rcf-lite 0.29.0 → 0.30.0

package/blueprints/application-spa/contributions/tacs/tac-210-application-spa-external-dependency-provisioning-probe.json

@@ -22,23 +22,23 @@
   "interfaces": [
     {
       "name": "runExternalDependencyProvisioningProbe",
-      "kind": "factory",
-      "description": "runExternalDependencyProvisioningProbe({ manifestPath, bootServer, deferralsStorePath, reportDir }) -> Promise<{ verdict, reportPath, refusals }>; the sole callable the entry point invokes. 'bootServer' is a factory returning '{ url, close, env }' for a server booted through the production entry-point path with the runtime environment the shipped instance observes. 'verdict' is 'ok' | 'deployed-with-defects'; the entry point translates 'deployed-with-defects' to a non-zero exit code."
+      "kind": "other",
+      "description": "runExternalDependencyProvisioningProbe({ manifestPath, bootServer, deferralsStorePath, reportDir }) -> Promise<{ verdict, reportPath, refusals }>; the sole callable the entry point invokes. 'bootServer' is a factory returning '{ url, close, env }' for a server booted through the production entry-point path with the runtime environment the shipped instance observes. 'verdict' is 'ok' | 'deployed-with-defects'; the entry point translates 'deployed-with-defects' to a non-zero exit code. (legacy kind: factory)"
     },
     {
       "name": "entry-point CLI",
-      "kind": "cli",
-      "description": "'node <entryPointPath>' with optional flags '--manifest <path>', '--boot <module>', '--deferrals <path>', '--report-dir <path>' that override configuration defaults. Exit code is 0 on 'ok', non-zero on 'deployed-with-defects'."
+      "kind": "other",
+      "description": "'node <entryPointPath>' with optional flags '--manifest <path>', '--boot <module>', '--deferrals <path>', '--report-dir <path>' that override configuration defaults. Exit code is 0 on 'ok', non-zero on 'deployed-with-defects'. (legacy kind: cli)"
     },
     {
       "name": "reports/external-dependency-provisioning.json",
-      "kind": "artefact",
-      "description": "'reports/external-dependency-provisioning.json' under the configured report directory. Shape: '{ verdict, dependencies: [{ id, purpose, provider, credentialField, status, placeholderCheck: { verdict, matchedPattern? }, verifiedEvidence?: { providerMessageId?, providerStatus?, capturedAt }, deferralRecord?: { path, ackedBy, ackedAt, reason, resolutionRoute }, refusals: [...] }], generatedAt }'."
+      "kind": "fileFormat",
+      "description": "'reports/external-dependency-provisioning.json' under the configured report directory. Shape: '{ verdict, dependencies: [{ id, purpose, provider, credentialField, status, placeholderCheck: { verdict, matchedPattern? }, verifiedEvidence?: { providerMessageId?, providerStatus?, capturedAt }, deferralRecord?: { path, ackedBy, ackedAt, reason, resolutionRoute }, refusals: [...] }], generatedAt }'. (legacy kind: artefact)"
     },
     {
       "name": "external-service-dependency manifest (project-owned)",
-      "kind": "artefact",
-      "description": "A project-owned JSON manifest the probe reads. Shape: '{ dependencies: [{ id, purpose, provider, credentialField, status: \"verified\" | \"deferred\" }] }'. Named at ship time; the probe refuses when the manifest is missing or malformed."
+      "kind": "fileFormat",
+      "description": "A project-owned JSON manifest the probe reads. Shape: '{ dependencies: [{ id, purpose, provider, credentialField, status: \"verified\" | \"deferred\" }] }'. Named at ship time; the probe refuses when the manifest is missing or malformed. (legacy kind: artefact)"
     }
   ],
   "dependencies": [

package/blueprints/application-spa/contributions/tacs/tac-211-application-spa-core-flow-e2e-probe.json

