rcf-lite 0.12.0 → 0.13.0

package/blueprints/application-spa/contributions/tacs/tac-207-application-spa-token-adherence-probe.json

@@ -0,0 +1,57 @@
+{
+  "tacId": "TAC-207-application-spa-token-adherence-probe",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Token adherence probe",
+  "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). Watchpost run4 demonstrated that declaring the discipline does not compel the shipped surface: build cycles ran green while raw hex values sat in component stylesheets. This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit when the discipline is violated, and writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "responsibilities": [
+    "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a ci-pipeline gate (AC-1129-1, AC-1129-4).",
+    "Read the design tokens source at a configured path (default `assets/tokens/design-tokens.json` per ADR-202) and enumerate the semantic token key sets for both themes (AC-1129-2).",
+    "Read the built stylesheet output at a configured glob (component-scope CSS files, excluding the token-realisation file at `assets/tokens/theme.css`) and scan each file line-by-line for raw palette literals: hex (`#[0-9a-fA-F]{3,8}`), `rgb(`, `rgba(`, `hsl(`, `hsla(`, `oklch(`, `oklab(`, and named CSS colours outside the pass-through allow list `transparent | currentColor | inherit | initial | unset` (AC-1129-1).",
+    "Diff the enumerated light and dark token key sets by key equality; every key present in one theme MUST be present in the other. A missing counterpart is a violation, not a runtime fallback (AC-1129-2).",
+    "Write a JSON report at a stable relative path (`reports/token-adherence.json` under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every stylesheet file scanned, every raw-literal violation found with file path and line number, every missing-parity token key, and the ok/fail verdict (AC-1129-3).",
+    "Exit with code 0 when zero violations were found and both parity sets match; exit with code 1 (or the configured non-zero code) on any violation, so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1129-1, AC-1129-2, AC-1129-4).",
+    "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1129-4)."
+  ],
+  "internalStructure": "One Node module that exports a `runTokenAdherenceProbe({ tokensPath, stylesheetGlob, reportDir })` function and a shebang entry point that reads its configuration and calls the exported function. Two independent scanners: (1) a stylesheet scanner that walks the resolved file list, matches every line against the raw-literal regex bank, and accumulates a `{ file, line, snippet, category }` record per violation; (2) a token-parity checker that reads the tokens JSON, extracts the theme-keyed sub-objects, and diffs their key sets. Both scanners contribute to one accumulated report object; the writer serialises the report and the caller returns the exit code derived from the ok/fail verdict.",
+  "interfaces": [
+    {
+      "name": "runTokenAdherenceProbe",
+      "kind": "factory",
+      "description": "runTokenAdherenceProbe({ tokensPath, stylesheetGlob, reportDir }) -> Promise<{ verdict, reportPath, violations }>; the sole callable the entry point invokes. `verdict` is `'ok' | 'fail'`; the entry point translates `fail` to a non-zero exit code."
+    },
+    {
+      "name": "entry-point CLI",
+      "kind": "cli",
+      "description": "`node <entryPointPath>` with optional flags `--tokens <path>`, `--stylesheet-glob <glob>`, `--report-dir <path>` that override configuration defaults. Exit code is 0 on `ok`, non-zero on `fail`."
+    },
+    {
+      "name": "token-adherence report",
+      "kind": "external",
+      "description": "`reports/token-adherence.json` under the configured report directory. Shape: `{ verdict, tokensFile, stylesheetsScanned: string[], rawLiteralViolations: [{ file, line, snippet, category }], parityViolations: [{ key, missingIn: 'light' | 'dark' }], generatedAt }`."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Design tokens source",
+      "kind": "external",
+      "description": "The project-side realisation of `assets/tokens/design-tokens.json` (or the equivalent path configured on the probe). ADR-202 names this file as the single source of colour, spacing, radius, typography, elevation, and motion values."
+    },
+    {
+      "name": "Built stylesheet output",
+      "kind": "external",
+      "description": "The component-scope stylesheet output as it lands in the deployed bundle. The probe scans the built (post-preprocessor) output, not source Sass or CSS-in-JS input, because the runtime surface is what the ADR-202 discipline binds."
