` names the missing marker; `recordShape` needs `fields:`; `httpRoute` needs `method`, `path`, `request`, `response`, `errors`; `fixture` needs `instances:`; `event` needs `payload:`; `cliCommand` needs `usage:`; `uiRoute` needs `path`; `port` needs `protocol`; `fileFormat` needs `format:`; `other` needs a note. Drafts are included (a `[draft]` recordShape without `fields:` fails exactly as a settled one).",
+    "`shapes:entityJoin` (every `coreEntities[].name` named by exactly one `recordShape`) (ADR-4131, 0.30.0 PR 5): engineer, over tree; match on `name` or an `entity:` line in the template; fail ids `TAD.entity:<name>` with `no record shape` or `N record shapes`.",
+    "`shapes:pathsResolve` (any `path:`-like token in an interface description that looks like a repo path resolves on disk or the description carries `authoredAt: D3`) (ADR-4131, 0.30.0 PR 5): engineer, over delta; gates stay pure, the readiness CLI resolves candidate paths and passes `resolvedPaths` in the stage context; ids `<tacId>:<name>` with the unresolved path in `why`.",
+    "`ackable(stage)` (ADR-4131, 0.30.0 PR 5): exported helper that returns `true` for D3, D5, D6 and `false` for every other stage. `stagePolicy(stage)` is unchanged; `ackable` is the companion that names the three gates that accept a recorded `--ack` override.",
+    "`stories:closedSets` (0.30.0 PR 6, spec section 4 row 'D4 closed-set and ownerRef as findings'): engineer, over delta. An AC whose description contains an enumeration cue (`one of`, `any of`, `the following`, `types of`, `status is`) without an inline bracketed list or an `ownerRef` fails. Honours the shared quoted-cue guard with D6: a cue inside a double-quoted substring does not fire.",
+    "`stories:ownerRefResolves` (0.30.0 PR 6; widened under R11 in PR 9, spec section 17): engineer, over delta plus tree for ownerRef targets. Every ownerRef on an AC with a tacId OR adrId whose field names an existing field path on the owning document (bracket grammar: interfaces[<name>], responsibilities[<n>], dependencies[<name>], alternativesConsidered[<n>]; or a bare schema field name -- purpose, decision, internalStructure, etc.) resolves. Dotted grammar is refused. Failing ids name the AC and the unresolved pointer with the why string `ownerRef does not resolve`. Validate reuses this check via `resolveOwnerRefField` (PR 8 adds the finding row, PR 9 generalises both arms).",
+    "`crosscut:catalogue` (0.30.0 PR 6, spec section 4 row 'D5 catalogue'): engineer, over tree. For every REQ in scope, enumerate applicable `(reqShape, concern)` pairs through `src/define/concern-catalogue.js` (eight concerns keyed by REQ shape); each pair needs a concern-ledger entry keyed `<REQ>:<concern>` with disposition `applied` or `waived` (with a reason for waived). Failing ids are `<REQ>:<concern>`. Keys shared with the baseline catalogue where names coincide. D5 is ackable: readiness --check crosscut rides the same --ack fold as D3.",
+    "`skeleton:standardsCited` (0.30.0 PR 6, spec section 4 row 'Standards-ingestion check'): engineer, over tree. Every standards pack registered through `rcf define standards` (manifest.standards[].slug) is cited in a REQ `rationale` or an ADR, or waived by a concern-ledger entry with key `standards:<pack>`. Fail ids `standards:<pack>` with 'uncited and unwaived'.",
+    "`src/define/concern-catalogue.js` (0.30.0 PR 6): the eight-concern applicability map keyed by REQ shape: `auth` to `auth`/`httpApi`; `errorEnvelope` to `httpApi`/`cliCommand`; `loggingAudit` to all shapes but `other`; `retention` to `persistence`; `performance` to `httpApi`/`batch`; `secrets` to `auth`/`externalIntegration`; `timeAndTimezone` to `persistence`/`batch`; `concurrencyIdempotency` to `httpApi`/`persistence`. Exports `applicableConcernsFor(reqShape)` returning the concern keys that apply, plus `CONCERN_KEYS` and `CONCERN_APPLICABILITY` for tests. Pure; no I/O.",
