rcf-lite 0.7.1 → 0.8.0

package/CHANGELOG.md

@@ -4,6 +4,62 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Pre-1.0, breaking changes are signalled by a minor version bump.
 
+## [0.8.0] - 2026-08-12 (on `slug-train/0.8.0`, PR pending)
+
+### Added (Car 4, verify updates per requirements doc)
+
+- **`src/verify/chain/index.js` (`readChain`) surfaces AC `scope` and per-TC `boundTcs`.** Every flattened AC now carries the schema-declared scope tag (or `undefined` for bootstrap-era ACs) plus a `boundTcs[]` list of `{ tsId, tcId, scope }` for every bound TC. Verify's downstream verdict layer runs the scope check off this shape, matching the shape the admissibility lint's `scanTcScopeVsAc` consumes at build stage.
+- **`src/verify/verdict/index.js` (`scopePerAcVerdict`, extended `derivePerAcVerdicts`).** New `SCOPE-MISMATCH` per-AC verdict (NV-BL-GATE-01 + NV-BL-ADM-03). Fires when an AC declares a scope tag AND every bound TC's scope is narrower than the AC's scope AND at least one bound TC declares a scope tag (bootstrap-era TCs without a tag are silent -- the admissibility lint handles that class). At least one TC at or wider than the AC scope clears the mismatch (a wider TC is always admissible). Emitted alongside the four 0.7.0 per-AC verdict classes on `report.perAcVerdicts[]`. Existing report validator (`src/verify/report/index.js`) admits the new class via the widened `PER_AC_VERDICTS` enum.
+- **`src/finalise/ingest.js` (`findScopeMismatchAcs`, `reportHasScopeMismatch`; extended `summariseReport`).** NV-BL-GATE-01 REVIEW-stage consumers (`rcf review <fbs-id>`, `rcf finalise`) read the same shape via new predicates. `summariseReport` renders a dedicated `scope mismatches (N)` section when the report carries any SCOPE-MISMATCH entries (silent when none, so pre-0.8.0 reports remain byte-identical in the summary output).
+- **`src/finalise/index.js` re-exports** `findScopeMismatchAcs` and `reportHasScopeMismatch` alongside the pre-existing mock-only-declared predicates.
+- **`test/verify/chain/scope-derivation-0-8-0.test.js` (2 tests):** chain reader hands through AC.scope + per-TC scope on boundTcs; leaves AC.scope undefined when the AC has no tag.
+- **`test/verify/verdict/scope-mismatch-0-8-0.test.js` (7 tests):** narrower TC surfaces SCOPE-MISMATCH; wider or equal TC clears; deployed TC covering runtime AC is fine; AC without scope is silent; TC without scope is silent; AC with no bound TCs is silent; `derivePerAcVerdicts` emits SCOPE-MISMATCH alongside MOCK-ONLY-DECLARED on the same AC when both apply.
+- **`test/finalise/scope-mismatch-0-8-0.test.js` (5 tests):** `findScopeMismatchAcs` extracts SCOPE-MISMATCH only; graceful with absent perAcVerdicts; `reportHasScopeMismatch` truthiness; `summariseReport` renders a dedicated section; silent when no mismatches present.
+- **`test/verify/verdict/per-ac-verdicts-0-7-0.test.js` PER_AC_VERDICTS assertion updated** to include SCOPE-MISMATCH (0.8.0 slug-train car 4).
+
+### Version bump
+
+- **`package.json` version 0.7.1 -> 0.8.0.** Consumes `@stravica-ai/rcf-schemas@0.4.3` (exact pin per the umbrella exact-pin doctrine ratified alongside item 18; the 0.4.3 diff is additive-only and preserved by the existing back-compat fixtures on the schemas side). The `rcf-lite@0.8.0` tag + publish is out of this train's scope and Dave will cut it post-merge.
+
+
+
+The `0.8.0` admissibility-and-ruleset release, cut against the ratified next-version plan (`projects/rcf-build-lite/docs/2026-08-06_next-version-plan-amendment.md`) and requirements (`projects/rcf-build-lite/docs/2026-08-06_build-lite-nextver-requirements.md`). Ships the shared standards ruleset bundled inside this umbrella package, wires build-lite's fitness tracks around it (admissibility lint refuse-by-default, build-stage drift refusal, gate tightenings), and pulls verify's per-AC scope check into REVIEW. Car 1 of the slug-train, `@stravica-ai/rcf-schemas@0.4.3`, published to npm on 2026-08-12 and is EXACT-PINNED here (no caret, no range) per the umbrella exact-pin doctrine ratified alongside item 18. The 0.4.3 diff is additive-only: widened id patterns to accept an optional kebab-case slug tail on FBS / CN / ADR / TAC ids, widened TS/TC to drop the 999 cap, added the shared `scopeTag` vocabulary in `common.schema.json`, and added optional `scope` fields on AC and TC. Every existing chain continues to validate; no retro-slugging is performed.
+
+### Added (Car 3, admissibility lint + drift refusal + refuse-by-default in query)
+
+- **`src/admissibility/` module (`#admissibility`).** Chain-admissibility gate wiring per NV-BL-ADM-02, -03, -04, -05, -06. Refuse-first per ratified ruling-sheet item 1.
+  - `scanAcScopeCoverage(tree, { tolerateUnclassified })` (NV-BL-ADM-02): every AC must carry a known scope tag from the shared vocabulary. `unclassified` is tolerated during the migration window (default; `tolerateUnclassified: false` fails those too after the window closes).
+  - `scanTcScopeVsAc(tree, opts)` (NV-BL-ADM-03): every bound TC's scope must be equal to or wider than the covered AC's scope. `library` < `runtime` < `deployed`; a wider TC on a narrower AC is admissible (opposite trips a finding).
+  - `scanSourceStringForMarkers(source, { filePath, markers })` and `scanFilesForMarkers(filePaths)` (NV-BL-ADM-04): scan source for the ratified marker vocabulary (`TODO`, `FIXME`, `XXX`, `HACK`, `placeholder`, `v1 refinement`, `deferred`, `stub`; case-insensitive). Line + column offsets on each finding. Vocabulary is read from the ruleset at call time so a future ruleset revision picks up without recompiling this module.
+  - `enforceAdmissibility({ tree, chainRulesetVersion, overrides, opts })` (NV-BL-ADM-05 + -06): the top-level refuse-first gate. Combines the scope scans with `detectRulesetDrift`; applies recorded overrides per rule id + optional documentId; emits `{ verdict: 'pass' | 'refuse' | 'passWithOverrides', findings, unresolved, appliedOverrides, drift }`. Guardrail: NV-BL-ADM-04 findings can NEVER be masked through the generic override channel (ruling-sheet item 16 narrowed override to ADR-only for source markers).
+  - `getRulesetToolScope()`: exposes the ruleset's `toolScope` block so consumers decide whether to apply the traceability-and-query-tools refusal per NV-BL-SR-03 addendum.
+- **`src/query/refuse-on-admissibility.js` (`runWithAdmissibilityGate`).** NV-BL-SR-03 addendum wiring (ruling-sheet item 1): traceability and query tools share the refuse-first posture. Wraps a query producer such that a REFUSE verdict short-circuits the query and returns a refusal envelope naming the unresolved rule ids; PASS lets the producer run and returns its payload. Re-exported from `src/query/index.js`.
+- **`#admissibility` package.json import specifier.** New subpath alias mapping to `./src/admissibility/index.js`.
+- **`test/admissibility/scope-lint.test.js` (5 tests)** covering NV-BL-ADM-02 absent / unclassified / tolerance, NV-BL-ADM-03 narrower-fails / wider-passes.
+- **`test/admissibility/markers.test.js` (4 tests)** covering the case-insensitive vocabulary scan, line/column offsets, empty input, and multi-file scan + ioFailure surfacing.
+- **`test/admissibility/enforce.test.js` (7 tests)** covering NV-BL-ADM-06 missing-version + behavioural drift refusal, NV-BL-ADM-05 override application, the NV-BL-ADM-04 override guardrail, `getRulesetToolScope`, and `runWithAdmissibilityGate` short-circuit + pass paths.
+
+### Changed (Car 3, landmines + schemas pin)
+
