rcf-lite 0.19.0 → 0.21.0

package/rcf/user-stories/us-1701.json

@@ -0,0 +1,56 @@
+{
+  "createdAt": "2026-09-04T17:59:40.838Z",
+  "updatedAt": "2026-09-04T18:51:45.216Z",
+  "usId": "US-1701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-017",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "Blueprint-shipped browser-verify probe packs load, scope to real surfaces, and gate ship on runtime failure",
+  "asA": "blueprint author shipping runtime-observable visual ACs alongside contributions",
+  "iWant": "the browser-verify runner to discover, scope and run my blueprint's probe pack, and record each check against the AC it names",
+  "soThat": "a runtime-observable AC that a Node build-scan cannot see (grid announcements, keyboard traversal, live-region text after a synthetic event) is compelled at ship the same way an invariant or an auth-smoke fail is compelled, and the run-4 pack-fires-on-every-FBS residual is cured at load time",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1701-1",
+      "description": "The pack loader discovers `.pack.js` and `.pack.mjs` modules under `blueprints/<slug>/probe-packs/` for every applied blueprint, imports each with a dynamic ESM import, validates the exported default object against the pack schema (`packName` starts with the owning blueprint's slug and matches `^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$`, `version` semver, `blueprintSlug` matches the directory, `checks[]` non-empty with each entry carrying `id`, `severity` in {block, warn, advisory}, `description` and async `run`), and refuses at load (exit 2) with a diagnostic that names the pack path and the offending field on any violation. A valid pack registers on the run.",
+      "testable": true
+    },
+    {
+      "id": "AC-1701-2",
+      "description": "The applicability predicate `appliesTo({ fbs, uiBaseline, manifest })` is a required top-level field on every pack; its source (`appliesTo.toString()`) MUST reference at least one of `route`, `tacIds`, or the `blueprint:` US-tag prefix, and an unqualified predicate (a body that references none of the three, including the default `() => true`) is refused at load with exit 2 and a diagnostic that names the pack, the requirement and the three legal scoping seams. A pack whose `appliesTo` returns `false` for an FBS records `applicable: false` on the record for that FBS with a one-line reason drawn from the predicate context and no `run` function is invoked.",
+      "testable": true
+    },
+    {
+      "id": "AC-1701-3",
+      "description": "The loader cross-checks every `checks[].id` against the AC ids the pack's blueprint contributes through `blueprint.json:contributions[]` (reading each US contribution file and enumerating `acceptanceCriteria[].id`). A pack whose check names an AC id the blueprint does not contribute is refused at load (exit 2) with a diagnostic that names the pack, the offending check id and the AC ids the blueprint actually contributes.",
+      "testable": true
+    },
+    {
+      "id": "AC-1701-4",
+      "description": "The runner runs the pack pass after invariants and after auth-smoke on `agentScreenshotCritique` mode. For each applicable pack the runner invokes every check's `run({ browser, fetch, runtimeUrl, route, theme })` (browser and fetch injected by the runner), records `{ id, verdict, severity, detail? }` on the pack record, and appends the pack record to `browserVerification.probePacks[]` on the composed record. The aggregate verdict extends the existing rule: `block` on any pack check whose severity is `block` and verdict is `fail`; `warn` on any pack check whose severity is `warn` and verdict is `fail` (and no block from invariants, auth-smoke or pack); `pass` otherwise.",
+      "testable": true
+    },
+    {
+      "id": "AC-1701-5",
+      "description": "`rcf verify browser <fbs-id> --probe-pack <name>` restricts one run to one pack by name; a `--probe-pack` value that resolves to no discovered pack (nothing loaded under any applied blueprint's `probe-packs/` matches the name) exits 2 with a diagnostic that names the value and the packs that were discovered. When omitted, every discovered and applicable pack runs; when a pack's `appliesTo` returns false for the FBS, the pack record carries `applicable: false` and no browser check runs against it.",
+      "testable": true
+    },
+    {
+      "id": "AC-1701-6",
+      "description": "A pack MAY declare `preChecks[]`: an array of `{ id, description, run: async () => ({ verdict, detail? }) }` Node build-scan fast-fail checks that the runner invokes before any browser check on the same pack. A pre-check with verdict `fail` records on the pack record and every browser check that names it under `dependsOn` records verdict `skipped` with detail `skipped-by-pre-check:<preCheckId>`; browser checks with no `dependsOn` on a failing pre-check still run. Pre-check verdicts fold into the aggregate the same way pack checks do (a `fail` at `severity: block` blocks ship).",
+      "testable": true
+    },
+    {
+      "id": "AC-1701-7",
+      "description": "The `packBrowser` seam the runner injects into every pack check is a real headless browser provisioned through the pinned Playwright MCP server (`PLAYWRIGHT_MCP_VERSION` in `src/verify/engine/launcher.js`, spawned as `npx -y @playwright/mcp@<pin>` over stdio) via a thin in-package JSON-RPC 2.0 client (zero new npm dependencies in rcf-lite; no LLM call). Every check receives a stable API: `goto(url)`, `snapshot()` returning accessibility-tree text, `evaluate(fn, arg?)` returning a parsed value, `click(selector, hint?)`, `type(selector, text, hint?)`, `press(key)`, `screenshot(filename?)`, `close()`. When the consuming project already resolves `playwright` from its own `node_modules`, the runner MAY take that cheaper direct route and expose the identical API; the pinned MCP version remains the source of the browser otherwise. The CLI provisions the browser only when at least one applicable pack is loaded and `--no-browser` was not passed; `deps.packBrowser` on the CLI handler overrides the provisioning for tests.",
+      "testable": true
+    },
+    {
+      "id": "AC-1701-8",
+      "description": "A pack MAY declare a `boot: { bootCommand, waitForUrl, waitForSelector }` object. Before running the pack pass, the CLI probes the runtime URL; when it responds with any HTTP status the boot is skipped and the running server is used unchanged. When the runtime is not answering AND `boot.bootCommand` is a non-empty string, the CLI spawns `bootCommand` from the project root (Node.js child_process, cwd=projectRoot, no shell), polls `waitForUrl` at a bounded interval until a timeout, and when the URL responds runs the packs; when `waitForSelector` is set and a browser is available, the CLI navigates the browser to `waitForUrl` and polls the accessibility snapshot for a substring match on the selector until a bounded timeout (soft-failure only, packs still run). The CLI stops any process it started in reverse order after the pack pass completes (SIGTERM then SIGKILL fallback after 3s). `--no-boot` disables the fallback and forces packs to run against whatever the runtime URL currently answers. When the runtime is unreachable AND no `bootCommand` is declared, the CLI records the note and proceeds; the pack's own runtime checks then surface the failure.",
+      "testable": true
+    }
+  ],
+  "description": "As a blueprint author shipping a runtime-observable visual surface (row order after sort, live-region announcement text, focus return after dialog close, refetch on timeframe change), I want to ship a Playwright probe pack alongside my blueprint contributions and have `rcf verify browser` load and run it as a required ship gate on any FBS whose surface realises what the pack scopes, so that runtime failures refuse ship the same way invariants and auth-smoke already do, and a pack never fires on an FBS whose surface does not exist."
+}

