rcf-lite 0.12.0 → 0.13.0

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2118.json

@@ -0,0 +1,72 @@
+{
+  "usId": "application-api-rest-US-2118",
+  "prdId": "PRD-001",
+  "reqId": "application-api-rest-REQ-014",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Forward-only migrations with named reverts and a live schema-version report",
+  "asA": "platform operator deploying schema changes",
+  "iWant": "every migration to know how to undo itself and every instance to report what schema it runs",
+  "soThat": "deploys are ordered, reversible on purpose, and verifiable from the outside",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2118-1",
+      "description": "Migrations apply strictly forward in a deterministic order; the tool refuses to apply migrations out of order or to skip gaps.",
+      "given": "a migration set with an out-of-order or missing member",
+      "when": "migration is attempted",
+      "then": "the tool refuses with an error naming the ordering violation",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2118-2",
+      "description": "Every migration ships a named revert step, and the revert is exercised at least once in verification (apply then revert restores the prior schema).",
+      "given": "any migration in the set",
+      "when": "it is applied and its named revert executed",
+      "then": "the schema returns to its prior state",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2118-3",
+      "description": "The deploy order between migrations and application rollout is stated in the project documentation, including which schema versions each application version tolerates.",
+      "given": "the project's deploy documentation",
+      "when": "the migration-versus-rollout order is looked up",
+      "then": "the order and the tolerated schema-version window are stated",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2118-4",
+      "description": "GET /v1/_meta returns the current schema version and application version against a declared schema, under the same wire contract as every other endpoint.",
+      "given": "a running instance",
+      "when": "/v1/_meta is fetched",
+      "then": "the response conforms to the declared meta schema carrying schema version and application version",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2118-5",
+      "description": "The schema version reported by /v1/_meta equals the version recorded by the migration tool in the database, so the endpoint reports reality rather than a build-time constant.",
+      "given": "an instance after applying a new migration",
+      "when": "/v1/_meta and the migration tool's recorded version are compared",
+      "then": "they are equal, and change together when the next migration applies",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2118-6",
+      "description": "The /v1/_meta endpoint declares an auth class like any other endpoint (service or admin by default), and startup readiness (AC-2108-4) gates on migrations being current.",
+      "given": "the generated spec and a booting instance behind on migrations",
+      "when": "the _meta declaration and the startup probe are inspected",
+      "then": "_meta carries its declared auth class, and the startup probe withholds 200 until migrations are current",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-306-application-api-rest-operability"
+  ],
+  "createdAt": "2026-08-19T10:00:00Z",
+  "updatedAt": "2026-08-19T10:00:00Z"
+}

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2119.json

@@ -0,0 +1,63 @@
+{
+  "usId": "application-api-rest-US-2119",
+  "prdId": "PRD-001",
+  "reqId": "application-api-rest-REQ-015",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Spec-derived contract conformance across request, error, and auth axes",
+  "asA": "API consumer trusting the published contract",
+  "iWant": "every declared endpoint proven conformant on the happy path, the error path, and the auth boundary",
+  "soThat": "the contract holds by verification, including for the endpoint added yesterday",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2119-1",
+      "description": "For every declared operation, a schema-conforming request receives a response that validates against the operation's declared response schema for its status code.",
+      "given": "each operation in the generated spec",
+      "when": "a valid request is executed against it",
+      "then": "the response validates against the declared schema for the returned status",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2119-2",
+      "description": "For every declared operation accepting a body or parameters, an invalid request receives the declared error envelope with the documented 4xx status.",
+      "given": "each operation with declared inputs",
+      "when": "a request violating the input schema is executed",
+      "then": "the response is the documented 4xx carrying the problem-details envelope",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2119-3",
+      "description": "For every declared operation, the endpoint's x-auth-class is honoured: a caller below the declared class is rejected with 401 or 403 per AC-2106-5.",
+      "given": "each non-public operation",
+      "when": "an under-privileged request is executed",
+      "then": "the rejection matches the declared class semantics",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2119-4",
+      "description": "Conformance coverage is derived from the generated spec at verification time: an operation added to the surface is covered without anyone registering it manually, and an uncoverable operation fails the run.",
+      "given": "a newly added declared operation",
+      "when": "the conformance run executes",
+      "then": "the new operation is exercised on all three axes or the run fails naming it",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2119-5",
+      "description": "The conformance run is part of the standard verification pipeline and its per-operation results are reported, so contract conformance is visible at every build, not sampled occasionally.",
+      "given": "the project's verification pipeline",
+      "when": "it runs",
+      "then": "the conformance results appear per operation and a conformance failure fails the pipeline",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-303-application-api-rest-contract-surface"
+  ],
+  "createdAt": "2026-08-19T10:00:00Z",
+  "updatedAt": "2026-08-19T10:00:00Z"
+}

