rcf-lite 0.8.0 → 0.10.0

package/src/deployment/placeholder-detector.js

@@ -0,0 +1,113 @@
+// Canonical placeholder-credential-shape detector for the deployment-gate
+// class cure (spa-US-1132 / TAC-210, w-2026-08-24-006).
+//
+// The watchpost first production review (w-2026-08-24-005) shipped with
+// RESEND_API_KEY set to a placeholder value; the only login path (magic-link
+// email) was inert; sign-off still said DEPLOYED. The gap was filed as a
+// "quirk" note in status.md rather than blocked at gate time. This module
+// owns the one canonical placeholder shape catalogue rcf-lite ships so
+// downstream projects (via TAC-210 realisations) apply the same detector
+// - extending the ruleset is a rcf-lite minor bump, never a per-project
+// reinvention.
+//
+// The catalogue is deliberately narrow: only credential-shape strings a
+// developer would reasonably type as a stand-in ("YOUR_API_KEY_HERE",
+// "changeme", "xxx", empty). It does NOT try to classify all bad values;
+// entropy checks, provider-specific prefix rules, and format regexes live
+// in project-authored probes. This catalogue is what would have refused
+// the watchpost RESEND_API_KEY at gate time.
+
+/**
+ * @typedef {object} PlaceholderMatch
+ * @property {'empty'|'single-dash'|'null-token'|'you-here'|'named-stand-in'|'repeat-char'} pattern
+ *   The named pattern that matched. Callers surface this on their report
+ *   so a refusal message can name why.
+ */
+
+/**
+ * @typedef {object} PlaceholderVerdict
+ * @property {boolean} isPlaceholder     true when the value matches a placeholder shape
+ * @property {PlaceholderMatch['pattern']} [pattern]  the matched pattern name, when isPlaceholder is true
+ * @property {string} [reason]           a short refusal-message-ready reason string
+ */
+
+// Case-insensitive named stand-ins a developer would reasonably type. The
+// set is intentionally small; adding to it is a rcf-lite minor bump, and
+// the additions land in ONE place downstream projects inherit.
+const NAMED_STAND_INS = new Set([
+  'changeme',
+  'placeholder',
+  'example',
+  'test',
+  'dummy',
+  'fake',
+  'todo',
+  'tbd',
+  'sample',
+  'default',
+]);
+
+// `YOUR_X_HERE`, `your-key-here`, etc. Case-insensitive.
+const YOU_HERE_RE = /^your[_-].+[_-]here$/i;
+
+// Repeated single characters ("xxxx", "----", "0000") of length >= 3, or
+// the literal "xxx+" family common in scaffolds.
+const REPEAT_CHAR_RE = /^(.)\1{2,}$/;
+
+// Literal null-token strings that leak in when a resolver hands back a
+// nullish value stringified. `.env` files stringify unset values to the
+// empty string, but a JS resolver that String()s an undefined lands
+// "undefined" in the ship environment - that IS a placeholder, not a
+// live credential.
+const NULL_TOKENS = new Set(['null', 'undefined', 'none']);
+
+/**
+ * Detect whether `value` matches a placeholder-shape a credential value
+ * would never legitimately hold. Deterministic; case-insensitive against
+ * the named-stand-in catalogue and the `YOUR_X_HERE` pattern.
+ *
+ * The intent is a hard refusal filter, not a heuristic: every match is
+ * something a developer typed as a stand-in and forgot to replace. False
+ * positives are vanishingly unlikely; the shortest name-family entry is
+ * six characters ("dummy" being five is the shortest, and no real credential
+ * is a five-character English word); the repeat-char rule requires length
+ * >= 3 so a two-character hash prefix does not match.
+ *
+ * @param {unknown} value  the raw credential-field value at ship time
+ * @returns {PlaceholderVerdict}
+ */
+export function detectPlaceholderCredentialShape(value) {
+  // Non-strings are not credentials the shipped runtime carries; skip.
+  if (typeof value !== 'string') {
+    return { isPlaceholder: false };
+  }
+  const raw = value;
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) {
+    return { isPlaceholder: true, pattern: 'empty', reason: 'empty or whitespace-only credential value' };
+  }
+  if (trimmed === '-' || trimmed === '_') {
+    return { isPlaceholder: true, pattern: 'single-dash', reason: `credential value is the single-character stand-in "${trimmed}"` };
+  }
+  const lower = trimmed.toLowerCase();
+  if (NULL_TOKENS.has(lower)) {
+    return { isPlaceholder: true, pattern: 'null-token', reason: `credential value is the literal null-token string "${trimmed}"` };
+  }
+  if (YOU_HERE_RE.test(trimmed)) {
+    return { isPlaceholder: true, pattern: 'you-here', reason: `credential value matches the YOUR_X_HERE scaffold pattern: "${trimmed}"` };
+  }
+  if (NAMED_STAND_INS.has(lower)) {
+    return { isPlaceholder: true, pattern: 'named-stand-in', reason: `credential value is the named stand-in "${trimmed}"` };
+  }
+  if (REPEAT_CHAR_RE.test(trimmed)) {
+    return { isPlaceholder: true, pattern: 'repeat-char', reason: `credential value is a repeated-single-character stand-in "${trimmed}"` };
+  }
+  return { isPlaceholder: false };
+}
+
+/**
+ * The catalogue's stable identifier. Downstream probes surface this on
+ * their report so the gate-failure trail names which detector version
+ * refused the value. Extending the catalogue bumps this constant.
+ */
+export const PLACEHOLDER_DETECTOR_VERSION = '1.0.0';

