rcf-lite 0.11.0 → 0.13.0

package/blueprints/application-spa/contributions/requirements/application-spa-req-001.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-001",
+  "prdId": "PRD-001",
+  "title": "Information architecture: named routes, canonical URLs, and not-found handling",
+  "description": "The application declares its route inventory explicitly: every surface has a named route, resource pages follow one canonical URL shape per resource class, breadcrumbs appear wherever nesting exceeds two levels, and unknown or gone resources render dedicated 404 and 410 pages rather than a blank shell or a redirect to home.",
+  "category": "functional",
+  "domain": "information-architecture",
+  "priority": "must",
+  "rationale": "Routes that exist only implicitly cannot be verified, deep-linked, or telemetered. A declared route inventory is the anchor for the responsive, journey, and verification requirements in this blueprint.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:01-information-architecture"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-002.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-002",
+  "prdId": "PRD-001",
+  "title": "Navigation: persistent shell with full keyboard operability and landmark roles",
+  "description": "The application shell provides top-level navigation (with optional side navigation for secondary structure), visible and programmatically exposed active states, a skip-link as the first focusable element, ARIA landmark roles on the shell regions, and complete keyboard operation: Tab and Shift-Tab traverse, arrow keys move within menus, Escape closes any open overlay.",
+  "category": "functional",
+  "domain": "navigation",
+  "priority": "must",
+  "rationale": "Navigation is the one surface every journey crosses. If it is not keyboard-complete and landmark-labelled, no journey in the application can meet the accessibility bar.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:02-navigation"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-003.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-003",
+  "prdId": "PRD-001",
+  "title": "Layout system: 4pt spacing scale, per-breakpoint container widths, safe-area handling",
+  "description": "All layout derives from a single grid and spacing system on a 4pt base scale. Container maximum widths are declared per breakpoint. Spacing values outside the scale do not appear in component styles. Notched and rounded viewports are handled via safe-area insets so no content or control sits under hardware cutouts.",
+  "category": "nonFunctional",
+  "domain": "layout",
+  "priority": "must",
+  "rationale": "Ad-hoc spacing is the visible signature of unspecified layout. A closed scale makes drift detectable and keeps composed screens coherent.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:03-layout-system"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-004.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-004",
+  "prdId": "PRD-001",
+  "title": "Responsive behaviour: reflow without horizontal overflow at 360, 768, 1024, and 1440",
+  "description": "Every declared route renders without horizontal overflow at viewport widths 360, 768, 1024, and 1440. Layout reflows rather than scales: content reorganises per breakpoint instead of shrinking. Images carry intrinsic size hints and respond to container width. Data tables below 768 adopt a card layout or an explicit scroll container scoped to the table, never page-level overflow.",
+  "category": "nonFunctional",
+  "domain": "responsive",
+  "priority": "must",
+  "rationale": "The four breakpoints are the ratified baseline. Overflow at any of them is the single most common visible defect in unspecified builds.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:04-responsive"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-005.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Theme system: semantic token layer with dark and light parity",
+  "description": "All colour usage routes through a semantic token layer (surface, on-surface, primary, on-primary, accent, danger, warning, success, muted) with a complete palette declared for both light and dark themes. Every token declared for light is declared for dark. The application honours prefers-color-scheme on first visit and offers an explicit toggle whose choice persists for the session and for the signed-in user. Every token pairing used for text or essential UI passes the contrast thresholds in application-spa-REQ-019.",
+  "category": "functional",
+  "domain": "theming",
+  "priority": "must",
+  "rationale": "Theme parity declared as a token-layer invariant is checkable; theme parity declared as intent is not. The shipped token set in assets/tokens realises this requirement.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:05-theme-system"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-006.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Component library baseline: the named component set with tokens, semantics, keyboard behaviour, and states",
