rcf-lite 0.29.0 → 0.31.0

package/rcf/test-suites/ts-233.json

@@ -0,0 +1,61 @@
+{
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z",
+  "purpose": "Cover US-17702 (bundle refuses and skips): the refusal on an unfrozen tree, the --override write of freeze.override, the delta-impacted skip and the all-impacted refusal; the empty-delta frozen-tree case is byte-for-byte unchanged from 0.29.0.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-17702-1",
+    "AC-17702-2",
+    "AC-17702-3",
+    "AC-17702-4",
+    "AC-17702-5"
+  ],
+  "id": "TS-233",
+  "usId": "US-17702",
+  "title": "DEFINE step 3 PR 8: rcf build bundle --next refuses, overrides and skips",
+  "testCases": [
+    {
+      "id": "TC-233-bundle-refuses-without-freeze",
+      "acId": "AC-17702-1",
+      "description": "rcf build bundle --next on an unfrozen tree exits 4 and the stderr line names rcf define readiness.",
+      "status": "pending",
+      "testPointer": "test/cli/build-bundle-next-freeze-gate.test.js::bundle --next (PR 8, AC-17702-1): refuses without a freeze record naming rcf define readiness"
+    },
+    {
+      "id": "TC-233-bundle-override-writes-freeze-override",
+      "acId": "AC-17702-2",
+      "description": "rcf build bundle --next --override \"hotfix\" on an unfrozen tree writes freeze.override { reason, by, at } through saveFreezeRecord and emits a bundle (exit 0).",
+      "status": "pending",
+      "testPointer": "test/cli/build-bundle-next-freeze-gate.test.js::bundle --next (PR 8, AC-17702-2): --override writes freeze.override and proceeds"
+    },
+    {
+      "id": "TC-233-bundle-skips-impacted-fbs",
+      "acId": "AC-17702-3",
+      "description": "On a non-empty delta impacting FBS-018, bundle --next skips FBS-018 with the reason on stderr and hands out the next unimpacted actionable FBS.",
+      "status": "pending",
+      "testPointer": "test/cli/build-bundle-next-freeze-gate.test.js::bundle --next (PR 9, AC-17702-3): skips the impacted FBS and hands out the next unimpacted FBS (exit 0)"
+    },
+    {
+      "id": "TC-233-bundle-all-impacted-refuses",
+      "acId": "AC-17702-4",
+      "description": "When every actionable FBS is impacted by the delta and no --override is given, bundle --next refuses with exit 4 and the same message pointing at --override.",
+      "status": "pending",
+      "testPointer": "test/cli/build-bundle-next-freeze-gate.test.js::bundle --next (PR 9, AC-17702-4): refuses with exit 4 when every actionable FBS is impacted and no override"
+    },
+    {
+      "id": "TC-233-bundle-empty-delta-unchanged",
+      "acId": "AC-17702-5",
+      "description": "On a frozen tree with an empty delta the bundle --next output and exit code are byte-for-byte unchanged from 0.29.0 (compared against a captured fixture).",
+      "status": "pending",
+      "testPointer": "test/cli/build-bundle-next-freeze-gate.test.js::bundle --next (PR 9, AC-17702-5): empty delta on a frozen tree matches the 0.29.0 golden bundle byte-for-byte"
+    },
+    {
+      "id": "TC-233-override-by-order",
+      "acId": "AC-17702-6",
+      "description": "freeze.override.by resolves via the git config -> GITHUB_ACTOR -> USER -> USERNAME -> operator preference order.",
+      "status": "passing",
+      "testPointer": "test/cli/build-bundle-next-freeze-gate.test.js::bundle --next (PR 9, AC-17702-6): freeze.override.by resolves via git config user.email first, then GITHUB_ACTOR, then USER/USERNAME, then operator"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-234.json

