rcf-lite 0.32.2 → 0.32.3

package/CHANGELOG.md

@@ -6,6 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.32.3] - 2026-10-07
+
+0.32.3 is a hotfix for the 0.32.2 D6 consistency:unsatisfiable regression discovered by Barry on ai-on-record (define/kickoff, head 974b4c1) and second-sourced by Dex on WESPA (26 green-to-red findings in three classes, 2026-10-06 20:05Z). The regression came from pattern 4 of `extractThenFieldTokens` in `src/query/gates.js`, added in PR 313 as part of the issue 311 fix. breaking: false; the 0.32.1 and 0.32.2 fixes carry forward unchanged. minAgentAction: null.
+
+### Fixed
+
+- **D6 consistency:unsatisfiable stops reading filename stems, non-shape PascalCase dot phrases and sentence-ending dots as record-field references (issue 315, w-2026-10-06-dave-059).** 0.32.2 added a pattern 4 to `extractThenFieldTokens` that fired `consistency:unsatisfiable` on any `<PascalCase>.<lowercaseWord>` match in an AC `then` clause. On ai-on-record define/kickoff that read `CLAUDE.md`, `AGENTS.md`, `rcf/evals/corpus-V.json`, `rcf/evals/golden-transcripts-V.json` and other filename stems as record fields and false-failed AC-1501-9:md, AC-2201-1:json, AC-2201-5:json and AC-2201-8:json. Dex's WESPA re-run on 2026-10-06 20:05Z (AI-1987) added 26 findings in three classes: filename stems with a filename-stem head (js x7, vue x5, md x1), PascalCase heads that are not recordShape names in the tree (`Math.random`, `TEST_USERS.admin`, `ToolExecutionContext.pushLlmCall`, `LoadedFilterSchema.distinctLiveSourceTables`, and backticked dot-phrases like `` `Something.listModelInfo` ``, `` `Something.userID` ``), and AC-130-1 producing the token `the` from a sentence-ending dot inside a dot-separated phrase (`Foo.the`). Fix: pattern 4 is now gated on the head to the left of the dot resolving to a recordShape name declared somewhere in the tree. `collectRecordShapeNames` walks the TAC interfaces alongside the existing `collectRecordShapeFields` and the resulting shape-name set is threaded through `extractThenFieldTokens` as a second argument. Three belt-and-braces guards stay in behind the shape-name gate so a hostile shape-name collision cannot reintroduce the class: an English-stop-word skip on the field token (so `Foo.the` is silent even if a shape named `Foo` were declared), a closed file-extension skip (md, json, jsonl, html, css, js, mjs, cjs, ts, vue, yaml, yml, txt, csv, pdf, png, jpg, svg, zip, wav, mp4, mov, log) and a two-char lookbehind path-context skip (preceded by `/` or `./`). Patterns 1 (narrowed backticked identifier), 2 (`<name> field`), 3 (`field: <name>`), the issue 311 fixtures and the AC-12113-2 class are preserved. Regression fixtures in `test/query/gates.test.js` cover each of the three new classes plus a positive control (`Session.lastSeenAt` where Session is declared without `lastSeenAt`) and a verbatim quote of the four ai-on-record ACs at head 974b4c1 as negative controls. Expected drop on WESPA: 26 unsatisfiable findings removed; the issue 311 drop and all AC-12113-2 class failures remain.
+
 ## [0.32.2] - 2026-10-06
 
 0.32.2 ships two Dex-lane fixes merged since 0.32.1 (merge b478a4e) as the WESPA readiness alignment release. D6 consistency:unsatisfiable now context-gates backticked identifiers in AC then-clauses so enum values, query-string parameter names, sort and filter literals, env-var names and config knobs stop being read as record-shape field names, and `rcf discover req-baseline opt-out` and `rcf define ledger concerns add` honour `--dry-run` by writing nothing. breaking: false; no behavioural changes on verbs consumers run in CI; fixes only. minAgentAction: null; the managed agent-instructions block hash did not move.

