rcf-lite 0.20.0 → 0.21.0

package/src/browser-verify/pack-schema.js

@@ -0,0 +1,155 @@
+// Pack schema validator for blueprint-shipped probe packs
+// (visual round T-0, US-1701 AC-1701-1/2). CN-106.
+//
+// Validates a pack module's exported default object against the
+// section 3.2 shape. Enforces the field-level rules the loader must
+// refuse at load time (packName grammar and blueprint-slug prefix,
+// version semver, blueprintSlug matches directory, appliesTo function
+// referencing one of the three legal scoping seams, checks[] non-empty
+// with an id / severity / description / async run per entry).
+//
+// Returns a plain-JS shape (not RcfError): the loader wraps refusals
+// in its own diagnostic aggregate, so a single validation call reports
+// every issue on one pack instead of stopping at the first.
+
+const PACK_NAME_RE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+const SEMVER_RE = /^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/;
+const CHECK_ID_RE = /^AC-\d{3,}-\d+$/;
+const SEVERITIES = new Set(['block', 'warn', 'advisory']);
+
+const APPLIES_TO_TOKENS = [
+  { key: 'route', matcher: /\broute\b|\bnavModel\b|\bpath\b/ },
+  { key: 'tacIds', matcher: /\btacIds?\b/ },
+  { key: 'blueprintTag', matcher: /blueprint:/ },
+];
+
+/**
+ * Validate a pack module's exported default object.
+ *
+ * @param {object} args
+ * @param {object} args.mod  the imported module (its `.default` is the pack object).
+ * @param {string} args.blueprintSlug  the owning blueprint slug (directory).
+ * @param {string} args.packAbsPath  absolute path of the pack file, for error context.
+ * @returns {{ ok: true, pack: object } | { ok: false, errors: Array<{ field: string, message: string }> }}
+ */
+export function validatePackModule({ mod, blueprintSlug, packAbsPath }) {
+  const errors = [];
+  const pack = mod?.default;
+  if (!pack || typeof pack !== 'object') {
+    return { ok: false, errors: [{ field: 'default', message: `pack ${packAbsPath}: missing default export (expected an object)` }] };
+  }
+
+  if (typeof pack.packName !== 'string' || pack.packName.length === 0) {
+    errors.push({ field: 'packName', message: `pack ${packAbsPath}: packName must be a non-empty string` });
+  } else if (!PACK_NAME_RE.test(pack.packName)) {
+    errors.push({ field: 'packName', message: `pack ${packAbsPath}: packName '${pack.packName}' must match ${PACK_NAME_RE}` });
+  } else if (pack.packName !== blueprintSlug && !pack.packName.startsWith(`${blueprintSlug}-`)) {
+    errors.push({ field: 'packName', message: `pack ${packAbsPath}: packName '${pack.packName}' must equal the blueprint slug '${blueprintSlug}' or start with '${blueprintSlug}-'` });
+  }
+
+  if (typeof pack.version !== 'string' || !SEMVER_RE.test(pack.version)) {
+    errors.push({ field: 'version', message: `pack ${packAbsPath}: version must be semver (got ${JSON.stringify(pack.version)})` });
+  }
+
+  if (typeof pack.blueprintSlug !== 'string' || pack.blueprintSlug.length === 0) {
+    errors.push({ field: 'blueprintSlug', message: `pack ${packAbsPath}: blueprintSlug must be a non-empty string` });
+  } else if (pack.blueprintSlug !== blueprintSlug) {
+    errors.push({ field: 'blueprintSlug', message: `pack ${packAbsPath}: blueprintSlug '${pack.blueprintSlug}' must match the enclosing directory '${blueprintSlug}'` });
+  }
+
+  if (typeof pack.appliesTo !== 'function') {
+    errors.push({ field: 'appliesTo', message: `pack ${packAbsPath}: appliesTo is required and must be a function ({ fbs, uiBaseline, manifest }) => boolean` });
+  } else {
+    const source = String(pack.appliesTo);
+    const matched = APPLIES_TO_TOKENS.filter((t) => t.matcher.test(source)).map((t) => t.key);
+    if (matched.length === 0) {
+      errors.push({
+        field: 'appliesTo',
+        message: `pack ${packAbsPath}: appliesTo must reference one of { route (or navModel/path), tacIds, blueprint:<slug> tag }; got source ${trimForError(source)}. The default '() => true' predicate is refused; scope the pack to the FBS surface it probes.`,
+      });
+    }
+  }
+
+  if (pack.boot !== undefined && pack.boot !== null && typeof pack.boot !== 'object') {
+    errors.push({ field: 'boot', message: `pack ${packAbsPath}: boot must be an object or null when present (fields bootCommand, waitForUrl, waitForSelector are optional)` });
