rcf-lite 0.32.0 → 0.32.1

package/CHANGELOG.md

@@ -6,6 +6,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.32.1] - 2026-10-06
+
+0.32.1 ships two fixes merged since 0.32.0 (merge b6292f5) on top of the layout baseline chore. The viewer's Readiness tab now agrees with the CLI on D3 shapes:pathsResolve, and the D5 crosscut:operationalConcerns trigger reads the structured ac.scope field in addition to the legacy "[deployed]" marker. breaking: false; no behavioural changes on verbs consumers run in CI; fixes only. minAgentAction: null; the managed agent-instructions block hash did not move.
+
+### Fixed
+
+- **Viewer Readiness tab D3 shapes:pathsResolve now agrees with the CLI (issue 307, w-2026-10-06-dave-026).** The viewer's render path (`src/view/index.js` `renderModelToPage`) called `computeReadiness` without the `resolvedPaths` pre-walk, so D3 shapes:pathsResolve false-failed on TAC interface `path:` tokens that resolve on disk and the Readiness tab disagreed with the CLI and freeze. Hit on ai-baseline define/kickoff: CLI reported D3 4/4 passing while the viewer tab showed D3 shapes:pathsResolve failing on four TAC interface paths. Fix: thread `resolvedPaths` through the viewer compute via the same `resolveInterfacePaths` seam the CLI (PR 304, issue 302) and freeze use. The viewer compute now runs the resolve walk against `projectRoot` before `computeReadiness` and passes the resulting `resolvedPaths` set to the compute. The pure gate reads it unchanged. Additive: `renderModelToPage` also returns the computed readiness so a regression test can assert the viewer's check state without parsing HTML. Regression test in `test/view/readiness-paths-resolve-307.test.js` seeds a TAC interface whose `path:` token points at a real file and asserts the viewer compute reports D3 ok; the negative control flips the path to a missing file and asserts D3 fails with the shapes:pathsResolve finding.
+
+- **D5 crosscut:operationalConcerns trigger reads structured `ac.scope` (issue 306, w-2026-10-06-dave-031).** `computeOperationalConcernsCheck` in `src/query/gates.js` looked only for a literal `[deployed]` marker in AC description text, so trees that carry scope as the schema-canonical field `scope: "deployed"` (like ai-baseline, with 23 deployed-scope ACs and `TAD.operationalConcerns` absent) silently passed 0/0 and the gate never fired. Fix: the trigger now also reads `ac.scope === "deployed"`; a deployed-scope AC on either form must find a non-empty `TAD.operationalConcerns`. Legacy `[deployed]` markers are unchanged. Regression fixtures in `test/query/gates.test.js` cover the ai-baseline shape (structured `ac.scope` with empty `operationalConcerns` fails) and a negative control (non-deployed-scope ACs with empty `operationalConcerns` pass).
+
 ## [0.32.0] - 2026-10-06
 
 0.32.0 ships four readiness and viewer fixes merged since 0.31.0 (merge ec9464db) as one release. D6 consistency:orphanInterfaces now accepts the schema-canonical object-shape REQ.deliveredBy (issue 301), D3 shapes:pathsResolve inside rcf define freeze pre-resolves TAC interface path tokens the way readiness does (issue 302), the deploy-cloudflare-workers blueprint reworded AC-12113-2 so D6 consistency:unsatisfiable stops reading "absent" as a field name (PR 300), the viewer's SSE tree-update resync preserves the active tab for every main tab including Readiness (issue 297), and the audit view header keeps the tabs visible under long project names and prefers prd.productName (issue 295). minAgentAction: null; the managed agent-instructions block hash did not move.

package/blueprints/delivery-ci-workflows/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- adds ownerRef on AC-6102-1 (interfaces[entry-point CLI]), AC-6103-1 (interfaces[gate-descriptor]), AC-6108-1 (interfaces[aggregate-report-schema]), AC-6111-1 (interfaces[entry-point CLI]), AC-6111-2 (interfaces[workflow-shape]), AC-6121-2 (interfaces[release-mode]), AC-6122-1 (interfaces[entry-point CLI]) and AC-6123-1 (interfaces[entry-point CLI]) so TAC-701 gate-descriptor and entry-point CLI, TAC-703 aggregate-report-schema, TAC-704 workflow-shape and entry-point CLI, TAC-705 release-mode and entry-point CLI, and TAC-706 entry-point CLI have delivering AC owners (D6 consistency:orphanInterfaces).
+
+
 ## 2.3.5 - 2026-09-11
 
 probe-utils.writeReport no longer promotes an all-accountBoundSkipped row set to PASS via a separate override; aggregate() already returns PASS for a pure-skip set on its own and returns WARN when any WARN row is present, so an all-skipped array carrying a WARN row is no longer silently promoted. Anatomy suite tracks the strengthened shared helper.

