rcf-lite 0.12.0 → 0.13.0

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1121.json

@@ -0,0 +1,73 @@
+{
+  "usId": "application-spa-US-1121",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-014",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Visible offline handling with no silent data loss",
+  "asA": "user on an unreliable connection",
+  "iWant": "the application to tell me what it can and cannot do right now",
+  "soThat": "a network drop never costs me work I already did",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1121-1",
+      "description": "When connectivity is lost, the shell banner names the condition within a short detection window, without blocking interaction with already-loaded content.",
+      "given": "a loaded application",
+      "when": "the network drops",
+      "then": "the offline banner renders and existing content stays usable",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1121-2",
+      "description": "Failed reads render the error state with a retry affordance; retry succeeds once connectivity returns.",
+      "given": "a read failed offline",
+      "when": "retry is pressed after reconnect",
+      "then": "the data loads and the error state clears",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1121-3",
+      "description": "A write attempted offline is either queued with visible pending status or refused with an explanation; the entered payload remains in the form in both cases.",
+      "given": "a form submitted offline",
+      "when": "the write cannot reach the server",
+      "then": "queued-or-refused is explicit and the input is intact",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1121-4",
+      "description": "Queued writes replay on reconnect in order; replay outcomes are surfaced per write, and a replay failure re-presents the payload for user action.",
+      "given": "queued writes and a restored connection",
+      "when": "replay runs",
+      "then": "successes confirm, failures return to the user with data intact",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1121-5",
+      "description": "On reconnect the banner clears and stale views revalidate per application-spa-US-1120 without requiring a reload.",
+      "given": "a reconnected application",
+      "when": "the banner clears",
+      "then": "visible data refreshes in the background",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1121-6",
+      "description": "No code path discards user-entered data on a network failure; this holds for every mutating surface in the application.",
+      "given": "each mutating surface",
+      "when": "network failure is injected at submit",
+      "then": "the entered data survives on screen or in the queue in every case",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-204-application-spa-client-data-layer",
+    "TAC-201-application-spa-app-shell"
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1122.json

@@ -0,0 +1,69 @@
+{
+  "usId": "application-spa-US-1122",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-015",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Extracted strings, locale-aware formatting, RTL-safe layout",
+  "asA": "user in any locale",
+  "iWant": "text, dates, and numbers presented in ways my locale expects",
+  "soThat": "the product can meet me where I am without a rebuild",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1122-1",
+      "description": "Every user-facing string renders through the extraction catalogue; hard-coded display strings in components are absent.",
+      "given": "component source and the catalogue",
+      "when": "rendered strings are traced to origin",
+      "then": "each traces to a catalogue key",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1122-2",
+      "description": "Catalogue entries are whole messages with placeholders; sentences are never assembled from concatenated fragments in code.",
+      "given": "messages containing dynamic values",
+      "when": "their construction is inspected",
+      "then": "each is one catalogue entry with named placeholders",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1122-3",
+      "description": "Dates and times format through locale-aware APIs; no hand-rolled date formatting appears.",
+      "given": "every rendered date and time",
+      "when": "formatting paths are audited",
+      "then": "all route through Intl-based formatting per ADR-208",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1122-4",
+      "description": "Numbers and currency format through locale-aware APIs, including group separators and currency symbols.",
+      "given": "every rendered number and amount",
+      "when": "formatting paths are audited",
+      "then": "all route through Intl-based formatting",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1122-5",
+      "description": "Under an RTL test locale the layout mirrors correctly with no clipped, overlapped, or misaligned content on any declared route at any baseline breakpoint.",
+      "given": "an RTL locale",
+      "when": "each route renders at each breakpoint",
+      "then": "the layout survives with correct mirroring",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1122-6",
+      "description": "Pluralised messages use plural-aware catalogue forms, not \"(s)\" suffixes.",
+      "given": "messages varying by count",
+      "when": "zero, one, and many are rendered",
+      "then": "each count renders its correct form",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1123.json