+  }
+
+  if (!Array.isArray(pack.checks) || pack.checks.length === 0) {
+    errors.push({ field: 'checks', message: `pack ${packAbsPath}: checks must be a non-empty array` });
+  } else {
+    const seenIds = new Set();
+    pack.checks.forEach((check, index) => {
+      const at = `checks[${index}]`;
+      if (!check || typeof check !== 'object') {
+        errors.push({ field: at, message: `pack ${packAbsPath}: ${at} must be an object` });
+        return;
+      }
+      if (typeof check.id !== 'string' || !CHECK_ID_RE.test(check.id)) {
+        errors.push({ field: `${at}.id`, message: `pack ${packAbsPath}: ${at}.id must match ${CHECK_ID_RE} (got ${JSON.stringify(check.id)})` });
+      } else if (seenIds.has(check.id)) {
+        errors.push({ field: `${at}.id`, message: `pack ${packAbsPath}: ${at}.id '${check.id}' duplicates an earlier check on the same pack` });
+      } else {
+        seenIds.add(check.id);
+      }
+      if (!SEVERITIES.has(check.severity)) {
+        errors.push({ field: `${at}.severity`, message: `pack ${packAbsPath}: ${at}.severity must be one of ${[...SEVERITIES].join(' | ')} (got ${JSON.stringify(check.severity)})` });
+      }
+      if (typeof check.description !== 'string' || check.description.length === 0) {
+        errors.push({ field: `${at}.description`, message: `pack ${packAbsPath}: ${at}.description must be a non-empty string` });
+      }
+      if (typeof check.run !== 'function') {
+        errors.push({ field: `${at}.run`, message: `pack ${packAbsPath}: ${at}.run must be an async function` });
+      }
+      if (check.dependsOn !== undefined && !(typeof check.dependsOn === 'string' || (Array.isArray(check.dependsOn) && check.dependsOn.every((d) => typeof d === 'string')))) {
+        errors.push({ field: `${at}.dependsOn`, message: `pack ${packAbsPath}: ${at}.dependsOn must be a string or an array of strings (pre-check ids)` });
+      }
+    });
+  }
+
+  if (pack.preChecks !== undefined) {
+    if (!Array.isArray(pack.preChecks)) {
+      errors.push({ field: 'preChecks', message: `pack ${packAbsPath}: preChecks must be an array when present` });
+    } else {
+      const seenPre = new Set();
+      pack.preChecks.forEach((pre, index) => {
+        const at = `preChecks[${index}]`;
+        if (!pre || typeof pre !== 'object') {
+          errors.push({ field: at, message: `pack ${packAbsPath}: ${at} must be an object` });
+          return;
+        }
+        if (typeof pre.id !== 'string' || pre.id.length === 0) {
+          errors.push({ field: `${at}.id`, message: `pack ${packAbsPath}: ${at}.id must be a non-empty string` });
+        } else if (seenPre.has(pre.id)) {
+          errors.push({ field: `${at}.id`, message: `pack ${packAbsPath}: ${at}.id '${pre.id}' duplicates an earlier pre-check on the same pack` });
+        } else {
+          seenPre.add(pre.id);
+        }
+        if (!SEVERITIES.has(pre.severity)) {
+          errors.push({ field: `${at}.severity`, message: `pack ${packAbsPath}: ${at}.severity must be one of ${[...SEVERITIES].join(' | ')} (got ${JSON.stringify(pre.severity)})` });
+        }
+        if (typeof pre.description !== 'string' || pre.description.length === 0) {
+          errors.push({ field: `${at}.description`, message: `pack ${packAbsPath}: ${at}.description must be a non-empty string` });
+        }
+        if (typeof pre.run !== 'function') {
+          errors.push({ field: `${at}.run`, message: `pack ${packAbsPath}: ${at}.run must be an async function` });
+        }
+      });
+    }
+  }
+
+  if (errors.length > 0) return { ok: false, errors };
+  return { ok: true, pack };
+}
+
+function trimForError(s) {
+  const trimmed = String(s).replace(/\s+/g, ' ').trim();
+  return trimmed.length > 80 ? `${trimmed.slice(0, 77)}...` : trimmed;
+}
+
+export const PACK_SCHEMA_INTERNALS = Object.freeze({
+  PACK_NAME_RE,
+  SEMVER_RE,
+  CHECK_ID_RE,
+  SEVERITIES,
+  APPLIES_TO_TOKENS,
+});

package/src/browser-verify/runner.js

@@ -20,6 +20,7 @@
 import { runInvariantsForCapture, foldInvariantsForRecord, compareTopLevelStructure } from './invariants.js';
 import { runAuthSmokeChecks, shouldRunAuthSmokeChecks } from './auth-smoke.js';
 import { composeBrowserVerificationRecord } from './manifest-writer.js';
+import { runProbePacksForFbs } from './pack-runner.js';
 