package/rcf/user-stories/us-1801.json

@@ -0,0 +1,40 @@
+{
+  "createdAt": "2026-09-04T20:05:20.719Z",
+  "updatedAt": "2026-09-04T20:05:44.478Z",
+  "usId": "US-1801",
+  "prdId": "PRD-001",
+  "reqId": "REQ-018",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-datatable blueprint ships on the shelf and its probe pack refuses ship on a broken surface",
+  "asA": "shelf consumer applying the application-datatable v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, its Playwright probe pack, and a sample-app fixture proving both to load, apply and gate ship the way the T-0 runner extension expects",
+  "soThat": "a project consuming rcf-lite gets the datatable ACs, the pack that runs them, and a golden fixture the pack refuses on a broken surface",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1801-1",
+      "description": "The shelf carries blueprints/application-datatable/blueprint.json declaring slug application-datatable, version 1.0.0, category application, and 22 contributions (6 REQs, 9 USs, 3 TACs, 4 ADRs); the suggestedCompanions array declares logging and errorHandling with reasons from the ratified spec section 5.1.",
+      "testable": true
+    },
+    {
+      "id": "AC-1801-2",
+      "description": "rcf define blueprint add ./blueprints/application-datatable applies the 22 contributions cleanly on a fresh init project; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "testable": true
+    },
+    {
+      "id": "AC-1801-3",
+      "description": "The shipped probe pack blueprints/application-datatable/probe-packs/application-datatable.pack.js loads via T-0's pack-loader against a scratch project with the blueprint applied; each of its six check ids (AC-17101-1, AC-17102-1, AC-17103-2, AC-17104-3, AC-17105-1, AC-17106-1) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3.",
+      "testable": true
+    },
+    {
+      "id": "AC-1801-4",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-datatable/ ships a dependency-free Node HTTP server (server.js) with a start script; when started, its shell route realises every surface the pack's six checks probe, and running the pack against the fixture returns verdict=pass on every check (severity block, aggregate pass).",
+      "testable": true
+    },
+    {
+      "id": "AC-1801-5",
+      "description": "The probe pack refuses ship on a broken fixture: with the aria-live status region wrapper removed from the shell, running the pack returns verdict=fail on AC-17103-2 at severity=block and the aggregate verdict is block.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-1901.json