+    "`consistency:contradictions` (0.30.0 PR 7, spec section 4 row 'D6 scans and the injectable probe runner'): engineer, over delta. Two ACs on one story sharing a `when` clause with a negated `then` fail the story; failing ids name the story and both AC ids. The named false-positive guard: a negation inside a double-quoted substring in a `then` does not fail the story (the shared quoted-substring guard with D4).",
+    "`consistency:unsatisfiable` (0.30.0 PR 7): engineer, over delta. A `then` naming a field that no `recordShape` defines fails the AC; a field defined in a `[draft]` recordShape counts as defined. Failing ids `<acId>:<field>`.",
+    "`consistency:duplicates` (0.30.0 PR 7): engineer, over tree. Identical AC descriptions across stories fail both ACs with id `<acId>` and why 'duplicate description'. The comparison trims leading whitespace and the leading `[class]` marker.",
+    "`consistency:orphanInterfaces` (0.30.0 PR 7): engineer, over tree. An interface on a TAC that no AC's `ownerRef` points at and that no REQ's `deliveredBy` reaches fails with id `<tacId>:<name>` and why 'no AC ownerRef and no REQ deliveredBy reaches it'. Shares the `interfaces[<name>]` pointer grammar with D4 `stories:ownerRefResolves`."
   ],
   "internalStructure": "Every stage function follows the same shape: 1) decide notApplicable per section 3.2 and return { state: 'notApplicable' } with a single-check summary; 2) build checks[] as a list of { name, ok, over, pass, total, failing: [{ id, why }] }; 3) fold to state: 'passed' if every ok is true; 'failing' otherwise, unless the stage is D3/D5/D6 AND freeze.gates[<gate>].state === 'acknowledged' AND freeze.gates[<gate>].at.hash === currentTreeHash, in which case state is 'acknowledged'. Blocking-vs-warn is a property of the stage, not of the state: D3/D5/D6 use the acknowledged fold, D1/D2/D4/D7/D8 do not. The caller (readiness) folds the array of stage results into freezeable and nextAction.",
   "interfaces": [
@@ -55,6 +68,21 @@
       "name": "parseInterfaceDraft",
       "kind": "other",
       "description": "[draft] True when an interface's `description` carries the leading `[draft]` marker (whitespace tolerated)."
+    },
+    {
+      "name": "parseInterfaceTemplate",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): parseInterfaceTemplate(iface) returns the per-kind marker presence for an interface: for a recordShape it reports whether `fields:` is present; for an httpRoute it reports whether each of method, path, request, response and errors is present; for fixture it reports `instances:`; for event, cliCommand, uiRoute, port, fileFormat and other it reports the per-kind markers from spec section 4 row 'D3 template parser'. Exported from src/query/gates.js for shapes:templateMarkers and for the validate step 6 notice (0.30.0 PR 5)."
+    },
+    {
+      "name": "ackable",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): ackable(stage) returns true for D3, D5 and D6 and false for every other stage. The CLI readiness and freeze verbs read it to gate --ack as the recorded override for just those three gates (ADR-4131)."
+    },
+    {
+      "name": "applicableConcernsFor",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): applicableConcernsFor(reqShape) returns the concern keys that apply to a REQ shape, per the eight-concern applicability map in src/define/concern-catalogue.js (0.30.0 PR 6). Pure. crosscut:catalogue reads this to decide which (reqShape, concern) pairs each REQ in scope must have a concern-ledger entry for."
     }
   ],
   "notes": "Slice-3 hook (rcf define freeze): reads state to refuse on any 'failing'; --ack <gate> --reason <text> writes freeze.gates[<gate>] = { state: 'acknowledged', at: { hash: <currentTreeHash>, reason: <text>, by: <id> } } and re-runs computeReadiness to check freezeable. Slice-5 hook (viewer): reads the same object end-to-end."