@@ -0,0 +1,53 @@
+{
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z",
+  "purpose": "Cover US-17802 (validate findings): the four new findings on an interface kind outside the vocabulary, a bracketed AC prefix outside the known classes, a tacIds naming a non-TAC and an unresolving ownerRef or deliveredBy; the dogfood tree is clean; and absence of a class marker is NOT a finding (decision 10, kept).",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-17802-1",
+    "AC-17802-2",
+    "AC-17802-3",
+    "AC-17802-4"
+  ],
+  "id": "TS-234",
+  "usId": "US-17802",
+  "title": "DEFINE step 3 PR 8: rcf define validate findings",
+  "testCases": [
+    {
+      "id": "TC-234-validate-interface-kind-finding",
+      "acId": "AC-17802-1",
+      "description": "A TAC with an interface { kind: 'widget' } fails rcf define validate with a defineValidate:interfaceKind finding naming the TAC id, the interface name and the unknown kind; the exit code is 3.",
+      "status": "pending",
+      "testPointer": "test/define/validate-findings.test.js::validate findings (PR 8, AC-17802-1): interface kind outside the vocabulary is a finding"
+    },
+    {
+      "id": "TC-234-validate-ac-class-prefix-finding",
+      "acId": "AC-17802-2",
+      "description": "An AC with description '[sometimes] ...' fails rcf define validate with a defineValidate:acClassPrefix finding naming the US id, the AC id and the unknown prefix.",
+      "status": "pending",
+      "testPointer": "test/define/validate-findings.test.js::validate findings (PR 8, AC-17802-2): bracketed AC prefix outside the known classes is a finding"
+    },
+    {
+      "id": "TC-234-validate-tacids-and-ownerref-findings",
+      "acId": "AC-17802-1",
+      "description": "A US with tacIds naming a non-TAC fires defineValidate:tacIdsResolves; an AC with ownerRef { tacId, field } that does not resolve fires defineValidate:ownerRefResolves; a REQ with deliveredBy pointing at a dangling id fires defineValidate:deliveredByResolves. Each exits 3.",
+      "status": "pending",
+      "testPointer": "test/define/validate-findings.test.js::validate findings (PR 8): tacIds, ownerRef and deliveredBy each produce a finding"
+    },
+    {
+      "id": "TC-234-validate-dogfood-clean",
+      "acId": "AC-17802-3",
+      "description": "rcf define validate on the rcf-lite dogfood tree exits 0 (no new findings; no legacy finding is widened).",
+      "status": "pending",
+      "testPointer": "test/define/validate-dogfood.test.js::validate (PR 8, AC-17802-3): dogfood tree is clean"
+    },
+    {
+      "id": "TC-234-validate-no-finding-for-missing-class",
+      "acId": "AC-17802-4",
+      "description": "An AC description with no leading bracketed prefix fires no defineValidate:acClassPrefix finding (decision 10, kept); the exit code depends on other errors only.",
+      "status": "pending",
+      "testPointer": "test/define/validate-findings.test.js::validate findings (PR 8, AC-17802-4): absence of class marker is NOT a finding"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-235.json

@@ -0,0 +1,53 @@
+{
+  "createdAt": "2026-10-03T18:30:00Z",
+  "updatedAt": "2026-10-03T18:30:00Z",
+  "purpose": "Cover US-17902 (NV-DL enforced): the five ruleset rules land with refuseByDefault:true and overrideChannel:recordedInChain; the admissibility wrap on an unfrozen tree refuses citing NV-DL-ADM-01; freeze.override satisfies the override channel; readiness compute still runs and prints under refusal.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-17902-1",
+    "AC-17902-2",
+    "AC-17902-3",
+    "AC-17902-4"
+  ],
+  "id": "TS-235",
+  "usId": "US-17902",
+  "title": "DEFINE step 3 PR 8: NV-DL-ADM-01..05 refuse by default with recordedInChain override channel",
+  "testCases": [
+    {
+      "id": "TC-235-ruleset-nvdl-shape",
+      "acId": "AC-17902-1",
+      "description": "The shipped ruleset JSON carries NV-DL-ADM-01, 02, 03, 04 and 05 under admissibilityRules; each row has refuseByDefault: true and overrideChannel: 'recordedInChain'; each has a non-empty title.",
+      "status": "pending",
+      "testPointer": "test/ruleset/ruleset-nvdl.test.js::ruleset NV-DL (PR 8, AC-17902-1): NV-DL-ADM-01..05 refuse by default with overrideChannel recordedInChain"
+    },
+    {
+      "id": "TC-235-admissibility-wrap-refuses-on-unfrozen-tree",
+      "acId": "AC-17902-2",
+      "description": "runWithAdmissibilityGate on an unfrozen tree returns a refusal citing NV-DL-ADM-01; the inner produce function is not called.",
+      "status": "pending",
+      "testPointer": "test/query/refuse-on-admissibility-nvdl.test.js::evaluateDefineStageAdmissibility (PR 9): cites ADM-02 for failing D4, ADM-03 for failing D3, ADM-04 for non-empty validate errors"
+    },
+    {
+      "id": "TC-235-admissibility-wrap-accepts-with-override",
+      "acId": "AC-17902-3",
+      "description": "runWithAdmissibilityGate on a tree whose freeze.override is set returns ok and names the override; produce is called.",
+      "status": "pending",
+      "testPointer": "test/query/refuse-on-admissibility-nvdl.test.js::runWithAdmissibilityGate (PR 9): a failing NV-BL verdict combines NV-BL rule ids with biting NV-DL rules in the refusal, and the producer does not run"
+    },
+    {
+      "id": "TC-235-readiness-compute-unchanged-under-refusal",
+      "acId": "AC-17902-4",
+      "description": "rcf define readiness on an unfrozen tree still computes and prints the readiness envelope; the admissibility refusal is informational on the compute (ADR-4123); exit code is unchanged from 0.29.0.",
+      "status": "pending",
+      "testPointer": "test/cli/readiness-nvdl-informational.test.js::readiness compute (PR 8, AC-17902-4): still runs and prints under NV-DL refusal"
+    },
+    {
+      "id": "TC-235-wrap-cites-define-stages",
+      "acId": "AC-17902-5",
+      "description": "the admissibility wrap cites NV-DL-ADM-02/03/04 when stages or validateErrors indicate a biting rule; an --ack-at-current-hash entry omits the citation.",
+      "status": "passing",
+      "testPointer": "test/query/refuse-on-admissibility-nvdl.test.js::runWithAdmissibilityGate (PR 9): a failing NV-BL verdict combines NV-BL rule ids with biting NV-DL rules in the refusal, and the producer does not run"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-236.json