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2120.json

@@ -0,0 +1,73 @@
+{
+  "usId": "application-api-rest-US-2120",
+  "prdId": "PRD-001",
+  "reqId": "application-api-rest-REQ-016",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Security baselines: clean logs, redacted PII, TLS enforced, explicit CORS",
+  "asA": "security reviewer signing off the service",
+  "iWant": "secrets out of logs, PII redacted by stated policy, TLS mandatory outside development, and CORS deny-by-default",
+  "soThat": "the defects functional tests never catch are closed by specification",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2120-1",
+      "description": "No secret material (bearer tokens, API keys, passwords, session identifiers, idempotency keys) appears in log output at any level, including debug.",
+      "given": "traffic exercising auth, sessions, and idempotency with logging at the most verbose level",
+      "when": "all log output is scanned for the known secret values",
+      "then": "none appears in any line",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2120-2",
+      "description": "The PII-redaction policy is stated in project documentation, naming the field classes it covers and the redaction form, and log and error output conform to it.",
+      "given": "the stated policy and traffic carrying PII fields",
+      "when": "logs and error responses are inspected",
+      "then": "every covered field class appears only in its declared redacted form",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2120-3",
+      "description": "In non-development environments the service is reachable only over TLS: plain HTTP is refused or redirected, and no listener serves business endpoints in cleartext.",
+      "given": "a non-development deployment",
+      "when": "a plain HTTP request is attempted",
+      "then": "it is refused or redirected to TLS and no cleartext business response is served",
+      "testable": true,
+      "scope": "deployed"
+    },
+    {
+      "id": "AC-2120-4",
+      "description": "CORS is deny-by-default: a cross-origin request from an undeclared origin receives no permissive CORS headers, and no wildcard origin is served on any credentialed endpoint.",
+      "given": "a cross-origin request from an origin not on the declared allowlist",
+      "when": "the response headers are inspected",
+      "then": "no Access-Control-Allow-Origin permits the undeclared origin, and no credentialed endpoint ever serves a wildcard",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2120-5",
+      "description": "Per-endpoint CORS overrides are declared configuration: an endpoint allowing specific origins lists them, the declaration is auditable alongside the endpoint, and behaviour matches it.",
+      "given": "an endpoint with a declared CORS override",
+      "when": "cross-origin requests from declared and undeclared origins arrive",
+      "then": "declared origins succeed per the declaration and undeclared origins are refused",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-2120-6",
+      "description": "Problem-details responses never leak internals: stack traces, SQL, file paths, and dependency hostnames are absent from every error body in non-development environments.",
+      "given": "induced 4xx and 5xx errors in a non-development configuration",
+      "when": "every error body is scanned",
+      "then": "no stack trace, query text, filesystem path, or internal hostname appears",
+      "testable": true,
+      "scope": "deployed"
+    }
+  ],
+  "tacIds": [
+    "TAC-301-application-api-rest-request-pipeline",
+    "TAC-305-application-api-rest-observability"
+  ],
+  "createdAt": "2026-08-19T10:00:00Z",
+  "updatedAt": "2026-08-19T10:00:00Z"
+}

package/blueprints/application-api-rest/docs/topics.md

@@ -0,0 +1,46 @@
+# application-api-rest blueprint coordination vocabulary
+
+This file is the application-api-rest half of the cross-blueprint contract; the application-spa blueprint's `blueprints/application-spa/docs/topics.md` defines the format and the founding vocabulary. The conflict detector matches scope:global ADR topics by EXACT string equality, and AC ids are unnamespaced by the 0.4.4 grammar. Any blueprint intended to compose with this one must reuse these exact strings and respect these bands.
+
+## Global ADR topics this blueprint contributes (exact strings)
+
+| Topic string | application-api-rest contribution | Origin | Composition note |
+|---|---|---|---|
+| `errorEnvelope` | ADR-301-application-api-rest-error-envelope | Reused verbatim from the application-spa vocabulary | DELIBERATE pairing: application-spa contributes ADR-204-application-spa-error-envelope on this topic. Applying both blueprints to one project surfaces the conflict for operator resolution. Expected resolution: one project-level ADR adopting RFC 7807 end to end, superseding both halves |
+| `authModel` | ADR-302-application-api-rest-auth-model | Reused verbatim from the application-spa vocabulary | DELIBERATE pairing with SPA's ADR-205-application-spa-auth-model (cookie-based sessions, client half). Expected resolution: one project-level ADR fixing the credential transport and mapping the client session model onto the four server classes |
+| `apiVersioning` | ADR-303-application-api-rest-api-versioning | Minted here; pre-cleared as unclaimed in the application-spa vocabulary | The one versioning strategy for the project's wire contract. Any blueprint contributing a versioned API surface must join or supersede this decision |
+| `logging` | ADR-304-application-api-rest-logging | Minted here; pre-cleared as unclaimed in the application-spa vocabulary | The project's primary logging shape. Any blueprint contributing log-emitting server components conflicts here by design |
+
+Rules for new topics (inherited from the application-spa vocabulary, restated as law): lower camel case, one concept per topic, no version suffixes. A topic names the decision area, not the chosen answer. Do not mint variants of existing strings (`errorShape`, `auth`, `apiVersion`, `logShape` are all wrong).
+
+## Id number bands
+
+Band allocation is ratified policy (2026-08-19); the band IS the AC-collision enforcement mechanism, since AC ids are not namespaced by the 0.4.4 grammar. Composing blueprints take a fresh band rather than proposing namespaced AC ids.
+
+This table is maintained shelf-wide across every blueprint's `docs/topics.md`. Rows are recorded at ship, never predicted.
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-spa | 1101-1899 | 2xx | shipped v1.3.0 | `clientRouting`, `theming`, `clientState`, `errorEnvelope`, `authModel` |
+| application-api-rest | 2101-2899 | 3xx | shipped v1.0.0 | `errorEnvelope`, `authModel`, `apiVersioning`, `logging` |
+| security-auth-magic-link | 3101-3899 | 5xx | shipped v1.0.0 | `authModel` |
+| email-smtp-resend | 4101-4899 | 4xx | shipped v1.0.0 | none |
+| hello-panel (walkthrough exemplar) | 4101-4899 | 4xx | doc-reserved; teaching exemplar in `packages/rcf-lite/docs/blueprint-authoring-walkthrough.md`, not shipped as a blueprint directory | `operatorPanel` |
+| persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| ci-pipeline | 6101-6899 | 7xx | shipped v1.0.0 | `ciGates`, `strictCoverageGate` |
+| observability-essentials | 7101-7899 | 8xx | shipped v1.0.0 | `healthProbes`, `readinessSemantics`, `statusPageContract` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
+| security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
+| security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
+| security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
+| deploy-cloudflare-workers | 12101-12899 | 13xx | shipped v1.0.0 | `deploymentTarget` |
+| persistence-data-d1 | 13101-13899 | 14xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| observability-probe-endpoints | 14101-14899 | 15xx | shipped v1.0.0 | `healthProbes`, `readinessSemantics` |
+
+Suffix-family ids (ADR, TAC): SPA numbers in the 2xx range, this package takes 3xx (ADR-301 to ADR-308, TAC-301 to TAC-306); the next blueprint should take 4xx.
+
+## Shared expectations for future composing blueprints
+
+- Reuse `errorEnvelope`, `authModel`, `apiVersioning`, and `logging` exactly as spelled here when your blueprint holds an opinion on those decision areas; contribute your own scope:global ADR on the same string and let composition surface the pairing.
+- This blueprint's decisions state the server-side halves: RFC 7807 produced at the pipeline's error boundary, four auth classes enforced in middleware, path-versioned contract, JSON-line logs. Compose compatible client or worker halves, or expect the operator to supersede with project-level decisions.
+- Global topics that plausibly belong to a future blueprint and are NOT claimed here: `messageSerialisation` and `deliverySemantics` (a message-consumer blueprint's natural globals), `caching` (unclaimed by both application-spa and application-api-rest; claim it if your blueprint owns the caching story). Define any of these in your own package's topics doc, in this file's format.