package/rcf/tacs/tac-4123-define-readiness.json

@@ -1,10 +1,10 @@
 {
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-10-01T16:00:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
   "tacId": "TAC-4123-define-readiness",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "status": "draft",
   "name": "computeReadiness compute and rcf define readiness CLI",
   "purpose": "src/query/readiness.js and src/cli/readiness.js land as a matched pair. The pure module composes computeDelta, computeImpact, the eight gate check functions from TAC-4122, computeCoverage, and the decisions ledger into the single-object contract section 2.4 pins; the CLI is its twin. Text output for readable status; --json for machine consumers and the viewer slice; --check <stage>|all for targeted inspection with the same 0-green / 4-red exit shape rcf audit coverage uses.",
@@ -22,7 +22,13 @@
     "ADR-4126 (0.29.0): `deriveNextAction(stages, persona?)` gains an optional persona argument. With no persona it behaves exactly as 0.28.4. With a persona it picks the first stage in D1..D8 order holding a failing check of that persona, then the check with the largest failing list; the command carries `--level intent` on the productOwner variant. `formatVerdictLines(result)` builds the two strings (`Intent-complete: yes/no...` and `Ready-to-build: yes/no...`) shared by the CLI (PR B) and the Readiness tab (PR C) so they cannot disagree.",
     "ADR-4126 (0.29.0): the levels and personas folds are additive; every 0.28.4 top-level field (tree, delta, stages, nextAction, coverage, decisions, freezeable) is present with its 0.28.4 type. No file under rcf/ is created or modified by any `rcf define readiness` invocation. The CLI flags (`--level`, `--persona`) and the viewer tab are PR B and PR C respectively; the compute lands first (PR A).",
     "ADR-4126 PR B (0.29.0): src/cli/readiness.js owns the --level intent|build and --persona productOwner|engineer dispatch. --level drives the exit code against levels.<which>.ok per spec section 3.2 (stricter than --check all on warn-with-ack failures per decision 4); --persona is a display filter that never affects the exit code or JSON content. parseLevelFlag and parsePersonaFlag share the usage-line shape with --check. Unknown values exit 2 with a usage line naming the accepted set. The CLI passes the resolved level into computeReadiness via the readiness context so _meta.level reflects the invocation (null when the flag was absent).",
-    "ADR-4126 PR B (0.29.0): the text report prints both verdict lines (shared via formatVerdictLines) at the top; regroups blockers into one 'Product owner: N question(s)' and one 'Engineer: N check(s) blocking' section ordered by the profile register (productOwner-first or engineer-first; unstated and absent profile default to PO first); and renders the per-check line in the per-stage detail block with the persona inside the parenthesis after `over`. --persona X collapses the opposite-persona block to one 'hidden; run without --persona' line and restricts the per-stage detail to matching-persona checks."