+- **`@stravica-ai/rcf-schemas` bumped to EXACT `0.4.3`** (no caret, no range) per the ratified umbrella exact-pin doctrine (item 18 alongside the 0.4.3 release). The 0.4.3 diff is additive-only: widened `fbsId` / `cnId` / `adrId` / `tacId` to accept an optional kebab-case slug tail, widened `tsId` / `tcId` from `\d{3}` to `\d{3,}` (drops the 999 cap), added `common.$defs.scopeTag` (`library | runtime | deployed | unclassified`), added OPTIONAL `scope` on the AC subschema (`user-story.schema.json`) and TC subschema (`test-suite.schema.json`). Every pre-0.4.3 chain continues to validate; no retro-slugging is performed (the design is preferred-with-numeric-fallback per w-2026-07-28-012). Pin review: the additive-only nature is asserted by the schemas repo's `manifest-004-pre-040-backcompat.json` fixture round-tripping cleanly under 0.4.3, and by the existing writer / walker tests continuing to pass with the bumped pin.
+
+### Fixed (Car 3, w-2026-07-28-012 landmines)
+
+Four landmine fixes lifted from `w-2026-07-28-012` (design notes + d-2026-07-28-011 recon), each landing WITH its regression test. Every fix is a precondition for the slug-consuming changes that follow it in the same car; the walker prefix-only-uppercase fix lands first, per the ratified sequencing.
+
+- **Landmine 1: `packages/rcf-lite/src/core/store/walker.js` (loadChildKind).** The walker used to derive tree ids by upper-casing the whole filename stem (`stem.toUpperCase()`). Lossless while every id was `<PREFIX>-<digits>`; the moment a slug lands (`fbs-004-user-login.json` -> body `fbsId: "FBS-004-user-login"`), the whole-stem fold produced `FBS-004-USER-LOGIN` in `tree.byId` / `kindById` / `parentByChild` while every inbound reference used the lower-case form. The graph silently detached. The fix (`idFromFilenameStem`) upper-cases the prefix segment only and leaves the slug tail verbatim. Regression: `test/store/walker.test.js` `walkTree preserves case on slug tails when deriving id from filename`; also asserts a valid inbound `dependsOnFbsIds` reference resolves to the byId entry.
+- **Landmine 2: `packages/rcf-lite/src/core/store/writer.js` (nextFlatId).** The allocator's high-water mark used a slug-blind regex `^${prefix}-(\d+)$`; a slugged id was invisible to the max and the allocator reset to 001, re-issuing taken numbers. The fix replaces the local regex with the shared `idNumber(id, prefix)` helper (`ids.js:72-78`, pattern `^${prefix}-(\d+)(?:-|$)`) which parses both numeric-only and slugged shapes into the same numeric key. Regression: `test/core/store/writer.test.js` `nextIdForKind sees slugged ids in the occupancy set` and `nextIdForKind never re-issues a slugged FBS number even without a companion numeric-only FBS at the same slot`.
+- **Landmine 3: hardcoded three-digit id patterns across seven walker/writer sites AND three consumer-path stragglers.** The moment a TS crosses 999 (rcf-schemas 0.4.3 admits `TS-1000`), the walker's `idPrefixMatchesParent` rule silently skipped every inline TC under that TS, and the writer's `nextIdForKind tc` refused with "unrecognised TS id" even though the schema admitted the parent. Widened all sites to `\d{3,}` in lockstep with the schema. Walker + writer sites (7 total): `packages/rcf-lite/src/core/store/walker.js:851/854` and `writer.js:252/908/1163` (four regex sites), plus the corresponding comments and the resolveInlineId TC branch on writer.js widened for consistency. Consumer-path stragglers (3 sites, folded in as a rework commit after the initial car 3.1 landed): `packages/rcf-lite/src/cli/test-suite.js:85` (hard-refused any TS >= 1000 in `rcf test-suite <id> {provenance|approve}` with an error text citing "TS-015"; widened + error text updated to cite both "TS-015" and "TS-1000"), `packages/rcf-lite/src/cli/read.js:122` (`rcf read TC-1000-x` silently fell through to null even when the TC existed under a widened TS; widened the inline-TC guard), and `packages/rcf-lite/src/mcp/tools.js:765` (same silent-null pattern via the MCP read tool). Regressions: `test/core/store/writer.test.js` `nextIdForKind tc admits a TS beyond 999` + `walker inline-TC prefix-match rule fires for TS beyond 999`; `test/cli/test-suite-cli.test.js` `rcf test-suite TS-1000 provenance accepts a four-digit TS id` + `rcf test-suite TS-1000 approve accepts a four-digit TS id` + `rcf test-suite refuses a non-TS positional and cites both three-digit and four-digit shapes`; `test/cli/read.test.js` `rcf read TC-1000-first-case resolves the inline TC on a widened (four-digit) TS`; `test/mcp/tools.test.js` `rcf_read: resolves an inline TC on a widened (four-digit) TS`.
+- **Landmine 4: `packages/rcf-lite/src/core/store/writer.js` (`deriveSlug`).** Returned the literal `'tc'` on empty derivation. Every non-TC caller (FBS, CN, ADR, TAC create paths) would silently produce an id ending in `-tc` when the source description derived to empty -- wrong kind label baked in as a slug. The fix returns `''` at the source and moves the `|| 'tc'` fallback to the TC-specific callers (`writer.js` `createInlineTc`, `mcp/tools.js`, `cli/create.js`). Regression: `deriveSlug lowercases and squashes non-alphanumeric runs` updated (`!!!` now maps to `''`, not `'tc'`) and a new `0.8.0 slug-train (landmine 4): deriveSlug returns empty string, not the "tc" literal` test.
+
+### Added (Car 2, shared standards ruleset)
+
+- **`src/ruleset/ruleset.json` (NV-BL-SR-01).** Single machine-readable artefact bundled inside the umbrella package, camelCase per estate convention. Names the admissibility rule identifiers (`NV-BL-ADM-01`..`NV-BL-ADM-06`), the gate rule identifiers (`NV-BL-GATE-01`..`NV-BL-GATE-04`), the scope-tag vocabulary reference (points at `@stravica-ai/rcf-schemas` `common.schema.json#/$defs/scopeTag` rather than owning the enum, ratified 2026-08-11 item 11), the source-comment marker vocabulary (`TODO`, `FIXME`, `XXX`, `HACK`, `placeholder`, `v1 refinement`, `deferred`, `stub` — all case-insensitive per NV-BL-ADM-04), the canonical TC template family identifiers (`TCT-SERVER-BOOT`, `TCT-CLI-INVOKE`, `TCT-CONTAINER-RUN` — NV-BL-GATE-03), and the light-mechanical ruling-consistency check family (`RCC-EXTERNAL-RESOURCE-CONTRADICTION`, `RCC-TIER-CAPABILITY-MISMATCH` — NV-BL-GATE-04; probabilistic/suitability checks live in rcf-define-lite under DL-REQ-VALIDATE-04). `toolScope` covers chain admissibility AND traceability/query tools per the ratified addendum on item 1.
+- **`src/ruleset/index.js` (`#ruleset`).** Loader for the artefact. `getRuleset()` returns the frozen artefact with `rulesetVersion` stamped at read time from the umbrella `package.json` (NV-BL-SR-02: the ruleset has no separate semver; its version IS the umbrella version). `detectRulesetDrift({ chainRulesetVersion })` classifies chain-vs-shipping version mismatch as `none | additive | behavioural | missing`, feeding `NV-BL-ADM-06` (build-stage refusal on behavioural drift) and `DL-REQ-VALIDATE-03` (define-stage warning). `getUmbrellaVersion()` exposes the same version so callers do not re-parse `package.json`. `resetRulesetCache()` for tests.
+- **`#ruleset` package.json import specifier.** New subpath alias mapping to `./src/ruleset/index.js` so consumers reach the loader without hard-coding a relative path.
+- **`docs/ruleset.md`.** Ruleset reference doc — artefact location, version policy (NV-BL-SR-02), content at v1 (NV-BL-SR-03), consumers, migration state.
+- **`test/ruleset/ruleset.test.js`.** 14 tests covering NV-BL-SR-01 shape, NV-BL-SR-02 version stamping (umbrella-authoritative; baked-in `rulesetVersion` on the JSON refused), NV-BL-SR-03 content (every ADM/GATE id present, every ADM rule `refuseByDefault: true`, scope-tag vocabulary points at schemas, marker list matches NV-BL-ADM-04 vocabulary, TC template family matches NV-BL-GATE-03 surfaces, ruling-consistency checks are light-mechanical), and `detectRulesetDrift` classes.
+
 ## [0.7.0] - 2026-07-31
 