package/blueprints/application-api-rest/guide/application-api-rest.md

@@ -0,0 +1,41 @@
+# The REST API blueprint: an operator's guide
+
+This guide is for the human running the project, not the coding agent. It explains what applying this blueprint buys you, when it is the wrong tool, and what still needs your judgement afterwards.
+
+## What this blueprint is
+
+A specification package for a REST service: single deployable, versioned wire contract, no UI in scope. Applying it (`rcf define blueprint add <path>`) merges 50 namespaced documents into your RCF tree: 16 requirements, 20 user stories carrying 117 acceptance criteria, 6 architectural components, and 8 decision records. It also ships reference assets: an OpenAPI 3.1 skeleton with the probe endpoints, error envelope, pagination envelope, and rate-limit shapes pre-populated; a middleware-slot reference for the four auth classes; sample request-response pairs per verb class; and neutral sample resources.
+
+The point, in one sentence: the operational and contractual floor of your API becomes part of the specification, so the same build cycle that verifies your features also verifies that the service is documented, observable, probeable, secured, and honest about errors.
+
+## What it deliberately is not
+
+- It is not code. No framework choice, no middleware implementation, no test files. Your working agent implements tests from the ACs the same way it does for your own stories, and writes the service in whatever stack the project chose. (Adherence is expressed as ACs, decision 5 of the design brief.)
+- It is not your product spec. It says every endpoint declares an auth class and every error wears the envelope; it cannot know what your resources are. Elicitation still happens; this package is the floor under it.
+- It does not ship FBS work items. Build tasks are derived in the host project at creation time, where the project's own constraints, sequencing, and existing work apply. The blueprint contributes the WHAT (REQ/US/AC/TAC/ADR); your project derives the HOW.
+
+## When to reach for it
+
+Any project whose primary surface is an HTTP API meant to be consumed by clients you do not control end to end: a backend for an SPA, a service in a fleet, a public API. Compose it freely with the application-spa blueprint; that composition is the intended shape for a product with both tiers.
+
+## When it does not fit
+
+- GraphQL or RPC-first services: the resource-modelling, pagination, and filtering requirements assume REST semantics; the observability, probe, and security categories transfer, but you would be opting out of half the doc set. Wait for (or ask for) a blueprint of that shape instead.
+- Serverless function collections without a shared pipeline: the middleware-ordering architecture assumes one deployable with one request path. The per-category requirements still read well as a checklist, but the TAC structure will not map.
+- Pure internal batch or worker processes with no HTTP surface: only the migrations, logging, and security categories would apply; a worker blueprint is the right home.
+
+## What a good outcome looks like
+
+Attack the finished service from the outside and try to catch it lying: fetch /docs and call an endpoint straight from the spec, send garbage JSON, reuse an idempotency key with a different body, hammer a public endpoint past its limit, kill the database and watch /healthz/ready tell the truth while /healthz/live stays up, grep the logs for the bearer token you just used. A build that honours this doc set answers every one of those correctly. That is the measure: what an integrating client and an on-call engineer get out of the box.
+
+## Your decisions that remain open
+
+1. Resources. The blueprint's conventions bind to the resource inventory your project declares during elicitation; the widgets resource in the assets is anatomy, not product.
+2. The four global decisions. Error envelope, auth model, API versioning, and logging shape ship as accepted defaults. Disagree by superseding with a project-level ADR, not by editing the blueprint's files.
+3. Composition conflicts. Adding this blueprint alongside the application-spa blueprint surfaces deliberate conflicts on `errorEnvelope` and `authModel`. That is the mechanism working: resolve each with one project-level decision (RFC 7807 end to end; one credential transport mapped onto the four classes).
+4. Class defaults and budgets. The four auth classes are fixed; their rate limits, the idempotency TTL, the pagination limits, and the readiness check set are project configuration the ACs require you to declare honestly.
+5. Exposure policy for /docs and /openapi.* in production: always-on, authenticated, or off. The ACs require the policy stated; they do not pick it for you.
+
+## Cost honesty
+
+This doc set makes an API slower to declare done, on purpose: 117 criteria is the price of "no endpoint ships undocumented, unmeasured, or unguarded". If you are prototyping a throwaway integration, that price is wrong; skip the blueprint rather than opting out of half of it. If other people's code will call this service, the price is the product.