package/fixtures/canary-manifest.json

@@ -1,9 +1,9 @@
 {
   "registerCanary": [
     {
-      "id": "rc-2026-10-06-001",
-      "createdAt": "2026-10-06T19:49:58.281Z",
-      "buildVersion": "0.32.2-mockdriver",
+      "id": "rc-2026-10-07-001",
+      "createdAt": "2026-10-07T10:44:10.684Z",
+      "buildVersion": "0.32.3-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -34,9 +34,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-10-06-002",
-      "createdAt": "2026-10-06T19:49:58.282Z",
-      "buildVersion": "0.32.2-mockdriver",
+      "id": "rc-2026-10-07-002",
+      "createdAt": "2026-10-07T10:44:10.684Z",
+      "buildVersion": "0.32.3-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -67,9 +67,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-10-06-003",
-      "createdAt": "2026-10-06T19:49:58.282Z",
-      "buildVersion": "0.32.2-mockdriver",
+      "id": "rc-2026-10-07-003",
+      "createdAt": "2026-10-07T10:44:10.684Z",
+      "buildVersion": "0.32.3-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.32.2",
+  "version": "0.32.3",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",

package/releases/releases.yaml

@@ -40,8 +40,16 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.32.2"
+latest: "0.32.3"
 releases:
+  - version: "0.32.3"
+    date: "2026-10-07"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.32.3 is a hotfix for the 0.32.2 D6 consistency:unsatisfiable regression on filename stems and non-shape dot phrases (issue 315). Pattern 4 of extractThenFieldTokens now emits a field token only when the head to the left of the dot is a declared recordShape name in the tree, so AC then-clauses that mention report.json, CLAUDE.md, scripts/seeds/README.md, Math.random, TEST_USERS.admin, ToolExecutionContext.pushLlmCall and sentence-ending dots like Foo.the stop reading as record-field references; file-extension, path-context and English-stop-word skips stay as belt and braces. The 0.32.1 and 0.32.2 fixes carry forward unchanged."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.32.2"
     date: "2026-10-06"
     breaking: false

package/src/query/gates.js

@@ -1823,6 +1823,7 @@ export function checkD6Consistency(ctx) {
   // `[draft]` recordShape counts as defined (the engineer owns the
   // draft; its `fields:` list is honest about what the then may name).
   const definedFields = collectRecordShapeFields(tree);
+  const definedShapes = collectRecordShapeNames(tree);
   /** @type {Array<{ id: string, why: string }>} */
   const unsatisfiableFindings = [];
   let totalThenFieldChecks = 0;
@@ -1831,7 +1832,7 @@ export function checkD6Consistency(ctx) {
     for (const ac of acs) {
       const parts = parseWhenThen(ac?.description);
       if (!parts) continue;
-      const fields = extractThenFieldTokens(parts.then);
+      const fields = extractThenFieldTokens(parts.then, definedShapes);
       for (const field of fields) {
         totalThenFieldChecks += 1;
         if (definedFields.has(field)) continue;
@@ -2028,6 +2029,42 @@ function collectRecordShapeFields(tree) {
   return out;
 }
 