 /**
  * @typedef {object} BrowserCapture
@@ -63,7 +64,8 @@ export const stubBrowserDriver = Object.freeze({
  * @returns {Promise<object>}  the composed browserVerification record
  */
 export async function runAgentScreenshotCritique({
-  tree, fbs, runtimeUrl, runtimeProfile, browserDriver, fetch, artefactDir, critiqueNotes, now = new Date(),
+  tree, fbs, runtimeUrl, runtimeProfile, browserDriver, fetch, artefactDir, critiqueNotes,
+  probePacks = [], packBrowser = null, packNameFilter, projectRoot = null, now = new Date(),
 }) {
   const routes = fbs?.designStage?.navModel?.routes ?? [];
   const themes = readThemesFromBaseline(tree.manifest?.uiBaseline);
@@ -124,6 +126,26 @@ export async function runAgentScreenshotCritique({
     authSmokeChecks = await runAuthSmokeChecks({ fetch, runtimeUrl });
   }
 
+  // Probe-pack pass: runs after invariants and auth-smoke
+  // (visual-round-spec-2026-09-04 §3.4).
+  let packRecords = [];
+  if (Array.isArray(probePacks) && probePacks.length > 0) {
+    const result = await runProbePacksForFbs({
+      packs: probePacks,
+      fbs,
+      uiBaseline: tree.manifest?.uiBaseline ?? null,
+      manifest: tree.manifest ?? null,
+      projectRoot,
+      browser: packBrowser,
+      fetch,
+      runtimeUrl,
+      routes,
+      themes,
+      packNameFilter,
+    });
+    packRecords = result.probePacks;
+  }
+
   return composeBrowserVerificationRecord({
     manifest: tree.manifest,
     fbsId: fbs.fbsId,
@@ -133,6 +155,7 @@ export async function runAgentScreenshotCritique({
     routesChecked,
     invariantChecks,
     authSmokeChecks,
+    probePacks: packRecords,
     notes,
     now,
   });

package/src/cli/blueprint.js

@@ -184,6 +184,14 @@ const OPTION_SPEC = {
   // Companion-suggestion mechanism (core-companions spec section 2).
   companion: { type: 'string', multiple: true },
   'no-companion-suggestions': { type: 'boolean' },
+  // Capability-declaration mechanism (visual round T-5 spec 5.5.1,
+  // 5.5.2). --allow-no-auth-yet is the override for the
+  // requiresAppliedCapabilities gate. --answer <id>=<value> is
+  // repeatable; --answers <file> reads a JSON object mapping elicit
+  // ids to values. Both feed the elicitation phase in applyBlueprint.
+  'allow-no-auth-yet': { type: 'boolean' },
+  answer: { type: 'string', multiple: true },
+  answers: { type: 'string' },
 };
 