+  "description": "The application implements its UI from a component library covering: buttons, inputs, textareas, selects, checkboxes, radios, switches, comboboxes, cards, tables, tabs, modals, drawers, toasts, alerts, banners, tooltips, popovers, empty states, loading states, error states, skeleton loaders, and pagination. Each component consumes the semantic token layer, exposes correct accessibility semantics, implements its expected keyboard behaviour, and renders every applicable state: default, hover, focus, active, disabled, error, and success.",
+  "category": "functional",
+  "domain": "components",
+  "priority": "must",
+  "rationale": "A named component inventory converts \"professional visual baseline\" from taste into a checklist. Per-component contracts are specified in assets/component-specs and tested through the user stories under this requirement.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:06-component-library"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-007.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Forms and validation UX: inline on blur, summarised on submit, accessible error binding",
+  "description": "Form fields validate inline on blur and re-validate on change after a first failure. Submission failures render a submit-level summary listing every failed field with links to each. Error text is programmatically tied to its field via aria-describedby. Required fields are marked visibly and programmatically. Personal-data fields carry autocomplete tokens. Mobile keyboards match field intent via inputmode and type attributes.",
+  "category": "functional",
+  "domain": "forms",
+  "priority": "must",
+  "rationale": "Forms are where users do the work that matters. Validation timing, error binding, and keyboard intent are the difference between a form that helps and a form that blames.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:07-forms-validation"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-008.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-008",
+  "prdId": "PRD-001",
+  "title": "Journey completeness: every declared journey specified for arrival, loading, empty, error, success, and re-entry",
+  "description": "Every user journey the project declares is walked and specified for six states: arrival (first render), loading, empty, error, success, and re-entry (returning with existing state or an expired session). Each state has a designed layout; no state falls through to a blank region, an unstyled exception, or a spinner without context.",
+  "category": "functional",
+  "domain": "journeys",
+  "priority": "must",
+  "rationale": "Journey gaps are the classic silent defect class: functionally sound flows that present abandoned-looking non-happy states. Walking every declared journey through all six states makes the absence mechanical to catch.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:08-journey-completeness"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-009.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-009",
+  "prdId": "PRD-001",
+  "title": "User arrival and auth surfaces: landing, sign-in, sign-out, expiry, recovery, onboarding, and deep-link redirects",
+  "description": "The application ships designed surfaces for: first-visit unauthenticated landing, sign-in, sign-out confirmation, session-expired, forgot-password, account-recovery, and first-run onboarding. Deep links visited while unauthenticated redirect to sign-in and return the user to the originally requested route after successful authentication.",
+  "category": "functional",
+  "domain": "auth",
+  "priority": "must",
+  "rationale": "Arrival and auth surfaces are the first and the worst-tested screens in most applications. Specifying them as first-class surfaces stops them shipping as afterthoughts.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:09-arrival-auth"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-010.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-010",
+  "prdId": "PRD-001",
+  "title": "Empty, loading, error, and success states on every route and data-bearing component",
+  "description": "No route or data-bearing component ships without designed empty, loading, error, and success states where applicable. Loading states use skeleton loaders when the incoming content shape is known and spinners only for genuinely indeterminate operations. Empty states name what would fill the space and offer the action that fills it. Error states say what failed and what the user can do next.",
+  "category": "functional",
+  "domain": "ui-states",
+  "priority": "must",
+  "rationale": "The state quartet is the cheapest place to look unfinished. Making it a requirement with per-state ACs makes the absence mechanical to catch.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:10-state-quartet"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-011.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-011",
+  "prdId": "PRD-001",
+  "title": "Iconography: one icon set, consistent construction, semantic aliases",
+  "description": "The application uses a single icon set with consistent stroke width and grid size across every icon. Icons are referenced through semantic aliases (for example icon.danger, icon.close) rather than per-component bespoke artwork. Decorative icons are hidden from assistive technology; meaningful icons carry accessible names.",