@@ -22,23 +22,23 @@
   "interfaces": [
     {
       "name": "runCoreFlowE2eProbe",
-      "kind": "factory",
-      "description": "runCoreFlowE2eProbe({ manifestPath, bootServer, reportDir }) -> Promise<{ verdict, reportPath, refusals }>; the sole callable the entry point invokes. 'bootServer' is a factory returning '{ url, close }' for a server booted through the production entry-point path (same construction, same headers, same middleware). 'verdict' is 'ok' | 'deployed-with-defects'; the entry point translates 'deployed-with-defects' to a non-zero exit code."
+      "kind": "other",
+      "description": "runCoreFlowE2eProbe({ manifestPath, bootServer, reportDir }) -> Promise<{ verdict, reportPath, refusals }>; the sole callable the entry point invokes. 'bootServer' is a factory returning '{ url, close }' for a server booted through the production entry-point path (same construction, same headers, same middleware). 'verdict' is 'ok' | 'deployed-with-defects'; the entry point translates 'deployed-with-defects' to a non-zero exit code. (legacy kind: factory)"
     },
     {
       "name": "entry-point CLI",
-      "kind": "cli",
-      "description": "'node <entryPointPath>' with optional flags '--manifest <path>', '--boot <module>', '--report-dir <path>' that override configuration defaults. Exit code is 0 on 'ok', non-zero on 'deployed-with-defects'."
+      "kind": "other",
+      "description": "'node <entryPointPath>' with optional flags '--manifest <path>', '--boot <module>', '--report-dir <path>' that override configuration defaults. Exit code is 0 on 'ok', non-zero on 'deployed-with-defects'. (legacy kind: cli)"
     },
     {
       "name": "reports/core-flow-e2e-adherence.json",
-      "kind": "artefact",
-      "description": "'reports/core-flow-e2e-adherence.json' under the configured report directory. Shape: '{ verdict, flows: [{ id, entryPointRoute, verdict, steps: [{ index, action, route, status, timingMs }], terminalAssertion: { kind, expected, actual }, providerEvidence?: { messageIds }, refusals: [...] }], generatedAt }'."
+      "kind": "fileFormat",
+      "description": "'reports/core-flow-e2e-adherence.json' under the configured report directory. Shape: '{ verdict, flows: [{ id, entryPointRoute, verdict, steps: [{ index, action, route, status, timingMs }], terminalAssertion: { kind, expected, actual }, providerEvidence?: { messageIds }, refusals: [...] }], generatedAt }'. (legacy kind: artefact)"
     },
     {
       "name": "core-flow manifest (project-owned)",
-      "kind": "artefact",
-      "description": "A project-owned JSON manifest the probe reads. Shape: '{ flows: [{ id, entryPointRoute, steps: [{ action, target?, input? }], terminalAssertion: { kind, expected } }] }'. Authentication must be enumerated when the application declares any application-spa-REQ-009 surface; otherwise the manifest scanner refuses ship."
+      "kind": "fileFormat",
+      "description": "A project-owned JSON manifest the probe reads. Shape: '{ flows: [{ id, entryPointRoute, steps: [{ action, target?, input? }], terminalAssertion: { kind, expected } }] }'. Authentication must be enumerated when the application declares any application-spa-REQ-009 surface; otherwise the manifest scanner refuses ship. (legacy kind: artefact)"
     }
   ],
   "dependencies": [

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1101.json

@@ -19,7 +19,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-201-application-spa-app-shell",
-        "field": "interfaces[0].name"
+        "field": "interfaces"
       },
       "disposition": "template"
     },
@@ -53,7 +53,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-201-application-spa-app-shell",
-        "field": "interfaces[0].name"
+        "field": "interfaces"
       },
       "disposition": "fixed"
     },

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1102.json

@@ -19,7 +19,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-201-application-spa-app-shell",
-        "field": "interfaces[0].name"
+        "field": "interfaces"
       },
       "disposition": "template"
     },

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1107.json

@@ -70,7 +70,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-202-application-spa-theme-system",
-        "field": "interfaces[0].name"
+        "field": "interfaces"
       }
     }
   ],

