RCF Lite changelog: what's new

Read the full changelog details for technical notes on every release.

Run rcf version --check to check your installed version. RCF Lite is still 0.x; minor releases can include breaking changes.

0.36.1, 23 October 2026

A fix release for feedback and rcf verify run. The agent sessions rcf-lite launches itself, such as the verifier that rcf verify run starts against a URL, now run with the feedback ask off, so your project's feedback hook stays quiet inside them. The agent there can still record an entry, and your own sessions keep the ask. rcf verify run --out takes a file path: a directory now exits 2 before the run starts, instead of failing after it. In a linked git worktree, a feedback entry is now recorded in the main checkout's .rcf/feedback/, so it is still there after git worktree remove. That needs the main checkout to ignore .rcf/feedback/: until it does, rcf feedback add in the worktree exits 2 and points at rcf doctor --fix. A queue the worktree already holds moves into the main checkout on the next rcf feedback command run in the worktree once the main checkout ignores the store. The store is now locked while a command writes to it, so feedback commands and hooks running at the same time keep every entry, ask record and bundle. A command still waiting on another one after 10 seconds exits 1, names that command's process id and writes nothing. Two bundles written in the same second are both kept. rcf define create ac now keeps the criterion's scope field from a --from-file body. Known issue: removing a linked worktree before the main checkout ignores .rcf/feedback/ still loses the queue that worktree holds. Run rcf doctor --fix in the main checkout first, then any rcf feedback command in the worktree, and only then remove the worktree. Action: not breaking, and no rcf init rerun is needed: the managed agent-instructions block and the @stravica-ai/rcf-schemas 0.9.0 pin are unchanged since 0.36.0. Run rcf doctor --fix in each main checkout so it ignores .rcf/feedback/ before you remove a linked worktree that holds a queue. Criteria an earlier rcf define create ac --from-file wrote without their scope are not repaired, so check whether any of them need it added back.

0.36.0, 22 October 2026

Finalise now runs on the pull-request branch, before the merge. rcf build finalise <fbs-id> --ci-run <ref> promotes on any branch whose HEAD contains the head the Test-stage report names, so the verified status is committed on the branch and the merge carries it to the default branch. Finalise no longer refuses a working tree that is off main or master. Once the work lands with a merge commit, running it again on the default branch confirms the status and writes nothing; a squash merge is not covered by that promise. --ci-run now names the CI run that passed on the pull-request head the report names, and finalise records it without fetching it. A local server can now carry an item to verified. Finalise accepts a report against a loopback target (localhost, *.localhost, 127.0.0.0/8, ::1 or 0.0.0.0) when the report names the engine that served the app, the port, and the served commit, and that commit is the report's own head. rcf verify run --hand records all three: against a loopback --url it now needs --engine <name> and --served-sha <sha>, exits 2 without them, and exits 4 when the served sha is not the full sha of the committed HEAD. Neither flag applies to the packed-package targets, where both exit 2 before anything is packed or installed. Close the loop without a deploy now walks the local route first. Finalise is also stricter about the report it reads. It refuses, with exit 4, a report that is not committed at HEAD, one whose bytes on disk differ from the committed copy, a --report path outside the project root, and a path read through a symbolic link. On a merged or fast-forwarded head it still checks that the verifier is not also a builder. --allow-pre-merge is deprecated: it is accepted, prints one warning and changes nothing. The guidance, the build-cycle playbook, the bundle runbook and the managed agent-instructions block now say Finalise runs on the pull-request branch before the merge. Action: breaking. Add --engine <name> --served-sha <sha> to any rcf verify run --hand against a loopback URL in your scripts and CI, or it exits 2. A finalise that passed on 0.35.0 can now be refused when its report is uncommitted, edited on disk, outside the project or reached through a symbolic link. Then rerun rcf init or run rcf doctor --fix: the managed agent-instructions block changed, so rcf doctor reports a stale hash until it is refreshed. The @stravica-ai/rcf-schemas 0.9.0 pin is unchanged, and trees from 0.35.0 need no schema migration.

