rcf-lite 0.29.0 → 0.30.0

package/rcf/test-suites/ts-235.json

@@ -0,0 +1,53 @@
+{
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z",
+  "purpose": "Cover US-17902 (NV-DL enforced): the five ruleset rules land with refuseByDefault:true and overrideChannel:recordedInChain; the admissibility wrap on an unfrozen tree refuses citing NV-DL-ADM-01; freeze.override satisfies the override channel; readiness compute still runs and prints under refusal.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-17902-1",
+    "AC-17902-2",
+    "AC-17902-3",
+    "AC-17902-4"
+  ],
+  "id": "TS-235",
+  "usId": "US-17902",
+  "title": "DEFINE step 3 PR 8: NV-DL-ADM-01..05 refuse by default with recordedInChain override channel",
+  "testCases": [
+    {
+      "id": "TC-235-ruleset-nvdl-shape",
+      "acId": "AC-17902-1",
+      "description": "The shipped ruleset JSON carries NV-DL-ADM-01, 02, 03, 04 and 05 under admissibilityRules; each row has refuseByDefault: true and overrideChannel: 'recordedInChain'; each has a non-empty title.",
+      "status": "pending",
+      "testPointer": "test/ruleset/ruleset-nvdl.test.js::ruleset NV-DL (PR 8, AC-17902-1): NV-DL-ADM-01..05 refuse by default with overrideChannel recordedInChain"
+    },
+    {
+      "id": "TC-235-admissibility-wrap-refuses-on-unfrozen-tree",
+      "acId": "AC-17902-2",
+      "description": "runWithAdmissibilityGate on an unfrozen tree returns a refusal citing NV-DL-ADM-01; the inner produce function is not called.",
+      "status": "pending",
+      "testPointer": "test/query/refuse-on-admissibility-nvdl.test.js::evaluateDefineStageAdmissibility (PR 9): cites ADM-02 for failing D4, ADM-03 for failing D3, ADM-04 for non-empty validate errors"
+    },
+    {
+      "id": "TC-235-admissibility-wrap-accepts-with-override",
+      "acId": "AC-17902-3",
+      "description": "runWithAdmissibilityGate on a tree whose freeze.override is set returns ok and names the override; produce is called.",
+      "status": "pending",
+      "testPointer": "test/query/refuse-on-admissibility-nvdl.test.js::runWithAdmissibilityGate (PR 9): a failing NV-BL verdict combines NV-BL rule ids with biting NV-DL rules in the refusal, and the producer does not run"
+    },
+    {
+      "id": "TC-235-readiness-compute-unchanged-under-refusal",
+      "acId": "AC-17902-4",
+      "description": "rcf define readiness on an unfrozen tree still computes and prints the readiness envelope; the admissibility refusal is informational on the compute (ADR-4123); exit code is unchanged from 0.29.0.",
+      "status": "pending",
+      "testPointer": "test/cli/readiness-nvdl-informational.test.js::readiness compute (PR 8, AC-17902-4): still runs and prints under NV-DL refusal"
+    },
+    {
+      "id": "TC-235-wrap-cites-define-stages",
+      "acId": "AC-17902-5",
+      "description": "the admissibility wrap cites NV-DL-ADM-02/03/04 when stages or validateErrors indicate a biting rule; an --ack-at-current-hash entry omits the citation.",
+      "status": "passing",
+      "testPointer": "test/query/refuse-on-admissibility-nvdl.test.js::runWithAdmissibilityGate (PR 9): a failing NV-BL verdict combines NV-BL rule ids with biting NV-DL rules in the refusal, and the producer does not run"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-17404.json