@@ -0,0 +1,40 @@
+{
+  "createdAt": "2026-09-04T21:08:30.292Z",
+  "updatedAt": "2026-09-04T21:08:30.292Z",
+  "asA": "shelf consumer applying the application-charts v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, its Playwright probe pack anchoring non-colour distinction, text-alternative table and keyboard traversal, and a sample-app fixture proving both to load, apply and gate ship the way the T-0 runner extension expects",
+  "soThat": "a project consuming rcf-lite gets the chart-accessibility ACs, the pack that runs them, and a golden fixture the pack refuses on a chart surface that drops the text-alternative table or the non-colour pattern.",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-1901-1",
+      "description": "The shelf carries blueprints/application-charts/blueprint.json declaring slug application-charts, version 1.0.0, category application, and 15 contributions (4 REQs, 6 USs, 2 TACs, 3 ADRs); the suggestedCompanions array declares logging and errorHandling with reasons from the ratified spec section 5.2; providesRoles is absent (leaf blueprint per spec).",
+      "testable": true
+    },
+    {
+      "id": "AC-1901-2",
+      "description": "rcf define blueprint add ./blueprints/application-charts applies the 15 contributions cleanly on a fresh init project; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "testable": true
+    },
+    {
+      "id": "AC-1901-3",
+      "description": "The shipped probe pack blueprints/application-charts/probe-packs/application-charts.pack.mjs loads via T-0's pack-loader against a scratch project with the blueprint applied; each of its three check ids (AC-18102-1 non-colour distinction, AC-18103-1 text-alternative table, AC-18104-1 keyboard traversal with reduced motion) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9.",
+      "testable": true
+    },
+    {
+      "id": "AC-1901-4",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-charts/ ships a dependency-free Node HTTP server (server.js) with a start script; when started, its chart route renders at least one bar chart and one line chart with two series each (colour plus pattern plus direct label), a visually-hidden focus-reachable table carrying the same values, keyboard-focusable data points announcing series x y unit, and a prefers-reduced-motion media rule; running the pack against the fixture returns verdict pass on every check (severity block, aggregate pass).",
+      "testable": true
+    },
+    {
+      "id": "AC-1901-5",
+      "description": "The probe pack refuses ship on a broken fixture: with the text-alternative table removed via the ?break=table switch, running the pack returns verdict fail on AC-18103-1 at severity block and the aggregate verdict is block; with the pattern attributes removed via the ?break=pattern switch, verdict fail on AC-18102-1 at severity block; with keyboard focus removed via the ?break=keyboard switch, verdict fail on AC-18104-1 at severity block.",
+      "testable": true
+    }
+  ],
+  "usId": "US-1901",
+  "prdId": "PRD-001",
+  "reqId": "REQ-019",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-charts blueprint ships on the shelf and its probe pack refuses ship on a broken chart surface"
+}

package/rcf/user-stories/us-2001.json

@@ -0,0 +1,50 @@
+{
+  "createdAt": "2026-09-04T22:10:00.000Z",
+  "updatedAt": "2026-09-04T22:10:00.000Z",
+  "usId": "US-2001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-020",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-dashboard blueprint ships on the shelf with its packaged design-guidance asset and probe pack refuses ship on a broken dashboard surface",
+  "asA": "shelf consumer applying the application-dashboard v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the packaged design-guidance asset, the Playwright probe pack anchoring primary-KPI position, timeframe refetch fan-out and per-tile state contract, and a sample-app fixture proving the pack passes on a compliant surface and refuses on a broken one",
+  "soThat": "a project consuming rcf-lite gets the dashboard-shape ACs, the operator-facing design guidance the applying agent reads at ship, the pack that runs the three runtime-observable ACs, and a golden fixture the pack refuses on a surface that drops the primary-KPI placement or the timeframe fan-out or the four-state distinction",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2001-1",
+      "description": "The shelf carries blueprints/application-dashboard/blueprint.json declaring slug application-dashboard, version 1.0.0, category application, and 18 contributions (5 REQs, 7 USs, 3 TACs, 3 ADRs); the suggestedCompanions array declares logging and errorHandling with reasons from the ratified spec section 5.3; providesRoles is absent (leaf blueprint per spec; the loader refuses an empty providesRoles array when set, so the leaf-blueprint intent is expressed by omitting the field).",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-2",
+      "description": "rcf define blueprint add ./blueprints/application-dashboard applies the 18 contributions cleanly on a fresh init project; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-3",
+      "description": "The packaged design-guidance asset at blueprints/application-dashboard/assets/guidance/dashboard-design.md exists, carries the eight sections named in the ratified spec section 5.3.1 (primary KPI placement; tile density and count limits; timeframe and filter chrome; loading, empty and error states; colour and contrast; when a table beats a chart, delegating to application-datatable; refresh cadence and staleness; anti-patterns), and carries at least five https:// citations to the sources named in the spec (NN/g dashboard design, Few, Tufte, GOV.UK Design System patterns, WCAG 2.2 Understanding docs).",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-4",
+      "description": "The shipped probe pack blueprints/application-dashboard/probe-packs/application-dashboard.pack.mjs loads via T-0's pack-loader against a scratch project with the blueprint applied; each of its three check ids (AC-19102-1 primary-KPI position, AC-19104-1 timeframe refetch fan-out, AC-19103-1 per-tile state contract) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack's appliesTo predicate references the tacIds seam and binds TAC-2001-application-dashboard-tile-grid.",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-5",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-dashboard/ ships a dependency-free Node HTTP server (server.js) with a start script; when started, its dashboard route renders a tile grid with a primary KPI top-left (data attribute naming its kind from the enum), a chart region reusing the application-charts sample-app markup shape, a timeframe preset picker whose change refetches every tile with the same from/to boundary and updates an as-of ISO-8601 stamp, per-tile four states switchable by query, an export handle listing CSV/PDF/PNG, a request log exposed on window.__dashboardFetches and at /__requests, and CSS that reflows to one column at 360 with the primary KPI first. Running the pack against the fixture returns verdict pass on every check (severity block, aggregate pass).",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-6",
+      "description": "The probe pack refuses ship on a broken fixture: with the primary KPI moved off top-left via the ?break=kpi-position switch, running the pack returns verdict fail on AC-19102-1 at severity block and the aggregate verdict is block; with the timeframe refetch fan-out drift-boundary via ?break=fanout, verdict fail on AC-19104-1 at severity block; with the aria-live and role region attributes dropped via ?break=state-aria, verdict fail on AC-19103-1 at severity block.",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-7",
+      "description": "The pack-browser seam (packages/rcf-lite/src/browser-verify/pack-browser.js) exposes a resize(width, height) method to probe pack authors: on the MCP route the method calls the pinned Playwright MCP's browser_resize tool, on the project route it calls page.setViewportSize({ width, height }), and packs can drive the three breakpoint checks (1440/1024/360) through the new seam.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2101.json