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1117.json

@@ -19,7 +19,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-201-application-spa-app-shell",
-        "field": "interfaces[0].name"
+        "field": "interfaces"
       },
       "disposition": "template"
     },

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1129.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-207-application-spa-token-adherence-probe",
-        "field": "interfaces[2].name"
+        "field": "interfaces"
       }
     },
     {
@@ -33,7 +33,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-207-application-spa-token-adherence-probe",
-        "field": "interfaces[2].name"
+        "field": "interfaces"
       },
       "disposition": "fixed"
     },
@@ -48,7 +48,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-207-application-spa-token-adherence-probe",
-        "field": "interfaces[2].name"
+        "field": "interfaces"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-207-application-spa-token-adherence-probe",
-        "field": "interfaces[2].name"
+        "field": "interfaces"
       }
     }
   ],

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1130.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-208-application-spa-icon-adherence-probe",
-        "field": "interfaces[2].name"
+        "field": "interfaces"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-208-application-spa-icon-adherence-probe",
-        "field": "interfaces[2].name"
+        "field": "interfaces"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-208-application-spa-icon-adherence-probe",
-        "field": "interfaces[2].name"
+        "field": "interfaces"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-208-application-spa-icon-adherence-probe",
-        "field": "interfaces[2].name"
+        "field": "interfaces"
       }
     }
   ],

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1131.json

@@ -59,7 +59,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-209-application-spa-csp-styled-adherence-probe",
-        "field": "interfaces[2].name"
+        "field": "interfaces"
       },
       "disposition": "fixed"
     },

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1132.json

@@ -20,7 +20,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-210-application-spa-external-dependency-provisioning-probe",
-        "field": "interfaces[3].name"
+        "field": "interfaces"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-210-application-spa-external-dependency-provisioning-probe",
-        "field": "interfaces[3].name"
+        "field": "interfaces"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-210-application-spa-external-dependency-provisioning-probe",
-        "field": "interfaces[3].name"
+        "field": "interfaces"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-210-application-spa-external-dependency-provisioning-probe",
-        "field": "interfaces[3].name"
+        "field": "interfaces"
       }
     },
     {
@@ -75,7 +75,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-210-application-spa-external-dependency-provisioning-probe",
-        "field": "interfaces[3].name"
+        "field": "interfaces"
       },
       "disposition": "fixed"
     },
@@ -90,7 +90,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-210-application-spa-external-dependency-provisioning-probe",
-        "field": "interfaces[3].name"
+        "field": "interfaces"
       }
     }
   ],

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1133.json

@@ -20,7 +20,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-211-application-spa-core-flow-e2e-probe",
-        "field": "interfaces[3].name"
+        "field": "interfaces"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-207-application-spa-token-adherence-probe",
-        "field": "interfaces[1].name"
+        "field": "interfaces"
       }
     },
     {
@@ -58,7 +58,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-207-application-spa-token-adherence-probe",
-        "field": "interfaces[1].name"
+        "field": "interfaces"
       }
     },
     {
@@ -71,7 +71,7 @@
       "scope": "runtime",
       "ownerRef": {
         "tacId": "TAC-211-application-spa-core-flow-e2e-probe",
-        "field": "interfaces[3].name"
+        "field": "interfaces"
       },
       "disposition": "fixed"
     },
@@ -86,7 +86,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-211-application-spa-core-flow-e2e-probe",
-        "field": "interfaces[3].name"
+        "field": "interfaces"
       }
     }
   ],

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1134.json

@@ -20,7 +20,7 @@
       "disposition": "fixed",
       "ownerRef": {
         "tacId": "TAC-207-application-spa-token-adherence-probe",
-        "field": "interfaces[1].name"
+        "field": "interfaces"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-208-application-spa-icon-adherence-probe",
-        "field": "interfaces.runIconAdherenceProbe"
+        "field": "interfaces[runIconAdherenceProbe]"
       }
     }
   ],