+  "category": "nonFunctional",
+  "domain": "iconography",
+  "priority": "must",
+  "rationale": "Mixed icon sets read as unfinished even when every individual icon is fine. One set, aliased semantically, keeps replacement and theming mechanical.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:11-iconography"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-012.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-012",
+  "prdId": "PRD-001",
+  "title": "Motion: tokenised durations and easings, reduced-motion respected",
+  "description": "All enter, exit, and state-change animation uses durations and easing curves from the motion token set (defaults 150-250ms, ease-out). The application honours prefers-reduced-motion by disabling non-essential animation. No motion autoplays in critical flows such as auth, forms, and destructive confirmations.",
+  "category": "nonFunctional",
+  "domain": "motion",
+  "priority": "must",
+  "rationale": "Unmanaged motion is either absent (dead-feeling) or excessive (nauseating). A small token set with a reduced-motion escape hatch covers both failure modes.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:12-motion"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-013.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-013",
+  "prdId": "PRD-001",
+  "title": "State management: server state and UI state separated, stale-while-revalidate reads, explicit invalidation on writes",
+  "description": "Client state is split into a server-state cache and local UI state, managed separately. Reads default to stale-while-revalidate: cached data renders immediately while a background refresh runs. Writes explicitly invalidate the affected cache entries. Optimistic updates are applied only where the write is highly likely to succeed and are rolled back visibly on failure.",
+  "category": "technical",
+  "domain": "state",
+  "priority": "must",
+  "rationale": "Mixing server and UI state is the root of most SPA data bugs: stale lists after writes, flicker on navigation, and phantom optimistic state. The split plus explicit invalidation makes cache behaviour specifiable.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:13-state-management"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-014.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-014",
+  "prdId": "PRD-001",
+  "title": "Offline and degraded behaviour: visible network state, retry affordances, no silent data loss",
+  "description": "When the network is unavailable the application shows a non-blocking banner naming the condition, offers retry affordances on failed reads, and either queues writes for replay or clearly refuses them; a user-entered payload is never dropped silently. On reconnect the banner clears and queued work resumes or is surfaced for confirmation.",
+  "category": "functional",
+  "domain": "resilience",
+  "priority": "must",
+  "rationale": "Silent data loss on a flaky connection is the least forgivable defect class. Queueing is preferred where the domain permits; visible refusal is the accepted fallback.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:14-offline-degraded"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-015.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-015",
+  "prdId": "PRD-001",
+  "title": "Internationalisation readiness: extracted strings, locale-aware formatting, RTL-safe layout",
+  "description": "All user-facing strings live in an extraction layer, none hard-coded in components. Dates, numbers, and currency render through locale-aware formatting. The layout survives an RTL locale without visual breakage: mirrored ordering where required, no clipped or overlapped text. Shipping additional translations is out of scope; readiness is in scope.",
+  "category": "technical",
+  "domain": "i18n",
+  "priority": "must",
+  "rationale": "Retrofitting extraction into a string-littered codebase costs an order of magnitude more than building against it. Readiness now is what keeps localisation a content task later.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:15-i18n-readiness"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-016.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-016",
+  "prdId": "PRD-001",
+  "title": "Telemetry hooks: journey checkpoint events, error boundary reports, performance marks",
+  "description": "The application emits named telemetry events at each declared journey checkpoint, reports every error-boundary catch with route and component context, and records performance marks at first paint and time-to-interactive. Event names follow the declared naming scheme so dashboards survive refactors.",
+  "category": "technical",
+  "domain": "telemetry",
+  "priority": "must",
+  "rationale": "A journey that cannot be observed cannot be improved. Naming the events in the spec stops telemetry being an unplanned afterthought with unstable names.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:16-telemetry"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-017.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-017",
+  "prdId": "PRD-001",
+  "title": "Copy hygiene: no internal identifiers, no placeholder text, actionable error messages",