0.35.0, 20 October 2026

The five build stages now run with a hand per stage, and verification moves out of Finalise into the Test stage. The verifier hand runs rcf verify run --fbs <fbs-id> --hand verifier against the preview or version host serving the reviewed head. The run writes a VerifyReport v1 to rcf/verify-reports/<fbs-id>/<head12>.json, prints verify report: <path> <verdict> <verified>/<total>, and the report is committed before the merge. A working tree dirty outside rcf/verify-reports/ is refused, and so is a second report for the same head unless --replace "<reason>" says why. rcf build finalise <fbs-id> --ci-run <ref> then ingests that report and writes verified without running verify; it spawns nothing but git lookups. Promotion needs the CI run that passed on the merged head, the FBS at complete on the default branch with a Code Node on every bound criterion, and a report whose head the merged head contains, whose target is not loopback, whose hand is verifier with a --verifier-id that no builder commit carries as its Hand-Id:, which finished within --max-report-age days (default 7), and whose verdict is PASS with ship authority. A report against localhost can no longer promote, so a local server does not close the loop on its own any more; Close the loop without a deploy is rewritten for the new routes. Without --ci-run finalise refuses with exit 4, and with no report it refuses with exit 4 and names the verify command to run. The packed package is now a verify target. rcf verify run --artefact <tgz> --fbs <fbs-id> --hand verifier installs the tarball in a scratch project, runs the test files the FBS's test cases point at with node --test against the installed package, and records each criterion as pass, fail, skipped or critique-only, with the raw TAP and the install log beside the report. --package <dir> packs the artefact from the committed HEAD first, inside an exported copy, so ignored files and lifecycle-script output never reach the project; it refuses a dirty tree and a directory outside the repository. --offline installs from the local npm cache only and is refused outside package target mode. Package mode is deterministic and never spawns the agent CLI. Hand separation gets its own check. rcf audit separation reads each non-merge commit's Hand: trailer (test-author, builder, reviewer, verifier, stage-keeper or mixed) over a pull request's range and judges it against the path classes the commit touches: tests, criteria, production code, verifier evidence, stage-keeper files, and neutral paths such as lockfiles and Markdown outside rcf/. A Hand: mixed commit passes as an exception only with a non-empty Separation-Reason: trailer, rcf/separation.json overrides the default classes, --require-hand also fails a commit with no Hand: trailer and a builder commit with no Hand-Id:, and a shallow clone is refused. It prints one PASS or FAIL line (or --json rows) and exits 4 on a violation. rcf-lite's own CI runs it on every pull request; it is not added to your project's CI for you. Two more guards close the cycle. With rcf/define/backstop.json present, rcf build bundle --next refuses with exit 4 while a merged spec inside the window is complete and not yet verified; --allow-unverified "<reason>" proceeds for one call and records the reason, and rcf build backstop adopt --from <fbs-id> switches the backstop on from that build item. Acceptance criteria can carry a probe (a method and path plus at least one status, header, body or selector expectation, and an optional parityEnv), set with rcf define update <us-id> --ac <ac-id> --probe <json> or listed in rcf/verify-catalog.json, and rcf verify run --mode deterministic resolves each one to pass, fail or skipped with evidence. A probe with no assertion, or an empty or whitespace-only one, fails as "missing assertion" instead of passing, and rcf define validate refuses it with exit 3. --parity-env now takes an environment name, and a probe whose parityEnv does not match it is recorded skipped. The @stravica-ai/rcf-schemas pin moves from 0.7.0 to 0.9.0. The guidance, the bundle's closing runbook and the managed agent-instructions block state the contract stage by stage: the test-author writes the AC-based and E2E tests at Define, the builder writes production code, Code Nodes and code-hygiene unit tests at Build, the reviewer runs the scoped gate and rcf audit separation at Review, the verifier runs and commits the verify report at Test, and the stage-keeper merges on a Review MERGE and a Test PASS, then runs rcf build finalise <fbs-id> --ci-run <ref> at Finalise. The repository README names audit as the fifth verb. Two temporary-directory leaks are fixed, in the git blueprint-library fetcher and the docker-compose-host compose-config-lint probe. Action: breaking. Sweep your scripts, CI and docs for the old finalise forms: --mode, --url and the other verify flags on rcf build finalise now exit 2, and a finalise without --ci-run exits 4. Move the verify run to the Test stage with --hand verifier, commit the report, and pass --ci-run at Finalise. Then rerun rcf init or run rcf doctor --fix: the managed agent-instructions block changed, so rcf doctor reports a stale hash until it is refreshed. Trees from 0.34.x need no schema migration, because probes are new in this release.

0.34.2, 15 October 2026

A viewer fix. Following a Readiness or Coverage Trace link that named an item took you to the Requirements tab instead of the Trace sub-view the link pointed at: the hash #tab=readiness&sub=trace&entity=<docId> activated Readiness and mounted Trace, and then the shared entity-redirect branch resolved the item id to Requirements and swapped the panel out from under you. The redirect now short-circuits when the sub value names Trace, with the sub value normalised once at hash parse and four spelling cases covered. Action: no migration needed. The managed agent-instructions block and the @stravica-ai/rcf-schemas 0.7.0 pin are unchanged since 0.34.1, so no rcf init rerun is needed.