@@ -0,0 +1,51 @@
+{
+  "usId": "US-17404",
+  "prdId": "PRD-001",
+  "reqId": "REQ-174",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "D3 bites",
+  "description": "User story under REQ-174 for DEFINE step 3 PR 5 (ADR-4131). D3 gets the three bite checks the spec section 4 names (shapes:templateMarkers, shapes:entityJoin, shapes:pathsResolve), stagePolicy exposes an ackable(stage) that is true for D3, D5 and D6, and the readiness CLI --check shapes exits 4 on an unacknowledged D3 failure and 0 when acked at the current hash. D5 and D6 bites land in PRs 6 and 7.",
+  "asA": "an engineer",
+  "iWant": "D3 to run the substantive template, entity-join and path-resolution checks under --check with the same recorded-override channel D3, D5 and D6 share",
+  "soThat": "a draft shape that is missing its markers, an unjoined entity or a dangling path blocks the gate until I either fix the tree or acknowledge it at the current hash",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17404-1",
+      "description": "[happy] given a recordShape with fields: and an httpRoute with method, path, request, response and errors, when D3 runs, then shapes:templateMarkers passes both.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-2",
+      "description": "[failure] given an httpRoute missing errors, when D3 runs, then shapes:templateMarkers fails <tacId>:<name> with \"missing marker errors\".",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-3",
+      "description": "[happy] given every coreEntity named by exactly one recordShape, when D3 runs, then shapes:entityJoin passes; given one named twice, then it fails TAD.entity:<name> with \"2 record shapes\".",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-4",
+      "description": "[happy] given an interface naming a path that exists in resolvedPaths, when D3 runs, then shapes:pathsResolve passes it; given a missing path marked authoredAt: D3, then it passes it.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-5",
+      "description": "[failure] given rcf define readiness --check shapes on an unacknowledged D3 failure, when it runs, then it exits 4; acknowledged at the current hash, it exits 0.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-6",
+      "description": "[must-not] given --ack on D1, D2, D4, D7 or D8, when freeze runs, then it exits 2 unchanged from 0.29.0.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4122-define-gates",
+    "TAC-4123-define-readiness"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T10:50:00Z",
+  "updatedAt": "2026-10-03T10:50:00Z"
+}

package/rcf/user-stories/us-17405.json

@@ -0,0 +1,61 @@
+{
+  "usId": "US-17405",
+  "prdId": "PRD-001",
+  "reqId": "REQ-174",
+  "version": "0.1.1",
+  "status": "draft",
+  "title": "D4, D5 and D2 bite",
+  "description": "User story under REQ-174 for DEFINE step 3 PR 6 (spec section 4 rows for D4, D5 and standards citation). D4 reports closed-set and ownerRef resolution as findings (stories:closedSets, stories:ownerRefResolves). D5 ships the concern catalogue module and the crosscut:catalogue check that enumerates applicable (reqShape, concern) pairs per in-scope REQ against the concern ledger. D2 ships skeleton:standardsCited that fails any registered standards pack that is neither cited in a REQ rationale or an ADR nor waived by a concern-ledger entry with key standards:<pack>. D5 is ackable: --check crosscut rides the same --ack fold as D3, exits 4 on an unacknowledged D5 failure at the current hash and 0 when acked at the current hash. Validate adds no finding for a missing AC class marker (decision 10 kept; the validate finding rows land in PR 8).",
+  "asA": "an engineer",
+  "iWant": "D4 to flag enumeration cues without a closed set, D5 to drive the eight-concern catalogue against the concern ledger for every REQ in scope, D2 to insist every registered standards pack is cited or waived, and --check crosscut to honour the recorded override at the current hash",
+  "soThat": "an AC that invites unlisted values, an unresolved ownerRef, a REQ that forgot a crosscut concern or a registered standards pack that no document cites blocks the gate until the tree is fixed or the gate is acknowledged",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17405-1",
+      "description": "[failure] given an AC \"status is one of the following\" with no bracketed list and no ownerRef, when D4 runs, then stories:closedSets fails it.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-2",
+      "description": "[happy] given an ownerRef { tacId, field: \"interfaces[loan]\" } resolving on that TAC, when D4 runs, then stories:ownerRefResolves passes; given interfaces[missing], then it fails with \"ownerRef does not resolve\". (PR 9 R11: ownerRef resolves on any existing field path, bracket grammar -- interfaces[<name>], responsibilities[<n>], dependencies[<name>], alternativesConsidered[<n>] -- or a bare schema field name -- purpose, decision, internalStructure, etc.; interfaces[loan] still resolves, interfaces[missing] still fails.)",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-3",
+      "description": "[happy] given a persistence REQ with retention applied and timeAndTimezone waived with a reason, when D5 runs, then crosscut:catalogue passes it.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-4",
+      "description": "[failure] given an httpApi REQ with no errorEnvelope entry, when D5 runs, then crosscut:catalogue fails <REQ>:errorEnvelope.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-5",
+      "description": "[happy] given a registered standards pack cited in an ADR, when D2 runs, then skeleton:standardsCited passes; uncited and unwaived, it fails standards:<pack>.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-6",
+      "description": "[must-not] given a story with no class marker on any AC, when rcf define validate runs, then no finding is raised for the missing marker.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-7",
+      "description": "[happy] (PR 9 R11) given an ownerRef { tacId, field: \"responsibilities[0]\" } naming an existing responsibility index on that TAC, when D4 runs, then stories:ownerRefResolves passes; a bare field name (purpose, internalStructure, decision) resolves when the owning doc carries a non-empty value under that key.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-8",
+      "description": "[must-not] (PR 9 R11) given an ownerRef whose field uses dotted grammar (interfaces.loan, responsibilities.audit), when D4 or rcf define validate runs, then it fails with the finding naming the dotted field so the author can rewrite to bracket grammar.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4122-define-gates",
+    "TAC-4121-define-ledgers"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T13:30:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z"
+}