 The cold-run response train. Four tracks land together in one release, each closing a systemic gap the 0.5.2 watchpost cold run exposed. Ships alongside `@stravica-ai/rcf-lite-core@0.3.0` (shared pattern sets, baseline catalog, canary fixtures) and `@stravica-ai/rcf-verify-lite@0.2.0` (per-AC verdict classes, chain-reader derivation); `@stravica-ai/rcf-schemas@0.4.2` already carries the full 0.7.0 surface additively so every new chain field is optional at the schema layer. Track A (verification integrity) ships the primitives that keep a mocked integration test from ever again looking identical to a live one: the chain gains an honest record of what the tests actually verified against. Track B (UI design gate + quality baseline) ships the Design substage (Stage 1.5), the ruled UI baseline, and the browser-verification gate for UI-bearing FBSes. Tracks C and D (elicitation upstream + playbook hardening) ship the REQ-shape classifier and baseline-AC catalog with silence-refuses-build enforcement (Track C), the variable-fidelity intake stage (Track C), and the release-time register canary, never-skip-RCF invariant, review-surface persistence and persona tail-interview template (Track D). Every field is optional at schema; the ENFORCEMENT (elicitation, `coverage --strict`, the review-stage audit, the finalise gate, `--mark complete` refusals, the Stage-1 sweep gate) is what makes them de-facto required for new chains from 0.7.0 onward.