0.34.1, 14 October 2026

rcf build finalise can now ship a chain whose prerequisites are supplied out of band. The gate accepts --provision-mode run|skip and forwards it verbatim to the fresh rcf verify run subprocess, so an admin-seeded tree verified with --provision-mode skip and ship authority can promote; without the flag the subprocess uses the verify default and nothing changes for a normal run. Every finalise report now carries provisioning.mode and run.verify { command, prefixArgs, source, version }, so a promoted tree records how the prerequisites were handled and which rcf binary did the verifying. A report that cannot be stamped with the verify record is never promoted: finalise stops before any gate evaluation with exit 1, names the record, the report path and the FBS on stderr, and leaves the FBS unchanged. detectVerify now resolves the verifier package-first (the rcf-lite package finalise runs from, then a project-local install), with PATH as the documented fallback, so an isolated project install stops spawning a stale global that would exit 2 on the newer arguments. Viewer user-story pages drop absent optional parts instead of rendering whitespace-only lines; the renderer now assembles its line list and leaves absent parts out, and the viewer golden is regenerated with no other byte change. Action: no migration needed. The report fields are additive, the report schema version is unchanged, and the managed agent-instructions block and the @stravica-ai/rcf-schemas 0.7.0 pin are unchanged since 0.34.0, so no rcf init rerun is needed.

0.34.0, 13 October 2026

Verification scopes to one build unit by default. rcf build finalise <fbs-id> passes its own FBS to the fresh verify subprocess as the acceptance-criterion filter, so finalising one build unit costs one unit's verification instead of walking the whole tree; on an estate tree a two-FBS finalise used to verify 1,124 criteria. rcf verify run gains a repeatable --fbs <id> filter (a comma list is accepted) that narrows per-AC verdicts, provisioning, the adversarial brief, the deterministic skip ledger and the EVAL coverage line to the scoped set, and the report carries run.scope (chain or fbs:<ids>) and run.scopeAcCount. Pass --all on finalise to verify the whole chain at the end of a slice; an FBS with no bound acceptance criteria is refused before verify launches with exit 3, and the ADR-4112 verified invariant evaluates over the scoped set so an agent-mode run with a blocked AC and passing findings elsewhere no longer promotes. The brief composer now carries the canonical criterion text whichever field holds it (the given, when and then triplet wins when all three parts are non-empty, otherwise description wins) and refuses an empty criterion as a hard validation failure (exit 3) rather than running the adversarial walk against nothing. Skipped provisioning is now documented on rcf verify run --provision-mode skip, disclosed on report.provisioning.mode, and the human renderer calls out when prerequisites were supplied out of band. Discovery gains a D0 stage. rcf discover journey writes the project's journey record at rcf/discovery/journey.json: add --from <path> parses one source in the line grammar, import --from <path> parses a journey-map document in the designer prose shape, check walks the record and emits a stable discovery hash, declare --ui <none|light|central> records the UI posture (lowering a prior declaration is refused without --reason), review summarises the record and stamps a review sealed by the discovery hash on a pass of the structural check list, and show prints every journey with its steps, interruption answers and review state. Ids are minted by slug with a high-water mark; a hand-supplied id is refused. D0 is the first blocking DEFINE readiness stage: while the gate fails, rcf define ledger brief add, rcf define create and rcf define blueprint add refuse with exit 4 before any id is minted, and the matching MCP tools surface the same refusal. Build units can name the journey steps they build (journeyStepIds), and a per-step execution state is derived from the least-advanced bound unit; rcf build queue, the build bundle and rcf build review carry the derived state and surface unbound UI-bearing steps. A fully built tree now reads as a terminal readiness pass: checkD8Freeze emits freeze:queueEmptyAllBuilt on an empty-but-done queue, so rcf define freeze stops refusing when there is nothing left to build. The @stravica-ai/rcf-schemas pin moves from 0.6.3 to 0.7.0 as an additive change; the schema $id URLs stay at v0.6.0. Action: rerun rcf init after installing. The managed agent-instructions block gained the journey review rule, so rcf doctor reports a stale hash until the block is refreshed. Existing chain files need no migration, and existing trees without a journey record are grandfathered through the D0 gate; an unreadable or invalid record is never grandfathered. The finalise default narrows the verified set and --all restores the previous whole-chain run.