package/rcf/user-stories/us-17406.json

@@ -0,0 +1,51 @@
+{
+  "usId": "US-17406",
+  "prdId": "PRD-001",
+  "reqId": "REQ-174",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "D6 bites",
+  "description": "User story under REQ-174 for DEFINE step 3 PR 7 (spec section 4 row 'D6 scans and the injectable probe runner'). D6 gets the four mechanical consistency scans the spec section 11.5 names: consistency:contradictions (two ACs on one story sharing a when clause with a negated then), consistency:unsatisfiable (a then naming a field no recordShape defines; a field defined in a [draft] recordShape counts as defined), consistency:duplicates (identical descriptions across stories, both fail), consistency:orphanInterfaces (no AC ownerRef and no REQ deliveredBy reaches it). D6 is already ackable per PR 5; flipping D6 into the biting set in src/cli/readiness.js is this PR's one-line change. Named false-positive guards: a negation inside a double-quoted substring in a then does not fire contradictions; a field defined in a [draft] recordShape counts as defined for unsatisfiable.",
+  "asA": "an engineer",
+  "iWant": "D6 to run the four substantive consistency scans and --check consistency to honour the recorded override at the current hash",
+  "soThat": "two ACs on one story that contradict each other, a then that names an undefined field, duplicate descriptions across stories or an orphaned interface block the gate until the tree is fixed or the gate is acknowledged",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17406-1",
+      "description": "[failure] given two ACs on one story with the same when clause and a negated then, when D6 runs, then consistency:contradictions fails the story naming both ACs.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-2",
+      "description": "[failure] given a then naming a field no recordShape defines, when D6 runs, then consistency:unsatisfiable fails the AC.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-3",
+      "description": "[happy] given the field defined in a [draft] recordShape, when D6 runs, then consistency:unsatisfiable passes the AC.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-4",
+      "description": "[failure] given identical AC descriptions on two stories, when D6 runs, then consistency:duplicates fails both.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-5",
+      "description": "[failure] given an interface no ownerRef and no deliveredBy reaches, when D6 runs, then consistency:orphanInterfaces fails it.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-6",
+      "description": "[must-not] given a negation inside a quoted string in a then, when D6 runs, then consistency:contradictions does not fail the story on it.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4122-define-gates",
+    "TAC-4123-define-readiness"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/user-stories/us-17503.json

@@ -32,7 +32,7 @@
     },
     {
       "id": "AC-17503-5",
-      "description": "[happy] Given --check all on the same tree, when the verb runs, then it exits 0, unchanged from 0.28.4.",
+      "description": "[happy] Given --check all on a tree with an unacknowledged D3 bite failure, when the verb runs, then it exits 4 (ADR-4131 bite); given --check all on a tree where only D5 or D6 fail without an ack, then it exits 0 with a stderr [warn] line (warn-with-ack posture preserved until PRs 6 and 7). (Amended by DEFINE step 3 PR 5 under ADR-4131; superseded prior wording: 'exits 0, unchanged from 0.28.4'.)",
       "testable": true
     },
     {
@@ -61,5 +61,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-01T16:00:00Z",
-  "updatedAt": "2026-10-01T16:00:00Z"
+  "updatedAt": "2026-10-03T12:10:00Z"
 }