+    },
+    {
+      "name": "ci-pipeline gate runner",
+      "kind": "tac",
+      "tacId": "TAC-701-ci-pipeline-gate-runner",
+      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+    }
+  ],
+  "tradeoffs": "Scanning built CSS costs one file walk per build cycle; that cost buys a runtime-observable enforcement of the semantic-token discipline that ADR-202 declares. Scanning at the built layer rather than the source layer catches violations that a preprocessor may otherwise mask (a token indirection that a build-time script expands into a raw literal). The regex bank over string colours accepts some false-positive risk on unusual identifier shapes; the allow list captures the pass-through cases, and a project that needs to extend the allow list does so through the probe's configuration surface, not by silencing the gate.",
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-208-application-spa-icon-adherence-probe.json

@@ -0,0 +1,56 @@
+{
+  "tacId": "TAC-208-application-spa-icon-adherence-probe",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Icon adherence probe",
+  "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). Watchpost run4 shipped zero icons across eight surfaces while the build cycle ran green; declaring the discipline is not the same as compelling it. This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit when a component sidesteps the alias registry, and writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "responsibilities": [
+    "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a ci-pipeline gate (AC-1130-1, AC-1130-4).",
+    "Read the icon alias registry at a configured path (default `assets/icons/aliases.json` or the project-declared equivalent per ADR-206) and enumerate the declared alias names (AC-1130-2).",
+    "Read the component source tree at a configured glob (excluding the icon registry file itself and the icon-set source files it references) and scan each file for two violation classes: (a) any inline `<svg>...</svg>` element that is NOT a JSX fragment consumed by the registry, and (b) any icon reference that resolves to a name absent from the enumerated alias set (AC-1130-1, AC-1130-2).",
+    "Write a JSON report at a stable relative path (`reports/icon-adherence.json` under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every component file scanned, every inline-SVG violation with file path and line number, every unknown-alias violation with file path, line number, and the offending name, and the ok/fail verdict (AC-1130-3).",
+    "Exit with code 0 when zero violations were found; exit with code 1 (or the configured non-zero code) on any violation, so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1130-1, AC-1130-2, AC-1130-4).",
+    "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1130-4)."
+  ],
+  "internalStructure": "One Node module that exports a `runIconAdherenceProbe({ registryPath, componentGlob, reportDir })` function and a shebang entry point that reads its configuration and calls the exported function. Two scanners share the walked file list: (1) an inline-SVG scanner that matches the shipped source for `<svg` opening tags and refuses any occurrence in a file whose path is outside the registry allow list; (2) an alias-reference scanner that matches configured icon-reference call sites (`icon.<name>`, `<Icon name=\"...\">`, or the project-declared reference shape recorded on the probe's configuration) and looks up every referenced name in the enumerated alias set. Both scanners contribute to one accumulated report; the writer serialises and the caller returns the exit code derived from the ok/fail verdict.",
+  "interfaces": [
+    {
+      "name": "runIconAdherenceProbe",
+      "kind": "factory",
+      "description": "runIconAdherenceProbe({ registryPath, componentGlob, reportDir }) -> Promise<{ verdict, reportPath, violations }>; the sole callable the entry point invokes. `verdict` is `'ok' | 'fail'`; the entry point translates `fail` to a non-zero exit code."
+    },
+    {
+      "name": "entry-point CLI",
+      "kind": "cli",
+      "description": "`node <entryPointPath>` with optional flags `--registry <path>`, `--component-glob <glob>`, `--report-dir <path>` that override configuration defaults. Exit code is 0 on `ok`, non-zero on `fail`."
+    },
+    {
+      "name": "icon-adherence report",
+      "kind": "external",
+      "description": "`reports/icon-adherence.json` under the configured report directory. Shape: `{ verdict, registryFile, componentsScanned: string[], inlineSvgViolations: [{ file, line, snippet }], unknownAliasViolations: [{ file, line, name }], generatedAt }`."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Icon alias registry",
+      "kind": "external",
+      "description": "The project-side realisation of the icon alias registry (ADR-206 names `icon.close`, `icon.danger`, `icon.search` and peers as the reference shape; the project declares the concrete registry file's path on the probe's configuration)."
+    },
+    {
+      "name": "Component source tree",
+      "kind": "external",
+      "description": "The shipped component source as it lands in the built bundle. The probe scans the source layer for inline-SVG and alias-reference violations because that is the layer at which the ADR-206 discipline binds; a build-time compilation that inlines an alias to the underlying SVG file is not a violation."