@@ -0,0 +1,44 @@
+{
+  "createdAt": "2026-10-04T14:00:00Z",
+  "updatedAt": "2026-10-05T12:30:00Z",
+  "purpose": "Cover US-207 (every viewer text and control colour pair meets WCAG 2.1 AA in both themes): a static CSS-contrast audit parses `src/view/style.css`, resolves the `--sv-*` tokens for the light (`:root`) and dark (`:root[data-theme=\"dark\"]`) blocks, enumerates every rule that sets `color` paired with a reachable background, walks state variants (default, :hover, :focus, :focus-visible, :active, [aria-pressed=true], [aria-selected=true], .is-active, :disabled) and asserts the WCAG 2.1 AA thresholds (>= 4.5:1 for text, >= 3:1 for large text and non-text UI boundaries); the test exits non-zero on any failure, naming selector, state, theme, foreground, background, computed ratio and threshold. Points at test/view/contrast-aa.test.js and the BEFORE/AFTER report at ./output/contrast-report.md captured during the lane work (w-2026-10-04-dave-001). 2026-10-05 (PR 291 landing review F2, F3): state rules are merged over their base selector before pairing, border and outline colours are enumerated against the adjacent surface at 3:1, and the SearchButton and theme-control states are required to exist and pass in both themes.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-207-1",
+    "AC-207-2"
+  ],
+  "id": "TS-236",
+  "usId": "US-207",
+  "title": "WCAG 2.1 AA contrast audit across the viewer stylesheet, both themes, every state",
+  "testCases": [
+    {
+      "id": "TC-236-aa-enumerates-all-pairs",
+      "acId": "AC-207-1",
+      "description": "The audit parses `src/view/style.css`, enumerates every selector that sets `color` with every reachable background (own rule, ancestor surface token, page background `--sv-canvas`) in each state (default, :hover, :focus, :focus-visible, :active, [aria-pressed=true], [aria-selected=true], .is-active, :disabled) in both the light and dark token sets, computes the WCAG relative-luminance ratio and asserts >= 4.5:1 for normal text and >= 3:1 for large text and non-text UI boundaries (WCAG 1.4.3 and 1.4.11).",
+      "status": "pending",
+      "testPointer": "test/view/contrast-aa.test.js::enumerates every color/background pair and asserts WCAG 2.1 AA in both themes (AC-207-1)"
+    },
+    {
+      "id": "TC-236-aa-failure-message",
+      "acId": "AC-207-2",
+      "description": "When a contrast pair is below the threshold, the test failure message names the selector, state, theme, foreground colour, background colour, computed ratio and applied threshold; the test exits non-zero so the suite blocks a merge that drops below AA.",
+      "status": "pending",
+      "testPointer": "test/view/contrast-aa.test.js::failure message names selector/state/theme/fg/bg/ratio/threshold and exits non-zero (AC-207-2)"
+    },
+    {
+      "id": "TC-236-state-merge-and-boundaries",
+      "acId": "AC-207-1",
+      "description": "A state rule that changes only the background (the original `.rcf-search-btn:hover` defect) is merged over its base selector and paired with the inherited colour; `border` / `border-color` and `outline` / `outline-color` are enumerated against the adjacent surface at the 3:1 non-text threshold; run against the pre-amendment stylesheet the helper reports the dark `.rcf-search-btn:hover` failure.",
+      "status": "pending",
+      "testPointer": "test/view/contrast-aa.test.js::state rules merge over their base; borders and outlines are enumerated as 3:1 pairs (AC-207-1)"
+    },
+    {
+      "id": "TC-236-theme-btn-states",
+      "acId": "AC-207-1",
+      "description": "`.rcf-theme-btn` hover, focus-visible and active pairs exist and pass in both themes, and its focus ring clears 3:1 against the surface it sits on.",
+      "status": "pending",
+      "testPointer": "test/view/contrast-aa.test.js::.rcf-theme-btn passes WCAG 2.1 AA in both themes across hover, focus-visible and active (AC-207-1)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-17302.json