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-001.json

@@ -5,7 +5,7 @@
   "description": "The commit-triggered workflows the materialiser produces (per REQ-014 for feature-branch and REQ-015 for trunk-based) run the required check set on every trigger event the elicited branch model defines: for feature-branch, pushes to the default branch and pull requests targeting the default branch; for trunk-based, pushes to the trunk branch (and, in the sub-shape where `trunkPullRequests: sometimes`, pull requests targeting the trunk branch). The workflows' aggregate exit status is the merge criterion: the branch protection or equivalent policy refuses to admit a change whose most recent aggregate run did not exit zero, per the merge-policy AC binding for the branch model in play (AC-6114-3, AC-6115-1, AC-6115-2). No manual override path bypasses the required check set; a hotfix that skips it requires a documented ADR trail.",
   "deliveredBy": {
     "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
-    "field": "interfaces.materialise"
+    "field": "interfaces[materialise]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-002.json

@@ -5,7 +5,7 @@
   "description": "The project realises a single Node entry point script that runs every RCF gate in order. The entry point is a plain Node process invoked by whatever runner the project's CI provider ships (GitHub Actions job step, GitLab job script, CircleCI step, Buildkite command, Jenkins stage). The CI-provider job definition contains one invocation line and the standard Node and package-manager setup steps; every gate-specific piece of logic lives in the Node entry point.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "technical",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-003.json

@@ -5,7 +5,7 @@
   "description": "The Node entry point invokes `rcf define validate` as a required gate. The gate runs with the project's tree at the pull request's head commit. A non-zero exit code from `rcf define validate` terminates the suite and marks the aggregate result as failed. The failing invocation's stdout and stderr are captured to the gate report file so the reviewer can read the specific schema or reference issue without re-running the gate.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-004.json

@@ -5,7 +5,7 @@
   "description": "The Node entry point invokes `rcf audit coverage --strict` as a required gate. The gate runs against the tree at the pull request's head commit and reports per-AC coverage: every AC on every US must resolve to a TC whose testPointer points at a real test. A non-zero exit code (mechanism exit 4 on gaps) terminates the suite and marks the aggregate result as failed. The strict-flag invocation is the sole coverage mode the suite runs; shallow-any is not accepted as a substitute.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-005.json

@@ -5,7 +5,7 @@
   "description": "Every gate the suite invokes writes a JSON report file at a stable relative path under a project-configured report directory (default `.rcf/reports/ci/`). The per-gate report file is written whether the gate passed or failed. The report file carries the gate name, the underlying CLI invocation, the exit code, the start and end ISO-8601 timestamps, the duration in milliseconds, the tool version invoked, the captured stdout and stderr strings, and (v2 addition) a `checkKind` field naming the elicited-check kind (`validate`, `coverage-strict`, `linter`, `formatter`, `typecheck`, `unitTest`, `securityScan`, or `custom:<name>`). The report file's schema is stable within a blueprint major version; v1 additive fields (the `checkKind` addition) are preserved from v1.0.0 to v2.0.0.",
   "deliveredBy": {
     "tacId": "TAC-702-delivery-ci-workflows-gate-report",
-    "field": "interfaces.writeGateReport"
+    "field": "interfaces[writeGateReport]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-006.json

@@ -5,7 +5,7 @@
   "description": "The suite writes a single aggregate JSON report at a stable path under the same report directory (default `.rcf/reports/ci/pipeline.json`). The aggregate report carries the suite's own start and end ISO-8601 timestamps, the total duration, an overall pass/fail verdict, the fixed ordered list of gates the suite ran, and for each gate an entry naming the gate, its outcome, its duration, and the relative path to the per-gate report file. The aggregate schema is stable within a blueprint major version.",
   "deliveredBy": {
     "tacId": "TAC-703-delivery-ci-workflows-aggregate-report",
-    "field": "interfaces.writeAggregateReport"
+    "field": "interfaces[writeAggregateReport]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-007.json