+    },
+    {
+      "name": "ci-pipeline gate runner",
+      "kind": "tac",
+      "tacId": "TAC-701-ci-pipeline-gate-runner",
+      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+    }
+  ],
+  "tradeoffs": "Scanning source for inline SVG accepts that a project may sometimes ship a genuinely single-use bespoke glyph; the discipline says such a glyph joins the registry rather than living inline, and the probe surfaces the choice at the ship gate rather than at design review. The alias-reference scanner needs a project-declared reference-shape pattern (JSX prop, function call, or template literal); the probe ships a small pattern library and the project selects the shape it uses. The cost is one line of configuration; the buy is a runtime-observable enforcement that closes the mechanism-reach gap watchpost run4 caught.",
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-209-application-spa-csp-styled-adherence-probe.json

@@ -0,0 +1,61 @@
+{
+  "tacId": "TAC-209-application-spa-csp-styled-adherence-probe",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.1",
+  "status": "approved",
+  "name": "Styled-under-shipped-CSP adherence probe",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). Watchpost run4 demonstrated the mechanism-reach gap this probe cures: FBS-011 declared a strict CSP (style-src 'self', no unsafe-inline), FBS-013/015 rendered inline <style> blocks, every existing UI-bearing gate passed (28 styled screenshots, browser-verify green), and yet every production page rendered unstyled at deploy because the harness bypassed the production security-header path. This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "responsibilities": [
+    "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a ci-pipeline gate (AC-1131-5, AC-1131-6).",
+    "Accept configuration naming (i) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration), (ii) the enumerated set of UI-bearing routes to probe, and (iii) the stylesheet URL every rendered document is expected to link (AC-1131-3, AC-1131-4).",
+    "For every enumerated route: navigate a real headless browser to the served URL, capture the response `content-security-policy` header, capture the response body, read the browser's final URL after any redirect chain resolves, run getComputedStyle on document.body, and record the results (AC-1131-1, AC-1131-2, AC-1131-3).",
+    "Refuse the run when any captured CSP declares 'unsafe-inline' or 'unsafe-eval' on style-src, when style-src is absent, or when style-src is served as a wildcard (AC-1131-1).",
+    "Refuse the run when any captured response body contains a `<style` substring (case-insensitive), including <style> injected by templating helpers (AC-1131-2).",
+    "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, watchpost run4 partial-acceptance gap w-2026-08-24-003).",
+    "Refuse the run when the computed body backgroundColor for any route is the browser default (`rgba(0, 0, 0, 0)` / `transparent`) or when the computed body fontFamily resolves to an empty value; both indicate the shipped stylesheet did NOT reach the runtime surface under the production headers (AC-1131-3).",
+    "Issue a same-origin GET against the linked stylesheet URL through the same server instance and refuse when the response is not 200 with content-type `text/css` (AC-1131-4).",
+    "Write a JSON report at a stable relative path (`reports/csp-styled-adherence.json` under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every route probed, the CSP header captured, whether an inline <style> was detected, the computed background and fontFamily values, the stylesheet GET verdict, and an ok / fail verdict (AC-1131-5).",
+    "Exit with code 0 when every route passes; exit with code 1 (or the configured non-zero code) on any refusal, so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1131-5, AC-1131-6).",
+    "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1131-6)."
+  ],
+  "internalStructure": "One Node module that exports a `runCspStyledAdherenceProbe({ bootServer, routes, stylesheetUrl, reportDir })` function and a shebang entry point that reads its configuration and calls the exported function. Two independent scanners driven from one browser session: (1) an HTML + header scanner that reads the response body and the CSP header per route and applies the inline-style-block and style-src-relaxation refusal rules; (2) a computed-style scanner that first reads `new URL(page.url()).pathname` and applies the `pathMismatch` refusal (a silent redirect chain fails loud with a per-route diagnostic naming both the requested and the landed path, so downstream styled-body checks never run against a redirect target), then runs a `page.evaluate(() => { const cs = getComputedStyle(document.body); return { background: cs.backgroundColor, fontFamily: cs.fontFamily }; })` and applies the browser-default refusal rules. A third check issues a same-origin GET for the linked stylesheet URL and captures status + content-type. All scanners and the stylesheet check contribute to one accumulated report object; the writer serialises the report and the caller returns the exit code derived from the ok / fail verdict.",
+  "interfaces": [
+    {
+      "name": "runCspStyledAdherenceProbe",
+      "kind": "factory",
+      "description": "runCspStyledAdherenceProbe({ bootServer, routes, stylesheetUrl, reportDir }) -> Promise<{ verdict, reportPath, refusals }>; the sole callable the entry point invokes. `bootServer` is a factory returning `{ url, close }` for a server booted through the production entry-point path. `verdict` is `'ok' | 'fail'`; the entry point translates `fail` to a non-zero exit code."
+    },
+    {
+      "name": "entry-point CLI",
+      "kind": "cli",
+      "description": "`node <entryPointPath>` with optional flags `--boot <module>`, `--routes <comma-list>`, `--stylesheet <url>`, `--report-dir <path>` that override configuration defaults. Exit code is 0 on `ok`, non-zero on `fail`."
+    },
+    {
+      "name": "reports/csp-styled-adherence.json",
+      "kind": "artefact",
+      "description": "`reports/csp-styled-adherence.json` under the configured report directory. Shape: `{ verdict, stylesheetUrl, stylesheetResponse: { status, contentType }, routes: [{ route, landedPath, csp, inlineStyleDetected, computed: { backgroundColor, fontFamily }, refusals }], generatedAt }`. `landedPath` is the pathname the browser's final URL resolved to after any redirect chain; when it does not equal `route`, the entry's `refusals` includes a `pathMismatch` class naming both paths and the run verdict is `fail`."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Production server construction",
+      "kind": "external",
+      "description": "The probe requires a factory that boots the target server through the same construction the production entry point uses (same route registration, same security-header middleware, same static / assets registration). A separate server instance or a static-file-only mount does not satisfy AC-1131-4."