package/src/design/writer.js

@@ -180,7 +180,7 @@ export async function writeMarkComplete({
     return rcfError({
       kind: 'usage',
       message: `design --mark-complete: refused - ${fbsId} designStage is missing: ${missing.join(', ')}. `
-        + 'Author the missing artefacts first via `rcf design ' + fbsId + ' journeys add ...`, `nav set ...`, or `theme-a11y set ...`.',
+        + 'Author the missing artefacts first via `rcf define design ' + fbsId + ' journeys add ...`, `nav set ...`, or `theme-a11y set ...`.',
       documentId: fbsId,
     });
   }
@@ -189,8 +189,8 @@ export async function writeMarkComplete({
     return rcfError({
       kind: 'usage',
       message: `design --mark-complete: refused - ${fbsId} designStage.${disagreement.designStagePath} = ${JSON.stringify(disagreement.designValue)} conflicts with uiBaseline.defaults.${disagreement.path} = ${JSON.stringify(disagreement.baselineValue)} and there is no operatorOptOuts entry. `
-        + 'Options: (1) change designStage to match, (2) rcf ui-baseline opt-out --field '
-        + disagreement.path + ' --reason "..." (project override), (3) rcf update '
+        + 'Options: (1) change designStage to match, (2) rcf discover ui-baseline opt-out --field '
+        + disagreement.path + ' --reason "..." (project override), (3) rcf define update '
         + fbsId + ' --set designStage.' + disagreement.designStagePath + '=... (per-FBS override).',
       documentId: fbsId,
     });

package/src/finalise/detect.js

@@ -1,36 +1,35 @@
-// rcf-verify install detection (spec §8.3, amendment 5 - install-together
-// posture). The finalise gate MUST detect whether `rcf-verify` is resolvable
-// and, when it is absent, prompt to install it - NEVER silently skip the ship
-// gate (the one behaviour §8.3 explicitly forbids).
+// rcf verify install detection (spec §8.3, amendment 5 - install-together
+// posture). The finalise gate MUST detect whether the `rcf` bin (which
+// carries the `verify` group) is resolvable and, when it is absent,
+// prompt to install rcf-lite - NEVER silently skip the ship gate (the
+// one behaviour §8.3 explicitly forbids).
 //
-// Two detection routes, in order, matching how the CLI is actually installed:
-//   1. The `rcf-verify` bin on PATH - the umbrella install exposes both `rcf`
-//      and `rcf-verify` as global bins (`npm i -g rcf-lite`).
-//   2. Package resolution from the project dir - the local-project install
-//      (`npm i rcf-lite` in a repo's node_modules). Two package specifiers
-//      are tried in order: the current umbrella `rcf-lite`, then the legacy
-//      `@stravica-ai/rcf-verify-lite` name (deprecated at 0.7.1 but still
-//      resolvable in lockfiles that pinned it). Either resolves to the same
-//      `bin/rcf-verify.js` entry point.
-// Either route yields a concrete invocation the finalise spawn (spawn.js)
-// uses verbatim. A miss returns { installed:false } and the caller enters
-// the prompt-or-explicit-flag path.
+// The 0.10.0 CLI reorganisation folded the standalone `rcf-verify` bin
+// into the umbrella `rcf` CLI as the `verify` group. Detection now
+// resolves the `rcf` bin exclusively; there is no legacy fallback.
+//
+// Two detection routes, in order:
+//   1. The `rcf` bin on PATH - the umbrella install exposes `rcf` as a
+//      global bin (`npm i -g rcf-lite`).
+//   2. Package resolution from the project dir - the local-project
+//      install (`npm i rcf-lite` in a repo's node_modules) resolves the
+//      `rcf-lite` package and its `bin/rcf.js` entry point.
+// Either route yields a concrete invocation the finalise spawn
+// (spawn.js) uses verbatim. A miss returns { installed:false } and the
+// caller enters the prompt-or-explicit-flag path.
 
