rcf-lite 0.12.0 → 0.13.0

package/blueprints/application-spa/assets/wireframes/sign-in.md

@@ -0,0 +1,41 @@
+# Wireframe: sign-in
+
+The authentication entry surface (application-spa-US-1115). Motion-quiet (AC-1119-4), full application-spa-REQ-007 form contract, both themes, all breakpoints.
+
+## Shape
+
+```
++--------------------------------------------------------------------------+
+| minimal banner: product logo (links to landing) | theme toggle           |
+|                                                                          |
+|                    +------------------------------+                      |
+|                    |  h1  Sign in to <Product>    |                      |
+|                    |                              |                      |
+|                    |  [ error alert renders here  |                      |
+|                    |    on failed sign-in ]       |                      |
+|                    |                              |                      |
+|                    |  Email                       |                      |
+|                    |  [___________________]       |                      |
+|                    |                              |                      |
+|                    |  Password                    |                      |
+|                    |  [___________________] [show]|                      |
+|                    |                              |                      |
+|                    |  [        Sign in        ]   |                      |
+|                    |                              |                      |
+|                    |  Forgot your password?       |                      |
+|                    +------------------------------+                      |
+|                                                                          |
+| contentinfo: support link | legal                                        |
++--------------------------------------------------------------------------+
+```
+
+Card on surface-raised above 768; full-width single column on surface at 360.
+
+## Behaviour
+
+- Email field: type=email, autocomplete=username, inputmode=email. Password: autocomplete=current-password, show/hide toggle with accessible name and state (AC-1113-6).
+- Failed sign-in: one alert above the form, safe copy that never says which element was wrong (AC-1115-2); fields keep their values except the password.
+- Pending: button busy, duplicate submits ignored (AC-1115-3).
+- Success: forward to the deep-link target when one is pending (AC-1116-5, validated per AC-1116-6), else the default authenticated route.
+- Arriving already signed in redirects to the default authenticated route.
+- First focusable element is the skip-link, then the email field receives initial focus.

package/blueprints/application-spa/assets/wireframes/sign-out.md

@@ -0,0 +1,32 @@
+# Wireframe: sign-out confirmation
+
+The surface rendered after a completed sign-out (AC-1115-4). Its job: confirm the session is closed, reassure, and offer the two next steps that make sense.
+
+## Shape
+
+```
++--------------------------------------------------------------------------+
+| minimal banner: product logo | theme toggle                              |
+|                                                                          |
+|                    +------------------------------+                      |
+|                    |   [ success icon alias ]     |                      |
+|                    |                              |                      |
+|                    |  h1  You are signed out      |                      |
+|                    |                              |                      |
+|                    |  Body: Your session has      |                      |
+|                    |  ended on this device.       |                      |
+|                    |                              |                      |
+|                    |  [       Sign back in    ]   |                      |
+|                    |  [ go to the public site ]   |                      |
+|                    +------------------------------+                      |
+|                                                                          |
+| contentinfo                                                              |
++--------------------------------------------------------------------------+
+```
+
+## Behaviour
+
+- Reached only after the server-side session is invalidated and client caches are cleared (ADR-205); rendering this surface with a live session is a defect.
+- The theme choice persists across sign-out for the session (AC-1107-3); the per-user preference reapplies on next sign-in (AC-1107-4).
+- Back-navigation after sign-out must not reveal cached authenticated content.
+- No auto-redirect: the user chose to leave; let the surface rest.