 /**
@@ -286,9 +294,54 @@ export async function main(argv, deps = {}) {
         }
       }
     }
+    // Capability-declaration mechanism (visual round T-5). Compose
+    // the operator-supplied elicit answers bag from --answers <file>
+    // (JSON object) and --answer <id>=<value> (repeatable). Later
+    // --answer entries override --answers file entries so a shell
+    // one-liner beats a stored default without editing the file.
+    let elicitAnswers = {};
+    if (typeof parsed.values.answers === 'string' && parsed.values.answers.length > 0) {
+      try {
+        const raw = await (await import('node:fs/promises')).readFile(parsed.values.answers, 'utf8');
+        const parsedBag = JSON.parse(raw);
+        if (typeof parsedBag !== 'object' || parsedBag === null || Array.isArray(parsedBag)) {
+          stderr.write(`[error] blueprint add: --answers file must contain a JSON object of id -> value.\n`);
+          return 2;
+        }
+        elicitAnswers = { ...parsedBag };
+      } catch (err) {
+        stderr.write(`[error] blueprint add: --answers file read failed: ${err.message}\n`);
+        return 2;
+      }
+    }
+    if (Array.isArray(parsed.values.answer)) {
+      for (const entry of parsed.values.answer) {
+        const eq = entry.indexOf('=');
+        if (eq < 1) {
+          stderr.write(`[error] blueprint add: --answer expects <id>=<value>; got '${entry}'.\n`);
+          return 2;
+        }
+        elicitAnswers[entry.slice(0, eq)] = entry.slice(eq + 1);
+      }
+    }
+    // Custom-auth capability elicits (visual round T-5 spec 5.5
+    // "Risks"): providesCapability elicits fire pre-refusal. On a
+    // TTY, prompt the operator for any unanswered custom-auth elicits
+    // through readline so a fresh project with no shelf auth can pass
+    // the requiresAppliedCapabilities gate by declaring what its own
+    // auth provides. Non-interactive runs skip the prompt and read
+    // answers from the bag only.
+    const stdin = deps.stdin ?? process.stdin;
+    const isTty = Boolean(stdin && stdin.isTTY);
+    const customAuthReadLine = isTty
+      ? await createCustomAuthReadLine({ stdin, stdout })
+      : null;
     const result = await applyBlueprint({
       projectRoot, tree, source,
       namespaceOverride: parsed.values.namespace,
+      allowNoAuthYet: parsed.values['allow-no-auth-yet'] === true,
+      elicitAnswers,
+      customAuthReadLine,
       // Library-qualified resolves rewire the applied identity under
       // the library prefix and forward the library's declared bands
       // for the apply-time gate (spec §5.3, §8.3). The qualified typed
@@ -321,6 +374,19 @@ export async function main(argv, deps = {}) {
       }
     }
     if (isRcfError(result)) {
+      // Capability-declaration refusal (visual round T-5 spec 5.5.1)
+      // is exit 3, and the message is spec-verbatim (built by
+      // buildRefusalMessage in blueprint/capabilities.js): print it
+      // as-is on stderr, no [error] prefix. Every other rcfError
+      // stays exit 2 with the [error] prefix.
+      if (result.kind === 'requiresAppliedCapabilities') {
+        if (parsed.values.json) {
+          stderr.write(`${JSON.stringify({ refused: true, error: { kind: result.kind, message: result.message } })}\n`);
+        } else {
+          stderr.write(`${result.message}\n`);
+        }
+        return 3;
+      }
       if (parsed.values.json) {
         stderr.write(`${JSON.stringify({ refused: true, error: { kind: result.kind, message: result.message } })}\n`);
       } else {
@@ -759,3 +825,29 @@ function parseResolveOptions(rawList, reason) {
   }
   return { value: out };
 }
+
+/**
+ * Build a readline-backed prompt function for custom-auth capability
+ * elicits (visual round T-5 spec 5.5 "Risks"). Wraps node:readline in
+ * a promise so `runCustomAuthCapabilityElicits` can `await` each line.
+ * Only used when stdin is a TTY; the callback closes the interface on
+ * first shutdown to avoid leaking file descriptors.
+ *
+ * @param {{ stdin: NodeJS.ReadableStream, stdout: NodeJS.WritableStream }} deps
+ * @returns {Promise<(prompt: string) => Promise<string>>}
+ */
+async function createCustomAuthReadLine({ stdin, stdout }) {
+  const { createInterface } = await import('node:readline');
+  const rl = createInterface({ input: stdin, output: stdout, terminal: true });
+  let closed = false;
+  return (prompt) => new Promise((resolve) => {
+    if (closed) return resolve('');
+    rl.question(prompt, (answer) => {
+      if (!closed) {
+        try { rl.close(); } catch { /* fine */ }
+        closed = true;
+      }
+      resolve(answer);
+    });
+  });
+}

package/src/cli/browser-verify.js

@@ -18,13 +18,18 @@
 
 import { parseArgs } from 'node:util';
 import process from 'node:process';
+import { isAbsolute, resolve } from 'node:path';
 
 import { walkTree } from '#core/store';
 import { writeUnexpectedFailure, rcfError } from '#core/errors';
 
 import { findProjectRoot } from '../view/index.js';
 import {
+  bootIfNeeded,
   composeOperatorSessionRecord,
+  createPackBrowser,
+  loadProbePacks,
+  pickBootFromPacks,
   runAgentScreenshotCritique,
   stubBrowserDriver,
   writeBrowserVerificationAck,
@@ -40,6 +45,9 @@ const OPTION_SPEC = {
   quiet: { type: 'boolean' },
   ack: { type: 'boolean' },
   notes: { type: 'string' },
+  'probe-pack': { type: 'string' },
+  'no-boot': { type: 'boolean' },
+  'no-browser': { type: 'boolean' },
   help: { type: 'boolean' },
 };
 