 import { access, constants } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { delimiter, dirname, join, resolve } from 'node:path';
 
-// VERIFY_PACKAGE is the current install target and the name shown to
-// operators in absent-verify messaging. VERIFY_PACKAGE_LEGACY is only used
-// as a resolution fallback for lockfiles still pinning the pre-0.7.1 scoped
-// name; it is never displayed as an install target.
+// VERIFY_PACKAGE is the install target and the name shown to operators
+// in absent-verify messaging.
 const VERIFY_PACKAGE = 'rcf-lite';
-const VERIFY_PACKAGE_LEGACY = '@stravica-ai/rcf-verify-lite';
-const VERIFY_PACKAGE_CANDIDATES = [VERIFY_PACKAGE, VERIFY_PACKAGE_LEGACY];
-const VERIFY_BIN = 'rcf-verify';
+const VERIFY_PACKAGE_CANDIDATES = [VERIFY_PACKAGE];
+const VERIFY_BIN = 'rcf';
 
 /**
- * The concrete way to launch rcf-verify as a fresh subprocess.
+ * The concrete way to launch the `rcf` bin as a fresh subprocess.
  *   - `{ command: '<abs-bin>', prefixArgs: [] }` for a PATH / shim bin
  *     (its own shebang runs it).
  *   - `{ command: process.execPath, prefixArgs: ['<abs-entry.js>'] }` for a
@@ -43,8 +42,8 @@ const VERIFY_BIN = 'rcf-verify';
  */
 
 /**
- * Scan PATH for an executable named `rcf-verify` (plus the Windows
- * `.cmd`/`.exe` shim variants). Returns the first absolute path that exists
+ * Scan PATH for an executable named `rcf` (plus the Windows `.cmd` /
+ * `.exe` shim variants). Returns the first absolute path that exists
  * and is executable, or null.
  *
  * @param {string} name
@@ -78,16 +77,11 @@ export async function findOnPath(name, { env = process.env } = {}) {
 }
 
 /**
- * Resolve the rcf-verify bin entry point from a starting directory, following
- * the normal node_modules resolution the caller's project sees. Returns the
- * absolute path to `bin/rcf-verify.js`, or null if no candidate package is
+ * Resolve the `rcf` bin entry point from a starting directory, following
+ * the normal node_modules resolution the caller's project sees. Returns
+ * the absolute path to `bin/rcf.js`, or null if the package is not
  * installed / resolvable from there.
  *
- * Candidates are tried in the order defined by VERIFY_PACKAGE_CANDIDATES: the
- * current umbrella (`rcf-lite`) first, then the deprecated scoped name
- * (`@stravica-ai/rcf-verify-lite`) as a fallback for lockfiles pinned to it.
- * The first candidate whose bin resolves and exists on disk wins.
- *
  * @param {string} fromDir - directory to resolve from (the project root / cwd)
  * @returns {Promise<string|null>}
  */
@@ -119,9 +113,9 @@ export async function resolvePackageBin(fromDir) {
 }
 
 /**
- * Detect whether rcf-verify is resolvable and, if so, how to launch it.
- * Deps are injectable so the finalise gate can be exercised without a real
- * rcf-verify on the test machine.
+ * Detect whether the `rcf` bin (carrying the `verify` group) is
+ * resolvable and, if so, how to launch it. Deps are injectable so the
+ * finalise gate can be exercised without a real installed rcf-lite.
  *
  * @param {object} [deps]
  * @param {string} [deps.cwd] - project dir to resolve a local install from
@@ -148,4 +142,4 @@ export async function detectVerify(deps = {}) {
   return { installed: false, invocation: null };
 }
 