package/fixtures/canary-manifest.json

@@ -2,8 +2,8 @@
   "registerCanary": [
     {
       "id": "rc-2026-08-12-001",
-      "createdAt": "2026-08-12T10:45:12.561Z",
-      "buildVersion": "0.7.1-mockdriver",
+      "createdAt": "2026-08-12T16:39:41.040Z",
+      "buildVersion": "0.8.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -35,8 +35,8 @@
     },
     {
       "id": "rc-2026-08-12-002",
-      "createdAt": "2026-08-12T10:45:12.562Z",
-      "buildVersion": "0.7.1-mockdriver",
+      "createdAt": "2026-08-12T16:39:41.041Z",
+      "buildVersion": "0.8.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -68,8 +68,8 @@
     },
     {
       "id": "rc-2026-08-12-003",
-      "createdAt": "2026-08-12T10:45:12.562Z",
-      "buildVersion": "0.7.1-mockdriver",
+      "createdAt": "2026-08-12T16:39:41.041Z",
+      "buildVersion": "0.8.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI (init, view, validate, build, verify, finalise and 25+ more verbs), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",
@@ -53,10 +53,12 @@
     "#core/patterns/services": "./src/core/patterns/services.js",
     "#core/patterns/register-canary": "./src/core/patterns/register-canary.js",
     "#core/baseline-catalog": "./src/core/baseline-catalog/index.js",
-    "#core/fixtures/register-canary/*": "./src/core/fixtures/register-canary/*"
+    "#core/fixtures/register-canary/*": "./src/core/fixtures/register-canary/*",
+    "#ruleset": "./src/ruleset/index.js",
+    "#admissibility": "./src/admissibility/index.js"
   },
   "dependencies": {
-    "@stravica-ai/rcf-schemas": "0.4.2",
+    "@stravica-ai/rcf-schemas": "0.4.3",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1"
   },