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6102.json

@@ -17,7 +17,11 @@
       "then": "the aggregate report's `runner.entryPoint` field records a project-relative path to a `.js` or `.mjs` file that exists at that path in the tree",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed"
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+        "field": "interfaces[entry-point CLI]"
+      }
     },
     {
       "id": "AC-6102-2",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6103.json

@@ -17,7 +17,11 @@
       "then": "the file exists, its `gate` field is `validate`, its `command` field names the `rcf define validate` invocation, its `exitCode` field records the underlying process exit code, and its `stdout` and `stderr` fields carry the captured streams",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-701-delivery-ci-workflows-gate-runner",
+        "field": "interfaces[gate-descriptor]"
+      }
     },
     {
       "id": "AC-6103-2",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6108.json

@@ -17,7 +17,11 @@
       "then": "the aggregate report's `gates[]` array contains a `coverage-strict` entry with `outcome: missing`, its `reason` field carries a non-empty string, and the aggregate `verdict` is `failed`",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-703-delivery-ci-workflows-aggregate-report",
+        "field": "interfaces[aggregate-report-schema]"
+      }
     },
     {
       "id": "AC-6108-2",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6111.json

@@ -17,7 +17,11 @@
       "then": "the materialiser reads the file at the documented path and treats its `workflowShape` as authoritative",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "interfaces[entry-point CLI]"
+      }
     },
     {
       "id": "AC-6111-2",
@@ -27,7 +31,11 @@
       "then": "the materialiser processes the recognised fields (including the substitution-surface trio) and ignores the unknown fields without failing the boot-check",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-704-delivery-ci-workflows-workflow-materialiser",
+        "field": "interfaces[workflow-shape]"
+      }
     },
     {
       "id": "AC-6111-3",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6121.json

@@ -27,7 +27,11 @@
       "then": "the release workflow creates the release entity, runs the artefact-publish step, uploads the published artefact to the release entity, and records the just-published version identifier in the aggregate report",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
+        "field": "interfaces[release-mode]"
+      }
     },
     {
       "id": "AC-6121-3",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6122.json

@@ -17,7 +17,11 @@
       "then": "the release workflow dispatches the promote workflow with `versionId` set to the just-published version identifier and waits on the promote workflow's outcome",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-705-delivery-ci-workflows-release-workflow",
+        "field": "interfaces[entry-point CLI]"
+      }
     },
     {
       "id": "AC-6122-2",

package/blueprints/delivery-ci-workflows/contributions/user-stories/delivery-ci-workflows-us-6123.json

@@ -17,7 +17,11 @@
       "then": "a `scheduled-audit` workflow file lands at the provider's workflow path, its trigger set names a cron schedule, and its command line invokes the Node gate-runner entry point with the required check set writing to the distinct report path",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-706-delivery-ci-workflows-scheduled-audit",
+        "field": "interfaces[entry-point CLI]"
+      }
     },
     {
       "id": "AC-6123-2",

package/blueprints/deploy-cloudflare-workers/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- adds ownerRef on AC-12103-1 (interfaces[workerIdentity]) and AC-12110-1 (interfaces[probeUrl]) so the preview URL resolver's workerIdentity and probeUrl interfaces have delivering AC owners (D6 consistency:orphanInterfaces).
+
+
 ## 1.3.2 (register patch, 2026-09-10)
 
 - Register: neutral wording on the ADR-1306 consequences field (closes F-1); no capability change.

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12103.json

@@ -17,7 +17,11 @@
       "then": "both responses carry the `versionSha` field of V's build provenance in the health-probe body, and the two responses agree on that field",
       "testable": true,
       "scope": "deployed",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1303-deploy-cloudflare-workers-preview-url-resolver",
+        "field": "interfaces[workerIdentity]"
+      }
     },
     {
       "id": "AC-12103-2",

package/blueprints/deploy-cloudflare-workers/contributions/user-stories/deploy-cloudflare-workers-us-12110.json