+  "description": "Rendered copy never exposes internal specification identifiers (REQ, US, AC, FBS references), never ships lorem ipsum or placeholder strings in any reachable state, and phrases error messages around what the user can do next rather than what the user did wrong.",
+  "category": "nonFunctional",
+  "domain": "copy",
+  "priority": "must",
+  "rationale": "Internal ids and placeholder text in rendered copy are the leak-shaped defects that erode user trust instantly and are trivially checkable.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:17-copy-hygiene"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-018.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-018",
+  "prdId": "PRD-001",
+  "title": "SPA security baselines: CSP, sanitised dynamic HTML, hardened session cookies, no bundled secrets",
+  "description": "The application ships a named Content-Security-Policy, never renders user-influenced data through raw HTML injection without a sanitiser, sets session cookies with Secure, HttpOnly, and SameSite attributes, round-trips form values XSS-safely, and includes no secrets or privileged endpoints in the shipped bundle.",
+  "category": "security",
+  "domain": "security",
+  "priority": "must",
+  "rationale": "These are the SPA-applicable floors. Anything below them is a vulnerability, not a style choice.",
+  "tags": [
+    "blueprint:application-spa",
+    "category:18-security"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-019.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-019",
+  "prdId": "PRD-001",
+  "title": "Accessibility conformance: WCAG 2.2 AA minimum across every route and component",
+  "description": "The application meets WCAG 2.2 AA: contrast at least 4.5:1 for body text and 3:1 for large text and essential non-text UI, a visible focus indicator on every interactive element, pointer target size at least 24x24 CSS pixels, and no keyboard traps anywhere. Conformance applies in both themes and at every declared breakpoint.",
+  "category": "nonFunctional",
+  "domain": "accessibility",
+  "priority": "must",
+  "rationale": "AA is the ratified floor for the blueprint, not a stretch goal. Stating it as a requirement with mechanical ACs is what makes the floor real.",
+  "tags": [
+    "blueprint:application-spa",
+    "quality-bar:accessibility"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-020.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-020",
+  "prdId": "PRD-001",
+  "title": "Typography: modular scale, minimum body sizes, declared line heights",
+  "description": "Type sizes derive from a modular scale (ratio 1.125 or 1.25) realised in the typography tokens. Body text is at least 14px below 768 viewport width and at least 16px at 768 and above, with fluid scaling between breakpoints. Line height is 1.5 for body text and 1.2 for headings.",
+  "category": "nonFunctional",
+  "domain": "typography",
+  "priority": "must",
+  "rationale": "Type is the largest visual surface in any application. A closed scale with minimums removes the most common squint-inducing defects at zero ongoing cost.",
+  "tags": [
+    "blueprint:application-spa",
+    "quality-bar:typography"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/requirements/application-spa-req-021.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-spa-REQ-021",
+  "prdId": "PRD-001",
+  "title": "Performance budget: sub-2s first meaningful paint on 3G-fast, Lighthouse 90+, main-thread under 3s",
+  "description": "On the 3G-fast reference profile, first meaningful paint lands under 2 seconds. Lighthouse performance scores at least 90 on the declared key routes. Total main-thread work during initial load stays under 3 seconds. The budget is enforced against production builds, not development servers.",
+  "category": "nonFunctional",
+  "domain": "performance",
+  "priority": "must",
+  "rationale": "A stated budget converts performance from a mood into a gate. The reference profile and thresholds are the ratified quality bar.",
+  "tags": [
+    "blueprint:application-spa",
+    "quality-bar:performance"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-201-application-spa-app-shell.json

@@ -0,0 +1,45 @@
+{
+  "tacId": "TAC-201-application-spa-app-shell",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Application shell and navigation",
+  "purpose": "Owns the persistent frame around every route: top navigation, optional side navigation, skip-link, landmark structure, and the outlet the router renders into.",
+  "responsibilities": [
+    "Render top navigation and, where the project declares secondary structure, side navigation, with active-state semantics per application-spa-REQ-002.",
+    "Expose ARIA landmarks (banner, navigation, main, contentinfo) and the skip-link as the first focusable element.",
+    "Own keyboard behaviour for shell-level interaction: Tab traversal, arrow-key movement within menus, Escape closing overlays.",
+    "Host the global surfaces that outlive routes: network-state banner (application-spa-REQ-014), toast region, and theme toggle.",
+    "Apply safe-area insets so shell chrome clears hardware cutouts (application-spa-REQ-003)."