+    "ADR-4126 PR B (0.29.0): the text report prints both verdict lines (shared via formatVerdictLines) at the top; regroups blockers into one 'Product owner: N question(s)' and one 'Engineer: N check(s) blocking' section ordered by the profile register (productOwner-first or engineer-first; unstated and absent profile default to PO first); and renders the per-check line in the per-stage detail block with the persona inside the parenthesis after `over`. --persona X collapses the opposite-persona block to one 'hidden; run without --persona' line and restricts the per-stage detail to matching-persona checks.",
+    "ADR-4131 (0.30.0 PR 5): collects candidate paths; the CLI resolves them on disk and passes `resolvedPaths` in the stage context so the `shapes:pathsResolve` check can decide a path:-like token against the real filesystem without turning the gates module into an I/O module. The compute remains pure: readiness.js owns the collection seam; cli/readiness.js owns the resolve-on-disk step before invoking the gate functions.",
+    "ADR-4131 (0.30.0 PR 5): the readiness CLI --check policy becomes bite-aware for D3. --check shapes exits 4 on an unacknowledged D3 failure and 0 when acked at the current hash (same recorded-override channel ADR-4124 pins). --check on D4, D5 and D6 keeps the 0.29.0 behaviour until their own PRs (6 and 7) bite. --level intent and --level build exits are unchanged.",
+    "ADR-4131 extended (0.30.0 PR 7, spec section 11.6): computeReadiness accepts an injectable `probeRunner` ({ reqId, tree }) => findings[], default null; findings land as probe-ledger entries in the result (merged into `ledgers.probes.probes[]` the gate reads) and count toward consistency:probeCount. With no probeRunner the result equals the 0.29.0 result on the same fixture. src/define/probe-runner.js lands as the seam only; no shipped runner (the harness is the runner through `ledger probes add`). The CLI never passes a probeRunner today; the seam is for test harnesses and for a later harness-driven call site.",
+    "ADR-4131 extended (0.30.0 PR 7; R9 amended 2026-10-03, w-2026-10-03-dave-011): --litmus <n> on readiness and freeze requires n distinct litmus readings at the current LITMUS HASH. A litmus reading is a probe-ledger entry whose `finding` begins `litmus:<reader>:` and whose text includes a `hash` matching `tree.litmusHash`. The litmus hash is the tree hash computed with the probes ledger excluded (new computeLitmusHash helper in src/query/readiness.js); the probes ledger is inside `tree.currentTreeHash` by ADR-4120, so a reader writing a probe-ledger entry that referenced `currentTreeHash` would shift the hash it just attested to. The litmus hash is the content-stable hash readers pin to: writes to the probes ledger do not shift it, so n readers can land `litmus:<reader>:` entries at the same hash; writes to the brief, decisions or concerns ledgers do shift it (the content under review has changed). One reader exits 4 naming the shortfall; n distinct readers at the hash pass. No process is spawned and no network call is made; the harness is the runner. `--litmus-attested` remains the default attestation path. Trade-off: litmus readings do not attest to probe findings written after them, which is acceptable because probe entries are themselves readings.",
+    "ADR-4131 extended (0.30.0 PR 7): the readiness CLI --check policy becomes bite-aware for D6. --check consistency exits 4 on an unacknowledged D6 failure and 0 when acked at the current hash (the one-line change: D6 joins the BITING_STAGES set in src/cli/readiness.js; the --ack channel D3/D5/D6 already share stays unchanged).",
+    "PR 9 (REQ-179 enforcement locus): the CLI computes readiness BEFORE calling `runWithAdmissibilityGate`, passing the computed `stages[]` and the validate-errors array via `defineStages` and `defineValidateErrors`; the wrap evaluates NV-DL-ADM-02 (failing D4), NV-DL-ADM-03 (failing D3) and NV-DL-ADM-04 (non-empty validate errors), honouring --ack-at-current-hash as the recordedInChain override for ADM-02/03. The compute still runs and prints under refusal (AC-17902-4)."
   ],
   "internalStructure": "readiness.js is a linear composer: 1) compute delta and its docHashes; 2) fan-out impacted / impactedFbs; 3) build stage context (freeze, delta, scope, ledgers, profile, validateErrors, probeOpenCount, coverageTree); 4) call the eight check functions; 5) fold freezeable and nextAction. The CLI parses flags, loads the tree once, loads the four ledgers and the freeze record once, computes the readiness, then routes to the text or JSON emitter. --check maps its argument to the STAGE_SHORT_NAMES map (brief -> D1 ... freeze -> D8) or accepts D1..D8 directly. The runWithAdmissibilityGate wrap sits inside main so refusals ride the same exit path as coverage's admissibility refusals.",
   "interfaces": [
@@ -55,6 +61,26 @@
       "name": "parsePersonaFlag",
       "kind": "other",
       "description": "[draft] Validate --persona against the closed value set (productOwner | engineer); return the value or null (flag absent) or throw a usage error for an unknown value."
+    },
+    {
+      "name": "parseLitmusFlag",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): parseLitmusFlag(raw) parses --litmus <n> as a positive integer; returns null (flag absent) or throws a usage error for a non-integer or non-positive value (0.30.0 PR 7, ADR-4131 extended)."