package/blueprints/application-spa/blueprint.json

@@ -0,0 +1,387 @@
+{
+  "slug": "application-spa",
+  "version": "1.3.1",
+  "category": "application",
+  "contributions": [
+    {
+      "id": "application-spa-REQ-001",
+      "kind": "req",
+      "path": "requirements/application-spa-req-001.json"
+    },
+    {
+      "id": "application-spa-REQ-002",
+      "kind": "req",
+      "path": "requirements/application-spa-req-002.json"
+    },
+    {
+      "id": "application-spa-REQ-003",
+      "kind": "req",
+      "path": "requirements/application-spa-req-003.json"
+    },
+    {
+      "id": "application-spa-REQ-004",
+      "kind": "req",
+      "path": "requirements/application-spa-req-004.json"
+    },
+    {
+      "id": "application-spa-REQ-005",
+      "kind": "req",
+      "path": "requirements/application-spa-req-005.json"
+    },
+    {
+      "id": "application-spa-REQ-006",
+      "kind": "req",
+      "path": "requirements/application-spa-req-006.json"
+    },
+    {
+      "id": "application-spa-REQ-007",
+      "kind": "req",
+      "path": "requirements/application-spa-req-007.json"
+    },
+    {
+      "id": "application-spa-REQ-008",
+      "kind": "req",
+      "path": "requirements/application-spa-req-008.json"
+    },
+    {
+      "id": "application-spa-REQ-009",
+      "kind": "req",
+      "path": "requirements/application-spa-req-009.json"
+    },
+    {
+      "id": "application-spa-REQ-010",
+      "kind": "req",
+      "path": "requirements/application-spa-req-010.json"
+    },
+    {
+      "id": "application-spa-REQ-011",
+      "kind": "req",
+      "path": "requirements/application-spa-req-011.json"
+    },
+    {
+      "id": "application-spa-REQ-012",
+      "kind": "req",
+      "path": "requirements/application-spa-req-012.json"
+    },
+    {
+      "id": "application-spa-REQ-013",
+      "kind": "req",
+      "path": "requirements/application-spa-req-013.json"
+    },
+    {
+      "id": "application-spa-REQ-014",
+      "kind": "req",
+      "path": "requirements/application-spa-req-014.json"
+    },
+    {
+      "id": "application-spa-REQ-015",
+      "kind": "req",
+      "path": "requirements/application-spa-req-015.json"
+    },
+    {
+      "id": "application-spa-REQ-016",
+      "kind": "req",
+      "path": "requirements/application-spa-req-016.json"
+    },
+    {
+      "id": "application-spa-REQ-017",
+      "kind": "req",
+      "path": "requirements/application-spa-req-017.json"
+    },
+    {
+      "id": "application-spa-REQ-018",
+      "kind": "req",
+      "path": "requirements/application-spa-req-018.json"
+    },
+    {
+      "id": "application-spa-REQ-019",
+      "kind": "req",
+      "path": "requirements/application-spa-req-019.json"
+    },
+    {
+      "id": "application-spa-REQ-020",
+      "kind": "req",
+      "path": "requirements/application-spa-req-020.json"
+    },
+    {
+      "id": "application-spa-REQ-021",
+      "kind": "req",
+      "path": "requirements/application-spa-req-021.json"
+    },
+    {
+      "id": "application-spa-US-1101",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1101.json"
+    },
+    {
+      "id": "application-spa-US-1102",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1102.json"
+    },
+    {
+      "id": "application-spa-US-1103",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1103.json"
+    },
+    {
+      "id": "application-spa-US-1104",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1104.json"
+    },
+    {
+      "id": "application-spa-US-1105",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1105.json"
+    },
+    {
+      "id": "application-spa-US-1106",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1106.json"
+    },
+    {
+      "id": "application-spa-US-1107",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1107.json"
+    },
+    {
+      "id": "application-spa-US-1108",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1108.json"
+    },
+    {
+      "id": "application-spa-US-1109",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1109.json"
+    },
+    {
+      "id": "application-spa-US-1110",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1110.json"
+    },
+    {
+      "id": "application-spa-US-1111",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1111.json"
+    },
+    {
+      "id": "application-spa-US-1112",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1112.json"
+    },
+    {
+      "id": "application-spa-US-1113",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1113.json"
+    },
+    {
+      "id": "application-spa-US-1114",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1114.json"
+    },
+    {
+      "id": "application-spa-US-1115",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1115.json"
+    },
+    {
+      "id": "application-spa-US-1116",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1116.json"
+    },
+    {
+      "id": "application-spa-US-1117",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1117.json"
+    },
+    {
+      "id": "application-spa-US-1118",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1118.json"
+    },
+    {