+  ],
+  "internalStructure": "A shell layout component wrapping the router outlet; navigation data is declarative (the route inventory from application-spa-REQ-001), not hand-wired per link.",
+  "interfaces": [
+    {
+      "name": "route inventory",
+      "kind": "configuration",
+      "description": "Declared route table consumed to render navigation and breadcrumbs."
+    },
+    {
+      "name": "toast region",
+      "kind": "ui-slot",
+      "description": "Imperative enqueue API for transient notifications, rendered in one landmark-safe region."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Theme system",
+      "kind": "tac",
+      "tacId": "TAC-202-application-spa-theme-system",
+      "description": "Shell chrome consumes semantic tokens only."
+    },
+    {
+      "name": "Component library",
+      "kind": "tac",
+      "tacId": "TAC-203-application-spa-component-library"
+    }
+  ],
+  "tradeoffs": "A single persistent shell trades a little initial bundle weight for consistent navigation, one focus-management seam, and one place to verify landmarks.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-202-application-spa-theme-system.json

@@ -0,0 +1,32 @@
+{
+  "tacId": "TAC-202-application-spa-theme-system",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Theme system and design tokens",
+  "purpose": "Realises the semantic token layer (colour, spacing, radius, typography, elevation, motion) in both themes and owns theme selection, persistence-data-sqlite, and application.",
+  "responsibilities": [
+    "Load the design tokens from assets/tokens/design-tokens.json as CSS custom properties per assets/tokens/theme.css.",
+    "Resolve the initial theme from the persisted user choice, falling back to prefers-color-scheme, falling back to light.",
+    "Expose the theme toggle state and persist explicit choices per session and per signed-in user (application-spa-REQ-005).",
+    "Guarantee dark and light parity: every semantic token resolves in both themes; a missing dark value is a build-time error, not a runtime fallback.",
+    "Serve the motion tokens and the reduced-motion switch consumed by application-spa-REQ-012."
+  ],
+  "internalStructure": "Token definitions are data (JSON), realised once as CSS custom properties on the root element; the active theme is a single attribute swap, never per-component conditionals.",
+  "interfaces": [
+    {
+      "name": "design tokens",
+      "kind": "asset",
+      "description": "assets/tokens/design-tokens.json, the canonical token values for both themes."
+    },
+    {
+      "name": "theme attribute",
+      "kind": "dom-contract",
+      "description": "data-theme attribute on the document root; components style exclusively via tokens that respond to it."
+    }
+  ],
+  "tradeoffs": "Semantic tokens over raw palette references cost one indirection and buy theme parity, contrast checkability, and re-skinning without component edits.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-203-application-spa-component-library.json

@@ -0,0 +1,32 @@
+{
+  "tacId": "TAC-203-application-spa-component-library",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Component library",
+  "purpose": "The single source of interactive and presentational primitives listed in application-spa-REQ-006; application screens compose these, they do not restyle them.",
+  "responsibilities": [
+    "Implement every component named in application-spa-REQ-006 with the states, semantics, and keyboard contracts specified in assets/component-specs.",
+    "Consume the semantic token layer exclusively; no hard-coded colours, spacing, or type sizes.",
+    "Expose accessibility semantics per component (roles, names, states) and keep them correct across states.",
+    "Render the state quartet primitives (empty, loading, error, skeleton) that routes compose per application-spa-REQ-010.",
+    "Keep every interactive target at or above the 24x24 CSS pixel minimum (application-spa-REQ-019)."
+  ],
+  "internalStructure": "One module per component family (actions, inputs, selection, overlays, data display, feedback), each pairing a spec document in assets/component-specs with an implementation the working agent writes.",
+  "dependencies": [
+    {
+      "name": "Theme system",
+      "kind": "tac",
+      "tacId": "TAC-202-application-spa-theme-system"
+    },
+    {
+      "name": "Icon set",
+      "kind": "external",
+      "description": "The single icon set selected under ADR-206-application-spa-iconography."