+    },
+    {
+      "name": "Headless browser",
+      "kind": "external",
+      "description": "A real browser (Playwright chromium, Puppeteer chromium, or equivalent). The probe MUST drive a browser fetch through the shipped headers; an in-process fetch or app.inject() does not exercise the CSP path and cannot satisfy AC-1131-3."
+    },
+    {
+      "name": "ci-pipeline gate runner",
+      "kind": "tac",
+      "tacId": "TAC-701-ci-pipeline-gate-runner",
+      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+    }
+  ],
+  "tradeoffs": "The probe requires a real browser and a running server for every ci-pipeline invocation. That cost buys the runtime-observable enforcement the mechanism-reach gap at watchpost run4 proved was missing: build cycles ran green and shipped an unstyled surface because no gate exercised the production header path with a real browser. Driving the shipped construction (not a bespoke harness) is the load-bearing choice; refusing app.inject() satisfaction is deliberate. The requirement that verification runs THROUGH the shipped headers is what makes the AC bite; a probe that stamps its own headers would recreate the class defect it exists to refuse. The v1.0.1 landed-path refusal cures a second gap the same class defect exposed: Playwright's `page.goto` follows redirects by default and returns the FINAL response, so a session-broken authenticated route silently 302'ing to a styled /login left every downstream styled-body assertion validating the login page instead of the requested surface (watchpost partial-acceptance w-2026-08-24-003 / AC-1601-14). Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes the gap without coupling the probe to session-lane internals.",
+  "createdAt": "2026-08-24T10:30:00Z",
+  "updatedAt": "2026-08-31T11:15:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-210-application-spa-external-dependency-provisioning-probe.json

@@ -0,0 +1,70 @@
+{
+  "tacId": "TAC-210-application-spa-external-dependency-provisioning-probe",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "External-service-dependency provisioning adherence probe",
+  "purpose": "The runtime-observable enforcement handle for the deployment-gate class defect the watchpost first-production review caught (w-2026-08-24-005, w-2026-08-24-006): the only login path (magic-link email) shipped inert because RESEND_API_KEY was a placeholder, the gap was filed as a 'quirk' in status.md rather than blocked at sign-off, and a real key existed in the estate all along. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md quirk line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "responsibilities": [
+    "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a ci-pipeline gate (AC-1132-5, AC-1132-6).",
+    "Accept configuration naming (i) the path of the application's external-service-dependency manifest, (ii) how to boot the target server for handshake evidence (a Node module or command that starts the same server instance the production entry point starts, with the same route registration and middleware stack), (iii) the path of the ratified-deferrals store the deferral records live in, and (iv) the report directory (AC-1132-1, AC-1132-3, AC-1132-4).",
+    "Read the external-service-dependency manifest, iterate every declared dependency, and refuse when any runtime-reached external service is missing from the manifest (the probe accepts a project-supplied enumerator that lists runtime-reached externals; a strict-mode config refuses when the enumerator finds a service not on the manifest) (AC-1132-1).",
+    "Resolve each manifest-named credential-field value from the shipped runtime environment (the boot-server factory hands the probe the environment the runtime observes, not the developer machine's environment). Apply the canonical placeholder-shape detector (rcf-lite exports detectPlaceholderCredentialShape) and refuse the run when any manifest-named credential field carries a placeholder-shape value (AC-1132-2).",
+    "For every dependency at status 'verified', replay the manifest-declared handshake against the shipped runtime, capture the provider-side acknowledgement (a provider message id, a provider status endpoint 2xx, or an equivalent provider-attested receipt), and record it on the probe report. A run refuses when a 'verified' entry has no captured provider-attested evidence, when the captured evidence is synthetic (in-process stub, mock adapter, unit-test double), or when the handshake failed at provider level (AC-1132-3).",
+    "For every dependency at status 'deferred', check the ratified-deferrals store for a record naming the dependency id, the reason for deferral, the acknowledging operator identifier, the ISO-8601 acknowledgement timestamp, and the intended resolution route. Refuse the run when the record is absent, malformed, refers to a dependency the manifest does not declare, or its acknowledgement timestamp is stale beyond the ratified window the store declares (AC-1132-4).",
+    "Write a JSON report at a stable relative path ('reports/external-dependency-provisioning.json' under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every dependency declared, the credential-field placeholder-detector verdict per dependency, the captured handshake evidence per 'verified' dependency, the ratified deferral record reference per 'deferred' dependency, per-dependency verdict, and an aggregate verdict of 'ok' | 'deployed-with-defects' (AC-1132-5).",
+    "Exit with code 0 when the aggregate verdict is 'ok'; exit with code 1 (or the configured non-zero code) on 'deployed-with-defects', so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1132-5, AC-1132-6).",
+    "Never treat the absence of a manifest, the absence of a deferrals store, or an unreadable credential resolution as an implicit pass; every such condition refuses ship (AC-1132-1, AC-1132-4).",
+    "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1132-6)."