@@ -0,0 +1,45 @@
+{
+  "createdAt": "2026-09-04T23:59:00.000Z",
+  "updatedAt": "2026-09-04T23:59:00.000Z",
+  "usId": "US-2101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-021",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-notifications-in-app blueprint ships on the shelf and its probe pack refuses ship on a broken notifications surface",
+  "asA": "shelf consumer applying the application-notifications-in-app v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring live-region preseeding, the transient toast contract with priority-to-role mapping and timeout floor, and the notification-centre acknowledge round-trip, plus a sample-app fixture proving the pack passes on a compliant surface and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the in-app notifications-shape ACs, the pack that runs the three runtime-observable ACs, and a golden fixture the pack refuses on a surface that lazy-inserts the wrappers, inverts the priority-to-role mapping, dismisses toasts below the WCAG 2.2.1 floor, or drops the acknowledge POST",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2101-1",
+      "description": "The shelf carries blueprints/application-notifications-in-app/blueprint.json declaring slug application-notifications-in-app, version 1.0.0, category application, and 19 contributions (5 REQs, 8 USs, 3 TACs, 3 ADRs); the suggestedCompanions array declares logging and errorHandling with reasons from the ratified spec section 5.4; providesRoles is absent (leaf blueprint per spec; the loader refuses an empty providesRoles array when set, so the leaf-blueprint intent is expressed by omitting the field).",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-2",
+      "description": "rcf define blueprint add ./blueprints/application-notifications-in-app applies the 19 contributions cleanly on a fresh init project; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-3",
+      "description": "The shipped probe pack blueprints/application-notifications-in-app/probe-packs/application-notifications-in-app.pack.mjs loads via T-0's pack-loader against a scratch project with the blueprint applied; each of its three check ids (AC-20101-1 live-region preseeding, AC-20102-1 transient toast contract, AC-20103-1 centre acknowledge round-trip) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the AC-20101-1 description contains the word 'preseeded' per section 9 T-4 row; the pack's appliesTo predicate references BOTH tacIds and route (the two legal source-scan seams).",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-4",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app/ ships a dependency-free Node HTTP server (server.js) with a start script; when started, its main route preseeds both live-region wrappers ([data-live-region=\"polite\"] with aria-live=polite AND [data-live-region=\"assertive\"] with role=alert), both empty at page load; the notification centre route lists a seeded backlog of notifications each carrying data-notification-id, a keyboard-reachable [data-action=\"acknowledge\"] control and a [data-action=\"mark-read\"] control, plus one [data-action=\"mark-all-read\"] control; the preferences route lists per-category silence toggles and sibling-channel digest sections disabled by default; POST /api/notifications/acknowledge round-trips and updates the seeded row's acknowledgedAt; GET /api/delivery-log returns {rows:[]} with the seeded backlog; window.__notificationFetches and /__requests mirror every client-side fetch record.",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-5",
+      "description": "The probe pack refuses ship on each broken fixture: with ?break=preseed the wrappers are inserted lazily after the first event so AC-20101-1 fails at severity block; with ?break=role the priority-to-role mapping is inverted (error toast in polite/status, info toast in assertive/alert) so AC-20102-1 fails at severity block; with ?break=timeout the toast dismisses after two seconds and the shell root advertises a two-second floor so AC-20102-1 fails at severity block on both the shell-declared floor and the WCAG six-second floor; with ?break=ack the acknowledge click handler is a no-op so AC-20103-1 fails at severity block.",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-6",
+      "description": "The blueprint's family-prefix reservation (application-notifications- reserved for the sibling channels -email, -push, -webhook per Baz decision 2026-09-04) is documented as a paragraph in the blueprint README AND as a row in the shelf band registry table in every applying blueprint's docs/topics.md (marked as a doc-only reservation with no shipped blueprint).",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2201.json