@@ -5,7 +5,7 @@
   "description": "When any gate in the suite fails, the Node entry point writes an operator-readable failure summary to its own stderr and to the aggregate report's `failure` field. The summary names the failing gate, the failing invocation's exit code, the first few lines of the captured stderr, and the relative path to the per-gate report file the reviewer can open for the full detail. The suite continues past a failing gate to run the remaining required gates and record their outcomes; the aggregate exit is non-zero if any gate failed.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-008.json

@@ -5,7 +5,7 @@
   "description": "The aggregate report's `gates` array lists every required gate in fixed configured order. If the suite completes without a corresponding per-gate report on disk for any required gate (a runner crash, an unhandled exception in a gate invocation, a report directory that was not writable), the aggregate report records the missing gate as `missing` with an explanatory reason, the aggregate verdict is `failed`, and the suite exits non-zero. A missing report is never treated as an implicit pass.",
   "deliveredBy": {
     "tacId": "TAC-703-delivery-ci-workflows-aggregate-report",
-    "field": "interfaces.writeAggregateReport"
+    "field": "interfaces[writeAggregateReport]"
   },
   "category": "nonFunctional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-009.json

@@ -5,7 +5,7 @@
   "description": "The blueprint's package resources include one illustrative GitHub Actions workflow file per workflow the v2 matrix materialises (`pull-request-checks.yml`, `default-branch-checks.yml`, `release.yml`, and `scheduled-audit.yml` under `assets/ci-provider-examples/github-actions/`). Each file names the required trigger set for its workflow, sets up Node and the package manager, installs dependencies, invokes the corresponding Node entry point (gate-runner for the check-set workflows, release orchestrator for the release workflow, scheduled-audit runner for the cron workflow), and uploads the report directory as a workflow artefact. The blueprint's guide names GitLab CI, CircleCI, Buildkite, and Jenkins as equally supported providers, calls out the four-point mapping (job trigger, Node setup, single-line entry-point invocation, artefact upload) applied to each workflow in the matrix, and states that the blueprint does not ship provider-specific configuration for those runners in v2.0.0; sibling asset packs (v2.1 candidate) can ship them without changing the AC contracts.",
   "deliveredBy": {
     "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
-    "field": "interfaces.materialise"
+    "field": "interfaces[materialise]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-010.json

@@ -5,7 +5,7 @@
   "description": "The Node entry point script is invocable on a developer's machine with the same command the CI provider invokes, against the same tree the developer has checked out, and produces the same per-gate reports and aggregate report at the same stable paths. A developer reproducing a CI failure runs the same one line the CI job ran; no CI-only wrapper or environment shim is on the CI code path but not the developer's.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "nonFunctional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-011.json

@@ -5,7 +5,7 @@
   "description": "The project ships a `workflowShape` declaration at the stable path `.rcf/config/delivery-ci-workflows.json` on the project tree. The declaration carries three required top-level fields (`branchModel`, `checkSet`, `providerHint`), one optional top-level field (`releaseMode`; absent has the same effect as `releaseMode: none`, per Q6-B ratification), one optional fifth field (`scheduledAudit`, default false), and one optional sub-field (`trunkPullRequests`) that qualifies `branchModel: trunk`. The four-field composed form (`branchModel`, `checkSet`, `releaseMode`, `providerHint`, with `releaseMode` defaulted to `none` when absent) is the authoritative representation the downstream workflow-materialiser (TAC-704) and every AC in this blueprint bind against; the profile-alias convenience surface (REQ-013) expands to the same composed form before any consumer reads it. The declaration is a data file, not code; the workflow-materialiser reads it once at the start of every materialisation run and refuses to proceed when the file is absent or malformed. The `providerHint` field currently accepts one shipped-asset value, `githubActions`, whose runtime clause is: the workflow-materialiser reads `githubActions` from the declaration and seeds the shipped illustrative GitHub Actions workflow files from `assets/ci-provider-examples/github-actions/` (per REQ-009 and ADR-708). Other named provider hints are elicit-accepted but do not seed provider assets in v2 (per ADR-708-delivery-ci-workflows-provider-hint-shape); AC-6113-1 binds the four-field expansion including `providerHint: githubActions`.",
   "deliveredBy": {
     "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
-    "field": "interfaces.materialise"
+    "field": "interfaces[materialise]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-012.json