@@ -17,7 +17,11 @@
       "then": "at least one HTTP request to the production URL's `/healthz` completes within the sixty-second window; the request carries no `Authorization` header that would bypass a production auth layer; the retry count for any single probe does not exceed six",
       "testable": true,
       "scope": "deployed",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1303-deploy-cloudflare-workers-preview-url-resolver",
+        "field": "interfaces[probeUrl]"
+      }
     },
     {
       "id": "AC-12110-2",

package/blueprints/email-smtp-resend/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- adds ownerRef on AC-4106-1 (interfaces[smtpClient]), AC-4104-2 (interfaces[auditSink]) and AC-4105-1 (interfaces[verifierClock]) so TAC-401 smtpClient and TAC-402 auditSink and verifierClock have delivering AC owners (D6 consistency:orphanInterfaces).
+
+
 ## 1.1.7 - 2026-09-11
 
 unverified-sender-refusal AC-4102-1 and AC-4102-2 rows are de-claimed to conformanceOnly. The refusal is driven by the local catch-all SMTP fixture (fixture-as-engine) and carries no Resend-returned message id, so the identifier half of the strict-evidence contract is not satisfied here. The live real-account-resend-send row (AC-4101-2) is unchanged.

package/blueprints/email-smtp-resend/contributions/user-stories/email-smtp-resend-us-4104.json

@@ -27,7 +27,11 @@
       "then": "the response status is 401, the response body is empty, the handler invocation counter is unchanged, and the audit sink observes exactly one `webhookVerificationFailed` event",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed"
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
+        "field": "interfaces[auditSink]"
+      }
     },
     {
       "id": "AC-4104-3",

package/blueprints/email-smtp-resend/contributions/user-stories/email-smtp-resend-us-4105.json

@@ -17,7 +17,11 @@
       "then": "the response status is 401, the response body is empty, the handler invocation counter is unchanged, and the audit sink observes exactly one `webhookReplayStale` event",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
+        "field": "interfaces[verifierClock]"
+      }
     },
     {
       "id": "AC-4105-2",

package/blueprints/email-smtp-resend/contributions/user-stories/email-smtp-resend-us-4106.json

@@ -17,7 +17,11 @@
       "then": "the scan returns exactly one module and that module is the adapter module",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed"
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-401-email-smtp-resend-send-adapter",
+        "field": "interfaces[smtpClient]"
+      }
     },
     {
       "id": "AC-4106-2",

package/blueprints/observability-probe-endpoints/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## Unreleased
+
+- adds ownerRef on AC-14104-1 (interfaces[listenerFactory]) so the listener-topology's listenerFactory interface has a delivering AC owner (D6 consistency:orphanInterfaces).
+
+
 ## 1.2.5 - 2026-09-11
 
 Anatomy suite tracks the strengthened shared helper (WARN-only shortcut removed, log objects and content lists no longer identifiers, retained anchor existence check). No probe changes required.

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14104.json

@@ -17,7 +17,11 @@
       "then": "a GET against `/live` on port 9091 returns 200, a GET against `/live` on the user-traffic port returns 404 (or the project's default not-found response), and a GET against `/ready` on the user-traffic port returns 404",
       "testable": true,
       "scope": "runtime",
-      "disposition": "template"
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1503-observability-probe-endpoints-listener-topology",
+        "field": "interfaces[listenerFactory]"
+      }
     },
     {
       "id": "AC-14104-2",

package/fixtures/canary-manifest.json

@@ -2,8 +2,8 @@
   "registerCanary": [
     {
       "id": "rc-2026-10-06-001",
-      "createdAt": "2026-10-06T16:00:03.482Z",
-      "buildVersion": "0.32.0-mockdriver",
+      "createdAt": "2026-10-06T18:28:43.472Z",
+      "buildVersion": "0.32.1-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -35,8 +35,8 @@
     },
     {
       "id": "rc-2026-10-06-002",
-      "createdAt": "2026-10-06T16:00:03.483Z",
-      "buildVersion": "0.32.0-mockdriver",
+      "createdAt": "2026-10-06T18:28:43.473Z",
+      "buildVersion": "0.32.1-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -68,8 +68,8 @@
     },
     {
       "id": "rc-2026-10-06-003",
-      "createdAt": "2026-10-06T16:00:03.483Z",
-      "buildVersion": "0.32.0-mockdriver",
+      "createdAt": "2026-10-06T18:28:43.473Z",
+      "buildVersion": "0.32.1-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.32.0",
+  "version": "0.32.1",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",