package/blueprints/application-spa/README.md

@@ -0,0 +1,90 @@
+# application-spa blueprint (v1.3.0)
+
+The first content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 2 of the blueprint programme). Scope: single-page applications with public and authenticated surfaces, session-based auth, single deployable, dark and light by default, fully responsive by default.
+
+## Apply
+
+```
+rcf define blueprint add <path-to>/blueprints/application-spa
+```
+
+Phase 1 resolves local path sources only; registry and git-ref resolution is a mechanism follow-up. Apply is idempotent; `rcf define blueprint list` shows the applied entry; `rcf define blueprint remove application-spa` cleanly removes an unreferenced application.
+
+## Anatomy
+
+| Piece | Where | What |
+|---|---|---|
+| Metadata | `blueprint.json` | Slug, version, and the 74 contributions with scope/topic on the five global ADRs |
+| Doc set | `contributions/` | 21 REQs, 33 USs (193 ACs), 11 TACs, 9 ADRs, all schema-valid against rcf-schemas 0.4.5 and namespaced (`application-spa-REQ-001` prefix family; `ADR-201-application-spa-routing` suffix family) |
+| Design tokens | `assets/tokens/design-tokens.json` | Colour (both themes, contrast-validated), spacing, radius, typography, elevation, motion, breakpoints |
+| Stylesheet | `assets/tokens/theme.css` | The tokens realised as CSS custom properties with the theme-switch, focus, and reduced-motion machinery |
+| Wireframes | `assets/wireframes/` | Nine canonical surfaces: dashboard, list, detail, form, empty, error, sign-in, sign-out, session-expired |
+| Component specs | `assets/component-specs/` | Behaviour contracts for the full application-spa-REQ-006 component inventory |
+| Viewport table | `assets/viewports.md` | The ratified 360/768/1024/1440 baseline and per-breakpoint layout rules |
+| Sample data | `assets/sample-data/` | Neutral entities for skeletons, wireframe realisation, and state demos |
+| Guide | `guide/application-spa.md` | Operator-facing: when to use it, when not, what stays your call |
+| Coordination vocabulary | `docs/topics.md` | Exact global-topic strings and id number bands for composing blueprints |
+
+The doc set is contributions (copied into the project tree by `rcf define blueprint add`); the guide, assets, and docs are package-resident references. Guide rendering into `rcf/knowledge/docs/blueprint-guides/` and asset ingestion are mechanism follow-ups; until they land, the working agent reads them from the applied blueprint's source path recorded in `manifest.blueprints[].source`.
+
+## What it contributes, and what it deliberately does not
+
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+
+No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing. Structurally the same conclusion falls out of the mechanism: an FBS binds to a bsId and a buildOrder slot the blueprint cannot know.
+
+## The five global decisions
+
+ADR-201 clientRouting, ADR-202 theming, ADR-203 clientState, ADR-204 errorEnvelope, ADR-205 authModel ship `scope: global`. Composing with the application-api-rest blueprint deliberately conflicts on `errorEnvelope` and `authModel`; see `docs/topics.md` for the exact strings, the expected resolutions, and the AC id band allocation (application-spa owns 1101-1899).
+
+## Quality bar (ratified)
+
+WCAG 2.2 AA (contrast 4.5:1 body / 3:1 large-and-non-text, visible focus, 24x24 targets, no traps), breakpoints 360/768/1024/1440 with zero horizontal overflow, dark/light token parity, modular type scale with 14/16px body floors, motion tokens honouring reduced motion, performance budget (FMP under 2s on 3G-fast, Lighthouse 90+, main-thread under 3s). Every bar is carried by ACs in the doc set, not by this README.
+
+## What v1.1.0 adds
+
+v1.1.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump introduces the mechanism-reach cure for the icon and semantic-token disciplines that watchpost run4 caught shipping while the build cycle ran green.
+
+- `application-spa-US-1129` (anchored to application-spa-REQ-005) with four ACs binding the token-adherence probe.
+- `application-spa-US-1130` (anchored to application-spa-REQ-011) with four ACs binding the icon-adherence probe.
+- `TAC-207-application-spa-token-adherence-probe`: a Node build-scan probe the project realises; scans the built component-scope stylesheets for raw palette literals, diffs the light and dark token key sets for parity, writes a stable JSON report, and exits non-zero on any violation.
+- `TAC-208-application-spa-icon-adherence-probe`: a Node build-scan probe the project realises; scans the component source for inline SVG outside the icon registry and for icon references naming aliases the registry does not declare, writes a stable JSON report, and exits non-zero on any violation.
+- `ADR-202-application-spa-theming` and `ADR-206-application-spa-iconography` are amended in place at version 1.1.0: the decision is unchanged; the consequences narrative names the new probe and the ci-pipeline gate-failure path the probe rides.
+
+The v1.1 probes are runtime-observable AC binding at the ship gate. When a project wires each probe as a required gate in the ci-pipeline runner (TAC-701), a violation refuses ship through TAC-702's per-gate report and TAC-703's aggregate report; the run4 pattern of a discipline declared but not compelled no longer applies to these two categories.
+
+## What v1.2.0 adds
+
+v1.2.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the styled-under-shipped-CSP mechanism-reach gap watchpost caught at first production review (w-2026-08-24-003, w-2026-08-24-004): FBS-011 declared strict CSP (`style-src 'self'`, no `'unsafe-inline'`), FBS-013/015 rendered inline `<style>` blocks, every existing UI-bearing gate passed, and every production page rendered unstyled at deploy because the harness bypassed the production security-header path.
+