0.33.0, 9 October 2026

The tree viewer's Readiness tab becomes the command page. Questions and Blocking are paired, read-only tables with a stage and persona filter bar, a copy-for-your-agent control, and a #tab=readiness&...&entity=<itemId> hash scheme that lands on a single row. A coverage summary adds a stacked bar, six family stat tiles and an unresolved-pointers table; a thin-requirements table widens to five reasons (reqHasUs, usFloors, reqIntent, zeroCriteria, uncoveredAc) plus resolvedBy. The layout gains a stage-by-delta overview grid, five sub-tabs across Overview, Questions, Blocking, Coverage and Trace, and six count tiles for what the latest change added, changed, removed and impacted. A per-pivot Trace matrix with rows for every user story and acceptance criterion under the pivot replaces the per-REQ Mermaid slice; cells carry reach and resolution without a new palette token. The engineer blocker cards, the stage chips, the 20-id slice and the engineer coverage block all retire; the freeze state renders in plain words that name the gates that are failing and what resolves them. Three new viewer JSON routes come with the Readiness changes: GET /trace.json?id=<id>&direction=<forward|back|both>, GET /impact.json?id=<id> and GET /coverage.json?scope=<id>. Each is served application/json with cache-control: no-store, keyed in a per-version cache that is replaced wholesale on every rewalk, so a new tree version never serves a previous version's bytes. /trace.json grows an additive opt-in ?includeCode=1 for the matrix; the default is unchanged for every pre-0.33.0 caller. The three routes answer even on a tree that fails admissibility, and nothing is written under rcf/. rcf verify run and rcf build finalise gain a deterministic mode. rcf verify run --mode deterministic and the same flag on rcf build finalise run an in-process verifier that probes HTTP reachability and records every testable acceptance criterion as critique-only on blockedAcs[], so a dispatched worker that cannot spawn the agent CLI still produces a report and refuses promotion honestly. The pre-existing agent mode (--mode agentScreenshotCritique) stays the default, so existing runs are unchanged. Two live-viewer fixes finish the release. On Linux Node's recursive fs.watch reports the first rename over a file then goes permanently blind to that path, so editors that save by write-temp-then-rename (vim backupcopy=no, JetBrains safe-write) silently stalled the live viewer until restart; the watcher now re-arms the affected base on each rename and coalesces a burst into one re-arm per flush. A change that arrived mid-rewalk previously got dropped silently; it now sets a trailing flag so exactly one trailing walk picks up the final state. Fatal watcher and walker errors always reach stderr even when --verbose is off. Action: for embedders of the viewer under /rcf-viewer/*, add /trace.json, /impact.json and /coverage.json to the reverse-proxy allow-list before pinning to 0.33.0; without the allow-list the Readiness Trace sub-view cannot fetch its data. The embed contract and the rcf-view-theme postMessage are unchanged. Under embed=1 the standalone theme control stays absent and the rcf-view:v1:theme key is never read or written. The @stravica-ai/rcf-schemas 0.6.3 pin is unchanged and the managed agent-instructions block did not move, so no rcf init rerun is needed.

0.32.5, 7 October 2026

The dogfood walker in test/rcf-tree.test.js now ignores rcf/define/ the same way the ledger module writes to it, so the first rcf define ledger brief add on a fresh tree no longer blows up three dogfood assertions. A new packages/rcf-lite/guidance/discovery/ (plus a companion packages/rcf-lite/docs/discovery/) gives discovery briefs, prototype notes and infographic sketches a predictable home outside the locked methodology inventories; the three locked slug lists stay untouched, so an in-package methodology addition still requires a coordinated test change. Action: no migration needed.

0.32.4, 7 October 2026

Stop-word follow-up to 0.32.3. 0.32.3 moved the English stop-word skip onto the dot-notation branch but left the prose <name> field and fields: <name> branches with no stop-word filter at all, so a sentence-ending fields: the ... still fed the word the to the D6 extractor and false-failed one real tree. The broader English stop-word set (the, a, an, and, or, of, to, in, on, for, with, by, from, at, as, is, are, be, this, that, these, those, it, its, not, no, all, any, each, per, via, into, than, then, when, which, who, whom, where, while) now applies on patterns 2 and 3 as well, together with the file-extension skip and the path-context lookbehind. Pattern 3 also walks a comma-separated list after fields:, so a prose required fields: userID, email, createdAt yields every token it names, not only the first after the colon. Action: no migration needed.

0.32.3, 7 October 2026

Hotfix for the 0.32.2 D6 consistency:unsatisfiable regression. 0.32.2's pattern 4 (dot notation) read any <PascalCase>.<lowercaseWord> match in an acceptance-criterion then clause as a record field, which treated filename stems (CLAUDE.md, AGENTS.md), non-shape PascalCase dot phrases (Math.random, TEST_USERS.admin) and sentence-ending dots (Foo.the) as record-field references. Pattern 4 is now gated on the head to the left of the dot resolving to a recordShape name declared somewhere in the tree. Three belt-and-braces guards stay in behind the shape-name gate: an English stop-word skip on the field token, a closed file-extension skip and a two-character path-context lookbehind. Patterns 1 to 3 and the AC-12113-2 class are preserved. Action: no migration needed.