+/**
+ * Collect every recordShape interface name declared anywhere in the
+ * tree. Pattern 4 of `extractThenFieldTokens` (dot-notation
+ * `<Head>.<field>`) uses this set to gate: a Head that is not a
+ * declared shape name is not read as a record-field reference. This
+ * closes the 0.32.2 class in issue 315 where filename stems, non-shape
+ * PascalCase heads (Math.random, TEST_USERS.admin,
+ * ToolExecutionContext.pushLlmCall) and sentence-ending dots (Foo.the)
+ * were being read as record-field references.
+ *
+ * @param {import('#core/store/walker.js').TreeModel} tree
+ * @returns {Set<string>}
+ */
+function collectRecordShapeNames(tree) {
+  const out = new Set();
+  for (const tac of tree.tacs ?? []) {
+    for (const iface of tac.interfaces ?? []) {
+      if (iface?.kind !== 'recordShape') continue;
+      const name = iface?.name;
+      if (typeof name !== 'string' || name.length === 0) continue;
+      out.add(name);
+    }
+  }
+  return out;
+}
+
+// Closed list of file-extension tokens; pattern 4 (dot notation) never
+// emits a field token drawn from this set. Belt and braces behind the
+// shape-name gate: a tree with a recordShape literally named `Json` or
+// `Md` would still not read `foo.json`/`CLAUDE.md` as a field.
+const PATTERN_4_FILE_EXTENSION_SKIP = new Set([
+  'md', 'json', 'jsonl', 'html', 'css', 'js', 'mjs', 'cjs', 'ts', 'vue',
+  'yaml', 'yml', 'txt', 'csv', 'pdf', 'png', 'jpg', 'svg', 'zip', 'wav',
+  'mp4', 'mov', 'log',
+]);
+
 /**
  * Pull field tokens out of a `then` clause. A field token is a word
  * that follows a verb like `set`, `write`, `include`, `return`,
@@ -2052,9 +2089,12 @@ function collectRecordShapeFields(tree) {
  * the check.
  *
  * @param {string} thenClause
+ * @param {Set<string>} [shapeNames] - recordShape names declared in
+ *   the tree. Pattern 4 (`<Head>.<field>` dot notation) emits a field
+ *   token only when the head is a member of this set (issue 315).
  * @returns {string[]}
  */
-function extractThenFieldTokens(thenClause) {
+function extractThenFieldTokens(thenClause, shapeNames = new Set()) {
   if (typeof thenClause !== 'string' || thenClause.length === 0) return [];
   const text = stripQuotedSubstrings(thenClause);
   /** @type {Set<string>} */
@@ -2076,11 +2116,33 @@ function extractThenFieldTokens(thenClause) {
   for (const m of text.matchAll(/\bfields?\s*[:=]\s*`?([A-Za-z_][A-Za-z0-9_]*)`?/g)) {
     if (m[1]) tokens.add(m[1]);
   }
-  // Pattern 4 (new, issue 311): `<ShapeName>.<fieldName>` dot
-  // notation. Shape names are PascalCase; the field name after the
-  // dot is the candidate.
-  for (const m of text.matchAll(/\b[A-Z][A-Za-z0-9_]*\.([a-z_][A-Za-z0-9_]*)\b/g)) {
-    if (m[1]) tokens.add(m[1]);
+  // Pattern 4 (narrowed, issue 315): `<ShapeName>.<fieldName>` dot
+  // notation. Shape names are PascalCase. 0.32.2 emitted a field
+  // token whenever a PascalCase-ish head sat next to a lowercase dot
+  // tail, which read filename stems (`CLAUDE.md`, `*.json`,
+  // `report.json`), non-shape PascalCase heads (`Math.random`,
+  // `ToolExecutionContext.pushLlmCall`), bare-letter version tags
+  // (`corpus-V.json`) and sentence-ending dots inside a dotted
+  // phrase (`Foo.the`) as record fields. Narrowing: emit ONLY when
+  // the head resolves to a recordShape name declared somewhere in
+  // the tree. Three belt-and-braces guards remain regardless of the
+  // shape-name set so a hostile shape-name collision cannot
+  // reintroduce the class: the field is not an English stop word
+  // (sentence-dot), not a known file extension (filename stems),
+  // and the match does not sit inside a path context (preceded by
+  // `/` or `./`, which also catches backticked paths like
+  // `rcf/evals/corpus-V.json`).
+  for (const m of text.matchAll(/\b([A-Z][A-Za-z0-9_]*)\.([a-z_][A-Za-z0-9_]*)\b/g)) {
+    const head = m[1];
+    const field = m[2];
+    if (!head || !field) continue;
+    if (!shapeNames.has(head)) continue;
+    if (STOP.has(field.toLowerCase())) continue;
+    if (PATTERN_4_FILE_EXTENSION_SKIP.has(field.toLowerCase())) continue;
+    const start = m.index ?? 0;
+    const beforeHead = text.slice(Math.max(0, start - 2), start);
+    if (/[\/]/.test(beforeHead)) continue;
+    tokens.add(field);
   }
   // Pattern 1 (narrowed, issue 311): backticked identifier WITH
   // explicit field evidence in its immediate neighbourhood AND no