@@ -61,6 +69,22 @@ Options:
   --quiet                   Suppress non-error confirmations.
   --ack                     Mark operatorAckAt on the latest record for
                             this FBS (used to clear a warn verdict).
+  --probe-pack <name>       Restrict this run to one blueprint-shipped
+                            probe pack by packName. When omitted, every
+                            discovered pack whose appliesTo() matches
+                            this FBS runs. Refuses (exit 2) when the
+                            name resolves to no discovered pack.
+  --no-browser              Skip the real headless browser (probe packs
+                            that call browser.* will see browser=null).
+                            Default: provision a headless browser via
+                            the pinned Playwright MCP so packs can drive
+                            real DOM interactions.
+  --no-boot                 Do not run a pack's declared bootCommand
+                            when the runtime URL is unreachable. Default:
+                            when any pack declares a boot block and the
+                            runtime is not answering, spawn bootCommand
+                            from the project root, wait for waitForUrl
+                            then waitForSelector, then run packs.
   --help                    Print this help.
 
 Exit codes:
@@ -163,13 +187,77 @@ export async function main(argv, deps = {}) {
         stderr.write('[error] usage browser-verify: no fetch available in the runtime; supply deps.fetch\n');
         return 2;
       }
-      record = await runAgentScreenshotCritique({
-        tree, fbs, runtimeUrl, runtimeProfile: profile,
-        browserDriver, fetch: fetchFn,
-        artefactDir: `.rcf/artefacts/${fbsId.toLowerCase()}`,
-        critiqueNotes: flags.notes,
-        now,
-      });
+      // Probe-pack discovery: gather packs from every applied blueprint
+      // on the manifest, then apply --probe-pack filter if any.
+      const appliedBlueprints = readAppliedBlueprints({ manifest: tree.manifest, projectRoot });
+      const { packs, errors: packErrors } = await loadProbePacks({ appliedBlueprints, projectRoot });
+      if (packErrors.length > 0) {
+        for (const e of packErrors) stderr.write(`[error] usage browser-verify: probe-pack loader refused ${e.packAbsPath}: ${e.message}\n`);
+        return 2;
+      }
+      const packNameFilter = typeof flags['probe-pack'] === 'string' && flags['probe-pack'].length > 0
+        ? flags['probe-pack']
+        : undefined;
+      if (packNameFilter && !packs.some((p) => p.packName === packNameFilter)) {
+        const discovered = packs.map((p) => p.packName).sort();
+        stderr.write(`[error] usage browser-verify: --probe-pack '${packNameFilter}' resolves to no discovered pack. Discovered packs: ${discovered.length === 0 ? '(none)' : discovered.join(', ')}.\n`);
+        return 2;
+      }
+
+      const filteredPacks = packNameFilter
+        ? packs.filter((p) => p.packName === packNameFilter)
+        : packs;
+      const provisionBrowser = deps.createPackBrowser ?? createPackBrowser;
+      const bootProbe = deps.bootIfNeeded ?? bootIfNeeded;
+
+      let packBrowser = deps.packBrowser ?? null;
+      const cleanups = [];
+      try {
+        if (packBrowser === null && filteredPacks.length > 0 && !flags['no-browser']) {
+          packBrowser = await provisionBrowser({
+            projectRoot,
+            logger: (line) => { if (!flags.quiet) stderr.write(`${line}\n`); },
+          });
+          cleanups.push(async () => { try { await packBrowser.close(); } catch { /* fine */ } });
+        }
+
+        if (!flags['no-boot'] && filteredPacks.length > 0) {
+          const boot = pickBootFromPacks(filteredPacks);
+          if (boot) {
+            const bootOutcome = await bootProbe({
+              boot,
+              runtimeUrl,
+              projectRoot,
+              fetch: fetchFn,
+              browser: packBrowser,
+              logger: (line) => { if (!flags.quiet) stderr.write(`${line}\n`); },
+            });
+            for (const n of bootOutcome.notes) if (!flags.quiet) stderr.write(`[boot] ${n}\n`);
+            if (bootOutcome.started) {
+              cleanups.push(async () => { try { await bootOutcome.stop(); } catch { /* fine */ } });
+            }
+          }
+        }
+
+        record = await runAgentScreenshotCritique({
+          tree, fbs, runtimeUrl, runtimeProfile: profile,
+          browserDriver, fetch: fetchFn,
+          artefactDir: `.rcf/artefacts/${fbsId.toLowerCase()}`,
+          critiqueNotes: flags.notes,
+          probePacks: packs,
+          packBrowser,
+          packNameFilter,
+          projectRoot,
+          now,
+        });
+      } finally {
+        // LIFO cleanup: close browser before stopping the server so a
+        // page.close talking to a killed server never hangs the CLI.
+        while (cleanups.length > 0) {
+          const step = cleanups.pop();
+          try { await step(); } catch { /* fine */ }
+        }
+      }
     }
   } catch (err) {
     writeUnexpectedFailure(
@@ -203,6 +291,41 @@ export async function main(argv, deps = {}) {
   return record.verdict === 'pass' ? 0 : 4;
 }
 