@@ -5,7 +5,7 @@
   "description": "The workflow-materialiser performs a boot-check on the `workflowShape` declaration before any workflow file is produced. Any of the three required top-level fields (`branchModel`, `checkSet`, `providerHint`) being absent causes the materialiser to exit non-zero with a stable-coded error message that names the missing field. Any field (required or optional) carrying a value not in the recognised enumeration causes the same failure shape, with the message additionally naming the value it received and the allowed set. `releaseMode` being absent is NOT a failure (Q6-B ratification): the materialiser treats it as `releaseMode: none` and ships no release workflow. A `releaseMode: deployHandoff:<slug>` value additionally triggers a manifest boot-check (REQ-022) that names the required deploy blueprint if it is missing from `manifest.blueprints[]`. The boot-check runs before any workflow file is written; a partial workflow set never lands on disk.",
   "deliveredBy": {
     "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
-    "field": "interfaces.materialise"
+    "field": "interfaces[materialise]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-013.json

@@ -5,7 +5,7 @@
   "description": "The elicitation surface accepts a named profile alias (`smallLibrary`, `smallService`, `internalPackage`, `trunkLibrary`) in place of the four-field form. On boot the workflow-materialiser detects the alias, expands it to the shipped four-field composition, and treats the expanded form as authoritative for every downstream. Every AC in this blueprint binds to the four-field form only; the alias layer is a convenience surface, not an authoritative representation. An unrecognised alias name is refused at boot with a stable-coded error naming the alias and listing the shipped set. A project that wants a shape the shipped aliases do not name uses the four-field form.",
   "deliveredBy": {
     "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
-    "field": "interfaces.materialise"
+    "field": "interfaces[materialise]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-014.json

@@ -5,7 +5,7 @@
   "description": "When `workflowShape.branchModel` is `feature`, the workflow-materialiser produces two workflows sharing the same required check set: `pull-request-checks` firing on pull requests targeting the default branch, and `default-branch-checks` firing on pushes to the default branch. Both workflows invoke the same Node gate-runner entry point (TAC-701) with the required check set produced by the two-tier catalogue (mandatory tier plus the elicited subset from `checkSet`). Both workflows write their aggregate report to the stable path and preserve the ordering discipline. The blueprint contributes an AC that the project configure default-branch protection to require the `pull-request-checks` aggregate as a merge-blocking check; the configuration itself is a project responsibility on the platform's own surface.",
   "deliveredBy": {
     "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
-    "field": "interfaces.materialise"
+    "field": "interfaces[materialise]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-015.json

@@ -5,7 +5,7 @@
   "description": "When `workflowShape.branchModel` is `trunk`, the workflow-materialiser produces `default-branch-checks` as the always-on workflow firing on every push to the trunk branch. A nested `trunkPullRequests` field qualifies the shape: `never` (default) ships only `default-branch-checks`; `sometimes` additionally ships `pull-request-checks` against the same check set. The merge-policy AC states the property differently per sub-shape: without PRs, the trunk branch's push protection admits only commits whose `default-branch-checks` aggregate passed; with PRs, the trunk branch's protection admits only PRs whose `pull-request-checks` aggregate passed. Every other contract (check catalogue, report shape, ordering) is shared with the feature-branch shape.",
   "deliveredBy": {
     "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
-    "field": "interfaces.materialise"
+    "field": "interfaces[materialise]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-016.json

@@ -5,7 +5,7 @@
   "description": "The elicited `linter` check, when the project enables it in `workflowShape.checkSet.linter`, runs a lint gate that exits non-zero on any lint error the project treats as blocking. The gate writes its per-gate report to `.rcf/reports/ci/lint.json` in the shared per-gate report shape (with `checkKind: \"linter\"`). The blueprint does not pick the linter tool; the project realises the runner over the tool of its choice and satisfies the runner-contract interface the gate-runner TAC binds. Warnings that the project does not treat as blocking are reported in the per-gate report without flipping the exit code.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-017.json