@@ -39,6 +39,41 @@
       "id": "AC-17302-6",
       "description": "[must-not] given a statement whose text contains an existing REQ title and no resolvedBy, when D2 runs in 0.30.0, then skeleton:resolvedBy does not pass it on the title hit.",
       "testable": true
+    },
+    {
+      "id": "AC-17302-7",
+      "description": "[happy] (R1 2026-10-05) given rcf define ledger brief add --id 3 --text \"foo\" --kind capability on a ledger whose entry 3 already carries kind capability and text foo, when the verb runs, then it exits 0 and stdout reads 'brief-ledger: unchanged 3' (with --json, {\"status\":\"unchanged\",\"id\":3}); the file is not rewritten.",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-8",
+      "description": "[failure] (R1 2026-10-05) given rcf define ledger brief add --id 3 --text \"bar\" --kind constraint on a ledger whose entry 3 carries kind capability and text foo, when the verb runs, then it exits 3 and stderr names the id and the differing fields (text, kind); the file is not rewritten.",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-9",
+      "description": "[happy] (R1 2026-10-05) given rcf define ledger brief add --text \"foo\" with no --id on an empty ledger, when the verb runs, then it mints id 1 as before (idempotency opt-in is id-carried; the harness threads --id back on replay).",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-10",
+      "description": "[happy] (R1 create extension 2026-10-05, PR 292 follow-up; amended on the PR 293 landing review) given rcf define create ac --parent US-1 --id AC-1-1 --description \"foo\" on a tree where US-1 already carries AC-1-1 with description foo and testable true and no other fields, when the verb runs, then it exits 0 and stdout reads 'AC-1-1: unchanged (rcf/user-stories/us-1.json)'; the parent US file is not rewritten; and given the same verb with --description \"bar\" instead, it exits 3, stderr names the id and the differing field (description), and the file is not rewritten. rcf define create has no --json flag; the stdout line is the whole output (suppressed by --quiet).",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-11",
+      "description": "[happy] (R1 create extension, PR 293 landing review) given rcf define create tc --parent TS-1 --id TC-1-foo --ac AC-1-1 --description \"foo\" --test-pointer t.test.js::foo on a tree where TS-1 already carries TC-1-foo with the same acId, description, testPointer and status pending, when the verb runs, then it exits 0 and stdout reads 'TC-1-foo: unchanged (rcf/test-suites/ts-1.json)' and the file is not rewritten; given the same verb with --description \"bar\", it exits 3 naming the id and the differing field (description) and the file is not rewritten. Idempotency is id-carried: without --id, a derived-slug collision still refuses with exit 2 and the 'supply --slug explicitly' message.",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-12",
+      "description": "[happy] (R1 create extension, PR 293 landing review) given rcf define create cn --id CN-1 --path src/a.js --acs AC-1-1 on a tree where CN-1 already carries path src/a.js, implementsAcIds [AC-1-1], dependencies [], version 0.1.0 and status draft, when the verb runs, then it exits 0 and stdout reads 'CN-1: unchanged (rcf/code-nodes/cn-1.json)' and the file is not rewritten; given the same verb with --path src/b.js, it exits 3 naming the id and the differing field (path) and the file is not rewritten.",
+      "testable": true
+    },
+    {
+      "id": "AC-17302-13",
+      "description": "[happy] (R1 create extension, PR 293 landing review) given rcf define create req --parent PRD-001 --id REQ-050 --title T --description D whose first run persisted a classifier-owned shapeClassification block, when the identical command is replayed, then it exits 0 and stdout reads 'REQ-050: unchanged (rcf/requirements/req-050.json)' and the file is not rewritten: the replay compare ignores every writer- and classifier-owned field (createdAt, updatedAt, shapeClassification; one exported REPLAY_IGNORE_FIELDS list in src/core/store/writer.js); given the same verb with a different --description, it exits 3 naming description and the file is not rewritten.",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -46,5 +81,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-02T16:40:00Z",
-  "updatedAt": "2026-10-02T16:40:00Z"
+  "updatedAt": "2026-10-05T19:00:00Z"
 }