package/releases/releases.yaml

@@ -40,8 +40,16 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.32.0"
+latest: "0.32.1"
 releases:
+  - version: "0.32.1"
+    date: "2026-10-06"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.32.1 fixes two readiness gates that false-paired under schema-canonical content on top of 0.32.0. The viewer's Readiness tab D3 shapes:pathsResolve now agrees with the CLI by pre-resolving TAC interface path tokens through the same resolveInterfacePaths seam (issue 307), and the D5 crosscut:operationalConcerns trigger reads the structured ac.scope field in addition to the legacy '[deployed]' marker so trees that carry scope as a schema field no longer silently pass 0/0 (issue 306)."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.32.0"
     date: "2026-10-06"
     breaking: false

package/src/query/gates.js

@@ -1582,7 +1582,15 @@ function computeSecurityArchitectureCheck(ctx) {
 function computeOperationalConcernsCheck(ctx) {
   const tree = ctx.tree;
   const tad = /** @type {any} */ (tree.tad ?? {});
-  const hasDeployedAc = (tree.userStories ?? []).some((us) => (us.acceptanceCriteria ?? []).some((ac) => typeof ac?.description === 'string' && ac.description.includes('[deployed]')));
+  // Issue 306 (2026-10-06): schemas carry AC scope as the structured
+  // field `scope: "deployed"`; the legacy `[deployed]` description
+  // marker (R13 2026-10-05) is kept so older trees still trigger. A
+  // deployed-scope AC on either form must find a non-empty
+  // TAD.operationalConcerns.
+  const hasDeployedAc = (tree.userStories ?? []).some((us) => (us.acceptanceCriteria ?? []).some((ac) => {
+    if (ac?.scope === 'deployed') return true;
+    return typeof ac?.description === 'string' && ac.description.includes('[deployed]');
+  }));
   const opFail = [];
   if (hasDeployedAc) {
     const oc = tad.operationalConcerns;

package/src/view/index.js

@@ -12,6 +12,7 @@ import { resolveTestPointers, walkTree } from '#core/store';
 import { computeReadiness } from '../query/readiness.js';
 import { computeQuestions } from '../query/questions.js';
 import { loadFreezeRecord } from '../define/freeze-record.js';
+import { resolveInterfacePaths } from '../define/interface-paths.js';
 import { loadAllLedgers } from '../define/ledgers.js';
 import { renderContent, renderPage } from './html-page.js';
 import { renderProductMapGrouping } from './product-map.js';
@@ -77,11 +78,18 @@ export async function renderModelToPage({ projectRoot }) {
   // Load the readiness inputs once per rewalk; the viewer is pure
   // (never recomputes readiness). Failures load as `null` so the tab
   // still renders when a tree is partial.
-  const [freezeRecord, ledgers, testPointers, profileText] = await Promise.all([
+  const [freezeRecord, ledgers, testPointers, profileText, resolvedPaths] = await Promise.all([
     loadFreezeRecord({ projectRoot }).catch(() => null),
     loadAllLedgers({ projectRoot }).catch(() => ({})),
     resolveTestPointers({ projectRoot, tree }).catch(() => undefined),
     readProfileText(projectRoot),
+    // Issue 307 (2026-10-06): run the same TAC-interface path
+    // resolver the CLI and freeze run so the viewer's D3
+    // `shapes:pathsResolve` check reads the resolved set from the
+    // same seam. Before this, the viewer called computeReadiness
+    // without `resolvedPaths`, D3 false-failed on paths that resolve
+    // on disk, and the Readiness tab disagreed with the CLI.
+    resolveInterfacePaths(projectRoot, tree).catch(() => undefined),
   ]);
 
   let readiness = null;
@@ -93,6 +101,7 @@ export async function renderModelToPage({ projectRoot }) {
       profileText,
       testPointers,
       validateErrors: errors,
+      resolvedPaths,
     });
   } catch (err) {
     // A malformed tree should not block the viewer; the Readiness tab
@@ -149,7 +158,12 @@ export async function renderModelToPage({ projectRoot }) {
   // list is extended before the version pin bump). One row per doc id
   // plus one row per AC under each US.
   const indexJson = serialiseViewIndex(model);
-  return { fullPageHtml, contentHtml, errors, tree, pmPartials, indexJson };
+  // Issue 307 (2026-10-06): expose the computed readiness alongside
+  // the rendered HTML so tests can assert the viewer's D3
+  // shapes:pathsResolve agrees with the CLI without parsing HTML. The
+  // viewer HTML is still the operator-facing surface; this field is
+  // additive and consumed by test code only.
+  return { fullPageHtml, contentHtml, errors, tree, pmPartials, indexJson, readiness };
 }
 
 /**