+    },
+    {
+      "name": "countLitmusReadersAtHash",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): countLitmusReadersAtHash(ledgers, hash) returns the set of distinct reader ids extracted from probe-ledger entries whose `finding` begins `litmus:<reader>:` and whose text includes `hash` (0.30.0 PR 7). Pure. The CLI exits 4 when the set size is below --litmus <n>. `hash` is `tree.litmusHash` (ADR-4131 extended R9, w-2026-10-03-dave-011), not `tree.currentTreeHash`: the probes ledger is inside currentTreeHash by ADR-4120, so a reader writing a probe-ledger entry that referenced currentTreeHash would shift the hash it just attested to."
+    },
+    {
+      "name": "computeLitmusHash",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): computeLitmusHash(tree, ledgers) returns the tree hash (`sha256:<hex>`) recomputed with the probes ledger excluded (ADR-4131 extended R9, w-2026-10-03-dave-011). Reuses hashDocument and computeTreeHash from src/query/delta.js. Pure. The result is stable under writes to the probes ledger (so n readers can pin litmus entries to the same hash) and shifts the same way currentTreeHash shifts under writes to the brief, decisions or concerns ledgers (which do change what the readers were attesting to)."
+    },
+    {
+      "name": "probeRunner",
+      "kind": "other",
+      "description": "[draft] moduleApi (authoredAt: D3): injectable runner shape `({ reqId, tree }) => findings[]`, default null. computeReadiness calls the runner (when set) over every REQ in scope and merges the returned findings into ledgers.probes.probes[] so the gate reads them (0.30.0 PR 7). No runner ships; src/define/probe-runner.js carries the seam only. Pure over its inputs; must not do I/O or spawn a process."
     }
   ],
   "notes": "Slice-3 hook (rcf define freeze) reads freezeable and stages[].state; --ack <gate> writes into freeze.gates[<gate>] and re-computes readiness. Slice-5 hook (viewer) fetches the same JSON object over the existing tab wire and renders the pill vocabulary + findings-list + diff components. Performance seam: computeImpact per id on a whole-tree delta (before freeze) may be quadratic on very large trees; the compute stays fast on the dogfood chain (~700 documents, sub-second) but the CLI notes the wall time in text mode so an operator can spot regression."

package/rcf/tacs/tac-4125-build-bundle-refuse-override-skip.json

@@ -0,0 +1,43 @@
+{
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z",
+  "tacId": "TAC-4125-build-bundle-refuse-override-skip",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "0.1.1",
+  "status": "draft",
+  "name": "build bundle --next refusal, override and impacted-FBS skip",
+  "purpose": "0.30.0 PR 8 (spec section 4 bundle row, section 11.7 US-17702). `rcf build bundle --next` is tightened against the detection-model freeze record: without a freeze record the verb refuses with exit 4 naming `rcf define readiness`; `--override \"<reason>\"` writes `freeze.override { reason, by, at }` through saveFreezeRecord and proceeds; on a non-empty delta against the current tree, the next-item compute skips re-execute FBS impacted by the delta with the reason text in a line and hands out the next unimpacted FBS; when every actionable FBS is impacted and no override is given the verb refuses with exit 4 with the same message. On a frozen tree with an empty delta the verb's 0.29.0 shape is unchanged (AC-17702-5).",
+  "responsibilities": [
+    "refusal: on `bundle --next` with no freeze record, exit 4 with a usage line naming `rcf define readiness` (and `--override \"<reason>\"` as the override channel); the next-item compute does not run.",
+    "override: `--override \"<reason>\"` on `bundle --next` writes `freeze.override { reason, by, at }` through saveFreezeRecord before the next-item compute runs; `--override` without a non-empty reason is a usage refusal (exit 2); when a freeze record exists the override is still written and the override reason is named in the output.",
+    "skip: on a non-empty delta against the current tree hash, next-item selection filters re-execute FBS impacted by the delta out of the actionable queue with a stderr line naming each skipped FBS and the reason; the next unimpacted actionable FBS is handed out.",
+    "all-impacted refusal: when every actionable FBS is impacted by the delta and no override is given, the verb refuses with exit 4 and the same message pointing at `--override \"<reason>\"`.",
+    "unchanged on empty delta: on a frozen tree with an empty delta the verb's output and exit code are byte-for-byte unchanged from 0.29.0 (AC-17702-5).",
+    "override.by identity (PR 9, AC-17702-6): freeze.override.by is resolved by `resolveOverrideBy({projectRoot})` with the preference order `git config user.email` -> `GITHUB_ACTOR` -> `USER` -> `USERNAME` -> literal `operator`. Each failing arm falls through silently to the next; the write path cannot blow up on a stripped-down container."