@@ -0,0 +1,63 @@
+{
+  "usId": "application-spa-US-1123",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-016",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Journey events, error-boundary reports, and performance marks",
+  "asA": "product team member reading dashboards",
+  "iWant": "stable, named signals from every journey and failure",
+  "soThat": "we can see where users struggle without instrumenting after the fact",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1123-1",
+      "description": "Every checkpoint in the journey inventory emits its declared event with the ADR-209 naming scheme; emitted names match the registry exactly.",
+      "given": "each declared journey",
+      "when": "walked end to end",
+      "then": "every checkpoint event fires with its registered name",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1123-2",
+      "description": "Events carry the declared minimal context (route, journey step, outcome) and never include personal data beyond the declared allow-list.",
+      "given": "captured events",
+      "when": "payloads are audited",
+      "then": "context is present and no disallowed personal data appears",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1123-3",
+      "description": "Error boundaries exist at shell and route level; a component crash renders the designed error state per application-spa-REQ-010 instead of a white screen, and reports the catch with route and component context.",
+      "given": "a component forced to throw during render",
+      "when": "the boundary catches",
+      "then": "the designed error state renders and one report is emitted",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1123-4",
+      "description": "Performance marks fire at first paint and time-to-interactive with the reserved registry names.",
+      "given": "a cold application load",
+      "when": "marks are captured",
+      "then": "both marks fire once each with correct names",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1123-5",
+      "description": "With no telemetry backend configured, instrumentation no-ops cleanly: no console errors, no failed requests, no behavioural difference.",
+      "given": "a deployment without a telemetry endpoint",
+      "when": "the application is used normally",
+      "then": "no telemetry-related errors surface",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-206-application-spa-telemetry"
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1124.json

@@ -0,0 +1,60 @@
+{
+  "usId": "application-spa-US-1124",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-017",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Rendered copy free of internal ids and placeholders, errors phrased forward",
+  "asA": "user reading anything the application says",
+  "iWant": "copy written for me, not for the build system",
+  "soThat": "nothing on screen reads like scaffolding or blame",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1124-1",
+      "description": "No rendered surface in any reachable state contains internal specification identifiers: strings matching REQ-, US-, AC-, FBS-, or blueprint-namespaced id patterns never appear in visible copy.",
+      "given": "every route in every reachable state",
+      "when": "rendered text is scanned for id patterns",
+      "then": "zero matches in visible copy",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1124-2",
+      "description": "No rendered surface contains lorem ipsum or recognisable placeholder text in any reachable state, including empty, error, and onboarding surfaces.",
+      "given": "every reachable state",
+      "when": "rendered text is scanned for placeholder markers",
+      "then": "zero placeholder strings",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1124-3",
+      "description": "Error copy tells the user what happened and what to do next; it does not blame (\"you entered an invalid value\") or dead-end (\"an error occurred\").",
+      "given": "every error message in the catalogue",
+      "when": "copy is reviewed against the actionability rule",
+      "then": "each names the situation and a next step",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1124-4",
+      "description": "Raw failure internals (stack traces, exception class names, wire payloads) never render to the user in any state.",
+      "given": "forced failures across routes",
+      "when": "error surfaces render",
+      "then": "internals are absent; the problem-details mapping per ADR-204 produced user copy",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1124-5",
+      "description": "Empty-state and onboarding copy is product-specific per application-spa-US-1117; template copy from the blueprint assets is replaced before ship.",
+      "given": "shipped empty and onboarding surfaces",
+      "when": "copy is compared to blueprint template text",
+      "then": "no unreplaced template sentences remain",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1125.json