@@ -0,0 +1,60 @@
+{
+  "createdAt": "2026-09-05T01:30:00.000Z",
+  "updatedAt": "2026-09-05T01:30:00.000Z",
+  "usId": "US-2201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-022",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The capability-declaration mechanism lands in the loader and apply verb; the four shelf auth blueprints adopt it in v1.1.0 minor bumps",
+  "asA": "shelf consumer applying a consumer blueprint that gates surfaces on identity or platform capabilities",
+  "iWant": "the blueprint loader to accept capabilities[], elicits[] and requiresAppliedCapabilities on blueprint.json with shape validation, the apply verb to discover applied capabilities by reading each applied blueprint's source blueprint.json, refuse admin-console-shaped applies with the spec 5.5.1 verbatim message when no required capability is applied and --allow-no-auth-yet is absent, prompt an elicitation phase gated by the discovered capabilities, and persist appliedCapabilities and appliedElicitations to rcf/blueprints/${slug}.applied.json; and the four shelf auth blueprints to declare capabilities[] in v1.1.0 minor bumps landing in the same PR",
+  "soThat": "a project applying admin-console (or any future capability-gated blueprint) gets deterministic apply-time surface configuration, a bare-SPA apply is refused with the operator-friendly message the spec ratified, custom-auth projects elicit their answers into a persistent record the console reads, and the four shelf auth blueprints announce their identity capability set in one release train per spec Q2 default",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2201-1",
+      "description": "The blueprint loader accepts an optional capabilities[] top-level field on blueprint.json: when present it must be a non-empty array of lower camelCase strings on ^[a-z][a-zA-Z0-9]*$, and a malformed value refuses with a validation rcfError naming the field. LoadedBlueprint exposes capabilities[] verbatim.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-2",
+      "description": "The blueprint loader accepts an optional elicits[] top-level field: when present it must be a non-empty array of {id (kebab slug), prompt (non-empty operator-facing string, no em-dashes, no emojis), kind (one of enum, string, boolean), default (matching kind), options (required when kind=enum), when (optional predicate object)} entries; malformed shapes refuse with a validation rcfError naming the entry.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-3",
+      "description": "The blueprint loader accepts an optional requiresAppliedCapabilities top-level object: when present its capabilities[] property is a non-empty array of lower camelCase strings, allowSkipFlag is a kebab slug matching an apply-verb flag name (allow-no-auth-yet in v1), and refusalMessageId is a non-empty string; malformed shapes refuse with a validation rcfError.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-4",
+      "description": "applyBlueprint reads each applied blueprint's source blueprint.json (via the applied record's source field the T-2 core-companions train established) to compute the appliedCapabilities union across the project; when the loaded blueprint declares requiresAppliedCapabilities and the union has no overlap AND the CLI did not pass --allow-no-auth-yet, apply returns an rcfError kind requiresAppliedCapabilities carrying the spec 5.5.1 message body verbatim with the currently-applied blueprints list substituted, and the CLI exits 3 with that message on stderr naming security-auth-*.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-5",
+      "description": "When --allow-no-auth-yet is passed on the CLI and the blueprint's allowSkipFlag matches, apply proceeds and the applied-record sidecar rcf/blueprints/${slug}.applied.json is written with allowNoAuthYet: true and a notes string naming the no-auth-yet state; the manifest applied record's schema-closed fields remain untouched.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-6",
+      "description": "The elicitation phase reads --answer <id>=<value> repeatable arguments and --answers <file> (a JSON object mapping id to value) at apply time; every elicit entry whose when predicate resolves true against the discovered applied-capability set is prompted (on a TTY) or read from the answer bag (non-interactive) with the declared kind coerced (boolean from y/yes/n/no, enum against options, string trimmed); a missing required answer refuses with a validation rcfError naming the id.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-7",
+      "description": "On a clean apply, apply writes rcf/blueprints/${slug}.applied.json containing {slug, version, appliedAt, appliedCapabilities: [...], appliedElicitations: {id: value, ...}, allowNoAuthYet?: bool, notes?: string}; the sidecar is idempotent (re-apply on the same version rewrites the same file) and the manifest.blueprints[] applied record is unchanged in shape.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-8",
+      "description": "The four shelf auth blueprints declare capabilities[] in v1.1.0 minor bumps landing in the same PR: security-auth-magic-link 1.0.0 -> 1.1.0 capabilities: [principalDirectory]; security-auth-clerk 1.1.0 -> 1.2.0 capabilities: [principalDirectory, roleModel]; security-auth-oauth2 1.0.0 -> 1.1.0 capabilities: [principalDirectory, roleModel]; security-auth-keycloak 1.0.0 -> 1.1.0 capabilities: [principalDirectory, roleModel]. Each blueprint's CHANGELOG.md carries a new entry naming the capabilities added and citing this train (Baz Q2 default 2026-09-04, spec section 5.5.2). No other change to the four blueprints.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-9",
+      "description": "docs/blueprint-authoring.md section 6a extends the roles registry with the capability vocabulary table (principalDirectory, roleModel, tenancy, auditLog with meaning columns and shelf-provider(s) columns) and cross-references capabilities[] and requiresAppliedCapabilities in the loader as sibling fields to providesRoles and suggestedCompanions.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2301.json