package/src/admissibility/enforce.js

@@ -0,0 +1,142 @@
+// Chain-admissibility gate (NV-BL-ADM-05, NV-BL-ADM-06).
+//
+// Refuse-first per ratified ruling-sheet item 1 (2026-08-11): a chain
+// that fails any admissibility check is refused before build starts.
+// Explicit overrides are permitted for non-source-marker checks,
+// recorded in the chain with rule id, reason, and authoring identity,
+// and surfaced in the finalise summary. Source-comment markers
+// (NV-BL-ADM-04) fall outside this generic override channel and are
+// governed by the narrower ADR-only mechanism per ruling-sheet
+// item 16 -- callers apply that check separately.
+//
+// NV-BL-ADM-06 (build-stage refusal on ruleset-version drift):
+// composes with the scope-tag scans below so a build-time entry point
+// gets one call that returns a single verdict.
+
+import { detectRulesetDrift, getRuleset } from '#ruleset';
+
+import { scanAcScopeCoverage, scanTcScopeVsAc } from './scope-lint.js';
+
+/**
+ * @typedef {object} AdmissibilityOverride
+ * @property {string} rule - rule id being overridden (e.g. "NV-BL-ADM-02").
+ * @property {string} reason - operator-provided reason recorded on the chain.
+ * @property {string} [authoredBy] - author identity string.
+ * @property {string} [documentId] - optional pin to a specific doc id.
+ */
+
+/**
+ * @typedef {object} AdmissibilityVerdict
+ * @property {'pass' | 'refuse' | 'passWithOverrides'} verdict
+ * @property {import('#core/errors').RcfError[]} findings - all findings before override application.
+ * @property {import('#core/errors').RcfError[]} unresolved - findings not covered by a supplied override.
+ * @property {AdmissibilityOverride[]} appliedOverrides
+ * @property {object} drift - shape from detectRulesetDrift.
+ */
+
+/**
+ * Should this finding be masked by the given override? Match on rule id
+ * and, when the override pins a documentId, on documentId too.
+ */
+function overrideCovers(finding, override) {
+  if (finding.rule !== override.rule) return false;
+  if (override.documentId && finding.documentId !== override.documentId) return false;
+  return true;
+}
+
+/**
+ * Enforce admissibility across the whole chain (NV-BL-ADM-05 gate) plus
+ * ruleset-version drift (NV-BL-ADM-06). Callers pass the walker tree,
+ * the chain's declared ruleset version (per DL-REQ-VALIDATE-03), and an
+ * optional list of recorded overrides.
+ *
+ * A pure function on top of the ruleset + tree. Callers decide what to
+ * do with a `refuse` verdict (`rcf build` refuses with exit 4; a query
+ * or traceability tool refuses to surface the chain per the item 1
+ * addendum -- see `#query/refuse-on-admissibility`).
+ *
+ * @param {object} args
+ * @param {object} args.tree - walker output
+ * @param {string|null} [args.chainRulesetVersion]
+ * @param {AdmissibilityOverride[]} [args.overrides]
+ * @param {object} [args.opts]
+ * @param {boolean} [args.opts.tolerateUnclassified] - default true.
+ * @returns {Promise<AdmissibilityVerdict>}
+ */
+export async function enforceAdmissibility({
+  tree,
+  chainRulesetVersion = null,
+  overrides = [],
+  opts = {},
+} = {}) {
+  const ruleset = await getRuleset();
+  const drift = await detectRulesetDrift({ chainRulesetVersion, ruleset });
+
+  const findings = [];
+
+  // NV-BL-ADM-06: build-stage refusal on behavioural drift. Missing
+  // chain-ruleset-version is a separate class -- the chain never
+  // declared a version, so we cannot classify drift; the finding
+  // asks the operator to run the define-stage warning path
+  // (DL-REQ-VALIDATE-03) or acknowledge the omission via override.
+  if (drift.drift === 'behavioural') {
+    findings.push({
+      kind: 'validation',
+      message: `NV-BL-ADM-06: chain was authored against ruleset version ${drift.chainVersion}; shipping version is ${drift.shippingVersion}. Behaviour-changing drift refuses at build stage.`,
+      rule: 'NV-BL-ADM-06',
+    });
+  } else if (drift.drift === 'missing') {
+    findings.push({
+      kind: 'validation',
+      message: `NV-BL-ADM-06: chain does not declare a ruleset version. Run the define-stage adequacy check against ruleset ${drift.shippingVersion} (DL-REQ-VALIDATE-03) or record an override.`,
+      rule: 'NV-BL-ADM-06',
+    });
+  }
+
+  // NV-BL-ADM-02 / -03: scope-tag coverage + TC-scope-vs-AC-scope.
+  findings.push(...scanAcScopeCoverage(tree, opts));
+  findings.push(...scanTcScopeVsAc(tree, opts));
+
+  // NV-BL-ADM-05: refuse-first, override-recorded. Overrides are
+  // recorded on the chain; we apply them here to produce the
+  // unresolved-findings set. Source-comment markers (NV-BL-ADM-04) do
+  // NOT flow through this override channel; callers running that scan
+  // filter its findings only through the ADR-only channel per
+  // ruling-sheet item 16.
+  const appliedOverrides = [];
+  const unresolved = [];
+  for (const finding of findings) {
+    if (finding.rule === 'NV-BL-ADM-04') {
+      // Guardrail: source-marker findings must never be masked through
+      // the generic override channel. If a caller mistakenly threaded
+      // them into this function, leave them unresolved.
+      unresolved.push(finding);
+      continue;
+    }
+    const hit = overrides.find((o) => overrideCovers(finding, o));
+    if (hit) {
+      appliedOverrides.push(hit);
+      continue;
+    }
+    unresolved.push(finding);
+  }
+
+  let verdict;
+  if (unresolved.length === 0 && appliedOverrides.length === 0) verdict = 'pass';
+  else if (unresolved.length === 0) verdict = 'passWithOverrides';
+  else verdict = 'refuse';
+
+  return { verdict, findings, unresolved, appliedOverrides, drift };
+}
+
+/**
+ * Convenience: the ruleset's toolScope block. Query / traceability tools
+ * read this to decide whether to apply the refuse-first posture when
+ * surfacing chain data (NV-BL-SR-03 addendum on ruling-sheet item 1).
+ *
+ * @returns {Promise<{ chainAdmissibility: boolean, traceabilityAndQueryTools: boolean }>}
+ */
+export async function getRulesetToolScope() {
+  const ruleset = await getRuleset();
+  return ruleset.toolScope;
+}