+  ],
+  "internalStructure": "The next-item path in `src/cli/build.js` grows a pre-emit guard (`enforceBundleNextFreezeGate`) that loads the freeze record and the computed delta via loadFreezeRecord and computeDelta, applies the `--override` write (if given) before the next-item compute, and emits a refusal when the record is absent and no override is given. The impacted-FBS skip extends `selectNext` to accept an `impactedFbsIds` set and skip them with a stderr reason; the all-impacted case falls through to a refusal rather than an empty envelope. `freeze.override` records come through `saveFreezeRecord` so the existing schema and canonical-JSON contract are reused; a short writer `applyOverrideToFreezeRecord` writes `freeze.override` on the live freeze record (creating a minimal record stamped with `frozenAt=now`, `treeHash=currentTreeHash`, `docHashes=whole-tree`, `briefStatements=0` when none exists).",
+  "interfaces": [
+    {
+      "name": "enforceBundleNextFreezeGate",
+      "kind": "other",
+      "description": "`moduleApi` (`src/cli/build.js`). Signature: ({ tree, projectRoot, overrideReason, by }) -> { ok: boolean, exitCode?: 2|4, message?: string, impactedFbsIds?: Set<string>, override?: { reason, by, at } }. Reads the freeze record and `computeDelta(tree, { freeze })`, applies the override write when `overrideReason` is set, and either returns ok with the impacted-FBS set, or a refusal with exit 4 and the usage message. authoredAt: D3."
+    },
+    {
+      "name": "applyOverrideToFreezeRecord",
+      "kind": "other",
+      "description": "`moduleApi` (`src/define/freeze-record.js`). Signature: ({ projectRoot, reason, by, at }) -> { filePath }. Loads or creates a freeze record, sets its override to { reason, by, at }, writes through saveFreezeRecord. authoredAt: D3."
+    },
+    {
+      "name": "selectNext",
+      "kind": "other",
+      "description": "`moduleApi` (`src/build/queue.js`). Extended to accept an optional `{ impactedFbsIds, io }` parameter: when supplied, re-execute FBS whose id is in `impactedFbsIds` are skipped with a stderr line naming the FBS and the reason, and the next unimpacted FBS is returned; when every actionable FBS is impacted, returns `null` and the caller treats that as the all-impacted refusal."
+    },
+    {
+      "name": "resolveOverrideBy",
+      "kind": "other",
+      "description": "`moduleApi` (`src/cli/build.js`). Signature: ({ projectRoot }) -> Promise<string>. Resolves the identity for `freeze.override.by` under the R11 preference order (git config user.email, GITHUB_ACTOR, USER, USERNAME, operator). Pure of side effects beyond one bounded `git config --get user.email`. authoredAt: D3."
+    }
+  ],
+  "notes": "Spec amendment 2026-10-03 R9 does not alter this TAC: delta semantics are unchanged, the litmus hash is a readiness concern only. `freeze.override` writes do not shift `tree.currentTreeHash` or `tree.litmusHash` (the probes ledger is excluded from the litmus hash by R9; the override lives in the freeze record, not in a tree document). The brief named this TAC as `tac-4125*.json`; the file name follows the dash-prefixed naming convention of neighbouring TACs."
+}