+  ],
+  "internalStructure": "One Node module that exports a 'runExternalDependencyProvisioningProbe({ manifestPath, bootServer, deferralsStorePath, reportDir })' function and a shebang entry point that reads its configuration and calls the exported function. Three independent scanners assemble one accumulated report object: (1) a manifest scanner that reads the enumerated set and refuses on missing entries when the project supplies a runtime-reached-externals enumerator, (2) a placeholder scanner that resolves every manifest-named credential value from the boot-server-handed environment and applies rcf-lite's detectPlaceholderCredentialShape, and (3) an evidence scanner that either replays a live handshake (for 'verified') or reads the ratified-deferrals store (for 'deferred'). The writer serialises the report and the caller returns the exit code derived from the aggregate verdict.",
+  "interfaces": [
+    {
+      "name": "runExternalDependencyProvisioningProbe",
+      "kind": "factory",
+      "description": "runExternalDependencyProvisioningProbe({ manifestPath, bootServer, deferralsStorePath, reportDir }) -> Promise<{ verdict, reportPath, refusals }>; the sole callable the entry point invokes. 'bootServer' is a factory returning '{ url, close, env }' for a server booted through the production entry-point path with the runtime environment the shipped instance observes. 'verdict' is 'ok' | 'deployed-with-defects'; the entry point translates 'deployed-with-defects' to a non-zero exit code."
+    },
+    {
+      "name": "entry-point CLI",
+      "kind": "cli",
+      "description": "'node <entryPointPath>' with optional flags '--manifest <path>', '--boot <module>', '--deferrals <path>', '--report-dir <path>' that override configuration defaults. Exit code is 0 on 'ok', non-zero on 'deployed-with-defects'."
+    },
+    {
+      "name": "reports/external-dependency-provisioning.json",
+      "kind": "artefact",
+      "description": "'reports/external-dependency-provisioning.json' under the configured report directory. Shape: '{ verdict, dependencies: [{ id, purpose, provider, credentialField, status, placeholderCheck: { verdict, matchedPattern? }, verifiedEvidence?: { providerMessageId?, providerStatus?, capturedAt }, deferralRecord?: { path, ackedBy, ackedAt, reason, resolutionRoute }, refusals: [...] }], generatedAt }'."
+    },
+    {
+      "name": "external-service-dependency manifest (project-owned)",
+      "kind": "artefact",
+      "description": "A project-owned JSON manifest the probe reads. Shape: '{ dependencies: [{ id, purpose, provider, credentialField, status: \"verified\" | \"deferred\" }] }'. Named at ship time; the probe refuses when the manifest is missing or malformed."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Production server construction",
+      "kind": "external",
+      "description": "The probe requires a factory that boots the target server through the same construction the production entry point uses (same route registration, same security-header middleware, same runtime environment resolution). Handshake evidence is captured through the shipped runtime, not through a bespoke harness or a test double."
+    },
+    {
+      "name": "Ratified-deferrals store",
+      "kind": "external",
+      "description": "A project-owned persistent artefact (a JSON file, a manifest field, or a store the operator explicitly writes into) that records every 'deferred' entry with the required fields. A README note, a status.md line, or a work-item link does NOT satisfy the requirement; the store is a durable, machine-readable record."
+    },
+    {
+      "name": "Canonical placeholder-shape detector",
+      "kind": "external",
+      "description": "rcf-lite exports 'detectPlaceholderCredentialShape(value)' from 'packages/rcf-lite/src/deployment/placeholder-detector.js' as the canonical detector this probe (and downstream projects) apply. Extending the detector's ruleset is a rcf-lite minor bump, not a per-project reinvention."