+      "id": "application-spa-US-1119",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1119.json"
+    },
+    {
+      "id": "application-spa-US-1120",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1120.json"
+    },
+    {
+      "id": "application-spa-US-1121",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1121.json"
+    },
+    {
+      "id": "application-spa-US-1122",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1122.json"
+    },
+    {
+      "id": "application-spa-US-1123",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1123.json"
+    },
+    {
+      "id": "application-spa-US-1124",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1124.json"
+    },
+    {
+      "id": "application-spa-US-1125",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1125.json"
+    },
+    {
+      "id": "application-spa-US-1126",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1126.json"
+    },
+    {
+      "id": "application-spa-US-1127",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1127.json"
+    },
+    {
+      "id": "application-spa-US-1128",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1128.json"
+    },
+    {
+      "id": "application-spa-US-1129",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1129.json"
+    },
+    {
+      "id": "application-spa-US-1130",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1130.json"
+    },
+    {
+      "id": "application-spa-US-1131",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1131.json"
+    },
+    {
+      "id": "application-spa-US-1132",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1132.json"
+    },
+    {
+      "id": "application-spa-US-1133",
+      "kind": "us",
+      "path": "user-stories/application-spa-us-1133.json"
+    },
+    {
+      "id": "TAC-201-application-spa-app-shell",
+      "kind": "tac",
+      "path": "tacs/tac-201-application-spa-app-shell.json"
+    },
+    {
+      "id": "TAC-202-application-spa-theme-system",
+      "kind": "tac",
+      "path": "tacs/tac-202-application-spa-theme-system.json"
+    },
+    {
+      "id": "TAC-203-application-spa-component-library",
+      "kind": "tac",
+      "path": "tacs/tac-203-application-spa-component-library.json"
+    },
+    {
+      "id": "TAC-204-application-spa-client-data-layer",
+      "kind": "tac",
+      "path": "tacs/tac-204-application-spa-client-data-layer.json"
+    },
+    {
+      "id": "TAC-205-application-spa-forms-engine",
+      "kind": "tac",
+      "path": "tacs/tac-205-application-spa-forms-engine.json"
+    },
+    {
+      "id": "TAC-206-application-spa-telemetry",
+      "kind": "tac",
+      "path": "tacs/tac-206-application-spa-telemetry.json"
+    },
+    {
+      "id": "TAC-207-application-spa-token-adherence-probe",
+      "kind": "tac",
+      "path": "tacs/tac-207-application-spa-token-adherence-probe.json"
+    },
+    {
+      "id": "TAC-208-application-spa-icon-adherence-probe",
+      "kind": "tac",
+      "path": "tacs/tac-208-application-spa-icon-adherence-probe.json"
+    },
+    {
+      "id": "TAC-209-application-spa-csp-styled-adherence-probe",
+      "kind": "tac",
+      "path": "tacs/tac-209-application-spa-csp-styled-adherence-probe.json"
+    },
+    {
+      "id": "TAC-210-application-spa-external-dependency-provisioning-probe",
+      "kind": "tac",
+      "path": "tacs/tac-210-application-spa-external-dependency-provisioning-probe.json"
+    },
+    {
+      "id": "TAC-211-application-spa-core-flow-e2e-probe",
+      "kind": "tac",
+      "path": "tacs/tac-211-application-spa-core-flow-e2e-probe.json"
+    },
+    {
+      "id": "ADR-201-application-spa-routing",
+      "kind": "adr",
+      "path": "adrs/adr-201-application-spa-routing.json",
+      "scope": "global",
+      "topic": "clientRouting"
+    },
+    {
+      "id": "ADR-202-application-spa-theming",
+      "kind": "adr",
+      "path": "adrs/adr-202-application-spa-theming.json",
+      "scope": "global",
+      "topic": "theming"
+    },
+    {
+      "id": "ADR-203-application-spa-client-state",
+      "kind": "adr",
+      "path": "adrs/adr-203-application-spa-client-state.json",
+      "scope": "global",
+      "topic": "clientState"
+    },
+    {
+      "id": "ADR-204-application-spa-error-envelope",
+      "kind": "adr",
+      "path": "adrs/adr-204-application-spa-error-envelope.json",
+      "scope": "global",
+      "topic": "errorEnvelope"
+    },
+    {
+      "id": "ADR-205-application-spa-auth-model",
+      "kind": "adr",
+      "path": "adrs/adr-205-application-spa-auth-model.json",
+      "scope": "global",
+      "topic": "authModel"
+    },
+    {
+      "id": "ADR-206-application-spa-iconography",
+      "kind": "adr",
+      "path": "adrs/adr-206-application-spa-iconography.json"
+    },
+    {
+      "id": "ADR-207-application-spa-motion",
+      "kind": "adr",
+      "path": "adrs/adr-207-application-spa-motion.json"
+    },
+    {
+      "id": "ADR-208-application-spa-i18n",
+      "kind": "adr",
+      "path": "adrs/adr-208-application-spa-i18n.json"
+    },
+    {
+      "id": "ADR-209-application-spa-telemetry-naming",
+      "kind": "adr",
+      "path": "adrs/adr-209-application-spa-telemetry-naming.json"
+    }
+  ]
+}