-export { VERIFY_PACKAGE, VERIFY_PACKAGE_LEGACY, VERIFY_PACKAGE_CANDIDATES, VERIFY_BIN };
+export { VERIFY_PACKAGE, VERIFY_PACKAGE_CANDIDATES, VERIFY_BIN };

package/src/finalise/index.js

@@ -11,7 +11,6 @@ export {
   findOnPath,
   resolvePackageBin,
   VERIFY_PACKAGE,
-  VERIFY_PACKAGE_LEGACY,
   VERIFY_PACKAGE_CANDIDATES,
   VERIFY_BIN,
 } from './detect.js';

package/src/finalise/install.js

@@ -1,5 +1,6 @@
-// Absent-verify handling (spec §8.3, amendment 5). When `rcf-verify` is not
-// resolvable, the finalise gate MUST NOT silently skip - that recreates the
+// Absent-verify handling (spec §8.3, amendment 5). When the `rcf` bin
+// (which now carries the `verify` group post-0.10.0) is not resolvable,
+// the finalise gate MUST NOT silently skip - that recreates the
 // false-confidence failure the whole programme exists to prevent. The
 // sanctioned paths are exactly two, and nothing else:
 //   - interactive TTY  -> prompt the operator to install now (y/N);
@@ -35,8 +36,8 @@ export function promptYesNo(question, { input = process.stdin, output = process.
 }
 
 /**
- * Install rcf-verify globally (matches the install-together default of two
- * global bins). Streams npm's output to the operator. Returns the install
+ * Install rcf-lite globally so the `rcf verify` group becomes
+ * resolvable. Streams npm's output to the operator. Returns the install
  * process exit code.
  *
  * @param {object} [deps]
@@ -77,11 +78,11 @@ export async function resolveAbsentVerify({ installFlag, isTty }, io, deps = {})
   let wantsInstall = false;
   if (installFlag) {
     // Explicit flag: the sanctioned non-interactive install path.
-    io.stdout.write(`[finalise] rcf-verify not found; installing ${VERIFY_PACKAGE} (--install-verify)...\n`);
+    io.stdout.write(`[finalise] the rcf CLI (with verify) not found; installing ${VERIFY_PACKAGE} (--install-verify)...\n`);
     wantsInstall = true;
   } else if (isTty) {
     // Interactive: prompt. Declining aborts (never a silent skip).
-    io.stderr.write(`[finalise] rcf-verify is not installed. The ship gate cannot run without it.\n`);
+    io.stderr.write(`[finalise] rcf-lite is not installed. The ship gate cannot run without it.\n`);
     wantsInstall = await prompt(`Install ${VERIFY_PACKAGE} now? [y/N]`, {
       input: io.input, output: io.output,
     });
@@ -89,7 +90,7 @@ export async function resolveAbsentVerify({ installFlag, isTty }, io, deps = {})
       return {
         action: 'abort',
         code: 4,
-        reason: `finalise refused: rcf-verify is required and install was declined. `
+        reason: `finalise refused: rcf-lite is required and install was declined. `
           + `Install it (npm i -g ${VERIFY_PACKAGE}) or re-run with --install-verify. `
           + `The ship gate is never skipped.`,
       };
@@ -100,7 +101,7 @@ export async function resolveAbsentVerify({ installFlag, isTty }, io, deps = {})
     return {
       action: 'abort',
       code: 4,
-      reason: `finalise refused: rcf-verify is not installed and no TTY is available to prompt. `
+      reason: `finalise refused: rcf-lite is not installed and no TTY is available to prompt. `
         + `Install it (npm i -g ${VERIFY_PACKAGE}) or re-run with --install-verify. `
         + `The ship gate is never silently skipped.`,
     };

package/src/finalise/spawn.js

@@ -1,9 +1,10 @@
-// Fresh-subprocess invocation of `rcf-verify run` (spec §8.2). This is the
-// load-bearing independence guarantee: build-lite's finalise step launches
-// verify as a SEPARATE OS PROCESS with the isolation env - it MUST NOT import
-// verify's engine in-process, because the verifier agent must start from a
-// cold session with zero build context (§9). The subprocess exit code is the
-// gate; findings flow back via the --out report file, never stdout scraping.
+// Fresh-subprocess invocation of `rcf verify run` (spec §8.2). This is
+// the load-bearing independence guarantee: build-lite's finalise step
+// launches verify as a SEPARATE OS PROCESS with the isolation env - it
+// MUST NOT import verify's engine in-process, because the verifier
+// agent must start from a cold session with zero build context (§9).
+// The subprocess exit code is the gate; findings flow back via the
+// --out report file, never stdout scraping.
 //
 // The isolation env (core's ISOLATION_RECIPE, §7.3) is layered onto the child
 // env here so the recipe travels with the process boundary exactly as §8.2
@@ -14,9 +15,11 @@ import { spawn } from 'node:child_process';
 import { isolationEnv } from '#core/isolation';
 