package/rcf/user-stories/us-17401.json

@@ -59,6 +59,16 @@
       "id": "AC-17401-10",
       "description": "src/setup/identity-seed.js IDENTITY_TEMPLATE seeds a '## Surface' section containing one line that is one of 'viewer' | 'runningApp' | 'prDiff' (default 'prDiff' with explanatory text matching the Register section's style) so that a project immediately after 'rcf init' passes checkD1Brief's profile:surface check without further operator action. The seed stays idempotent (an existing profile.md is left byte-identical, per the slice-1 'kept' contract).",
       "testable": true
+    },
+    {
+      "id": "AC-17401-11",
+      "description": "[happy] (R13 2026-10-05) given a D5 scope narrowed so no REQ is in scope but the tree has an auth or httpApi REQ and TAD.securityArchitecture is empty, when D5 runs, then crosscut:securityArchitecture still fails TAD.securityArchitecture and the stage state is failing (not notApplicable) through the shared tree-wide-before-scope helper (ADR-4138 extended).",
+      "testable": true
+    },
+    {
+      "id": "AC-17401-12",
+      "description": "[happy] (R13 2026-10-05) given a D5 scope narrowed so no REQ is in scope but the tree carries a US with an AC description that contains the '[deployed]' marker and TAD.operationalConcerns is empty, when D5 runs, then crosscut:operationalConcerns still fails TAD.operationalConcerns and the stage state is failing (not notApplicable) through the shared tree-wide-before-scope helper (ADR-4138 extended).",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -66,5 +76,5 @@
   ],
   "tags": [],
   "createdAt": "2026-09-24T14:30:00Z",
-  "updatedAt": "2026-10-01T13:03:38Z"
+  "updatedAt": "2026-10-05T18:00:00Z"
 }

package/rcf/user-stories/us-17402.json

@@ -44,6 +44,11 @@
       "id": "AC-17402-7",
       "description": "[failure] Given a notApplicable stage, when readiness is computed, then its stage:<D>:scope placeholder check carries the stage's STAGE_FALLBACK_PERSONA and ok true.",
       "testable": true
+    },
+    {
+      "id": "AC-17402-8",
+      "description": "[happy] (R13 2026-10-05) given a D2 scope narrowed so no REQ, PRD, TAD or resolving brief statement is in scope but the tree has zero Deploy target or Deploy deferral ADRs (or two or more), when D2 runs, then skeleton:deployAdr still fails ADR:deploy and the stage state is failing (not notApplicable) through the shared tree-wide-before-scope helper (ADR-4138 extended).",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -51,5 +56,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-01T14:30:00Z",
-  "updatedAt": "2026-10-01T14:30:00Z"
+  "updatedAt": "2026-10-05T18:00:00Z"
 }

package/rcf/user-stories/us-17403.json

@@ -49,6 +49,16 @@
       "id": "AC-17403-8",
       "description": "[must-not] Given any tree, when D2 or D7 runs, then no check named skeleton:reqFields is emitted and the stage envelope shape (stage, gate, state, checks) is unchanged.",
       "testable": true
+    },
+    {
+      "id": "AC-17403-9",
+      "description": "[happy] (R2 2026-10-05) given a D3 scope that excludes every TAC and shaped REQ (no TAC, no httpApi/persistence/auth REQ in scope) but a [draft] marker exists on a TAC OUTSIDE the narrowed scope, when D3 runs, then shapes:draftSettled still fails the <tacId>:<name> finding and the stage state is failing (not notApplicable) through the shared tree-wide-before-scope helper (ADR-4138); the same test asserted against pre-R2 gates.js (origin/main d8adedff^) returns notApplicable instead.",
+      "testable": true
+    },
+    {
+      "id": "AC-17403-10",
+      "description": "[happy] (PR 292 follow-up 2026-10-05) given a scope-empty D3 with a failing shapes:draftSettled tree-wide, when the failing envelope the ADR-4138 helper returns is rendered by src/cli/readiness.js, then the printed D3 line reads 'D3 (define.shapes): failing' without the pre-R13 '(no TAC ... in scope)' notApplicable reason trailer; the envelope omits the reason field (foldState delegation inside the helper carries no reason text).",
+      "testable": true
     }
   ],
   "tacIds": [
@@ -56,5 +66,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-01T14:30:00Z",
-  "updatedAt": "2026-10-01T14:30:00Z"
+  "updatedAt": "2026-10-05T18:00:00Z"
 }