package/rcf/user-stories/us-17504.json

@@ -0,0 +1,46 @@
+{
+  "usId": "US-17504",
+  "prdId": "PRD-001",
+  "reqId": "REQ-175",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "probe seam and litmus",
+  "description": "User story under REQ-175 for DEFINE step 3 PR 7 (spec section 4 row 'D6 scans and the injectable probe runner' and section 11.6). computeReadiness(tree, { probeRunner }) accepts an injectable runner where probeRunner = ({ reqId, tree }) => findings[], default null; injected findings land as probe-ledger entries in the result and count toward consistency:probeCount. src/define/probe-runner.js is added as the seam only; no shipped runner (no LLM in rcf-lite; the harness is the runner through ledger probes add). With no probeRunner the result equals the 0.29.0 result on the same fixture. --litmus <n> on readiness and freeze requires at least n distinct litmus readings at the current LITMUS HASH, read from probe-ledger entries with finding beginning litmus:<reader>: and a hash matching tree.litmusHash; one reader exits 4 naming the shortfall. The litmus hash is the tree hash computed with the probes ledger excluded (ADR-4131 extended R9, w-2026-10-03-dave-011): the probes ledger is inside tree.currentTreeHash by ADR-4120, so a reader writing a probe-ledger entry that referenced currentTreeHash would shift the hash it just attested to; the litmus hash is the content-stable hash readers pin to so n readers can land their entries at the same hash. Writes to the brief, decisions or concerns ledgers do shift the litmus hash the same way they shift currentTreeHash. Trade-off: litmus readings do not attest to probe findings written after them, which is acceptable because probe entries are themselves readings. --litmus-attested remains the default attestation path. No process is spawned and no network call is made at runtime; the harness is the runner.",
+  "asA": "an engineer",
+  "iWant": "an injectable probeRunner seam on computeReadiness and a --litmus <n> flag on readiness and freeze that counts recorded litmus probe entries at the current litmus hash (the tree hash excluding the probes ledger)",
+  "soThat": "the harness can land fresh-context readings through the probe ledger and rcf-lite exits 4 until n distinct readers have attested at the current hash, without rcf-lite itself calling an LLM or spawning a process",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17504-1",
+      "description": "[happy] given a probeRunner returning two findings for REQ-003, when computeReadiness runs, then both appear as open probe entries in the result and consistency:probeCount fails.",
+      "testable": true
+    },
+    {
+      "id": "AC-17504-2",
+      "description": "[happy] given no probeRunner, when computeReadiness runs, then the result equals the 0.29.0 result on the same fixture.",
+      "testable": true
+    },
+    {
+      "id": "AC-17504-3",
+      "description": "[happy] given two probe entries litmus:<reader>: at the current litmus hash (the tree hash excluding the probes ledger) from distinct readers, when readiness --litmus 2 runs, then it passes the litmus requirement.",
+      "testable": true
+    },
+    {
+      "id": "AC-17504-4",
+      "description": "[failure] given one reader at the current litmus hash (the tree hash excluding the probes ledger), when readiness --litmus 2 runs, then it exits 4 naming the shortfall.",
+      "testable": true
+    },
+    {
+      "id": "AC-17504-5",
+      "description": "[must-not] given --litmus, when readiness runs, then no process is spawned and no network call is made.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4123-define-readiness",
+    "TAC-4128-define-guidance"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/user-stories/us-17702.json