+- `application-spa-US-1131` (anchored to application-spa-REQ-018) with six ACs binding the styled-under-shipped-CSP probe.
+- `TAC-209-application-spa-csp-styled-adherence-probe`: a Node probe the project realises; boots the target server through the production entry-point path, drives a real headless browser at every enumerated UI route, refuses on any inline `<style>` block, any style-src relaxation, any browser-default computed body background, or any non-200 text/css stylesheet response.
+- The rcf-lite package gains a matching `noInlineStyleBlocks` block-severity invariant in `V1_INVARIANTS` (DOM-string arm of AC-1131-2 the browser-verify runner can enforce natively).
+
+## What v1.3.0 adds
+
+v1.3.0 is an additive-non-global minor bump. No global topics change; no contribution is removed. The bump cures the deployment-gate class defect the watchpost first-production review caught (w-2026-08-24-005, class cure w-2026-08-24-006): the app was signed off as DEPLOYED with the only login path (magic-link email) inert because RESEND_API_KEY carried a placeholder value, admin access was reachable only via manually minted tokens, and the gap was filed as a "quirk" note in status.md rather than blocked at gate time. A real key existed in the estate the whole time.
+
+The bump encodes three class rules the deployment / handover gates now compel:
+
+1. **External-service dependency provisioning.** Every external service the app calls at runtime is enumerated on a stable manifest; every credential field is checked against the canonical placeholder-shape detector; every `verified` dependency requires captured live-handshake evidence from the shipped runtime; every `deferred` dependency requires an operator-ratified persistent record (a README note or a status.md quirk line does NOT satisfy).
+2. **Core-flow end-to-end.** Every core user flow is enumerated on a stable manifest; authentication is ALWAYS included when the app has a application-spa-REQ-009 surface; every flow executes end-to-end against the shipped runtime (production entry-point construction, production security headers, real external providers) driven by a real browser, with captured evidence per flow; a skipped, timed-out, or absent flow is a hard refusal.
+3. **Sign-off vocabulary.** A run in which every core flow completes and every external dependency is verified-or-ratified-deferred lands at aggregate verdict `ok`. Any placeholder-shape credential, any missing handshake evidence, any unratified deferral, any core-flow fail-or-skip lands at aggregate verdict `deployed-with-defects`. A "documented workaround exists" does not convert a broken flow into `ok`; the aggregate verdict is what the ci-pipeline runner surfaces.
+
+Contributions:
+
+- `application-spa-US-1132` (anchored to application-spa-REQ-018) with six ACs binding the external-service-dependency provisioning probe.
+- `application-spa-US-1133` (anchored to application-spa-REQ-008) with six ACs binding the core-flow end-to-end probe.
+- `TAC-210-application-spa-external-dependency-provisioning-probe`: a Node probe the project realises; reads the external-service-dependency manifest, applies the canonical placeholder-shape detector to every credential field, replays a live handshake against the shipped runtime for every `verified` entry, and reads the ratified-deferrals store for every `deferred` entry. Writes `reports/external-dependency-provisioning.json`.
+- `TAC-211-application-spa-core-flow-e2e-probe`: a Node probe the project realises; boots the target server through the production entry-point path, drives a real headless browser through every enumerated core flow against real external providers, and refuses on any fail/skip/absent flow. Writes `reports/core-flow-e2e-adherence.json`.
+- The rcf-lite package gains a shared `detectPlaceholderCredentialShape` utility under `packages/rcf-lite/src/deployment/` that TAC-210 realisations import; extending the placeholder-shape ruleset is a rcf-lite minor bump, never a per-project fork.
+
+## Known mechanism-reach gaps
+
+The blueprint declares a broader UI floor than v1.1-v1.3 cures. The following categories still declare their discipline through the AC layer but have no blueprint-side runtime-observable probe; a project inherits them as project-side ownership until a future minor bump adds probes.
+
+- **Component-library baseline (application-spa-REQ-006, US-1111 and peers).** The component-library discipline (cards, tables, tabs, pagination, forms) is declared through ACs anchored to TAC-203-application-spa-component-library. A project ships components without a blueprint-side probe checking that shipped components realise the discipline; project-side TCs bind the ACs to the runtime surface, and `rcf audit coverage --strict` refuses ship when a component AC is uncovered. Blueprint-side probe candidate for a future minor.
+- **Responsive baseline (application-spa-REQ-004, US-1105).** The 360/768/1024/1440 no-horizontal-overflow discipline is declared through ACs; there is no blueprint-side probe that renders every route at every baseline and reports overflow. `rcf verify browser` covers a subset when the project wires the uiBaseline pack; the mechanism-reach question of which routes the pack visits is project-owned.
+- **Motion and reduced-motion (application-spa-REQ-012, US-1112).** Reduced-motion respect is declared through ACs; no blueprint-side probe inspects the built stylesheet output for animation declarations that ignore `prefers-reduced-motion`.
+
+These gaps are the honest residual. The icon, token, styled-under-CSP, external-dependency provisioning, and core-flow E2E cures demonstrate the shape a future sweep takes for the remaining categories: name the runtime-observable surface, ship a Node probe TAC, add a low-band US with runtime-observable ACs binding the TAC, amend the anchor ADR when the consequences narrative needs the probe named.