+    },
+    {
+      "name": "ci-pipeline gate runner",
+      "kind": "tac",
+      "tacId": "TAC-701-ci-pipeline-gate-runner",
+      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+    }
+  ],
+  "tradeoffs": "The probe requires a running server booted through the production construction and network reach to real external providers for every ci-pipeline invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: the build cycle ran green, sign-off said DEPLOYED, and the only login path was inert on a placeholder credential. Requiring a manifest is a deliberate load-bearing choice: without the manifest, the enumeration set of runtime-reached externals is invisible to the gate. Requiring the ratified-deferrals store to be a persistent machine-readable artefact (not a README note) is the choice that refuses the 'quirk-in-status.md' pattern the class defect exposed. Extending the detector's ruleset in rcf-lite (rather than per-project) is deliberate: one authoritative catalogue of placeholder shapes serves every downstream project.",
+  "createdAt": "2026-08-24T13:00:00Z",
+  "updatedAt": "2026-08-24T13:00:00Z"
+}

package/blueprints/application-spa/contributions/tacs/tac-211-application-spa-core-flow-e2e-probe.json

@@ -0,0 +1,70 @@
+{
+  "tacId": "TAC-211-application-spa-core-flow-e2e-probe",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Core-flow end-to-end adherence probe",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. Watchpost first production (w-2026-08-24-005) demonstrated the deployment-gate class defect this probe cures: the app was signed off as DEPLOYED, admin access was reachable only via ssh-minted tokens because magic-link email never worked in production, and the authentication core flow was never proven end-to-end in the shipped runtime. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the ci-pipeline aggregate report can name.",
+  "responsibilities": [
+    "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a ci-pipeline gate (AC-1133-5, AC-1133-6).",
+    "Accept configuration naming (i) the path of the application's core-flow manifest, (ii) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration, the same production security-header stack, and the same middleware), (iii) how to reach real external-service providers (the deferrals-permission is the same shape as TAC-210 accepts for its 'deferred' entries), and (iv) the report directory (AC-1133-1, AC-1133-2, AC-1133-4).",
+    "Read the core-flow manifest, iterate every declared core flow, and refuse ship when the manifest omits an authentication flow while the application declares any application-spa-REQ-009 authentication surface. The auth-flow enumeration requirement is a hard invariant of the probe (AC-1133-1).",
+    "For every enumerated core flow, drive a real headless browser through the ordered step sequence against the SHIPPED runtime: the same server construction the production entry point boots, the same production security-header stack, real external-service providers (never in-process stubs, mocked adapters, or app.inject). Refuse the run when any flow ran through a bypassed header path, an in-process fetch, a mocked provider, or a bespoke test harness (AC-1133-2).",
+    "For every flow capture: an ordered navigation trace of routes visited with response status codes, the terminal DOM assertion result, the wall-clock timing per step, and any provider-side ids the flow generated (e.g. an emailed magic-link id, a payment intent id). Persist the evidence per flow on the probe report (AC-1133-3, AC-1133-5).",
+    "Refuse ship on any enumerated core flow whose evidence is absent, whose verdict is 'skip', whose verdict is 'fail', or whose terminal DOM assertion did not hold. 'A documented workaround exists', a status.md quirk line, an operator note, or an admin-bypass (e.g. mint-your-own-token) explicitly does NOT convert a broken or skipped flow into a passing verdict; the probe emits a hard refusal on any such flow (AC-1133-3).",
+    "For every fail-or-skip flow, write a structured refusal on the report naming the flow id, the entry-point route, the step at which the flow diverged, the assertion that did not hold, and the captured evidence up to the divergence; emit a stdout line naming the flow id and the report path (AC-1133-4).",
+    "Write a JSON report at a stable relative path ('reports/core-flow-e2e-adherence.json' under the configured report directory, matching the ci-pipeline per-gate report shape of TAC-702) naming: every core flow enumerated, its captured evidence entry, its per-flow verdict ('ok' | 'fail' | 'skip'), and an aggregate 'verdict' of 'ok' | 'deployed-with-defects' (AC-1133-5).",
+    "Exit with code 0 when the aggregate verdict is 'ok'; exit with code 1 (or the configured non-zero code) on 'deployed-with-defects', so a ci-pipeline runner (TAC-701) captures the failure through its ordinary gate-failure path (AC-1133-5, AC-1133-6).",
+    "Refuse to gate control flow on CI-provider-specific environment variables; the probe MUST run identically on a developer machine and inside CI (AC-1133-6)."
+  ],
+  "internalStructure": "One Node module that exports a 'runCoreFlowE2eProbe({ manifestPath, bootServer, reportDir })' function and a shebang entry point that reads its configuration and calls the exported function. A driver orchestrates: (1) a manifest scanner that reads the enumerated flow set and refuses when the auth-flow-required invariant is violated, (2) a per-flow runner that drives a real headless browser through the ordered step sequence against the boot-server-produced URL, respecting the shipped headers and reaching real providers, and (3) an evidence recorder that persists the navigation trace, response status codes, timings, and any provider ids per flow. The writer serialises the accumulated report and the caller returns the exit code derived from the aggregate verdict.",
+  "interfaces": [
+    {
+      "name": "runCoreFlowE2eProbe",
+      "kind": "factory",
+      "description": "runCoreFlowE2eProbe({ manifestPath, bootServer, reportDir }) -> Promise<{ verdict, reportPath, refusals }>; the sole callable the entry point invokes. 'bootServer' is a factory returning '{ url, close }' for a server booted through the production entry-point path (same construction, same headers, same middleware). 'verdict' is 'ok' | 'deployed-with-defects'; the entry point translates 'deployed-with-defects' to a non-zero exit code."