@@ -0,0 +1,69 @@
+{
+  "usId": "application-spa-US-1125",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-018",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle",
+  "asA": "user trusting the application with my data",
+  "iWant": "the standard browser security floors actually in place",
+  "soThat": "using the product does not expose me to script injection or session theft",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1125-1",
+      "description": "A Content-Security-Policy is served on the application document with directives explicitly declared for at least default-src, script-src, style-src, img-src, connect-src, and frame-ancestors; no wildcard script-src.",
+      "given": "the deployed application document",
+      "when": "response headers are inspected",
+      "then": "the CSP is present with the named directives and no wildcard script source",
+      "testable": true,
+      "scope": "deployed"
+    },
+    {
+      "id": "AC-1125-2",
+      "description": "User-influenced data never renders through raw HTML injection without passing the declared sanitiser; sanitiser bypasses do not exist in the codebase.",
+      "given": "every render path for user-influenced content",
+      "when": "the paths are audited",
+      "then": "each either escapes by default or routes through the sanitiser",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1125-3",
+      "description": "Session cookies carry Secure, HttpOnly, and SameSite attributes.",
+      "given": "a signed-in session",
+      "when": "the session cookie is inspected",
+      "then": "all three attributes are present",
+      "testable": true,
+      "scope": "deployed"
+    },
+    {
+      "id": "AC-1125-4",
+      "description": "Form values containing markup round-trip as inert text: entered script fragments display as text and never execute.",
+      "given": "a form field",
+      "when": "a script fragment is entered, submitted, and re-rendered",
+      "then": "the fragment displays as text with no execution",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1125-5",
+      "description": "The shipped bundle contains no secrets: API keys, private endpoints, and credentials are absent from every emitted asset.",
+      "given": "the production bundle output",
+      "when": "assets are scanned for secret patterns and known project secrets",
+      "then": "zero findings",
+      "testable": true,
+      "scope": "deployed"
+    },
+    {
+      "id": "AC-1125-6",
+      "description": "Authenticated-only data never embeds in surfaces served to unauthenticated users, including prefetched state in the document.",
+      "given": "the unauthenticated document and its embedded state",
+      "when": "inspected",
+      "then": "no authenticated-scope data is present",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1126.json

@@ -0,0 +1,78 @@
+{
+  "usId": "application-spa-US-1126",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-019",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "WCAG 2.2 AA: contrast, focus visibility, target size, no traps",
+  "asA": "user with low vision or motor constraints",
+  "iWant": "the interface to be perceivable and operable as a matter of course",
+  "soThat": "accessibility is a property of the product, not a request I have to make",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1126-1",
+      "description": "Body text meets 4.5:1 contrast against its background in both themes on every route.",
+      "given": "every text element in both themes",
+      "when": "contrast is computed",
+      "then": "body text is at or above 4.5:1",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1126-2",
+      "description": "Large text, icons, and essential non-text UI (control boundaries, state indicators) meet 3:1 contrast in both themes.",
+      "given": "large text and essential non-text elements",
+      "when": "contrast is computed",
+      "then": "all are at or above 3:1",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1126-3",
+      "description": "Every interactive element shows a visible focus indicator meeting the 3:1 contrast bar; no interactive element relies on the browser default while suppressing it elsewhere.",
+      "given": "every interactive element",
+      "when": "focused via keyboard",
+      "then": "a visible, sufficiently contrasting indicator renders",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1126-4",
+      "description": "Every pointer target is at least 24x24 CSS pixels or has equivalent spacing per the WCAG 2.2 target-size criterion.",
+      "given": "every interactive target",
+      "when": "measured across breakpoints",
+      "then": "the criterion is met everywhere",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1126-5",
+      "description": "No keyboard trap exists in any component or overlay across the application, verified over the full component inventory.",
+      "given": "each component and overlay",
+      "when": "keyboard escape paths are exercised",
+      "then": "focus can always leave",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1126-6",
+      "description": "Information is never conveyed by colour alone: states pair colour with text, icon, or structure.",
+      "given": "every state indication",
+      "when": "reviewed with colour removed",
+      "then": "the state remains determinable",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1126-7",
+      "description": "An automated WCAG audit (axe-core rules or equivalent) reports zero violations at the AA level on every declared route in both themes.",
+      "given": "every route in both themes",
+      "when": "the automated audit runs",
+      "then": "zero AA violations are reported",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1127.json