0.32.2, 6 October 2026

D6 consistency:unsatisfiable stops reading backticked enum values, query-string parameter names, sort and filter literals, env-var names and config knobs as record-shape field names. Pattern 1 (bare backticked identifier) is now context-gated: ALL_CAPS tokens are skipped unconditionally, and other backticked tokens count only when a field-signalling word (set, write, include, return, contain, is set, is written, equals, holds, field, record shape, response body, request body, payload, envelope) sits within a short neighbourhood and no explicit non-field context (query parameter, sort order, filter mode, enum value, env var, config knob, header name, CLI flag) overlaps the same neighbourhood. A new pattern 4 adds <ShapeName>.<fieldName> dot notation as a schema-style field reference. Patterns 2 and 3 are unchanged, and the AC-12113-2 class is unchanged: a then-clause that names a real undefined field still fails. --dry-run on rcf discover req-baseline opt-out and rcf define ledger concerns add now writes nothing. Both verbs accepted the flag but wrote the opt-out record and the appended concern entry to disk anyway, mutating viewer clones on rehearsal runs; a dry-run now emits a [dry-run] preview line (or a {dryRun: true, ...} payload with --json) and exits 0 without touching rcf/. Action: no migration needed.

0.32.1, 6 October 2026

Two fixes merged since 0.32.0 as a hotfix. The viewer's Readiness tab D3 shapes:pathsResolve now agrees with the CLI by threading resolvedPaths through the viewer compute, so a TAC interface path: token that resolves on disk stops false-failing on the Readiness tab when the CLI and freeze pass D3. D5 crosscut:operationalConcerns now reads the structured ac.scope === "deployed" as well as the legacy [deployed] marker, so a tree that carries scope as the schema-canonical field no longer silently passes 0/0 while TAD.operationalConcerns is empty. Action: no migration needed.

0.32.0, 6 October 2026

Four readiness and viewer fixes merged since 0.31.0 as one release. D6 consistency:orphanInterfaces now accepts the schema-canonical object-shape REQ.deliveredBy, so interfaces on blueprint TACs with no acceptance-criterion ownerRef stop reading as orphans; the walk now also handles {tacId, adrId?, field?} and routes field: interfaces[<name>] to the single named interface. D3 shapes:pathsResolve inside rcf define freeze now pre-resolves TAC interface path: tokens the way readiness does, so freeze no longer false-fails every repo-relative path the engineer named on a TAC interface description. The viewer's SSE tree-update resync preserves the active tab for every main tab including Readiness; the tab list is derived from the server-rendered nav.tabs itself so a future tab added to the renderer cannot be forgotten. The audit view header keeps the tabs visible under long project names (the shrink budget moved onto .product, and nav.tabs plus .tools are pinned not to shrink) and now prefers prd.productName for the display name, which is editable with rcf define update PRD-001 --set productName=<value>. One blueprint change rides along: the deploy-cloudflare-workers AC-12113-2 wording was reworded so D6 consistency:unsatisfiable stops reading "absent" as a field name; the field reference now names the real WranglerAssetsBlock field. Action: no migration needed.

0.31.0, 5 October 2026

The tree viewer gets a Light, Dark and Auto theme control in the header when you run it standalone, and remembers your choice across reloads. Under embed=1 the control is absent, nothing is stored and the rcf-view-theme message from the embedding host works exactly as before. The FIND button and the ID lookup modal are now readable on hover and focus in dark, and a new WCAG 2.1 AA contrast test checks every colour pair in both themes and blocks any change that drops one below the floor. DEFINE step 3 rulings R1 to R13 are all in. Every tree-wide readiness check (draft markers, entity joins, standards citations, the Deploy ADR, and the security and operational sections) now runs before any scope short-circuit, so a narrowed scope still reports a problem anywhere in the tree. A stage whose scope is empty but whose tree-wide check fails now reads failing (or acknowledged where an ack at the current hash applies) rather than notApplicable, and shapes:draftSettled is tree-wide. A standards:<pack> concern-ledger entry marked applied now satisfies skeleton:standardsCited, and bare repo names such as Dockerfile and Makefile are checked as paths. Write-backs that carry an id are idempotent. rcf define create <kind> --id and rcf define ledger <name> add --id exit 0 and write nothing when the same id comes back with the same content, and exit 3 naming the differing fields when the content differs. Action: harnesses or CI that pass --id to rcf define create should treat exit 3 as a hard refusal (previously an existing id refused with exit 2) and use rcf define update to change content at an existing id. Anything that reads the readiness envelope should expect failing where a scope-empty stage used to report notApplicable, and a [draft] marker outside the D3 scope now fails D3. The managed agent-instructions block did not change, so no rcf init rerun is needed.