@@ -0,0 +1,51 @@
+{
+  "createdAt": "2026-09-05T01:30:00.000Z",
+  "updatedAt": "2026-09-05T01:30:00.000Z",
+  "usId": "US-2301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-023",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-admin-console blueprint ships on the shelf; its probe pack fires only on applied capabilities and refuses on a broken admin surface",
+  "asA": "shelf consumer applying the application-admin-console v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files with a users, roles, orgs, audit-log surface set that self-configures from the applied capability declarations, the Playwright probe pack whose four checks each gate their fire on the applied capability, and a sample-app fixture proving the pack passes on a compliant surface, records applicable: false where the capability is absent, and refuses on the three break switches",
+  "soThat": "a project consuming rcf-lite gets a vendor-neutral admin console conditional on what identity blueprint is applied, no dead links to unapplied capabilities, the pack that proves the ARIA APG grid pattern on the permission matrix, the request-log ACs on the audit view, and a golden fixture the pack refuses on a surface that loses the grid roles, drops the request-access control, or writes an audit entry missing the correlation id",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2301-1",
+      "description": "The shelf carries blueprints/application-admin-console/blueprint.json declaring slug application-admin-console, version 1.0.0, category application, 23 contributions in the 6 REQ / 9 US / 4 TAC / 4 ADR groups per spec section 5.5; requiresAppliedCapabilities.capabilities is [principalDirectory] with allowSkipFlag: allow-no-auth-yet; elicits[] declares baselineRoles (when roleModel), tenancyShape (when tenancy), inviteTransport, and auditRetentionDays (when auditLog); suggestedCompanions declares logging and errorHandling with reasons from spec section 5.5; providesRoles is absent per spec 5.5.3.",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-2",
+      "description": "rcf define blueprint add ./blueprints/application-admin-console --allow-no-auth-yet applies the 23 contributions cleanly on a fresh init project with only application-spa applied; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project; the sidecar rcf/blueprints/application-admin-console.applied.json declares allowNoAuthYet: true and an appliedCapabilities: [] union.",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-3",
+      "description": "rcf define blueprint add ./blueprints/application-admin-console on a project with only application-spa applied exits 3 with a stderr message beginning 'application-admin-console requires at least one applied security-auth-*' and naming the currently-applied blueprints; nothing is written to disk (no contributions, no sidecar, no manifest entry).",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-4",
+      "description": "rcf define blueprint add ./blueprints/application-admin-console on a project with security-auth-magic-link 1.1.0 applied applies cleanly; the sidecar's appliedCapabilities reads exactly [principalDirectory] with no roleModel; rcf define blueprint add on a project with security-auth-clerk 1.2.0 + observability-logging applied produces appliedCapabilities [principalDirectory, roleModel, auditLog] (order-agnostic).",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-5",
+      "description": "The shipped probe pack blueprints/application-admin-console/probe-packs/application-admin-console.pack.mjs loads via T-0's pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-21102-1, AC-21103-1, AC-21104-1, AC-21105-1) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; each check's appliesTo predicate reads manifest.blueprints[]/${slug}.applied.json capabilities and returns false when the required capability is absent so the check records applicable: false; the pack-level appliesTo predicate references BOTH tacIds and route.",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-6",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/ ships a dependency-free Node HTTP server (server.js) with a start script; CAPS env or ?caps= query switch selects which surfaces exist mirroring the applied capability set (principalDirectory, roleModel, tenancy, auditLog, or comma combinations thereof); the console shell nav only links applied surfaces; the users directory table enumerates every row by data-user-id inside the role=table region; the permission matrix renders under role=grid with role=row on every rank, role=rowheader on the leftmost cell of each role rank, role=columnheader on every permission header, role=gridcell on inner cells, and each cell announces the exact permission string on focus via aria-label; the org switcher is present only when tenancy is applied; the audit-log table enumerates every row by data-audit-id and every audit entry carries actor, target, before, after, timestamp, and correlationId in inspectable columns; an access-denied route renders a request-access control routed to a POST /api/request-access endpoint; window.__adminFetches and /__requests mirror every request.",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-7",
+      "description": "The probe pack refuses ship on each broken fixture: with ?break=matrix-grid the permission matrix drops the role=grid attributes so AC-21103-1 fails at severity block; with ?break=denied the access-denied route drops the request-access control so AC-21102-1's negative branch (a principal without admin scope) fails at severity block; with ?break=audit-fields the audit entries omit the correlationId column so AC-21105-1 fails at severity block."
+      ,
+      "testable": true
+    }
+  ]
+}