package/blueprints/application-spa/assets/component-specs/actions-and-text-inputs.md

@@ -0,0 +1,36 @@
+# Component specs: actions and text inputs
+
+Contracts for buttons, text inputs, and textareas (application-spa-US-1108). Not code: the working agent implements these against the tokens in assets/tokens.
+
+## Button
+
+Variants: primary (primary/onPrimary), secondary (surface-raised + border, onSurface), ghost (transparent, primary text), destructive (danger/onDanger).
+
+| State | Spec |
+|---|---|
+| default | Variant fill and text tokens; radius-sm; space-2 vertical, space-4 horizontal padding; target 24x24 minimum |
+| hover | Perceptible shift of the variant fill (token-derived, both themes); cursor pointer |
+| focus | focusRing outline, 2px offset 2px; never outline suppression without replacement |
+| active | Pressed shift of fill; no layout movement |
+| disabled | Reduced-emphasis fill; excluded from Tab order; aria-disabled or disabled; boundary still 3:1 |
+| busy | Inline spinner replaces or precedes label; label persists or is announced; repeat activation ignored (AC-1108-2) |
+
+Semantics: real button element (or role plus full keyboard equivalence). Enter and Space activate. Icon-only buttons carry an accessible name (AC-1118-4). Destructive buttons never take default focus in confirmations (AC-1108-3).
+
+## Text input
+
+Anatomy: visible label (programmatically associated), control, optional helper text, error slot. Placeholder is a hint, never the label (AC-1108-5).
+
+| State | Spec |
+|---|---|
+| default | surface background, border token boundary, radius-sm, onSurface text |
+| focus | focusRing outline; border may echo the ring colour |
+| disabled | surface-sunken fill; excluded from Tab; announced disabled |
+| error | danger border and icon; message in error slot wired via aria-describedby with aria-invalid (AC-1108-6) |
+| success | success border or icon where confirmation is meaningful; never colour alone (AC-1126-6) |
+
+Behaviour: validation timing per application-spa-US-1113. Attributes per data intent: type, inputmode, autocomplete (AC-1113-6). Text at text-body size; 16px minimum on mobile to avoid zoom-on-focus.
+
+## Textarea
+
+Text-input contract plus: resizable within declared min and max rows (AC-1108-7), content scrolls inside the control when full, character-count indicator where a limit exists (count exposed to assistive technology as it approaches the limit).