@@ -5,7 +5,7 @@
   "description": "The elicited `formatter` check, when the project enables it in `workflowShape.checkSet.formatter`, runs a formatter check gate (not a formatter write) that exits non-zero when any tracked file would be rewritten by the formatter. The gate writes its per-gate report to `.rcf/reports/ci/format.json` in the shared per-gate report shape (with `checkKind: \"formatter\"`). The blueprint does not pick the formatter; the project realises the runner and satisfies the runner-contract interface.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-018.json

@@ -5,7 +5,7 @@
   "description": "The elicited `typecheck` check, when the project enables it in `workflowShape.checkSet.typecheck`, runs a typechecker gate that exits non-zero on any type error. The gate writes its per-gate report to `.rcf/reports/ci/typecheck.json` in the shared per-gate report shape (with `checkKind: \"typecheck\"`). The check is applicable only when the project uses a typed language or a TypeScript-style build; the workflow-materialiser turns the check on by default when the project tree contains a `tsconfig.json` or an equivalent tool marker, off otherwise. The project overrides the auto-detection by setting the check-set flag explicitly.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-019.json

@@ -5,7 +5,7 @@
   "description": "The elicited `unitTest` check, when the project enables it in `workflowShape.checkSet.unitTest`, runs the project unit-test suite as a gate that exits non-zero on any failing test. The gate writes its per-gate report to `.rcf/reports/ci/test.json` in the shared per-gate report shape (with `checkKind: \"unitTest\"`). The blueprint does not pick the test runner; the project realises the runner and satisfies the runner-contract interface. A missing runner (an empty test suite before the project has any tests) is recorded in the per-gate report and does not by itself fail the gate.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-020.json

@@ -5,7 +5,7 @@
   "description": "The elicited `securityScan` check, when the project enables it in `workflowShape.checkSet.securityScan`, runs a dependency-and-secret scan gate that exits non-zero when the scan finds any advisory at or above the project-configured severity threshold. The gate writes its per-gate report to `.rcf/reports/ci/security.json` in the shared per-gate report shape (with `checkKind: \"securityScan\"`). Findings below the threshold are reported in the per-gate report without flipping the exit code. The severity threshold is a project decision; the blueprint does not opine on the threshold.",
   "deliveredBy": {
     "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
-    "field": "interfaces.runGates"
+    "field": "interfaces[runGates]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-021.json

@@ -5,7 +5,7 @@
   "description": "When `workflowShape.releaseMode` is `none`, no release workflow ships. When `tagOnly`, a release workflow fires on the project-declared release trigger (a `release` event, a `workflow_dispatch`, or both) and creates a release entity on the CI provider's own release surface (a GitHub Release, a GitLab release, whatever the provider ships). When `tagPlusArtefact`, the release workflow also runs the project-realised artefact-publish step and uploads its output to the release entity; the AC contract requires the artefact-publish step to produce a verified artefact reachable at a stable identifier. When `deployHandoff:<slug>`, the release workflow additionally invokes the named deploy blueprint's promote workflow per REQ-022. The release workflow does not run the required check set; the check set already ran on the default-branch-checks workflow at the commit the release points at.",
   "deliveredBy": {
     "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
-    "field": "interfaces.runRelease"
+    "field": "interfaces[runRelease]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-022.json

@@ -5,7 +5,7 @@
   "description": "When `workflowShape.releaseMode` is `deployHandoff:<slug>`, the release workflow invokes the named deploy blueprint's `promote` workflow via that blueprint's declared invocation contract (a `workflow_dispatch` event carrying the just-published version identifier as the `versionId` input). The release workflow's aggregate outcome is `passed` only when the promote workflow's outcome is `passed`. The workflow-materialiser performs a boot-check that refuses the value when the named deploy blueprint is absent from `manifest.blueprints[]`; the error names the missing blueprint by slug and points at `rcf define blueprint add <deploy-slug>` as the resolution.",
   "deliveredBy": {
     "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
-    "field": "interfaces.runRelease"
+    "field": "interfaces[runRelease]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/requirements/delivery-ci-workflows-req-023.json