 /**
- * Assemble the `rcf-verify run` argument vector from finalise options.
- * Deterministic and pure so it is directly unit-testable; the exact shape is
- * the §8.2 invocation contract.
+ * Assemble the `rcf verify run` argument vector from finalise options.
+ * Deterministic and pure so it is directly unit-testable; the exact
+ * shape is the §8.2 invocation contract. The 0.10.0 CLI reorganisation
+ * prepends the `verify` group token; the run-verb arguments below are
+ * otherwise unchanged.
  *
  * @param {object} opts
  * @param {string} opts.repo - RCF chain source (the project root)
@@ -32,6 +35,7 @@ import { isolationEnv } from '#core/isolation';
  */
 export function buildVerifyArgs(opts) {
   const args = [
+    'verify',
     'run',
     '--repo', opts.repo,
     '--profile', opts.profile,
@@ -47,7 +51,7 @@ export function buildVerifyArgs(opts) {
 }
 
 /**
- * Spawn rcf-verify as a fresh subprocess and resolve with its exit code.
+ * Spawn `rcf verify run` as a fresh subprocess and resolve with its exit code.
  * stdio is inherited by default so the operator sees verify's live progress
  * and its verdict line; the report artifact is read separately by the caller.
  *

package/src/mcp/tools.js

@@ -69,7 +69,7 @@ const ISSUE_SCHEMA = {
 // success branch stays the verbatim envelope transcription (D8/D9).
 const ERROR_PAYLOAD_SCHEMA = {
   type: 'object',
-  description: 'Tool execution error payload (accompanies isError: true): the same issue shape rcf validate --json ships',
+  description: 'Tool execution error payload (accompanies isError: true): the same issue shape rcf define validate --json ships',
   properties: {
     ok: { const: false },
     errors: { type: 'array', items: ISSUE_SCHEMA },

package/src/query/formatters/table.js

@@ -122,7 +122,7 @@ function formatTraceTable(result) {
     lines.push(`${directionLabel}: (none)`);
   } else {
     for (const n of showList) {
-      rows.push([String(n.depth), n.id, n.kind, cellTitle(n.id)]);
+      rows.push([String(n.depth), n.id, n.kind, n.title ?? '']);
     }
     lines.push(renderTable(rows));
   }
@@ -139,7 +139,7 @@ function formatBothTraceTable(result) {
     lines.push('  (none)');
   } else {
     const rows = [['Depth', 'Id', 'Kind', 'Title']];
-    for (const n of ancestors) rows.push([String(n.depth), n.id, n.kind, '']);
+    for (const n of ancestors) rows.push([String(n.depth), n.id, n.kind, n.title ?? '']);
     lines.push(renderTable(rows));
   }
   lines.push('');
@@ -151,7 +151,7 @@ function formatBothTraceTable(result) {
     lines.push('  (none)');
   } else {
     const rows = [['Depth', 'Id', 'Kind', 'Title']];
-    for (const n of descendants) rows.push([String(n.depth), n.id, n.kind, '']);
+    for (const n of descendants) rows.push([String(n.depth), n.id, n.kind, n.title ?? '']);
     lines.push(renderTable(rows));
   }
   return `${lines.join('\n')}\n`;
@@ -194,10 +194,7 @@ function renderTable(rows) {
   return [out[0], sep, ...out.slice(1)].join('\n');
 }
 
-// Placeholder for future title lookup - the pure trace result does not
-// carry doc bodies, so title columns render blank unless the caller
-// passes a title source. Left here for the trace `Title` column so the
-// column stays if we ever wire in a title map without a schema change.
-function cellTitle(_id) {
-  return '';
-}
+// Trace nodes carry `title` as of the paper-cut batch (previously the
+// Title column was always empty). Doc-kind title source: PRD →
+// productName, REQ/US/TAC/ADR/TAD/TS/FBS/CN → title, inline AC/TC →
+// description. Nodes lacking a title render blank.