@@ -0,0 +1,51 @@
+{
+  "usId": "US-17702",
+  "prdId": "PRD-001",
+  "reqId": "REQ-177",
+  "version": "0.1.1",
+  "status": "draft",
+  "title": "bundle refuses and skips",
+  "description": "User story under REQ-177 for DEFINE step 3 PR 8 (spec section 4 bundle row, section 11.7 US-17702). `rcf build bundle --next` refuses on an unfrozen tree (exit 4, message naming `rcf define readiness`); `--override \"<reason>\"` writes `freeze.override { reason, by, at }` and proceeds; on a non-empty delta the next-item compute skips re-execute FBS impacted by the delta with the reason and hands out the next unimpacted FBS; when every actionable FBS is impacted and no override is given the verb refuses with exit 4.",
+  "asA": "an operator closing a change",
+  "iWant": "`rcf build bundle --next` to refuse without a freeze record, to accept a recorded override, to skip FBS impacted by a non-empty delta and hand out the next unimpacted one, and to refuse when every actionable item is impacted and no override is given",
+  "soThat": "I cannot bundle a stale next item against an unfrozen tree, a hotfix path exists with a recorded reason, and the 0.29.0 output on a frozen tree with an empty delta is unchanged",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17702-1",
+      "description": "[failure] given no freeze record, when rcf build bundle --next runs, then it exits 4 naming rcf define readiness.",
+      "testable": true
+    },
+    {
+      "id": "AC-17702-2",
+      "description": "[happy] given --override \"hotfix\", when bundle --next runs on an unfrozen tree, then freeze.override records reason, by and at and the bundle is produced.",
+      "testable": true
+    },
+    {
+      "id": "AC-17702-3",
+      "description": "[happy] given a delta impacting FBS-018, when bundle --next runs, then FBS-018 is skipped with the reason and the next unimpacted FBS is handed out.",
+      "testable": true
+    },
+    {
+      "id": "AC-17702-4",
+      "description": "[failure] given every actionable FBS impacted and no override, when bundle --next runs, then it exits 4.",
+      "testable": true
+    },
+    {
+      "id": "AC-17702-5",
+      "description": "[must-not] given a frozen tree with an empty delta, when bundle --next runs, then its output is unchanged from 0.29.0.",
+      "testable": true
+    },
+    {
+      "id": "AC-17702-6",
+      "description": "[happy] (PR 9, TAC-4125) given a project with `git config user.email` set, when bundle --next --override \"...\" runs, then freeze.override.by is the git identity; when it is absent, GITHUB_ACTOR wins; then USER; then USERNAME; then the literal `operator` as a never-null fallback.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4125-build-bundle-refuse-override-skip",
+    "TAC-4120-define-delta-and-freeze"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z"
+}

package/rcf/user-stories/us-17802.json

@@ -0,0 +1,40 @@
+{
+  "usId": "US-17802",
+  "prdId": "PRD-001",
+  "reqId": "REQ-178",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "validate findings",
+  "description": "User story under REQ-178 for DEFINE step 3 PR 8 (spec section 4 validate row, section 11.7 US-17802). `rcf define validate` reports a finding and exits non-zero for an interface kind outside the closed vocabulary, a bracketed AC prefix outside the known classes, a `tacIds` naming a non-TAC and an unresolving `ownerRef` or `deliveredBy`. Absence of an AC class marker is NOT a validate finding (decision 10): the dogfood tree and every legacy tree would otherwise fail CI; D4 reports absence as the floor.",
+  "asA": "an author of chain documents",
+  "iWant": "validate to catch misuse of the four closed vocabularies (interface kind, AC class, tacIds, ownerRef / deliveredBy) at the one surface everyone runs today",
+  "soThat": "a typo or a wrong vocabulary value fails fast and is not left to the gates",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17802-1",
+      "description": "[failure] given an interface kind \"widget\", when validate runs, then it reports a finding and exits non-zero.",
+      "testable": true
+    },
+    {
+      "id": "AC-17802-2",
+      "description": "[failure] given an AC description starting \"[sometimes]\", when validate runs, then it reports a finding.",
+      "testable": true
+    },
+    {
+      "id": "AC-17802-3",
+      "description": "[happy] given the rcf-lite dogfood tree, when validate runs, then it is clean.",
+      "testable": true
+    },
+    {
+      "id": "AC-17802-4",
+      "description": "[must-not] given an AC with no bracketed prefix, when validate runs, then no finding is raised.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4126-define-validate-findings"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z"
+}