@@ -0,0 +1,63 @@
+{
+  "usId": "application-spa-US-1127",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-020",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Modular type scale with size and line-height floors",
+  "asA": "user reading the interface for hours",
+  "iWant": "text sized and spaced for sustained reading",
+  "soThat": "nothing important is squint-small or cramped",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1127-1",
+      "description": "All font sizes resolve to the typography tokens, which realise a modular scale with ratio 1.125 or 1.25; off-scale literal sizes do not appear in component styles.",
+      "given": "the shipped stylesheet output",
+      "when": "font-size declarations are audited",
+      "then": "every size maps to a scale token",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1127-2",
+      "description": "Body text renders at 14px minimum below 768 and 16px minimum at 768 and above.",
+      "given": "body text at each baseline breakpoint",
+      "when": "computed sizes are measured",
+      "then": "the minimums hold",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1127-3",
+      "description": "Type scales fluidly between breakpoints rather than jumping only at breakpoint edges.",
+      "given": "a viewport resized between 360 and 1440",
+      "when": "body and heading sizes are sampled",
+      "then": "sizes interpolate smoothly within the declared bounds",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1127-4",
+      "description": "Line height is 1.5 for body text and 1.2 for headings across the application.",
+      "given": "body and heading elements",
+      "when": "computed line heights are measured",
+      "then": "the declared values hold",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1127-5",
+      "description": "Text containers tolerate 200% browser zoom without loss of content or functionality.",
+      "given": "any declared route",
+      "when": "rendered at 200% zoom",
+      "then": "all content remains readable and operable",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-202-application-spa-theme-system"
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1128.json

@@ -0,0 +1,51 @@
+{
+  "usId": "application-spa-US-1128",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-021",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Performance budget enforced on production builds",
+  "asA": "user on a mid-range phone and a slow connection",
+  "iWant": "the application usable within seconds of opening it",
+  "soThat": "performance is a shipped property, not a lab number",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1128-1",
+      "description": "First meaningful paint lands under 2 seconds on the 3G-fast reference profile against a production build of every declared key route.",
+      "given": "a production build under the 3G-fast profile",
+      "when": "each key route cold-loads",
+      "then": "first meaningful paint is under 2 seconds",
+      "testable": true,
+      "scope": "deployed"
+    },
+    {
+      "id": "AC-1128-2",
+      "description": "Lighthouse performance scores 90 or above on every declared key route against a production build.",
+      "given": "a production build",
+      "when": "Lighthouse runs per key route",
+      "then": "each scores at least 90",
+      "testable": true,
+      "scope": "deployed"
+    },
+    {
+      "id": "AC-1128-3",
+      "description": "Total main-thread work during initial load stays under 3 seconds per key route.",
+      "given": "a production build profiled on load",
+      "when": "main-thread work is measured",
+      "then": "the total is under 3 seconds per route",
+      "testable": true,
+      "scope": "deployed"
+    },
+    {
+      "id": "AC-1128-4",
+      "description": "Route-level code splitting keeps any single route's initial JavaScript payload within the budget declared in the project; no route loads the whole application to render itself.",
+      "given": "the production bundle map",
+      "when": "per-route payloads are measured",
+      "then": "each route loads only its declared chunks within budget",
+      "testable": true,
+      "scope": "deployed"
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1129.json