0.30.0, 3 October 2026

The DEFINE step 3 gates now bite. rcf define readiness --check exits 4 on a failing D3 (interface shapes), D5 (crosscutting concerns) or D6 (consistency) at the current tree hash and clears with --ack <gate>=<reason> recorded on freeze.gates (D3, D5 and D6 only; D4 is not ackable). rcf build bundle --next refuses on an unfrozen tree with exit 4 and clears with --override "<reason>" which writes freeze.override { reason, by, at }; impacted re-execute specs are skipped with the reason on stderr, and when every actionable spec is impacted and no override is given the verb also exits 4. rcf define validate grows four new finding kinds and exits 3 on any of them: an interface kind outside the closed vocabulary, a bracketed acceptance-criterion class prefix outside the five known classes, a tacIds naming a non-TAC, and an unresolving ownerRef or object-form deliveredBy. Absence of an acceptance-criterion class marker is not a finding (D4 reports absence as the floor). The admissibility ruleset NV-DL-ADM-01 through 05 flips to refuse by default with the recorded-in-chain override channel named per rule: --override for the bundle (ADM-01 and ADM-05), freeze.override only for D4 findings (ADM-02; D4 is not ackable; ruling R12 corrects pre-release wording that named --ack here), --ack on freeze.gates for D3 findings (ADM-03), and a chain-document correction committed to git for validate findings (ADM-04). Readiness and freeze pass the computed stages and validate errors through the admissibility wrap so the refusal line names every biting rule. A new litmus flag --litmus <n> on readiness and freeze requires n distinct readers to have recorded a litmus reading at the current litmus hash (the tree hash computed with the probes ledger excluded); readiness --json prints the litmus hash and the new rcf_define_litmus prompt tells the harness to spawn the readers. The ownerRef and object-form deliveredBy grammar widens under R11: bracket paths (interfaces[<name>], responsibilities[<n>], dependencies[<name>], alternativesConsidered[<n>]) and a bare schema field name both resolve on the owning TAC or ADR, and the ADR branch of ownerRef { adrId, field } now resolves. Dotted grammar is refused with the dotted field named so the author can rewrite. The shipped blueprint shelf is clean under R11 after the sweep (31 dotted-to-bracket rewrites, 493 dead-bracket collapses, 12 drops where the parent was empty); the sweep script at packages/rcf-lite/scripts/blueprint-r11-sweep.mjs --dry-run is re-runnable on a consumer tree. The MCP surface now serves fourteen tools and seven prompts; the new prompt is rcf_define_litmus. Node 24 is the build and gate floor. Action: existing CI invocations of rcf define readiness --check, rcf build bundle --next and rcf define validate need review before upgrade. For readiness, clear a failing D3, D5 or D6 with --ack <gate>=<reason> where the authoring call is a deliberate deferral. For bundle, either freeze the tree first or pass --override "<reason>" on CI runs that must proceed on an unfrozen tree; set USER or a git identity in CI if you want something recognisable in freeze.override.by. For validate, migrate any legacy interface kinds through the remap table (function, mcpTool, prompt, constant, moduleApi, interface to other; command to cliCommand; type to recordShape; artifact or artefact to fileFormat) and rewrite any dotted ownerRef or deliveredBy fields to the bracket form or the bare schema field. Spec note: the 0.30.0 wording for several D2 behaviours in the DEFINE step 3 spec in fact shipped in 0.29.0 (the closed skeleton:resolvedBy grammar, the rcf define ledger <name> update <id> subverb and the resolvedBy closed grammar); the spec will be amended on the next pass.

0.29.0, 3 October 2026

Rebuilds the tree viewer end to end: Stravica brand tokens with light and dark theme, an embed contract with same-origin theme switching, shared components across the Requirements, Architecture, Build and Readiness tabs, a Build DAG sub-tab with click-to-highlight closure and a dependency inspector, fast ID lookup from any tab with Cmd or Ctrl plus F, the Readiness tab Product Owner redesign, and a same-origin test-host fixture that pins the embedding contract. Splits DEFINE readiness by persona: every gate check carries product owner or engineer, two readiness levels land (intent-complete and ready-to-build), the Readiness tab moves to tab one, and rcf define readiness gains --level and --persona flags with a persona-grouped text report. Opens DEFINE step 3 with its first three PRs: document intake into the brief ledger via a statement file parser; a new rcf define ledger <name> update <id> subverb with a closed resolvedBy pointer grammar (REQ-nnn, TAD.entity:<name>, PRD.user:<name>, TAD.system:<name>, TAC-nnnn, omitted:<reason>) and the D2 skeleton:resolvedBy title-hit fallback dropped; a rcf define questions verb with three new MCP tools and four argument-free prompts for the harness-driven loop; and the [draft] shapes gate across TAC purpose, interface and core-entity homes with a DISCOVERY prototypes doctrine. Action: rerun rcf init to pick up the regenerated managed instructions block (the Prototypes in DISCOVERY rule and the four new DEFINE and DISCOVERY prompts). Wespa reverse-proxy allow-list for /rcf-viewer/* must add /page-init.js and /index.json before pinning to 0.29.0; /test-host.html and /test-host.js stay 404 by default so the allow-list is otherwise unchanged. Brief ledgers written against the 0.28.4 title-hit fallback must rewrite non-conforming resolvedBy values to the closed pointer grammar; rcf define ledger brief update <id> --resolved-by <pointer> validates before write.