package/blueprints/application-spa/assets/component-specs/data-display.md

@@ -0,0 +1,19 @@
+# Component specs: data display
+
+Contracts for card, table, tabs, and pagination (application-spa-US-1111).
+
+## Card
+
+Anatomy: surface-raised fill, radius-md, elevation-1, space-4 or space-6 internal padding, optional media slot, heading, body, actions row. Clickable-whole-card: exactly one link covering the card with one accessible name; secondary actions inside remain independently operable without nested-interactive violations (AC-1111-1). Hover on clickable cards: elevation-2 shift. Cards never carry their own bespoke palette; intent accents come from semantic tokens.
+
+## Table
+
+Markup: semantic table, thead/th with scope, caption or labelled heading. Column headers associate to cells (AC-1111-2). Sortable headers are buttons inside th exposing aria-sort, cycling none, ascending, descending (AC-1111-3). Row density: space-3 vertical padding; zebra striping optional via surface-raised; row hover highlight where rows act. Below 768: card layout per row, or a table-scoped horizontal scroll container with a visible affordance; the page never scrolls horizontally (AC-1105-4). Owns its state quartet: skeleton rows for loading, in-table empty state, in-table error with retry (AC-1111-4). Bulk selection, where declared: header checkbox supports all and indeterminate; selected count surfaces with the bulk actions.
+
+## Tabs
+
+Pattern (AC-1111-5): tablist with tab roles; one Tab stop; ArrowLeft/ArrowRight move between tabs (Home and End jump); activation mode declared per use (automatic on focus, or manual with Enter/Space); each panel labelled by its tab. Active tab: primary underline or fill indicator meeting 3:1 non-text contrast plus a non-colour signal. Persistence, where the journey spec declares it, serialises the active tab to the URL or stored state (AC-1111-6). Overflowing tab sets scroll within the tablist with affordances, never wrap into a second row.
+
+## Pagination
+
+Anatomy: previous, numbered window or position statement, next; optional page-size select. Impossible moves render disabled with state exposed, not hidden (AC-1111-7). Current page exposed via aria-current. Page changes update the canonical URL (AC-1111-8) and move focus predictably to the updated collection region. Cursor-paginated collections without total counts state relative position honestly (for example "Page 3") without inventing totals.

package/blueprints/application-spa/assets/component-specs/feedback-and-status.md

@@ -0,0 +1,27 @@
+# Component specs: feedback and status
+
+Contracts for alert, banner, empty state, loading and skeleton, error state, and spinner (application-spa-US-1112).
+
+## Alert
+
+Intents: info (accent), success, warning, danger, each pairing intent colour, intent icon from the alias registry, and a non-colour signal (AC-1112-1). Anatomy: icon, optional title, body, optional actions, optional dismiss. Dynamic alerts announce via live region (polite; assertive for danger) without stealing focus (AC-1112-2). Static page-load alerts are ordinary content. Body copy follows application-spa-REQ-017: situation plus next step.
+
+## Banner
+
+Lives in the shell-owned slot below the top bar; pushes layout, never overlaps (AC-1112-3). One banner at a time; priority order: offline (application-spa-US-1121) beats promotional. Dismissible when the condition is not persistent; persistent conditions (offline) clear themselves when resolved. Full-width, surface-raised or intent-toned fill, space-3 vertical padding.
+
+## Empty state
+
+Shape per assets/wireframes/empty.md: visual, headline naming the absent content, filling action (AC-1112-4). Context-specific copy per instance (AC-1117-3).
+
+## Skeleton and loading
+
+Skeletons mirror the incoming layout: text lines, avatar circles, card blocks in the target geometry (AC-1112-5). Shimmer within motion tokens; static under reduced motion (AC-1119-5). Region marked busy for assistive technology; skeletons themselves are hidden from the accessibility tree. Appear-delay of roughly 150ms so cached-fast loads never flash a skeleton (AC-1117-6).
+
+## Error state
+
+Shape per assets/wireframes/error.md region variant: intent icon, what failed in user terms, consequence, retry or alternative (AC-1112-6). Distinguishes user-fixable from system failure (AC-1117-4). Never a raw exception or internal id (AC-1124-4).
+
+## Spinner
+
+Indeterminate operations only, where no content shape is known (AC-1112-7). Always paired with an accessible label naming the operation. Sizes: inline (1em, inside buttons per the busy contract) and regional (space-8). Uses onSurfaceMuted or intent colour; rotation duration from motion tokens; static-with-label under reduced motion.

package/blueprints/application-spa/assets/component-specs/overlays.md

@@ -0,0 +1,23 @@
+# Component specs: overlays
+
+Contracts for modal, drawer, tooltip, popover, and toast (application-spa-US-1110). Shared rules: token-driven surfaces and backdrops in both themes; Escape closes topmost-first (AC-1110-8); motion from motion tokens honouring reduced motion.
+
+## Modal
+
+Focus: trapped while open; initial focus on the first meaningful element (never a destructive action, AC-1108-3); returns to trigger on close (AC-1110-1). Background inert. Dismissal: Escape and explicit close always; backdrop click only for non-destructive intents (AC-1110-2). Structure: labelled by its heading; described by its body where useful. Sizing: max-width per breakpoint; full-screen at 360 where content demands; internal scroll, never page scroll behind. Enter: motion-base ease-out; exit motion-fast.
+
+## Drawer
+
+Modal contract plus: slides from the declared edge; full-width at 360, token-sized panel above (AC-1110-3). Used for secondary flows that keep page context relevant; anything demanding full attention is a modal or a route.
+
+## Tooltip
+
+Trigger: hover and keyboard focus, short token delay; hides on blur, pointer-leave, and Escape (AC-1110-4). Content: text only, no interactive content; interactive needs a popover. Wired via aria-describedby. Never the only carrier of essential information. Positions to stay in-viewport.
+
+## Popover
+
+Opens on activation, receives focus, returns it on close; closes on Escape and outside click; repositions within the viewport (AC-1110-5). Carries interactive content (menus, filter panels, the [...] overflow menu). Menu-flavoured popovers add menu semantics with arrow-key traversal (AC-1103-3).
+
+## Toast
+
+One shell-owned region (AC-1110-6): top-right above 768, bottom full-width at 360. Auto-dismiss on motion-token-derived duration scaled to content length; hover and focus pause the timer. Announced via polite live region; assertive only for danger toasts. Never receives focus automatically; never the only path to an action (AC-1110-7). Maximum three visible; older toasts collapse into a count. Each toast: intent icon (semantic alias), one sentence, optional single action, dismiss control.