+    },
+    {
+      "name": "entry-point CLI",
+      "kind": "cli",
+      "description": "'node <entryPointPath>' with optional flags '--manifest <path>', '--boot <module>', '--report-dir <path>' that override configuration defaults. Exit code is 0 on 'ok', non-zero on 'deployed-with-defects'."
+    },
+    {
+      "name": "reports/core-flow-e2e-adherence.json",
+      "kind": "artefact",
+      "description": "'reports/core-flow-e2e-adherence.json' under the configured report directory. Shape: '{ verdict, flows: [{ id, entryPointRoute, verdict, steps: [{ index, action, route, status, timingMs }], terminalAssertion: { kind, expected, actual }, providerEvidence?: { messageIds }, refusals: [...] }], generatedAt }'."
+    },
+    {
+      "name": "core-flow manifest (project-owned)",
+      "kind": "artefact",
+      "description": "A project-owned JSON manifest the probe reads. Shape: '{ flows: [{ id, entryPointRoute, steps: [{ action, target?, input? }], terminalAssertion: { kind, expected } }] }'. Authentication must be enumerated when the application declares any application-spa-REQ-009 surface; otherwise the manifest scanner refuses ship."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Production server construction",
+      "kind": "external",
+      "description": "The probe requires a factory that boots the target server through the same construction the production entry point uses (same route registration, same security-header middleware, same static / assets registration). A separate server instance, a header-stripping harness, or an in-process app.inject does not satisfy AC-1133-2."
+    },
+    {
+      "name": "Headless browser",
+      "kind": "external",
+      "description": "A real browser (Playwright chromium, Puppeteer chromium, or equivalent). The probe MUST drive a browser fetch through the shipped headers against real external-service providers; an in-process fetch, a mocked provider, or a stubbed adapter cannot satisfy AC-1133-2 or AC-1133-3."
+    },
+    {
+      "name": "Real external-service providers",
+      "kind": "external",
+      "description": "The probe drives every enumerated core flow against real providers named on the external-service-dependency manifest TAC-210 reads. When a provider is 'deferred' per TAC-210, the affected flow is 'skip' and the aggregate lands 'deployed-with-defects' (a deferred provider cannot underwrite a passing core-flow gate)."
+    },
+    {
+      "name": "ci-pipeline gate runner",
+      "kind": "tac",
+      "tacId": "TAC-701-ci-pipeline-gate-runner",
+      "description": "When this probe is wired as a ci-pipeline gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
+    }
+  ],
+  "tradeoffs": "The probe requires a real browser, the shipped server construction, and network reach to real external providers for every ci-pipeline invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: sign-off said DEPLOYED, admin login was only reachable via a manually minted token, and no gate demanded the auth flow work end-to-end in the shipped runtime. Requiring an auth-flow-enumeration hard invariant is deliberate: authentication is the flow the class-defect instance exposed, and its enumeration cannot be optional when application-spa-REQ-009 surfaces are present. Refusing to accept a 'documented workaround' as sign-off is the choice that refuses the 'quirk-in-status.md' pattern; the aggregate 'deployed-with-defects' vocabulary is what the probe emits to name the distinction between 'shipped and accepted' and 'shipped with a broken core flow'.",
+  "createdAt": "2026-08-24T13:00:00Z",
+  "updatedAt": "2026-08-24T13:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1101.json

@@ -0,0 +1,72 @@
+{
+  "usId": "application-spa-US-1101",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Declared routes, canonical URLs, breadcrumbs, and not-found surfaces",
+  "asA": "user sharing and revisiting links",
+  "iWant": "every screen to have a stable, canonical URL that loads correctly on arrival",
+  "soThat": "I can bookmark, share, and return to anything I can see",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1101-1",
+      "description": "The project maintains a declared route inventory naming every route; no navigable surface exists outside it.",
+      "given": "the application source tree",
+      "when": "the route inventory is compared against reachable navigation targets",
+      "then": "every reachable target appears in the inventory and every inventory entry is reachable",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1101-2",
+      "description": "Each resource class uses one canonical URL shape; the same resource is never reachable under two shapes without a redirect to the canonical one.",
+      "given": "a resource with a canonical URL",
+      "when": "a non-canonical variant of that URL is visited",
+      "then": "the application redirects or rewrites to the canonical shape",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1101-3",
+      "description": "Breadcrumbs render on every route nested more than two levels deep, reflecting the canonical hierarchy, with each ancestor navigable.",
+      "given": "a route at nesting depth three or more",
+      "when": "the route renders",
+      "then": "a breadcrumb trail shows the ancestry and each crumb navigates to its level",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1101-4",
+      "description": "Visiting an unknown path renders the designed 404 surface inside the shell with navigation intact and a way back to a known route.",
+      "given": "a running application",
+      "when": "a path outside the route inventory is visited",
+      "then": "the 404 surface renders with shell navigation present, not a blank page or silent redirect",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1101-5",
+      "description": "Visiting a resource that previously existed and was removed renders the designed 410 surface distinguishing \"gone\" from \"never existed\".",