package/rcf/user-stories/us-17404.json

@@ -0,0 +1,66 @@
+{
+  "usId": "US-17404",
+  "prdId": "PRD-001",
+  "reqId": "REQ-174",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "D3 bites",
+  "description": "User story under REQ-174 for DEFINE step 3 PR 5 (ADR-4131). D3 gets the three bite checks the spec section 4 names (shapes:templateMarkers, shapes:entityJoin, shapes:pathsResolve), stagePolicy exposes an ackable(stage) that is true for D3, D5 and D6, and the readiness CLI --check shapes exits 4 on an unacknowledged D3 failure and 0 when acked at the current hash. D5 and D6 bites land in PRs 6 and 7.",
+  "asA": "an engineer",
+  "iWant": "D3 to run the substantive template, entity-join and path-resolution checks under --check with the same recorded-override channel D3, D5 and D6 share",
+  "soThat": "a draft shape that is missing its markers, an unjoined entity or a dangling path blocks the gate until I either fix the tree or acknowledge it at the current hash",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17404-1",
+      "description": "[happy] given a recordShape with fields: and an httpRoute with method, path, request, response and errors, when D3 runs, then shapes:templateMarkers passes both.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-2",
+      "description": "[failure] given an httpRoute missing errors, when D3 runs, then shapes:templateMarkers fails <tacId>:<name> with \"missing marker errors\".",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-3",
+      "description": "[happy] given every coreEntity named by exactly one recordShape, when D3 runs, then shapes:entityJoin passes; given one named twice, then it fails TAD.entity:<name> with \"2 record shapes\".",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-4",
+      "description": "[happy] given an interface naming a path that exists in resolvedPaths, when D3 runs, then shapes:pathsResolve passes it; given a missing path marked authoredAt: D3, then it passes it.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-5",
+      "description": "[failure] given rcf define readiness --check shapes on an unacknowledged D3 failure, when it runs, then it exits 4; acknowledged at the current hash, it exits 0.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-6",
+      "description": "[must-not] given --ack on D1, D2, D4, D7 or D8, when freeze runs, then it exits 2 unchanged from 0.29.0.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-7",
+      "description": "[happy] (R5 2026-10-05) given a D3 scope narrowed so no recordShape is in scope but a coreEntity has no record shape anywhere tree-wide, when D3 runs, then shapes:entityJoin fails TAD.entity:<name> and the stage state is failing (not notApplicable); the shared tree-wide-before-scope helper (ADR-4138) governs the ordering.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-8",
+      "description": "[happy] (R6 2026-10-05) given an interface description with path: Dockerfile and no entry for Dockerfile in resolvedPaths, when D3 runs, then shapes:pathsResolve fails it; given resolvedPaths contains Dockerfile, then it passes. The whitelist exported from gates.js names Dockerfile, Makefile, LICENSE, Procfile, Containerfile, Justfile, Rakefile, Gemfile and CODEOWNERS; a bare word outside the list (foo) still skips as before.",
+      "testable": true
+    },
+    {
+      "id": "AC-17404-9",
+      "description": "[happy] (PR 292 follow-up 2026-10-05) given treeWideFailureEnvelope invoked on a scope-empty stage with every tree-wide check passing, when the helper runs, then it returns null (the stage proceeds to its own notApplicable envelope); given at least one failing tree-wide check on an ackable stage (D3) with a freeze.gates acknowledgement whose at.hash equals the currentTreeHash, then the helper returns an envelope with state 'acknowledged' through foldState delegation (the helper does not re-implement ack-at-current-hash); given the same shape on D2 (blocking), then the helper never folds to acknowledged.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4122-define-gates",
+    "TAC-4123-define-readiness"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T10:50:00Z",
+  "updatedAt": "2026-10-05T18:00:00Z"
+}