0.28.4, 30 September 2026

Fixes user story minting on legacy trees that carry flat sequential ids. On a tree migrated in from a v1 project, minting a new user story under a requirement now extends the flat sequence (US-163 to US-164) instead of jumping to an encoded slot such as US-5301; a tree that mixes both id shapes is refused with a message naming one example of each so the operator can normalise it first. Rolls in the 0.28.3 fixes (never tagged on its own): the feedback redactor no longer folds git protocol sentinels as emails, a visible warning fires when identity folding is disabled, and the live-view server snapshots its static assets at startup. Lands the DEFINE workflow foundations ahead of the 0.29.0 train: delta detection, freeze records, four sidecar ledgers with rcf define ledger, stage gates D1 to D8, rcf define readiness, and the Product Map tab on the review surface. Action: no migration needed.

0.28.3, 22 September 2026

Written up on 22 September but never tagged or published; the fixes ship inside 0.28.4. The feedback redactor no longer folds the git protocol sentinel git@<host> inside git+ssh, ssh or git URLs as an email, so an evidence pointer copied verbatim from a git remote survives as evidence; bare git remotes and single-letter trailing labels are also protected. A visible stderr warning fires when identity folding is disabled, so an operator whose rcf/.identity/profile.md is missing or a placeholder is no longer left thinking their identity is in force. The live-view server snapshots its shipped static assets at startup instead of reading them from disk per request, so a branch switch during the server's lifetime cannot silently change the served CSS. Action: no migration needed; pick up the fixes by installing 0.28.4.

0.28.2, 22 September 2026

Batched fix release for the seven defects the first WSD-lens dogfood on 0.28.1 surfaced, plus three dry-run gaps folded in. rcf feedback submit no longer folds unrelated findings into one issue, re-reads every candidate issue body and folds only on a verified fingerprint match, and every fold comment now carries the full report; the redactor stops rewriting .md filenames as hostnames via a bundled extensions shortlist. The five discover verbs share one schema pass across --dry-run and the write path, so a preview reports the same validation error the real run would refuse on; --help advertises the allowed values. rcf discover intake dedupes findings before writing the record, req-baseline sweep --yes allocates distinct AC ids across a batch, and the TAD review surface renders dataStores, coreEntities and externalSystems as tables rather than raw JSON blobs. Action: no migration needed.

0.28.1, 17 September 2026

Fixes three defects the first WSD-lens round-trip surfaced on 0.28.0. Feedback on a library-owned blueprint now reaches the library owner even when the blueprint was applied by its bare slug, so a colleague running rcf define blueprint add application-spa against a project with a registered library that also owns application-spa no longer sees the finding silently routed to Stravica/rcf-lite. The operator-identity redactor no longer folds the canonical noun agent when it appears in an operator's ## Name line; a common-noun stopword set (agent, user, admin, api, code, system, and the rest) is exported as RESERVED_IDENTITY_TOKENS. The rcf feedback add help text now names --evidence as required and repeatable; a README callout box discloses the rename from @stravica-ai/rcf-build-lite to rcf-lite. Action: no migration needed.

0.28.0, 17 September 2026

Adds the rcf feedback verb family: an agent records what a blueprint or rcf-lite did that contradicts its own docs, fails, or forces a workaround, and after one operator yes at a natural pause files each finding as a GitHub issue under your own gh login, or writes a pastable outbox bundle when gh is not available. Tightens the referee-guarantees train: rcf define validate walks ADR supersededBy, rcf audit coverage is strict by default with --mode shallow-any as the deliberate opt-out, and rcf build finalise refuses on the three per-AC verdicts, gates the manual verified override behind --acknowledge-verified-override, and adds a merge-state precondition with --allow-pre-merge as the deliberate pre-merge dry-run opt-out. Action: rerun rcf init to pick up the feedback hooks in .claude/settings.json and .codex/hooks.json, and RULE 17 in the managed instructions block. Existing CI that pinned rcf audit coverage --strict keeps working; run rcf audit coverage --mode shallow-any when the intent is a printed gap report rather than a gate.

0.27.0, 11 September 2026

Shelf-wide hardening release: every shipped blueprint has been re-verified against the 2026-09-08 authoring criteria, so every requirement is backed at the REQ layer, every user story carries a sufficient acceptance-criteria set with disposition and owner references, and chain-consistency lint reports zero on every slug. Shipped prose is now customer-facing throughout, with internal workflow labels, operator names, work-item and dispatch identifiers, and long dashes removed. CI adds a hard register-scan gate and flips the chain-consistency lint gate to hard mode over the monorepo-root shelf. One CLI reliability fix rides along: the rcf audit view SIGINT handler is now installed before the readiness line is written. Action: no migration needed.