+      "given": "a resource known to be deleted",
+      "when": "its canonical URL is visited",
+      "then": "the 410 surface renders naming the resource as removed",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1101-6",
+      "description": "Every route in the inventory cold-loads from a direct URL entry, not only via in-app navigation.",
+      "given": "any route in the inventory",
+      "when": "the URL is opened in a fresh browser session",
+      "then": "the route renders its arrival state without client-side navigation first",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-201-application-spa-app-shell"
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1102.json

@@ -0,0 +1,63 @@
+{
+  "usId": "application-spa-US-1102",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Navigation shell with visible structure and active states",
+  "asA": "user moving between areas of the application",
+  "iWant": "persistent navigation that always shows where I am and where I can go",
+  "soThat": "I never feel lost or have to use the back button to orient myself",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1102-1",
+      "description": "Top navigation renders on every route from the route inventory; sections the signed-in user cannot access are absent, not disabled.",
+      "given": "any declared route",
+      "when": "the route renders",
+      "then": "the top navigation is present and reflects the route inventory for the current user",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1102-2",
+      "description": "The navigation item for the current section carries a visible active state and aria-current=\"page\" on the exact match.",
+      "given": "a route within a navigation section",
+      "when": "the route renders",
+      "then": "that section's item is visually active and exposes aria-current",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1102-3",
+      "description": "Side navigation, where the project declares secondary structure, collapses below 1024 into an accessible disclosure pattern rather than disappearing.",
+      "given": "a project with declared secondary navigation",
+      "when": "the viewport is below 1024",
+      "then": "secondary navigation is reachable via a toggle with an accessible name and state",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1102-4",
+      "description": "Navigation renders identically from the same inventory data on every route; no route ships a bespoke variant of the shell.",
+      "given": "any two declared routes",
+      "when": "their rendered shells are compared",
+      "then": "navigation structure and behaviour are identical except for active states",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1102-5",
+      "description": "Every navigation link is a real link with an href, supporting open-in-new-tab and middle-click, not a click-handler-only element.",
+      "given": "any navigation item",
+      "when": "it is inspected or middle-clicked",
+      "then": "it exposes an href and opens correctly in a new tab",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-201-application-spa-app-shell"
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1103.json

@@ -0,0 +1,72 @@
+{
+  "usId": "application-spa-US-1103",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Keyboard navigation, skip-link, and landmark roles",
+  "asA": "keyboard-only user",
+  "iWant": "to reach and operate every part of the application without a pointer",
+  "soThat": "the application is fully usable with the keyboard alone",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1103-1",
+      "description": "A skip-link is the first focusable element on every route, visible on focus, and moves focus to the main content region.",
+      "given": "any declared route",
+      "when": "Tab is pressed once from page load",
+      "then": "the skip-link receives visible focus and activating it moves focus into main",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1103-2",
+      "description": "Tab and Shift-Tab traverse all interactive elements in a logical order matching the visual order.",
+      "given": "any declared route",
+      "when": "the page is traversed with Tab and Shift-Tab",
+      "then": "focus order matches visual order with no unreachable interactive element",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1103-3",
+      "description": "Arrow keys move between items inside menus and menu-like composites; Tab exits the composite rather than walking every item.",
+      "given": "an open navigation menu",
+      "when": "arrow keys and Tab are pressed",
+      "then": "arrows move within the menu and Tab moves focus out of it",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1103-4",
+      "description": "Escape closes the topmost open overlay (menu, modal, drawer, popover) and returns focus to the element that opened it.",
+      "given": "an open overlay",
+      "when": "Escape is pressed",
+      "then": "the overlay closes and focus returns to its trigger",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1103-5",
+      "description": "Shell regions expose landmark roles: banner, navigation, main, and contentinfo; exactly one main per route.",
+      "given": "any declared route",
+      "when": "the accessibility tree is inspected",
+      "then": "the four landmarks are present and main is unique",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1103-6",
+      "description": "No keyboard trap exists anywhere: from any focused element, the user can always move focus away using standard keys.",
+      "given": "any interactive element on any route",
+      "when": "standard focus-movement keys are used",
+      "then": "focus always has an exit path",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-201-application-spa-app-shell"
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}