package/rcf/user-stories/us-17405.json

@@ -0,0 +1,66 @@
+{
+  "usId": "US-17405",
+  "prdId": "PRD-001",
+  "reqId": "REQ-174",
+  "version": "0.1.1",
+  "status": "draft",
+  "title": "D4, D5 and D2 bite",
+  "description": "User story under REQ-174 for DEFINE step 3 PR 6 (spec section 4 rows for D4, D5 and standards citation). D4 reports closed-set and ownerRef resolution as findings (stories:closedSets, stories:ownerRefResolves). D5 ships the concern catalogue module and the crosscut:catalogue check that enumerates applicable (reqShape, concern) pairs per in-scope REQ against the concern ledger. D2 ships skeleton:standardsCited that fails any registered standards pack that is neither cited in a REQ rationale or an ADR nor waived by a concern-ledger entry with key standards:<pack>. D5 is ackable: --check crosscut rides the same --ack fold as D3, exits 4 on an unacknowledged D5 failure at the current hash and 0 when acked at the current hash. Validate adds no finding for a missing AC class marker (decision 10 kept; the validate finding rows land in PR 8).",
+  "asA": "an engineer",
+  "iWant": "D4 to flag enumeration cues without a closed set, D5 to drive the eight-concern catalogue against the concern ledger for every REQ in scope, D2 to insist every registered standards pack is cited or waived, and --check crosscut to honour the recorded override at the current hash",
+  "soThat": "an AC that invites unlisted values, an unresolved ownerRef, a REQ that forgot a crosscut concern or a registered standards pack that no document cites blocks the gate until the tree is fixed or the gate is acknowledged",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17405-1",
+      "description": "[failure] given an AC \"status is one of the following\" with no bracketed list and no ownerRef, when D4 runs, then stories:closedSets fails it.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-2",
+      "description": "[happy] given an ownerRef { tacId, field: \"interfaces[loan]\" } resolving on that TAC, when D4 runs, then stories:ownerRefResolves passes; given interfaces[missing], then it fails with \"ownerRef does not resolve\". (PR 9 R11: ownerRef resolves on any existing field path, bracket grammar -- interfaces[<name>], responsibilities[<n>], dependencies[<name>], alternativesConsidered[<n>] -- or a bare schema field name -- purpose, decision, internalStructure, etc.; interfaces[loan] still resolves, interfaces[missing] still fails.)",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-3",
+      "description": "[happy] given a persistence REQ with retention applied and timeAndTimezone waived with a reason, when D5 runs, then crosscut:catalogue passes it.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-4",
+      "description": "[failure] given an httpApi REQ with no errorEnvelope entry, when D5 runs, then crosscut:catalogue fails <REQ>:errorEnvelope.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-5",
+      "description": "[happy] (R8 2026-10-05) given a registered standards pack cited in an ADR, when D2 runs, then skeleton:standardsCited passes; uncited and unwaived, it fails standards:<pack>; given a concern-ledger entry concern 'standards:<pack>' with disposition 'applied' or 'waived', it passes (the check question reads 'cited, applied or waived').",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-6",
+      "description": "[must-not] given a story with no class marker on any AC, when rcf define validate runs, then no finding is raised for the missing marker.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-7",
+      "description": "[happy] (PR 9 R11) given an ownerRef { tacId, field: \"responsibilities[0]\" } naming an existing responsibility index on that TAC, when D4 runs, then stories:ownerRefResolves passes; a bare field name (purpose, internalStructure, decision) resolves when the owning doc carries a non-empty value under that key.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-8",
+      "description": "[must-not] (PR 9 R11) given an ownerRef whose field uses dotted grammar (interfaces.loan, responsibilities.audit), when D4 or rcf define validate runs, then it fails with the finding naming the dotted field so the author can rewrite to bracket grammar.",
+      "testable": true
+    },
+    {
+      "id": "AC-17405-9",
+      "description": "[happy] (R7 2026-10-05) given a D2 scope narrowed so no REQ, PRD, TAD or brief statement is in scope but a registered standards pack is neither cited nor waived tree-wide, when D2 runs, then skeleton:standardsCited fails standards:<pack> and the stage state is failing (not notApplicable); the shared tree-wide-before-scope helper (ADR-4138) governs the ordering.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4122-define-gates",
+    "TAC-4121-define-ledgers"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T13:30:00Z",
+  "updatedAt": "2026-10-05T12:00:00Z"
+}

package/rcf/user-stories/us-17406.json

@@ -0,0 +1,51 @@
+{
+  "usId": "US-17406",
+  "prdId": "PRD-001",
+  "reqId": "REQ-174",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "D6 bites",
+  "description": "User story under REQ-174 for DEFINE step 3 PR 7 (spec section 4 row 'D6 scans and the injectable probe runner'). D6 gets the four mechanical consistency scans the spec section 11.5 names: consistency:contradictions (two ACs on one story sharing a when clause with a negated then), consistency:unsatisfiable (a then naming a field no recordShape defines; a field defined in a [draft] recordShape counts as defined), consistency:duplicates (identical descriptions across stories, both fail), consistency:orphanInterfaces (no AC ownerRef and no REQ deliveredBy reaches it). D6 is already ackable per PR 5; flipping D6 into the biting set in src/cli/readiness.js is this PR's one-line change. Named false-positive guards: a negation inside a double-quoted substring in a then does not fire contradictions; a field defined in a [draft] recordShape counts as defined for unsatisfiable.",
+  "asA": "an engineer",
+  "iWant": "D6 to run the four substantive consistency scans and --check consistency to honour the recorded override at the current hash",
+  "soThat": "two ACs on one story that contradict each other, a then that names an undefined field, duplicate descriptions across stories or an orphaned interface block the gate until the tree is fixed or the gate is acknowledged",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17406-1",
+      "description": "[failure] given two ACs on one story with the same when clause and a negated then, when D6 runs, then consistency:contradictions fails the story naming both ACs.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-2",
+      "description": "[failure] given a then naming a field no recordShape defines, when D6 runs, then consistency:unsatisfiable fails the AC.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-3",
+      "description": "[happy] given the field defined in a [draft] recordShape, when D6 runs, then consistency:unsatisfiable passes the AC.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-4",
+      "description": "[failure] given identical AC descriptions on two stories, when D6 runs, then consistency:duplicates fails both.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-5",
+      "description": "[failure] given an interface no ownerRef and no deliveredBy reaches, when D6 runs, then consistency:orphanInterfaces fails it.",
+      "testable": true
+    },
+    {
+      "id": "AC-17406-6",
+      "description": "[must-not] given a negation inside a quoted string in a then, when D6 runs, then consistency:contradictions does not fail the story on it.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4122-define-gates",
+    "TAC-4123-define-readiness"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}