package/blueprints/application-spa/contributions/adrs/adr-201-application-spa-routing.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-201-application-spa-routing",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Client-side routing over the History API with a declared route inventory",
+  "context": "A single-page application needs one answer to how URLs map to surfaces. Implicit or component-local routing makes deep links, canonical URLs, 404 handling, and telemetry unverifiable. The route model is a whole-project decision: two routing regimes in one deployable produce broken back-button behaviour and unshareable URLs.",
+  "decision": "Routing is client-side over the History API (clean paths, no hash routing) against a single declared route inventory. Every route is named, every resource class has one canonical URL shape, unknown paths render the 404 surface, and removed resources render 410. The server serves the application shell for any route path so deep links cold-load.",
+  "consequences": "Deep links, breadcrumbs, navigation rendering, and telemetry all derive from one inventory. The hosting layer must rewrite unknown paths to the shell (documented in the project deploy target). Hash-based routing is unavailable even where hosting rewrites are awkward; that constraint is accepted for canonical URLs.",
+  "alternativesConsidered": [
+    {
+      "name": "Hash routing",
+      "summary": "Fragment-based routes needing no server rewrites.",
+      "reasonNotChosen": "Non-canonical URLs, weaker analytics and SEO, and a legacy feel that fails the visual quality bar."
+    },
+    {
+      "name": "Server-driven navigation",
+      "summary": "Full page loads per navigation.",
+      "reasonNotChosen": "Out of scope for the application-spa blueprint; that shape belongs to a different blueprint."
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/adrs/adr-202-application-spa-theming.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-202-application-spa-theming",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "accepted",
+  "title": "Semantic design tokens as CSS custom properties with a root-level theme switch",
+  "context": "Dark and light parity is a ratified requirement (application-spa-REQ-005). Parity is only checkable when every colour decision routes through a named token that exists in both palettes. How theming is realised is a whole-project decision: two theming mechanisms cannot coexist without drift. Watchpost run4 demonstrated that declaring the discipline is not the same as compelling it: raw palette values can sit in component stylesheets across passing build cycles. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
+  "decision": "The token layer in assets/tokens/design-tokens.json is the single source of colour, spacing, radius, typography, elevation, and motion values. Tokens are realised as CSS custom properties on the document root (assets/tokens/theme.css); the active theme is a data-theme attribute swap. Components consume semantic tokens only; raw palette values in component styles are a defect.",
+  "consequences": "Theme parity and contrast become data checks over one JSON file. Re-skinning is a token edit. The indirection cost is one layer of naming; the working agent extends tokens by adding pairs, never by inlining values. The v1.1 token-adherence probe (TAC-207-application-spa-token-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the built stylesheet output for raw colour literals outside the token-realisation file and diffs the light and dark token key sets, and exits non-zero on any violation. When the probe is wired as a ci-pipeline gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
+  "alternativesConsidered": [
+    {
+      "name": "Per-component theme conditionals",
+      "summary": "Components branch on theme in code.",
+      "reasonNotChosen": "Parity becomes unverifiable and every component is a divergence point."
+    },
+    {
+      "name": "Two compiled stylesheets",
+      "summary": "Separate light and dark CSS builds.",
+      "reasonNotChosen": "Doubles the drift surface and breaks the instant toggle requirement."
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/application-spa/contributions/adrs/adr-203-application-spa-client-state.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-203-application-spa-client-state",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Server-state cache separated from UI state, stale-while-revalidate by default",
+  "context": "application-spa-REQ-013 requires a client cache discipline. Whether client state is one store or two regimes is a whole-project decision; mixing regimes per feature produces stale lists, flicker, and phantom optimistic state.",