+/**
+ * Read applied blueprints off the manifest as an array of
+ * `{ slug, absPath }` suitable for `loadProbePacks`.
+ *
+ * The applied-blueprint record carries a `source` field (see
+ * `src/blueprint/apply.js`). For a shelf apply the source is the
+ * shelf-relative slug; for a local-path apply it is an absolute
+ * path; for a library apply it is `<library>:<slug>`. We resolve
+ * to the shelf path shipped alongside the CLI package or, in the
+ * monorepo, the repo-root shelf. Missing directories are skipped
+ * without error (the CLI later checks discovered vs. requested).
+ */
+function readAppliedBlueprints({ manifest, projectRoot }) {
+  const list = Array.isArray(manifest?.blueprints) ? manifest.blueprints : [];
+  const out = [];
+  for (const entry of list) {
+    if (!entry || typeof entry.slug !== 'string' || entry.slug.length === 0) continue;
+    const absPath = resolveBlueprintAbsPath({ entry, projectRoot });
+    if (absPath) out.push({ slug: entry.slug, absPath });
+  }
+  return out;
+}
+
+function resolveBlueprintAbsPath({ entry, projectRoot }) {
+  const { slug, source } = entry;
+  if (typeof source === 'string' && source.length > 0) {
+    if (isAbsolute(source)) return source;
+    if (source.startsWith('./') || source.startsWith('../')) {
+      return resolve(projectRoot, source);
+    }
+  }
+  const cwd = resolve(projectRoot, 'blueprints', slug);
+  return cwd;
+}
+
 function defaultUrlForProfile(profile) {
   if (profile === 'ci') return 'http://127.0.0.1:3000';
   if (profile === 'deployed') return '';
@@ -227,5 +350,22 @@ function renderSummary({ stdout, record }) {
       stdout.write(`    [${c.verdict}] ${c.check} (status=${c.status ?? 'n/a'})${detail}\n`);
     }
   }
+  if (Array.isArray(record.probePacks) && record.probePacks.length > 0) {
+    stdout.write('  probe packs:\n');
+    for (const p of record.probePacks) {
+      if (p.applicable === false) {
+        stdout.write(`    [skip] ${p.packName} (${p.blueprintSlug}): ${p.detail ?? 'not applicable to this FBS'}\n`);
+        continue;
+      }
+      for (const pc of p.preChecks ?? []) {
+        const detail = pc.detail ? ` - ${pc.detail}` : '';
+        stdout.write(`    [${pc.verdict}] ${p.packName} pre-check ${pc.id}${detail}\n`);
+      }
+      for (const c of p.checks ?? []) {
+        const detail = c.detail ? ` - ${c.detail}` : '';
+        stdout.write(`    [${c.verdict}] ${p.packName} ${c.id}${detail}\n`);
+      }
+    }
+  }
   stdout.write(`  verdict: ${record.verdict}\n\n`);
 }

package/src/core/errors/index.js

@@ -42,6 +42,13 @@ const VALID_KINDS = new Set([
   // individually schema-clean) and from `brokenReference` (nothing
   // dangles; the graph is over-connected, not under-connected).
   'duplicateId',
+  // Visual round T-5 (spec section 5.5.1): a consumer blueprint whose
+  // requiresAppliedCapabilities gate refuses because no applied
+  // blueprint declares any of the required capabilities AND the CLI
+  // did not pass the allow-skip flag. The apply verb returns this kind
+  // with the spec-verbatim refusal message; the CLI translates it to
+  // exit 3 (not exit 2) with the message printed as-is on stderr.
+  'requiresAppliedCapabilities',
 ]);
 
 /**