package/rcf/user-stories/us-17503.json

@@ -32,7 +32,7 @@
     },
     {
       "id": "AC-17503-5",
-      "description": "[happy] Given --check all on the same tree, when the verb runs, then it exits 0, unchanged from 0.28.4.",
+      "description": "[happy] Given --check all on a tree with an unacknowledged D3 bite failure, when the verb runs, then it exits 4 (ADR-4131 bite); given --check all on a tree where only D5 or D6 fail without an ack, then it exits 0 with a stderr [warn] line (warn-with-ack posture preserved until PRs 6 and 7). (Amended by DEFINE step 3 PR 5 under ADR-4131; superseded prior wording: 'exits 0, unchanged from 0.28.4'.)",
       "testable": true
     },
     {
@@ -61,5 +61,5 @@
   ],
   "tags": [],
   "createdAt": "2026-10-01T16:00:00Z",
-  "updatedAt": "2026-10-01T16:00:00Z"
+  "updatedAt": "2026-10-03T12:10:00Z"
 }

package/rcf/user-stories/us-17504.json

@@ -0,0 +1,46 @@
+{
+  "usId": "US-17504",
+  "prdId": "PRD-001",
+  "reqId": "REQ-175",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "probe seam and litmus",
+  "description": "User story under REQ-175 for DEFINE step 3 PR 7 (spec section 4 row 'D6 scans and the injectable probe runner' and section 11.6). computeReadiness(tree, { probeRunner }) accepts an injectable runner where probeRunner = ({ reqId, tree }) => findings[], default null; injected findings land as probe-ledger entries in the result and count toward consistency:probeCount. src/define/probe-runner.js is added as the seam only; no shipped runner (no LLM in rcf-lite; the harness is the runner through ledger probes add). With no probeRunner the result equals the 0.29.0 result on the same fixture. --litmus <n> on readiness and freeze requires at least n distinct litmus readings at the current LITMUS HASH, read from probe-ledger entries with finding beginning litmus:<reader>: and a hash matching tree.litmusHash; one reader exits 4 naming the shortfall. The litmus hash is the tree hash computed with the probes ledger excluded (ADR-4131 extended R9, w-2026-10-03-dave-011): the probes ledger is inside tree.currentTreeHash by ADR-4120, so a reader writing a probe-ledger entry that referenced currentTreeHash would shift the hash it just attested to; the litmus hash is the content-stable hash readers pin to so n readers can land their entries at the same hash. Writes to the brief, decisions or concerns ledgers do shift the litmus hash the same way they shift currentTreeHash. Trade-off: litmus readings do not attest to probe findings written after them, which is acceptable because probe entries are themselves readings. --litmus-attested remains the default attestation path. No process is spawned and no network call is made at runtime; the harness is the runner.",
+  "asA": "an engineer",
+  "iWant": "an injectable probeRunner seam on computeReadiness and a --litmus <n> flag on readiness and freeze that counts recorded litmus probe entries at the current litmus hash (the tree hash excluding the probes ledger)",
+  "soThat": "the harness can land fresh-context readings through the probe ledger and rcf-lite exits 4 until n distinct readers have attested at the current hash, without rcf-lite itself calling an LLM or spawning a process",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-17504-1",
+      "description": "[happy] given a probeRunner returning two findings for REQ-003, when computeReadiness runs, then both appear as open probe entries in the result and consistency:probeCount fails.",
+      "testable": true
+    },
+    {
+      "id": "AC-17504-2",
+      "description": "[happy] given no probeRunner, when computeReadiness runs, then the result equals the 0.29.0 result on the same fixture.",
+      "testable": true
+    },
+    {
+      "id": "AC-17504-3",
+      "description": "[happy] given two probe entries litmus:<reader>: at the current litmus hash (the tree hash excluding the probes ledger) from distinct readers, when readiness --litmus 2 runs, then it passes the litmus requirement.",
+      "testable": true
+    },
+    {
+      "id": "AC-17504-4",
+      "description": "[failure] given one reader at the current litmus hash (the tree hash excluding the probes ledger), when readiness --litmus 2 runs, then it exits 4 naming the shortfall.",
+      "testable": true
+    },
+    {
+      "id": "AC-17504-5",
+      "description": "[must-not] given --litmus, when readiness runs, then no process is spawned and no network call is made.",
+      "testable": true
+    }
+  ],
+  "tacIds": [
+    "TAC-4123-define-readiness",
+    "TAC-4128-define-guidance"
+  ],
+  "tags": [],
+  "createdAt": "2026-10-03T16:10:00Z",
+  "updatedAt": "2026-10-03T16:10:00Z"
+}