+  "decision": "Server state lives in a keyed query cache with stale-while-revalidate reads and explicit invalidation on writes. UI state (selection, open panels, form drafts) lives in local component or page state and never enters the server-state cache. Optimistic updates are opt-in per mutation and roll back visibly on failure. Cache keys derive from canonical resource URLs.",
+  "consequences": "Data freshness has one policy to verify. Screens read query status instead of hand-rolling loading flags, which is what makes the application-spa-REQ-010 state quartet cheap. The discipline forbids stuffing view state into the cache even when convenient.",
+  "alternativesConsidered": [
+    {
+      "name": "Single global store for everything",
+      "summary": "One store holding server data and view state.",
+      "reasonNotChosen": "Couples wire lifecycles to view lifecycles; invalidation becomes manual and error-prone."
+    },
+    {
+      "name": "Fetch-per-render, no cache",
+      "summary": "Always fetch fresh.",
+      "reasonNotChosen": "Fails the performance budget and produces loading flicker on every navigation."
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/adrs/adr-204-application-spa-error-envelope.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-204-application-spa-error-envelope",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "RFC 7807 problem details as the error shape the client consumes",
+  "context": "The client must render errors it can rely on structurally. The wire error shape is a whole-project decision shared with whatever serves the API; this ADR records the client half. A application-api-rest blueprint applied to the same project contributes its own decision on the same topic, and blueprint composition will surface that pairing for the operator to reconcile at add time. That surfacing is intended.",
+  "decision": "The client treats RFC 7807 problem details (type, title, status, detail, instance, plus service extensions) as the canonical error shape. The data layer (TAC-204) normalises any non-conforming response into this shape at the boundary; UI code renders from the envelope, mapping fields to user-actionable copy per application-spa-REQ-017, and never parses ad-hoc error bodies.",
+  "consequences": "Error rendering is uniform and specifiable. When the backend natively emits problem details the normaliser is a pass-through; when it does not, the normaliser is quarantine for the inconsistency. Composing with the application-api-rest blueprint raises a deliberate conflict on this topic; the expected resolution is one project-level ADR adopting RFC 7807 end to end.",
+  "alternativesConsidered": [
+    {
+      "name": "Per-endpoint error shapes",
+      "summary": "Render whatever each endpoint returns.",
+      "reasonNotChosen": "Unverifiable error UX and blame-shaped fallback copy."
+    },
+    {
+      "name": "Message-string-only errors",
+      "summary": "Reduce every failure to a string.",
+      "reasonNotChosen": "Loses status semantics and retry-ability the UX requirements need."
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/adrs/adr-205-application-spa-auth-model.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-205-application-spa-auth-model",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Cookie-based session authentication with client-side expiry handling",
+  "context": "The blueprint scope is public plus authenticated surfaces with session-based auth. The authentication model is a whole-project decision: the client, the API, and the deploy target must hold the same answer. A application-api-rest blueprint contributes its own decision on this topic; composition surfaces the pairing for operator reconciliation, which is intended.",
+  "decision": "Authentication is a server-issued session carried in a Secure, HttpOnly, SameSite cookie; the bundle never stores tokens in script-readable storage. The client treats 401 as session expiry: the current route is remembered, the session-expired surface renders, and successful re-authentication returns the user to the remembered route (application-spa-REQ-009). Sign-out invalidates server-side and clears client caches.",
+  "consequences": "XSS cannot exfiltrate a bearer token because none is script-visible. CSRF posture must be handled with the API (SameSite plus the API blueprint auth classes). Session lifetime is server-owned; the client responds to expiry rather than predicting it.",
+  "alternativesConsidered": [
+    {
+      "name": "Bearer tokens in localStorage",
+      "summary": "JWT held by the client and attached per request.",
+      "reasonNotChosen": "Script-readable credentials fail the application-spa-REQ-018 floor."
+    },
+    {
+      "name": "OAuth authorization-code with PKCE per session",
+      "summary": "Delegated identity flow.",
+      "reasonNotChosen": "Valid where an external IdP is a project requirement; heavier than the blueprint default. Projects override by superseding this ADR."
+    }
+  ],
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/adrs/adr-206-application-spa-iconography.json