package/rcf/user-stories/us-17902.json

@@ -0,0 +1,46 @@
+{
+  "usId": "US-17902",
+  "prdId": "PRD-001",
+  "reqId": "REQ-179",
+  "version": "0.1.1",
+  "status": "draft",
+  "title": "NV-DL enforced",
+  "description": "User story under REQ-179 for DEFINE step 3 PR 8 (spec section 4 NV-DL row, section 11.7 US-17902). The rcf-lite ruleset carries NV-DL-ADM-01..05 with `refuseByDefault: true` and `overrideChannel: recordedInChain`. ADM-01 is the bundle refusal on an unfrozen tree; ADM-05 is the bundle skip of impacted FBS; ADM-02..04 are D4 and D3 findings surfaced through the admissibility wrap. `freeze.override` (bundle --override) and an `--ack` reason (readiness / freeze) satisfy `recordedInChain`. readiness compute still runs and prints under refusal; 0.29.0 informational posture on the compute is unchanged (ADR-4123).",
+  "asA": "an operator of the DEFINE stage gates",
+  "iWant": "the five NV-DL rules to refuse by default with a recorded-in-chain override channel so a build verb cannot proceed on an unfrozen tree without a documented reason",
+  "soThat": "the ruleset's intent (ruling-sheet item 1) is enforced in code and the readiness compute still prints its diagnostics under a refusal",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17902-1",
+      "description": "[happy] given ruleset.json, when read, then NV-DL-ADM-01 to 05 carry refuseByDefault true and overrideChannel recordedInChain.",
+      "testable": true
+    },
+    {
+      "id": "AC-17902-2",
+      "description": "[failure] given an unfrozen tree, when a build verb runs under the admissibility gate, then it refuses citing NV-DL-ADM-01.",
+      "testable": true
+    },
+    {
+      "id": "AC-17902-3",
+      "description": "[happy] given freeze.override present, when the same verb runs, then it proceeds and names the override.",
+      "testable": true
+    },
+    {
+      "id": "AC-17902-4",
+      "description": "[must-not] given readiness, when the gate refuses, then the compute still runs and prints (0.29.0 informational posture unchanged).",
+      "testable": true
+    },
+    {
+      "id": "AC-17902-5",
+      "description": "[happy] (PR 9, REQ-179 enforcement locus) given a readiness result with D4 state `failing` and a non-empty validateErrors array, when `runWithAdmissibilityGate` composes its envelope, then NV-DL-ADM-02 and NV-DL-ADM-04 appear in `defineRules` and in the refusal line alongside the NV-BL rules; a stage acknowledged at the current tree hash (freeze.gates with hash match) is not cited.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4125-build-bundle-refuse-override-skip",
+    "TAC-4126-define-validate-findings"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T20:30:00Z"
+}

package/releases/releases.yaml

@@ -40,8 +40,18 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.29.0"
+latest: "0.30.0"
 releases:
+  - version: "0.30.0"
+    date: "2026-10-03"
+    breaking: true
+    headlines:
+      - "rcf-lite 0.30.0 lands the DEFINE step 3 gates bite in one release. Readiness --check now exits 4 on a failing D3, D5 or D6 at the current tree hash and clears with --ack <gate>=<reason> on freeze.gates (D3/D5/D6 only; decision 9). rcf build bundle --next now refuses on an unfrozen tree with exit 4 and clears with --override \"<reason>\" writing freeze.override { reason, by, at }; freeze.override.by is resolved by the preference order git user.email -> GITHUB_ACTOR -> USER -> USERNAME -> operator. Impacted re-execute FBS are skipped with the reason on stderr; when every actionable FBS is impacted and no override is given the verb also exits 4."
+      - "rcf define validate now exits 3 on four new finding kinds: an interface kind outside the closed vocabulary, a bracketed AC class prefix outside the five known classes, a tacIds naming a non-TAC, and an unresolving ownerRef or object-form deliveredBy. R11 widens the ownerRef and object-form deliveredBy field grammar to every bracket path on the owning TAC or ADR (interfaces[<name>], responsibilities[<n>], dependencies[<name>], alternativesConsidered[<n>]) plus a bare schema field name; dotted grammar is refused and the finding names the dotted field. The pre-PR 9 validate silently skipped the object form of deliveredBy; it is now checked. Absence of an AC class marker is not a finding (D4 reports absence as the floor)."
+      - "NV-DL-ADM-01 through 05 flip to refuseByDefault with overrideChannel: recordedInChain. Per-rule enforcement locus and override channel: ADM-01 bundle refuses without a freeze (override: --override); ADM-02 D4 stories floor findings (override: freeze.override only; D4 is not ackable per decision 9; ruling R12 2026-10-03); ADM-03 D3 shapes bite findings (override: --ack on freeze.gates); ADM-04 validate finding set (override: a chain-document correction committed to git); ADM-05 bundle all-impacted refusal (override: --override). The admissibility wrap surfaces ADM-02, ADM-03 and ADM-04 alongside the NV-BL rules on readiness and freeze, which stay informational on the compute. The blueprint shelf is clean under R11 after the sweep (31 dotted-to-bracket rewrites, 493 dead-bracket collapses, 12 ownerRef / deliveredBy drops); the sweep script is re-runnable in dry-run mode on a consumer's own tree."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.29.0"
     date: "2026-10-03"
     breaking: true