package/releases/releases.yaml

@@ -40,8 +40,27 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.19.0"
+latest: "0.21.0"
 releases:
+  - version: "0.21.0"
+    date: "2026-09-05"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.21.0 adds five visual-feature blueprints to the shelf (data table, charts, dashboard with packaged design guidance, in-app notifications, admin console) and the mechanism that proves them: a blueprint can now ship a Playwright probe pack that rcf verify runs against your running app in a real browser, and the ship gate refuses while a surface check fails."
+      - "The admin console only offers the surfaces your applied auth blueprint can support. Blueprints can now ask you questions at apply time."
+      - "The schema floor moves to rcf-schemas 0.6.1."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
+  - version: "0.20.0"
+    date: "2026-09-04"
+    breaking: true
+    headlines:
+      - "rcf-lite 0.20.0 adds an optional evaluation step to the chain for the acceptance criteria whose outcome cannot be checked deterministically. You mark such a criterion when you define it, attach an evaluation with its own pass threshold, and the audit, verify and finalise steps refuse to ship while it is missing, with an explicit opt-out that records its reason."
+      - "The schema floor moves to rcf-schemas 0.6.0."
+    minAgentAction: "rerun-init"
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.19.0"
     date: "2026-09-04"
     breaking: false

package/src/blueprint/apply.js

@@ -20,6 +20,7 @@ import { loadBlueprint } from './loader.js';
 import { updateManifest } from './manifest-writer.js';
 import { stampId } from './namespace.js';
 import { nextResolutionId } from './resolutions.js';
+import { buildRefusalMessage, discoverAppliedCapabilities, runCustomAuthCapabilityElicits, runElicitationPhase, writeSidecar } from './capabilities.js';
 
 /**
  * @typedef {object} ApplyResult
@@ -79,7 +80,7 @@ import { nextResolutionId } from './resolutions.js';
  *        prove the rollback runs. Never used in production.
  * @returns {Promise<ApplyResult | import('../core/errors/index.js').RcfError>}
  */
-export async function applyBlueprint({ projectRoot, tree, source, displaySource, namespaceOverride, effectiveSlug, libraryPrefix, libraryBands, resolveDeclarations, now = new Date(), dryRun = false, _copyFileForTest }) {
+export async function applyBlueprint({ projectRoot, tree, source, displaySource, namespaceOverride, effectiveSlug, libraryPrefix, libraryBands, resolveDeclarations, allowNoAuthYet = false, elicitAnswers = null, customAuthReadLine = null, now = new Date(), dryRun = false, _copyFileForTest }) {
   const hintSource = typeof displaySource === 'string' && displaySource.length > 0 ? displaySource : source;
   const blueprint = await loadBlueprint(source);
   if (blueprint.kind) return blueprint; // RcfError
@@ -105,6 +106,69 @@ export async function applyBlueprint({ projectRoot, tree, source, displaySource,
     if (bandErr) return bandErr;
   }
 