+    }
+  ],
+  "tradeoffs": "A closed library slows the first screen slightly and then accelerates every screen after it; ad-hoc one-off components are the defect nursery this component exists to close.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-204-application-spa-client-data-layer.json

@@ -0,0 +1,27 @@
+{
+  "tacId": "TAC-204-application-spa-client-data-layer",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Client data layer",
+  "purpose": "Owns server-state caching, request lifecycle, invalidation, optimistic updates, and offline queueing; the seam between the UI and the wire.",
+  "responsibilities": [
+    "Maintain the server-state cache with stale-while-revalidate reads and explicit invalidation on writes (application-spa-REQ-013).",
+    "Expose per-query status (loading, error, success, empty) that routes and components bind their state quartet to (application-spa-REQ-010).",
+    "Detect network loss, surface it to the shell banner, queue or refuse writes per policy, and replay on reconnect (application-spa-REQ-014).",
+    "Normalise wire errors into the problem-details envelope shape declared in ADR-204-application-spa-error-envelope before they reach UI code.",
+    "Attach session credentials and handle 401 responses by routing through the session-expiry flow (application-spa-REQ-009)."
+  ],
+  "internalStructure": "A query/mutation layer with a keyed cache; keys derive from the canonical URL shapes in application-spa-REQ-001 so invalidation maps one-to-one to resources.",
+  "dependencies": [
+    {
+      "name": "Error envelope decision",
+      "kind": "external",
+      "description": "ADR-204-application-spa-error-envelope; the application-api-rest blueprint contributes the server half of the same topic."
+    }
+  ],
+  "tradeoffs": "A dedicated data layer costs indirection on trivial fetches and buys one place to verify caching, invalidation, offline, and auth behaviour instead of per-screen re-implementations.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-205-application-spa-forms-engine.json

@@ -0,0 +1,27 @@
+{
+  "tacId": "TAC-205-application-spa-forms-engine",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Forms and validation engine",
+  "purpose": "Shared machinery for field state, validation timing, error binding, and submit orchestration per application-spa-REQ-007.",
+  "responsibilities": [
+    "Drive validation timing: on blur first, on change after first failure, full pass on submit.",
+    "Bind error text to fields via aria-describedby and manage aria-invalid state.",
+    "Render the submit-level error summary with anchor links to each failed field and move focus to it on failed submit.",
+    "Apply required-field marking, autocomplete tokens, and inputmode/type attributes from the field definition.",
+    "Preserve entered values across failed submits and theme or locale switches; user input is never discarded by the engine."
+  ],
+  "dependencies": [
+    {
+      "name": "Component library",
+      "kind": "tac",
+      "tacId": "TAC-203-application-spa-component-library",
+      "description": "Form controls come from the library; the engine adds behaviour, not rendering."
+    }
+  ],
+  "tradeoffs": "Centralised validation timing means individual forms cannot invent their own interaction grammar, which is precisely the point.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-206-application-spa-telemetry.json

@@ -0,0 +1,19 @@
+{
+  "tacId": "TAC-206-application-spa-telemetry",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Telemetry and error reporting",
+  "purpose": "Emits journey checkpoint events, error-boundary reports, and performance marks per application-spa-REQ-016 under the naming scheme in ADR-209-application-spa-telemetry-naming.",
+  "responsibilities": [
+    "Expose a typed emit API for journey checkpoint events; free-text event names are not accepted.",
+    "Install error boundaries at the shell and route level and report catches with route, component, and session context, redacting personal data.",
+    "Record performance marks at first paint and time-to-interactive and forward them with the declared names.",
+    "Buffer events during offline periods and flush on reconnect, bounded, dropping oldest-first beyond the bound.",
+    "No-op cleanly when the project deploys without a telemetry backend; instrumentation must not break the application."
+  ],
+  "tradeoffs": "A typed event API costs a registry file per journey and buys dashboards that survive refactors.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}