0.26.0, 9 September 2026

Hardening and authoring release. The Cloudflare-platform blueprints on the shelf pick up real-account probe drivers with positive evidence and one shared account-token env matrix. The blueprint authoring standard gains three new sections (7c REQ-layer sufficiency, 7d positive-evidence verification, 7e single-definition ownership), ten checklist rows and RULE 16 in the managed agent block. The rcf define blueprint verb group gains a lint-consistency subverb, a per-slug disposition ledger with an apply-time prompt and a read-only dispositions view, and the identity seed grows a register field. Action: no migration needed. The schema floor moves to rcf-schemas 0.6.2.

0.25.0, 8 September 2026

Adds Hetzner hosting, Docker Compose and a Cloudflare Tunnel connection to your backend. Existing chains still validate; checks requiring real Hetzner or Cloudflare accounts remain skipped pending credentials. Action: no migration needed. Choose one deploy target per project when adopting the new hosting options.

0.24.0, 8 September 2026

Adds Cloudflare storage, scheduled work, durable objects, Access, Turnstile and rate limiting. The admin console can now use Cloudflare Access for sign-in. Action: no migration needed. Re-apply an existing admin console blueprint to pick up Access support.

0.23.0, 7 September 2026

Adds Postgres, object storage, queues and background jobs, plus static assets on Workers. Fixes truncated CLI output. Action: apply secrets management before object storage, and a queue before background jobs. Re-apply an existing Workers deploy blueprint to pick up static-asset support; existing configuration still works.

0.22.0, 7 September 2026

Adds empty and error states, file uploads, form wizards, account settings and onboarding tours. Account settings only shows controls supported by your applied authentication blueprint. Action: no migration needed. Apply authentication before account settings, or explicitly defer it with --allow-no-auth-yet.

0.21.0, 5 September 2026

Adds tables, charts, dashboards, notifications and an admin console, with browser checks against your running app. Blueprints can ask configuration questions and declare the capabilities they provide or need. Action: no migration needed. Apply authentication before the admin console and run rcf verify browser <fbs-id> for the new checks.

0.20.0, 4 September 2026

Adds graded evaluations for acceptance criteria that cannot be checked deterministically; missing or failing evaluations block finalise. Breaking: the schema minimum moves to 0.6.0, installed with the RCF Lite upgrade. Existing chains still validate. Action: rerun rcf init. Mark non-deterministic criteria and attach evaluations; chains without them need no edits.

0.19.0, 4 September 2026

Adds logging and error-handling blueprints, plus companion suggestions when applying a blueprint. Suggested companions require your choice before they are applied. Action: re-apply existing REST or SPA blueprints for the suggestions, then rerun rcf init to refresh agent guidance.

0.18.0, 4 September 2026

Gives health and readiness probe paths one shared owner and adds a doctor check for duplicate ownership. Breaking blueprint changes: observability essentials and REST move to v2.0.0 and drop their fixed probe paths. Action: when re-applying, supply probe paths or apply the probe-endpoints blueprint; update tests that use old paths and clear redundant resolutions flagged by doctor.

0.17.0, 4 September 2026

Pins Playwright browser tooling and adds doctor checks for projects with a browser interface. Existing Playwright MCP entries are preserved. The end-to-end CI job is documented here; automatic generation follows later. Action: re-apply SPA and CI workflow blueprints, then run rcf doctor. API-only projects need no changes.

0.16.0, 3 September 2026

Adds Git and tarball blueprint libraries, with pinned versions and a cache stored in your repository. Local path-based applies now record library identity; refresh refuses if the pinned source has changed. Action: rerun rcf init for the updated blueprint guidance. Existing local-path libraries need no migration.

Earlier releases

0.15.0, 31 August 2026

Fixes library ownership and blueprint source resolution, and adds CI package-manager and branch choices; no migration needed.

0.14.0, 31 August 2026

Adds update checks and local blueprint libraries; breaking rename: replace ci-pipeline with delivery-ci-workflows in commands and scripts.

0.13.0, 31 August 2026

Bundles stock blueprints and fixes Workers deploy guidance; use Node 24 or later and re-apply the Workers deploy blueprint if using v1.0.0.

The shelf grew, 31 August 2026

Adds eight blueprints and category-qualified names; update commands using the old names, while existing chains keep validating.

0.12.0, 28 August 2026

Moves test-pointer validation into the shared schema; pending and skipped test cases can omit pointers, with no change needed for most projects.

0.11.0, 27 August 2026

Updates agent guidance to validate before acting and explain findings in plain language; no migration needed.

0.10.0, 26 August 2026

Breaking: CLI commands move into groups and rcf-verify becomes rcf verify; update scripts and CI commands, while MCP tool names stay the same.

0.9.0, 25 August 2026

Introduces composable blueprints and six stock patterns; apply the ones your project needs.

0.7.1 and 0.8.0, 12 August 2026

Combines the tools as rcf-lite, then adds shared standards and stricter verification; update if you still run either version.

Earlier

Before August 2026, the tools shipped as separate packages; their history remains in the repository tags and changelogs.