package/src/admissibility/index.js

@@ -0,0 +1,8 @@
+// Public surface for the chain-admissibility gate (0.8.0 slug-train,
+// car 3). Rules consumed from the shared standards ruleset bundled
+// inside this umbrella package (`#ruleset`) per the ratified
+// requirements doc (2026-08-06 canonical since 2026-08-12).
+
+export { enforceAdmissibility, getRulesetToolScope } from './enforce.js';
+export { scanAcScopeCoverage, scanTcScopeVsAc } from './scope-lint.js';
+export { scanFilesForMarkers, scanSourceStringForMarkers } from './markers.js';

package/src/admissibility/markers.js

@@ -0,0 +1,104 @@
+// Source-comment marker scanner (NV-BL-ADM-04).
+//
+// Scans a set of source files for admission markers from the ratified
+// vocabulary carried on the shared standards ruleset
+// (`sourceCommentMarkers[]`). Any match is a finding. Per ratified
+// ruling-sheet item 16, the only permitted override channel is an ADR
+// recording the deferral for a genuine external-boundary blocker; the
+// generic recorded-override channel (NV-BL-ADM-05) does not cover
+// source markers.
+//
+// This module produces findings only. Wiring the gate into
+// `rcf build --mark complete` is a build-lite verb change that reads
+// the FBS's build-sequence files and calls `scanSourceForMarkers` for
+// each; the CLI change belongs in that verb's PR, not here.
+
+import { readFile } from 'node:fs/promises';
+
+import { rcfError } from '#core/errors';
+import { getRuleset } from '#ruleset';
+
+/**
+ * Compile the ruleset's marker vocabulary into a single case-insensitive
+ * pattern. Markers are ratified as case-insensitive per NV-BL-ADM-04, so
+ * we build the pattern with the `i` flag. Longest markers first so
+ * "v1 refinement" wins over "v1" if a shorter marker is ever added to
+ * the vocabulary in future releases.
+ *
+ * @param {Array<{ marker: string, caseInsensitive: boolean }>} markers
+ * @returns {RegExp}
+ */
+function compileMarkerPattern(markers) {
+  const sorted = [...markers].sort((a, b) => b.marker.length - a.marker.length);
+  const alternation = sorted
+    .map((m) => m.marker.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+    .join('|');
+  // Boundary-free by design: matches a marker anywhere in a comment
+  // ("PLACEHOLDER function" matches; "// placeholder" matches; a random
+  // word like "todos" also matches, which is the trade-off named in the
+  // ruleset's NV-BL-ADM-04 notes -- false positives on unrelated tokens
+  // are cheaper than false negatives on real deferrals.
+  return new RegExp(`(${alternation})`, 'ig');
+}
+
+/**
+ * Scan a single source string for the ratified marker vocabulary.
+ * Returns one finding per match, with line + column offsets. Empty
+ * input returns an empty findings array.
+ *
+ * @param {string} source
+ * @param {object} [opts]
+ * @param {string} [opts.filePath] - decorates each finding for callers
+ * @param {Array<{ marker: string, caseInsensitive: boolean }>} [opts.markers]
+ * @returns {Promise<import('#core/errors').RcfError[]>}
+ */
+export async function scanSourceStringForMarkers(source, { filePath, markers } = {}) {
+  if (typeof source !== 'string' || source.length === 0) return [];
+  const vocab = markers ?? (await getRuleset()).sourceCommentMarkers;
+  const pattern = compileMarkerPattern(vocab);
+  const findings = [];
+  let match;
+  while ((match = pattern.exec(source)) !== null) {
+    const before = source.slice(0, match.index);
+    const line = before.split('\n').length;
+    const lastNewline = before.lastIndexOf('\n');
+    const column = match.index - (lastNewline === -1 ? -1 : lastNewline);
+    findings.push(rcfError({
+      kind: 'validation',
+      message: `NV-BL-ADM-04: source-comment admission marker "${match[1]}" at ${filePath ?? '<source>'}:${line}:${column}`,
+      filePath: filePath ?? null,
+      rule: 'NV-BL-ADM-04',
+    }));
+  }
+  return findings;
+}
+
+/**
+ * Scan a set of files by path for the ratified marker vocabulary. IO
+ * failures on a single file are captured as `ioFailure` findings; other
+ * files continue to scan. Order is deterministic in the input file list.
+ *
+ * @param {string[]} filePaths - absolute paths to scan
+ * @returns {Promise<import('#core/errors').RcfError[]>}
+ */
+export async function scanFilesForMarkers(filePaths) {
+  if (!Array.isArray(filePaths) || filePaths.length === 0) return [];
+  const ruleset = await getRuleset();
+  const vocab = ruleset.sourceCommentMarkers;
+  const findings = [];
+  for (const filePath of filePaths) {
+    try {
+      const source = await readFile(filePath, 'utf8');
+      const perFile = await scanSourceStringForMarkers(source, { filePath, markers: vocab });
+      findings.push(...perFile);
+    } catch (err) {
+      findings.push(rcfError({
+        kind: 'ioFailure',
+        message: `NV-BL-ADM-04: failed to read source for marker scan: ${err.message}`,
+        filePath,
+        rule: 'NV-BL-ADM-04',
+      }));
+    }
+  }
+  return findings;
+}