@@ -5,7 +5,7 @@
   "description": "When `workflowShape.scheduledAudit` is `true`, the workflow-materialiser produces a `scheduled-audit` workflow that fires on a cron schedule (the provider's own schedule surface) and runs the same required check set the pull-request and default-branch workflows run. When the field is `false` (default), no scheduled workflow ships. The scheduled-audit workflow writes its aggregate report to a distinct stable path (`.rcf/reports/ci/scheduled-audit.json`) so a scheduled-run outcome never overwrites the most recent commit-triggered outcome downstream readers depend on.",
   "deliveredBy": {
     "tacId": "TAC-706-delivery-ci-workflows-scheduled-audit",
-    "field": "interfaces.runScheduledAudit"
+    "field": "interfaces[runScheduledAudit]"
   },
   "category": "functional",
   "domain": "continuous-integration",

package/blueprints/delivery-ci-workflows/contributions/tacs/tac-701-delivery-ci-workflows-gate-runner.json

@@ -20,18 +20,18 @@
   "interfaces": [
     {
       "name": "runGates",
-      "kind": "factory",
-      "description": "runGates({ reportDir, gates, cwd }) -> Promise<{ verdict, exitCode, aggregateReportPath }>; the sole callable the entry point invokes. Runs every gate in `gates` order, delegates each report write, resolves with the final verdict."
+      "kind": "other",
+      "description": "runGates({ reportDir, gates, cwd }) -> Promise<{ verdict, exitCode, aggregateReportPath }>; the sole callable the entry point invokes. Runs every gate in `gates` order, delegates each report write, resolves with the final verdict. (legacy kind: factory)"
     },
     {
       "name": "gate-descriptor",
-      "kind": "value",
-      "description": "{ name: string, command: string[] } where `command[0]` is the executable (typically `rcf`) and the rest are argv. The rcf CLI groups verbs by RCF stage; the mandatory tier for v1.0.0 uses the grouped forms this TAC's responsibilities section names: `[{ name: 'validate', command: ['rcf', 'define', 'validate'] }, { name: 'coverage-strict', command: ['rcf', 'audit', 'coverage', '--strict'] }]`. A descriptor whose `command` array omits the group (`['rcf', 'validate']`, `['rcf', 'coverage', '--strict']`) does not resolve on any shipped rcf CLI and refuses at gate spawn; the gate-runner does not paper over the difference."
+      "kind": "other",
+      "description": "{ name: string, command: string[] } where `command[0]` is the executable (typically `rcf`) and the rest are argv. The rcf CLI groups verbs by RCF stage; the mandatory tier for v1.0.0 uses the grouped forms this TAC's responsibilities section names: `[{ name: 'validate', command: ['rcf', 'define', 'validate'] }, { name: 'coverage-strict', command: ['rcf', 'audit', 'coverage', '--strict'] }]`. A descriptor whose `command` array omits the group (`['rcf', 'validate']`, `['rcf', 'coverage', '--strict']`) does not resolve on any shipped rcf CLI and refuses at gate spawn; the gate-runner does not paper over the difference. (legacy kind: value)"
     },
     {
       "name": "entry-point CLI",
-      "kind": "cli",
-      "description": "`node <entryPointPath>` with no required argv. Optional flag `--report-dir <path>` overrides the default report directory. Exit code is the aggregate exit code."
+      "kind": "other",
+      "description": "`node <entryPointPath>` with no required argv. Optional flag `--report-dir <path>` overrides the default report directory. Exit code is the aggregate exit code. (legacy kind: cli)"
     }
   ],
   "dependencies": [