@@ -0,0 +1,54 @@
+{
+  "usId": "application-spa-US-1129",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Token adherence probe refuses ship on raw palette or missing parity",
+  "asA": "operator relying on the theme-system discipline",
+  "iWant": "a runtime check that fails the build when component styles slip a raw hex or when a theme is missing a token pair",
+  "soThat": "the semantic-token contract in ADR-202 is enforced at the ship gate, not just declared",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1129-1",
+      "description": "The token-adherence probe (TAC-207) scans the built component-scope stylesheets and exits non-zero when any file outside the token-realisation file contains a raw palette literal: hex, `rgb(`, `rgba(`, `hsl(`, `hsla(`, `oklch(`, `oklab(`, or a named CSS colour outside the pass-through allow list (`transparent`, `currentColor`, `inherit`, `initial`, `unset`).",
+      "given": "a project build that shipped a raw `#123456` in a component stylesheet outside `assets/tokens/theme.css`",
+      "when": "the token-adherence probe runs against the built stylesheet output",
+      "then": "the probe exits with a non-zero code and records the file path and line number of the violation in its report",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1129-2",
+      "description": "The token-adherence probe reads the design tokens JSON, extracts the light and dark key sets, and exits non-zero when any key present in one theme is missing from the other.",
+      "given": "a design tokens JSON in which the light theme declares `surface.raised` but the dark theme does not",
+      "when": "the token-adherence probe runs against the tokens file",
+      "then": "the probe exits with a non-zero code and records the missing key with the theme it is missing from in its report",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1129-3",
+      "description": "The token-adherence probe writes a JSON report at a stable relative path (`reports/token-adherence.json` under the configured report directory) naming every stylesheet scanned, every raw-literal violation with file path and line number, every missing-parity token key, and an `ok` or `fail` verdict.",
+      "given": "a completed probe run (pass or fail)",
+      "when": "the report file is inspected on disk",
+      "then": "the JSON at `reports/token-adherence.json` matches the shape declared by TAC-207 and its verdict field agrees with the process exit code",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1129-4",
+      "description": "When the token-adherence probe is wired as a gate in the ci-pipeline runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the ci-pipeline runner refuses ship with a non-zero exit.",
+      "given": "the ci-pipeline runner configured with the token-adherence probe as a required gate",
+      "when": "the probe reports `fail` on any run",
+      "then": "the aggregate report records the gate as failed and the runner exits non-zero",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-207-application-spa-token-adherence-probe"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1130.json

@@ -0,0 +1,54 @@
+{
+  "usId": "application-spa-US-1130",
+  "prdId": "PRD-001",
+  "reqId": "application-spa-REQ-011",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Icon adherence probe refuses ship on inline SVG or unknown alias",
+  "asA": "operator relying on the iconography discipline",
+  "iWant": "a runtime check that fails the build when a component sidesteps the icon alias registry",
+  "soThat": "the one-icon-set-behind-semantic-aliases contract in ADR-206 is enforced at the ship gate, not just declared",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1130-1",
+      "description": "The icon-adherence probe (TAC-208) scans the shipped component source tree and exits non-zero when any file outside the icon registry allow list contains an inline `<svg>` opening tag.",
+      "given": "a project source tree in which a component ships an inline `<svg>` element outside the icon registry",
+      "when": "the icon-adherence probe runs against the component glob",
+      "then": "the probe exits with a non-zero code and records the file path and line number of the inline SVG in its report",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1130-2",
+      "description": "The icon-adherence probe reads the icon alias registry, enumerates the declared alias names, and exits non-zero when any component-source icon reference resolves to a name absent from the registry.",
+      "given": "a component that references `icon.close` while the alias registry declares only `icon.danger`, `icon.search`, and `icon.menu`",
+      "when": "the icon-adherence probe runs against the component glob",
+      "then": "the probe exits with a non-zero code and records the unknown alias name, file path, and line number in its report",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1130-3",
+      "description": "The icon-adherence probe writes a JSON report at a stable relative path (`reports/icon-adherence.json` under the configured report directory) naming every component file scanned, every inline-SVG violation, every unknown-alias violation, and an `ok` or `fail` verdict.",
+      "given": "a completed probe run (pass or fail)",
+      "when": "the report file is inspected on disk",
+      "then": "the JSON at `reports/icon-adherence.json` matches the shape declared by TAC-208 and its verdict field agrees with the process exit code",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-1130-4",
+      "description": "When the icon-adherence probe is wired as a gate in the ci-pipeline runner (TAC-701), a non-zero probe exit propagates through the per-gate report (TAC-702) and the aggregate report (TAC-703), and the ci-pipeline runner refuses ship with a non-zero exit.",
+      "given": "the ci-pipeline runner configured with the icon-adherence probe as a required gate",
+      "when": "the probe reports `fail` on any run",
+      "then": "the aggregate report records the gate as failed and the runner exits non-zero",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-208-application-spa-icon-adherence-probe"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}