package/blueprints/application-spa/assets/component-specs/selection-controls.md

@@ -0,0 +1,23 @@
+# Component specs: selection controls
+
+Contracts for select, checkbox, radio group, switch, and combobox (application-spa-US-1109). All render default, hover, focus, disabled, and error states from tokens in both themes, and meet the 24x24 target including label hit area.
+
+## Select
+
+Keyboard: Enter, Space, or arrows open; arrows traverse; type-ahead jumps; Enter commits; Escape cancels and restores the prior value (AC-1109-1). Semantics: native select preferred; a styled listbox must replicate the full grammar and expose expanded state and active option. Long option lists scroll within the popup; the popup repositions to stay in-viewport.
+
+## Checkbox
+
+States: unchecked, checked, indeterminate (parent-of-mixed only). Space toggles. The label is part of the hit area. Indeterminate is set programmatically and announced (AC-1109-2). Error state renders the danger boundary plus message per the input contract.
+
+## Radio group
+
+Grouped under a fieldset with a legend (or labelled group role). One Tab stop; arrows move selection and selection follows focus; exactly one checked member (AC-1109-3). Wrapping: arrows cycle from last to first.
+
+## Switch
+
+Role switch with checked state exposed; Space and Enter toggle (AC-1109-4). Applies immediately, no submit; a pending toggle shows busy and reverts visibly on failure (application-spa-US-1120 optimistic contract). Label states the thing controlled, not the current value. On and off are distinguishable without colour alone: thumb position plus track token.
+
+## Combobox
+
+Grammar (AC-1109-5): typing filters the listbox; ArrowDown enters and traverses it; Enter commits the active option; Escape closes without commit; Tab commits-or-closes per declared mode and always exits. ARIA: combobox role, aria-expanded, aria-activedescendant (or focus-moving equivalent), listbox with option roles. Zero matches renders the designed no-matches message inside the listbox (AC-1109-6). Async option loading shows an in-listbox loading state, never a frozen popup. Multi-select variants render choices as dismissible chips inside the field with each chip keyboard-removable.

package/blueprints/application-spa/assets/sample-data/sample-entities.json

@@ -0,0 +1,41 @@
+{
+  "meta": {
+    "blueprint": "application-spa",
+    "version": "1.0.0",
+    "notes": "Neutral sample entities for wireframe realisation, skeleton shaping, and state-quartet demos. Names and values are deliberately generic; replace with project entities during elicitation. Includes the shapes the wireframes reference: a listable collection, a detail record, a user profile, and a problem-details error (ADR-204)."
+  },
+  "users": [
+    { "id": "u-1001", "displayName": "Alex Morgan", "email": "alex.morgan@example.com", "role": "member", "themePreference": "dark", "createdAt": "2026-05-04T09:12:00Z" },
+    { "id": "u-1002", "displayName": "Sam Patel", "email": "sam.patel@example.com", "role": "admin", "themePreference": null, "createdAt": "2026-03-18T14:40:00Z" }
+  ],
+  "items": [
+    { "id": "itm-2001", "title": "Quarterly readiness review", "status": "active", "owner": "u-1001", "updatedAt": "2026-08-14T16:22:00Z", "tags": ["review", "q3"] },
+    { "id": "itm-2002", "title": "Supplier onboarding pack", "status": "draft", "owner": "u-1002", "updatedAt": "2026-08-11T08:05:00Z", "tags": ["onboarding"] },
+    { "id": "itm-2003", "title": "Renewal follow-up", "status": "archived", "owner": "u-1001", "updatedAt": "2026-07-30T11:47:00Z", "tags": ["renewal", "follow-up"] }
+  ],
+  "itemDetail": {
+    "id": "itm-2001",
+    "title": "Quarterly readiness review",
+    "status": "active",
+    "owner": { "id": "u-1001", "displayName": "Alex Morgan" },
+    "description": "Assess readiness across the five workstreams ahead of the quarterly checkpoint.",
+    "activity": [
+      { "at": "2026-08-14T16:22:00Z", "by": "u-1001", "action": "updated", "summary": "Revised workstream three notes" },
+      { "at": "2026-08-12T10:03:00Z", "by": "u-1002", "action": "commented", "summary": "Added supplier context" }
+    ],
+    "updatedAt": "2026-08-14T16:22:00Z"
+  },
+  "collectionPage": {
+    "data": ["itm-2001", "itm-2002", "itm-2003"],
+    "cursor": { "next": "cur-3f9a", "prev": null },
+    "limit": 25
+  },
+  "problemDetails": {
+    "type": "https://example.com/problems/validation",
+    "title": "The request could not be processed",
+    "status": 422,
+    "detail": "The title field is required.",
+    "instance": "/items",
+    "errors": [{ "field": "title", "message": "Enter a title before saving." }]
+  }
+}