@@ -0,0 +1,13 @@
+{
+  "adrId": "ADR-206-application-spa-iconography",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "accepted",
+  "title": "One icon set behind semantic aliases",
+  "context": "application-spa-REQ-011 requires a single icon set. Which construction (stroke width, grid) and how components reference icons needs one recorded answer inside the SPA. Watchpost run4 demonstrated that recording the discipline is not the same as compelling it: a build cycle passed while eight surfaces shipped zero icons. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
+  "decision": "The project selects exactly one icon set (consistent stroke and grid across all glyphs) and components reference icons only through semantic aliases (icon.close, icon.danger, icon.search, and peers) declared in one registry. Bespoke per-component artwork requires extending the registry, not inlining SVG.",
+  "consequences": "Swapping icon sets is a registry edit. Decorative versus meaningful icon semantics get one enforcement point for the application-spa-REQ-019 naming rules. The v1.1 icon-adherence probe (TAC-208-application-spa-icon-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the component source for inline SVG outside the registry and for icon references naming aliases the registry does not declare, and exits non-zero on any violation. When the probe is wired as a ci-pipeline gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/application-spa/contributions/adrs/adr-207-application-spa-motion.json

@@ -0,0 +1,13 @@
+{
+  "adrId": "ADR-207-application-spa-motion",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Motion tokens with ease-out defaults and a reduced-motion kill switch",
+  "context": "application-spa-REQ-012 requires tokenised motion. The duration range, easing family, and the reduced-motion mechanism need one recorded answer inside the SPA.",
+  "decision": "Motion durations and easings come from the motion tokens (fast 150ms, base 200ms, slow 250ms; ease-out family) in the token file. prefers-reduced-motion collapses non-essential transitions to none via one root-level media rule, not per-component checks.",
+  "consequences": "Motion is consistent and disableable in one place. Choreographed long-form animation is out of the blueprint's scope and would need its own decision.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/adrs/adr-208-application-spa-i18n.json

@@ -0,0 +1,13 @@
+{
+  "adrId": "ADR-208-application-spa-i18n",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "String extraction and locale-aware formatting from day one, translations deferred",
+  "context": "application-spa-REQ-015 requires internationalisation readiness without shipping translations. The mechanism needs one recorded answer inside the SPA.",
+  "decision": "User-facing strings live in an extraction catalogue keyed by stable identifiers; components render through the catalogue lookup. Dates, numbers, and currency format through the platform locale APIs (Intl). Layout is authored with logical properties (inline-start over left) so RTL rendering survives without a parallel stylesheet.",
+  "consequences": "Localisation later is catalogue work, not surgery. The discipline costs a lookup per string and forbids concatenated sentence fragments, which also improves copy review.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}

package/blueprints/application-spa/contributions/adrs/adr-209-application-spa-telemetry-naming.json

@@ -0,0 +1,13 @@
+{
+  "adrId": "ADR-209-application-spa-telemetry-naming",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Typed journey-checkpoint events named domain.surface.action",
+  "context": "application-spa-REQ-016 requires named events. Free-text names drift with refactors and kill dashboard continuity; the scheme needs one recorded answer inside the SPA.",
+  "decision": "Telemetry events are declared in a typed registry and named domain.surface.action in lower camel segments (for example auth.signIn.succeeded, orders.list.filtered). Error-boundary reports and the two performance marks (firstPaint, timeToInteractive) use reserved names in the same registry. Emitting an unregistered event name is a build-time error.",
+  "consequences": "Dashboards and alerts survive refactors because names are contracts. New journeys pay one registry entry per checkpoint, which doubles as the checkpoint inventory application-spa-REQ-008 walks.",
+  "createdAt": "2026-08-19T09:00:00Z",
+  "updatedAt": "2026-08-19T09:00:00Z"
+}