package/src/query/trace.js

@@ -32,6 +32,7 @@
  * @property {string} id
  * @property {string} kind
  * @property {number} depth - 0 for pivot; positive for descendants; negative for ancestors
+ * @property {string} title - display title, or '' when the node has none
  */
 
 /**
@@ -71,6 +72,41 @@ export function kindOf(tree, id) {
   return null;
 }
 
+/**
+ * Return the display title for an id, or '' when the node carries none.
+ * Different doc kinds carry the title on different fields (PRD →
+ * productName; inline AC/TC → description; everything else → title). A
+ * standalone doc that lacks its title field renders blank rather than
+ * throwing; that keeps trace output readable on a partially-authored tree.
+ *
+ * Inline lookup: AC / TC nodes live inside their parent's inline array
+ * (userStory.acceptanceCriteria[] / testSuite.testCases[]), not as
+ * standalone entries in `tree.byId`. Resolve via parentByChild.
+ *
+ * @param {object} tree - walker TreeModel
+ * @param {string} id
+ * @param {string} kind - as returned by `kindOf`
+ * @returns {string}
+ */
+export function titleOf(tree, id, kind) {
+  if (kind === 'ac') {
+    const usId = tree.parentByChild.get(id);
+    const us = usId ? tree.byId.get(usId) : null;
+    const ac = us?.acceptanceCriteria?.find((a) => a?.id === id);
+    return ac?.description ?? '';
+  }
+  if (kind === 'tc') {
+    const tsId = tree.parentByChild.get(id);
+    const ts = tsId ? tree.byId.get(tsId) : null;
+    const tc = ts?.testCases?.find((t) => t?.id === id);
+    return tc?.description ?? '';
+  }
+  const doc = tree.byId.get(id);
+  if (!doc) return '';
+  if (kind === 'prd') return doc.productName ?? '';
+  return doc.title ?? '';
+}
+
 /**
  * Compute a trace from `id` in the requested direction. Unknown pivot
  * returns `{found: false}`; the handler layer converts this to exit 2.
@@ -134,7 +170,7 @@ export function computeTrace(tree, {
  */
 function walkForward(tree, pivot, pivotKind, includeCode = false, expandFbsDependents = false) {
   /** @type {TraceNode[]} */
-  const nodes = [{ id: pivot, kind: pivotKind, depth: 0 }];
+  const nodes = [{ id: pivot, kind: pivotKind, depth: 0, title: titleOf(tree, pivot, pivotKind) }];
   /** @type {TraceEdge[]} */
   const edges = [];
   const seen = new Set([pivot]);
@@ -158,7 +194,12 @@ function walkForward(tree, pivot, pivotKind, includeCode = false, expandFbsDepen
       if (!childKind) continue;
       const nextDepth = curDepth + 1;
       depthById.set(child.id, nextDepth);
-      nodes.push({ id: child.id, kind: childKind, depth: nextDepth });
+      nodes.push({
+        id: child.id,
+        kind: childKind,
+        depth: nextDepth,
+        title: titleOf(tree, child.id, childKind),
+      });
       queue.push(child.id);
     }
   }
@@ -178,7 +219,7 @@ function walkForward(tree, pivot, pivotKind, includeCode = false, expandFbsDepen
  */
 function walkBack(tree, pivot, pivotKind) {
   /** @type {TraceNode[]} */
-  const nodes = [{ id: pivot, kind: pivotKind, depth: 0 }];
+  const nodes = [{ id: pivot, kind: pivotKind, depth: 0, title: titleOf(tree, pivot, pivotKind) }];
   /** @type {TraceEdge[]} */
   const edges = [];
   const seen = new Set([pivot]);
@@ -188,7 +229,7 @@ function walkBack(tree, pivot, pivotKind) {
     const k = kindOf(tree, toId);
     if (!k) return;
     seen.add(toId);
-    nodes.push({ id: toId, kind: k, depth });
+    nodes.push({ id: toId, kind: k, depth, title: titleOf(tree, toId, k) });
     edges.push({ from: fromId, to: toId, kind: edgeKind });
   };
 

package/src/req-baseline/gate.js

@@ -73,7 +73,7 @@ export function formatStage1RefusalMessage({ fbsId, usId, reqId, openCandidates
     const short = shortDescription(c.canonicalText);
     lines.push(`          ${c.baselineKey}: ${short}`);
   }
-  lines.push(`        Resolve: rcf req-baseline sweep --req ${reqId}`);
+  lines.push(`        Resolve: rcf discover req-baseline sweep --req ${reqId}`);
   return lines.join('\n');
 }
 