package/src/blueprint/consistency-lint.js

@@ -319,9 +319,16 @@ export function runPass2(input) {
         continue;
       }
       const carried = collectTacSurfaceText(target).toLowerCase();
-      const field = typeof delivery.field === 'string' ? delivery.field.toLowerCase() : '';
-      const fieldTail = field ? field.split('.').pop() : '';
-      if (fieldTail && !carried.includes(fieldTail)) {
+      const field = typeof delivery.field === 'string' ? delivery.field : '';
+      const fieldTail = extractDeliveryFieldTail(field);
+      // R11 (spec section 17, PR 9): a bare schema field name
+      // (`responsibilities`, `interfaces`, `purpose`, `decision`,
+      // etc.) resolves on the owner by presence; the lint treats
+      // these as covered by the surface text when the owner carries
+      // a non-empty value under that key. Bracket forms
+      // (`interfaces[<name>]`, `responsibilities[<n>]`) are parsed
+      // to their inner key for the carried-text match.
+      if (fieldTail && !carried.includes(fieldTail.toLowerCase())) {
         findings.push({
           id: `pass2-delivery-field-missing-${rid}-${delivery.tacId}`, pass: 'pass2', kind: 'reqDeliveryNotCarried',
           subject: rid, refs: [rid, delivery.tacId, fieldTail],
@@ -347,6 +354,68 @@ function collectTacSurfaceText(tac) {
   return parts.join(' ');
 }
 
+/**
+ * R11 (spec section 17, PR 9): parse `deliveredBy.field` into the
+ * tail the carried-text match should see.
+ *
+ *   - `interfaces[loan]`           -> `loan`           (bracket inner)
+ *   - `responsibilities[verify]`   -> `verify`         (bracket inner)
+ *   - `responsibilities[0]`        -> ``               (bare integer index
+ *                                                       resolves on the array;
+ *                                                       nothing to match)
+ *   - bare `responsibilities`,
+ *     `interfaces`, `purpose`,
+ *     `decision`, `internalStructure`, ...  -> ``       (bare schema field;
+ *                                                       covered by the
+ *                                                       owner's presence
+ *                                                       alone -- the
+ *                                                       pre-PR 9 `.pop()`
+ *                                                       on a dotted form
+ *                                                       is preserved for
+ *                                                       legacy dotted
+ *                                                       pointers that have
+ *                                                       not yet been
+ *                                                       swept)
+ *   - legacy dotted `interfaces.loan`
+ *     or `decision.retryBackoff`   -> `loan` / `retryBackoff`
+ *
+ * The returned tail is empty when nothing meaningful remains to
+ * match; callers skip the carried-text check in that case.
+ *
+ * @param {string} field
+ * @returns {string}
+ */
+function extractDeliveryFieldTail(field) {
+  if (typeof field !== 'string' || field.length === 0) return '';
+  // Bracket form: `<root>[<inner>]`.
+  const bracket = field.match(/^[A-Za-z0-9_]+\[([^\]]+)\]$/);
+  if (bracket) {
+    const inner = bracket[1];
+    // A bare integer index on responsibilities / alternativesConsidered
+    // resolves by position; there is nothing semantic to match on the
+    // surface text, so skip the check (the resolver has already
+    // confirmed the index exists).
+    if (/^\d+$/.test(inner)) return '';
+    return inner;
+  }
+  // Legacy dotted form (`interfaces.loan`, `decision.retryBackoff`,
+  // `responsibilities.verify`): the tail is the last dotted segment.
+  if (field.includes('.')) return field.split('.').pop();
+  // Bare schema field name: resolves on the owner by presence; no
+  // tail to match.
+  const KNOWN_BARE_FIELDS = new Set([
+    'purpose', 'internalStructure', 'tradeoffs', 'notes', 'name',
+    'responsibilities', 'interfaces', 'dependencies',
+    'decision', 'context', 'consequences', 'title',
+    'alternativesConsidered', 'description',
+  ]);
+  if (KNOWN_BARE_FIELDS.has(field)) return '';
+  // Anything else: fall through to the pre-PR 9 behaviour and match
+  // the whole thing against the carried text. This covers composite
+  // free-form tokens the sweep may not have reached.
+  return field;
+}
+
 /**
  * Load a blueprint from disk into the shape the passes consume.
  *