+  // Capability-declaration mechanism (visual round T-5 spec 5.5).
+  // Discover the union of applied capabilities across every applied
+  // blueprint via source read-back; the applied-blueprint-record
+  // schema is closed (rcf-schemas 0.6.0) and does not carry a
+  // capabilities field, so the source blueprint.json is the ground
+  // truth for what each applied blueprint declares.
+  const discovery = await discoverAppliedCapabilities(applied, projectRoot);
+  const discoveredCapabilities = discovery.union;
+
+  // Custom-auth capability elicitation (visual round T-5 spec 5.5
+  // "Risks": custom auth elicits per capability). Fires BEFORE the
+  // requiresAppliedCapabilities refusal gate: providesCapability
+  // elicits let a project with no shelf auth blueprint declare which
+  // capabilities its own custom auth carries. Truthy answers fold
+  // into the effective applied set; that set is what the refusal gate
+  // and the standard elicitation phase see.
+  const customAuth = await runCustomAuthCapabilityElicits({
+    elicits: blueprint.elicits,
+    answers: elicitAnswers ?? {},
+    readLine: customAuthReadLine ?? undefined,
+  });
+  if (customAuth.kind) return customAuth; // RcfError
+  const appliedCapabilities = [...new Set([...discoveredCapabilities, ...customAuth.capsProvided])].sort();
+  const customAuthElicitations = customAuth.answered;
+
+  // Refusal gate for consumer blueprints that require at least one
+  // applied capability. When the effective set has no overlap AND
+  // the CLI did not pass the allow-skip flag AND no custom-auth
+  // capability answers were supplied that satisfy the gate, refuse
+  // with the templated message (spec 5.5.1 verbatim for admin-console).
+  if (blueprint.requiresAppliedCapabilities && !allowNoAuthYet) {
+    const required = blueprint.requiresAppliedCapabilities.capabilities;
+    const overlap = required.some((c) => appliedCapabilities.includes(c));
+    if (!overlap) {
+      const message = buildRefusalMessage({
+        slug: appliedSlug,
+        refusalMessageId: blueprint.requiresAppliedCapabilities.refusalMessageId,
+        requiredCapabilities: required,
+        appliedRecords: applied,
+        allowSkipFlag: blueprint.requiresAppliedCapabilities.allowSkipFlag,
+      });
+      return rcfError({ kind: 'requiresAppliedCapabilities', message });
+    }
+  }
+
+  // Elicitation phase (visual round T-5 spec section 5.5, T-2 gate).
+  // Evaluate each declared elicit against the effective capability set
+  // (union of applied blueprints and custom-auth answers). Skip
+  // providesCapability entries: those were resolved above and their
+  // answers already landed in customAuthElicitations. Coerce operator
+  // answers per kind. A missing required answer refuses before any
+  // write.
+  const regularElicits = Array.isArray(blueprint.elicits)
+    ? blueprint.elicits.filter((e) => typeof e.providesCapability !== 'string')
+    : [];
+  const elicitResult = runElicitationPhase({
+    elicits: regularElicits,
+    appliedCapabilities,
+    answers: elicitAnswers ?? {},
+  });
+  if (elicitResult.kind) return elicitResult; // RcfError
+  const appliedElicitations = { ...customAuthElicitations, ...elicitResult.value };
+
   // Pre-detection: fold operator-supplied --resolve declarations into a
   // WORKING COPY of the manifest so the detector honours them on this
   // run. The final manifest write later composes the same resolution
@@ -302,11 +366,44 @@ export async function applyBlueprint({ projectRoot, tree, source, displaySource,
   });
   if (manifestResult.kind) return manifestResult; // RcfError
 
+  // Sidecar write for the capability-declaration mechanism (visual
+  // round T-5 spec 5.5.1). Per-project apply-state that the applied-
+  // blueprint-record schema cannot carry today: the discovered
+  // appliedCapabilities snapshot, the elicit answers, and (when the
+  // gate was skipped) an allowNoAuthYet flag plus a notes string that
+  // rcf define validate later reads to flag ungated surfaces. The
+  // sidecar is written on ANY apply that carries capabilities-related
+  // data (declared capabilities, requiresAppliedCapabilities gate,
+  // elicits, or an override) so probe packs and audit tooling have
+  // one deterministic file to read. dryRun skips the write.
+  const wroteSidecar = !dryRun && (
+    blueprint.requiresAppliedCapabilities !== undefined ||
+    (Array.isArray(blueprint.elicits) && blueprint.elicits.length > 0) ||
+    Array.isArray(blueprint.capabilities) ||
+    allowNoAuthYet === true
+  );
+  let sidecarPath = null;
+  if (wroteSidecar) {
+    sidecarPath = await writeSidecar({
+      projectRoot,
+      slug: appliedSlug,
+      version: blueprint.version,
+      appliedAt: now.toISOString(),
+      appliedCapabilities,
+      appliedElicitations,
+      allowNoAuthYet: allowNoAuthYet === true ? true : undefined,
+      notes: allowNoAuthYet === true
+        ? `no auth yet: applied under --${blueprint.requiresAppliedCapabilities?.allowSkipFlag ?? 'allow-no-auth-yet'}; surfaces gated on ${(blueprint.requiresAppliedCapabilities?.capabilities ?? []).join(', ')} will refuse at runtime until an auth blueprint is applied.`
+        : undefined,
+    });
+  }
+
   return {
     applied: true,
     slug: appliedSlug,
     version: blueprint.version,
     contributions: writtenContributions,
+    ...(wroteSidecar ? { sidecarPath, appliedCapabilities, appliedElicitations } : {}),
     // Companion-suggestion mechanism (spec 2.6). Bubble the source
     // blueprint's `suggestedCompanions[]` up on the result so the CLI
     // can render the resolved-suggestion block after a successful