package/src/ui-baseline/manifest-writer.js

@@ -210,14 +210,14 @@ export async function writeUiBaselineOptOut({
   if (!priorBaseline) {
     return rcfError({
       kind: 'usage',
-      message: 'ui-baseline opt-out: no uiBaseline record exists yet; run \'rcf ui-baseline init\' first.',
+      message: 'ui-baseline opt-out: no uiBaseline record exists yet; run \'rcf discover ui-baseline init\' first.',
     });
   }
   const normalisedField = String(field).startsWith('defaults.') ? String(field).slice('defaults.'.length) : String(field);
   if (typeof isKnownField === 'function' && !isKnownField(normalisedField)) {
     return rcfError({
       kind: 'usage',
-      message: `ui-baseline opt-out: unknown baseline field '${normalisedField}' (see 'rcf ui-baseline show' for the field list).`,
+      message: `ui-baseline opt-out: unknown baseline field '${normalisedField}' (see 'rcf discover ui-baseline show' for the field list).`,
     });
   }
   const isoNow = now.toISOString();

package/src/verify/cli/cleanup.js

@@ -9,7 +9,7 @@ import { formatError, isRcfError } from '#core/errors';
 
 import { readProvisionFile, cleanup } from '../provision/index.js';
 
-export const HELP = `Usage: rcf-verify cleanup --provision <file> [--url <app-url>]
+export const HELP = `Usage: rcf verify cleanup --provision <file> [--url <app-url>]
 
 Tear down artefacts recorded in the --provision file (all prefixed
 'zzverify-'). Reports what was removed and what could not be.

package/src/verify/cli/mcp.js

@@ -14,7 +14,7 @@ import { createToolRegistry } from '../mcp/tools.js';
 
 const here = dirname(fileURLToPath(import.meta.url));
 
-export const HELP = `Usage: rcf-verify mcp [options]
+export const HELP = `Usage: rcf verify mcp [options]
 
 Serve verify over the Model Context Protocol (local stdio). Exposes one tool,
 rcf_verify_run, over the same in-process engine the CLI uses. stdout carries

package/src/verify/cli/provision.js

@@ -11,7 +11,7 @@ import { formatError, isRcfError } from '#core/errors';
 import { readChain } from '../chain/index.js';
 import { runProvisioning } from '../provision/index.js';
 
-export const HELP = `Usage: rcf-verify provision --repo <path> --url <app-url> --provision <file>
+export const HELP = `Usage: rcf verify provision --repo <path> --url <app-url> --provision <file>
 
 Stand up prerequisite accounts / sandboxes / seed data for a later run.
 Credentials are written to the --provision FILE only, never echoed.

package/src/verify/cli/report.js

@@ -11,7 +11,7 @@ import { formatError, isRcfError } from '#core/errors';
 import { parseReport } from '../report/index.js';
 import { renderReport } from '../report/renderer.js';
 
-export const HELP = `Usage: rcf-verify report <report-path> [--json]
+export const HELP = `Usage: rcf verify report <report-path> [--json]
 
 Re-render a prior report artifact. Default output is the human-readable
 summary; --json re-emits the parsed artifact as JSON.

package/src/verify/cli/run.js

@@ -29,7 +29,7 @@ const OPTION_SPEC = {
   help: { type: 'boolean' },
 };
 
-export const HELP = `Usage: rcf-verify run [options]
+export const HELP = `Usage: rcf verify run [options]
 
 Launch a fresh-context adversarial verifier against a running app and emit a
 structured verdict stamped with the runtime it ran against.

package/src/view-supervisor/manifest-writer.js

@@ -19,13 +19,13 @@ export const DEFAULT_PID_PATH = '.rcf/view-server.pid';
  */
 export const viewServerGitignoreEntry = Object.freeze({
   path: '.rcf/view-server.pid',
-  owner: 'rcf view --detach (view-server pid file)',
+  owner: 'rcf audit view --detach (view-server pid file)',
   since: '0.7.0',
 });
 
 export const viewServerLogGitignoreEntry = Object.freeze({
   path: '.rcf/view-server.log',
-  owner: 'rcf view --detach (supervisor log)',
+  owner: 'rcf audit view --detach (supervisor log)',
   since: '0.7.0',
 });