package/src/admissibility/scope-lint.js

@@ -0,0 +1,163 @@
+// Chain-admissibility scope checks (NV-BL-ADM-02, NV-BL-ADM-03).
+//
+// The scope-tag vocabulary itself lives on rcf-schemas 0.4.3
+// (`common.$defs.scopeTag`). This module consumes the tags off ACs
+// and TCs and enforces the admissibility rules the shared standards
+// ruleset references (`NV-BL-ADM-02` for AC scope classification and
+// `NV-BL-ADM-03` for TC scope >= AC scope).
+//
+// Refuse-first, override-recorded per NV-BL-ADM-05; source-comment
+// markers are governed separately by NV-BL-ADM-04 and its ADR-only
+// override channel.
+
+import { rcfError } from '#core/errors';
+
+/**
+ * Rank each scope so we can compare "TC scope >= AC scope" numerically.
+ * `unclassified` is the migration state; ranked -1 so a TC-scoped
+ * unclassified against a runtime-scope AC surfaces as a mismatch.
+ * @type {Record<string, number>}
+ */
+const SCOPE_RANK = Object.freeze({
+  library: 1,
+  runtime: 2,
+  deployed: 3,
+  unclassified: -1,
+});
+
+/**
+ * True when the tag is a known scope value per the shared vocabulary.
+ * @param {unknown} tag
+ * @returns {boolean}
+ */
+function isKnownScope(tag) {
+  return typeof tag === 'string' && Object.prototype.hasOwnProperty.call(SCOPE_RANK, tag);
+}
+
+/**
+ * NV-BL-ADM-02: every AC must carry a known scope tag. An AC without a
+ * scope, or with a non-vocabulary value, produces an admissibility
+ * finding. Per the ruleset's `unclassifiedMigrationTolerance` block,
+ * an AC scoped `unclassified` is currently tolerated (findings not
+ * emitted); callers who want to enforce full migration pass
+ * `tolerateUnclassified: false`.
+ *
+ * @param {object} tree - walkTree output
+ * @param {object} [opts]
+ * @param {boolean} [opts.tolerateUnclassified] - default true (migration state)
+ * @returns {import('#core/errors').RcfError[]}
+ */
+export function scanAcScopeCoverage(tree, { tolerateUnclassified = true } = {}) {
+  const findings = [];
+  for (const us of tree.userStories ?? []) {
+    for (const ac of us.acceptanceCriteria ?? []) {
+      const scope = ac?.scope;
+      if (scope === undefined) {
+        findings.push(rcfError({
+          kind: 'validation',
+          message: `NV-BL-ADM-02: AC ${ac.id} on US ${us.usId} carries no scope tag`,
+          documentId: ac.id,
+          field: 'scope',
+          rule: 'NV-BL-ADM-02',
+        }));
+        continue;
+      }
+      if (!isKnownScope(scope)) {
+        findings.push(rcfError({
+          kind: 'validation',
+          message: `NV-BL-ADM-02: AC ${ac.id} on US ${us.usId} carries an unknown scope tag "${scope}"`,
+          documentId: ac.id,
+          field: 'scope',
+          rule: 'NV-BL-ADM-02',
+        }));
+        continue;
+      }
+      if (scope === 'unclassified' && !tolerateUnclassified) {
+        findings.push(rcfError({
+          kind: 'validation',
+          message: `NV-BL-ADM-02: AC ${ac.id} on US ${us.usId} still scoped "unclassified" after the migration window`,
+          documentId: ac.id,
+          field: 'scope',
+          rule: 'NV-BL-ADM-02',
+        }));
+      }
+    }
+  }
+  return findings;
+}
+
+/**
+ * NV-BL-ADM-03: for each AC, every bound TC's scope must be equal to
+ * or wider than the AC's scope. A library-scope TC bound to a
+ * runtime-scope AC surfaces as a mismatch. TCs with no scope tag are
+ * flagged the same way ACs are in NV-BL-ADM-02: absent = finding
+ * (bootstrap: unclassified tolerated).
+ *
+ * @param {object} tree - walkTree output
+ * @param {object} [opts]
+ * @param {boolean} [opts.tolerateUnclassified] - default true
+ * @returns {import('#core/errors').RcfError[]}
+ */
+export function scanTcScopeVsAc(tree, { tolerateUnclassified = true } = {}) {
+  const findings = [];
+  const acScope = new Map();
+  for (const us of tree.userStories ?? []) {
+    for (const ac of us.acceptanceCriteria ?? []) {
+      if (ac?.id) acScope.set(ac.id, ac.scope);
+    }
+  }
+  for (const ts of tree.testSuites ?? []) {
+    for (const tc of ts.testCases ?? []) {
+      if (!tc?.id || !tc?.acId) continue;
+      const tcScope = tc?.scope;
+      const acTag = acScope.get(tc.acId);
+      if (acTag === undefined || !isKnownScope(acTag) || acTag === 'unclassified') {
+        // The AC's own scope problem surfaces via scanAcScopeCoverage;
+        // this scan is silent for ACs the classifier could not read.
+        continue;
+      }
+      if (tcScope === undefined) {
+        findings.push(rcfError({
+          kind: 'validation',
+          message: `NV-BL-ADM-03: TC ${tc.id} on TS ${ts.id} carries no scope tag (bound AC ${tc.acId} is scope=${acTag})`,
+          documentId: tc.id,
+          field: 'scope',
+          rule: 'NV-BL-ADM-03',
+        }));
+        continue;
+      }
+      if (!isKnownScope(tcScope)) {
+        findings.push(rcfError({
+          kind: 'validation',
+          message: `NV-BL-ADM-03: TC ${tc.id} on TS ${ts.id} carries an unknown scope tag "${tcScope}"`,
+          documentId: tc.id,
+          field: 'scope',
+          rule: 'NV-BL-ADM-03',
+        }));
+        continue;
+      }
+      if (tcScope === 'unclassified') {
+        if (!tolerateUnclassified) {
+          findings.push(rcfError({
+            kind: 'validation',
+            message: `NV-BL-ADM-03: TC ${tc.id} on TS ${ts.id} still scoped "unclassified" after the migration window`,
+            documentId: tc.id,
+            field: 'scope',
+            rule: 'NV-BL-ADM-03',
+          }));
+        }
+        continue;
+      }
+      if (SCOPE_RANK[tcScope] < SCOPE_RANK[acTag]) {
+        findings.push(rcfError({
+          kind: 'validation',
+          message: `NV-BL-ADM-03: TC ${tc.id} scope "${tcScope}" is narrower than the AC ${tc.acId} scope "${acTag}"; a bound TC must be equal to or wider than the AC scope`,
+          documentId: tc.id,
+          field: 'scope',
+          rule: 'NV-BL-ADM-03',
+        }));
+      }
+    }
+  }
+  return findings;
+}

package/src/cli/create.js

@@ -261,7 +261,10 @@ export async function main(argv, deps = {}) {
       return 2;
     }
     body.acId = flags.ac;
-    options.slug = flags.slug ?? deriveSlug(body.description);
+    // 0.8.0 slug-train (w-2026-07-28-012 landmine 4): deriveSlug returns ''
+    // on empty derivation; TC keeps its historical 'tc' fallback locally
+    // rather than letting deriveSlug bake it in.
+    options.slug = flags.slug ?? (deriveSlug(body.description) || 'tc');
     options.testPointer = flags['test-pointer'];
   }
 

package/src/cli/read.js

@@ -119,7 +119,13 @@ function resolveTarget(tree, id) {
     const entry = (us.acceptanceCriteria ?? []).find((ac) => ac.id === id);
     return entry ? { doc: entry, containerId: parentId, invalid: false } : null;
   }
-  if (/^TC-\d{3}-[a-z0-9-]+$/.test(id)) {
+  // 0.8.0 slug-train (w-2026-07-28-012 landmine 3, consumer-path
+  // straggler): widened `\d{3}` -> `\d{3,}` in lockstep with rcf-schemas
+  // 0.4.3's TC pattern. Under the previous shape `rcf read TC-1000-x`
+  // fell through to the `return null` below (silent skip) even when the
+  // TC existed under a widened TS -- exactly the class the landmine
+  // charter names.
+  if (/^TC-\d{3,}-[a-z0-9-]+$/.test(id)) {
     const parentId = tree.parentByChild.get(id);
     if (!parentId) return null;
     const ts = tree.byId.get(parentId);

package/src/cli/test-suite.js

@@ -82,8 +82,13 @@ export async function main(argv, deps = {}) {
     stderr.write('[error] usage test-suite: verb required (provenance | approve)\n');
     return 2;
   }
-  if (!/^TS-\d{3}$/.test(tsId)) {
-    stderr.write(`[error] usage test-suite: expected a TS id like TS-015, got '${tsId}'\n`);
+  // 0.8.0 slug-train (w-2026-07-28-012 landmine 3, consumer-path
+  // straggler): widened `\d{3}` -> `\d{3,}` in lockstep with rcf-schemas
+  // 0.4.3's TS pattern. The previous shape hard-refused any TS >= 1000 --
+  // silent from the operator's perspective (the tsId matched the schema
+  // but the CLI verb refused with a usage error citing "TS-015").
+  if (!/^TS-\d{3,}$/.test(tsId)) {
+    stderr.write(`[error] usage test-suite: expected a TS id like TS-015 or TS-1000, got '${tsId}'\n`);
     return 2;
   }
 

package/src/core/store/loader.js

@@ -154,7 +154,10 @@ export async function loadDocument({ projectRoot, id }) {
  * discovery mechanism for tree topology (topology comes from parent-id
  * fields); this is just the load-time enumeration required to bring every
  * on-disk file into memory. Callers derive the document id from the
- * filename stem in upper case (per the layout convention).
+ * filename stem by upper-casing the PREFIX segment only (0.8.0
+ * slug-train, w-2026-07-28-012 landmine 1); slug tails stay verbatim
+ * because rcf-schemas 0.4.3 admits lower-case kebab tails on FBS / CN /
+ * ADR / TAC and a full-stem fold would silently detach the graph.
  *
  * Returns `{ files: string[] }` on success. Missing subdir returns
  * `{ files: [] }` (an empty children collection is a valid tree state).