rcf-lite 0.20.0 → 0.21.0

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-005.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-admin-console-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Audit-log surface conditional on the auditLog capability (via the applied logging companion), reading the delivered event stream",
+  "description": "When the auditLog capability is applied (through the observability-logging companion or a future dedicated audit blueprint), the console renders an audit-log route: an audit table listing every entry identified by data-audit-id and carrying actor, target, before, after, timestamp, and correlationId columns; per-actor filter chrome and per-target filter chrome; retention window per ADR-2204. Consumes application-datatable (T-1) for the table shell.",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round spec section 5.5, REQ 5 of the admin-console blueprint.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:05-audit"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-006.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-admin-console-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Access-denied and request-access states per WCAG 2.2 AA",
+  "description": "A principal without admin scope reaching an admin route renders an access-denied state under WCAG 2.4.6 Headings and Labels and 3.3.4 Error Prevention: a heading naming the denied action, an explanation of why access was refused, and a request-access control routed to a POST /api/request-access endpoint the applied notification blueprint delivers on. The request-access control is keyboard-reachable and announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3).",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round spec section 5.5, REQ 6 of the admin-console blueprint.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:06-access-denied"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2201-application-admin-console-shell.json

@@ -0,0 +1,40 @@
+{
+  "tacId": "TAC-2201-application-admin-console-shell",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Admin-console shell",
+  "purpose": "Owns the rendered admin-console surface: the top-level nav landmark, the surface-manifest read at load, the conditional rendering of every applied surface (users, roles, orgs, audit), the access-denied and request-access states, and the shared page layout every surface renders within. The shell is the base surface every AC in this blueprint anchors on.",
+  "responsibilities": [
+    "Read the applied capability sidecar (rcf/blueprints/application-admin-console.applied.json) at load and configure the surface set (AC-21101-1, AC-21107-1).",
+    "Render a single primary navigation landmark carrying an accessible name and rendering only applied surfaces (AC-21101-1, AC-21101-2).",
+    "Render the access-denied state for a non-admin principal reaching any admin route with a keyboard-reachable request-access control announcing its state (AC-21106-1).",
+    "Delegate the users, roles, orgs and audit surfaces to their respective TACs (TAC-2201 through TAC-2204)."
+  ],
+  "internalStructure": "One shell module that mounts the surface, reads the applied capabilities sidecar, and renders the nav landmark, the page-layout scaffolding, and the route-level containers for each conditional surface. The framework is not prescribed; the shell interfaces are what the project realises against React, Vue, Svelte or vanilla DOM.",
+  "interfaces": [
+    {
+      "name": "renderShell",
+      "kind": "factory",
+      "description": "renderShell({ capsSidecarUrl, surfaceRegistry, accessGuard }) -> { mount(rootElement), unmount() }. The project supplies the capsSidecarUrl (where the sidecar is served from), the surfaceRegistry (maps a capability string to a surface component), and the accessGuard (returns whether the current principal has admin scope)."
+    },
+    {
+      "name": "capabilitiesSidecar",
+      "kind": "shape",
+      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Capability discovery",
+      "kind": "tac",
+      "tacId": "TAC-2202-application-admin-console-capability-discovery",
+      "description": "The shell reads the surface-manifest through discovery."
+    }
+  ],
+  "tradeoffs": "The shell reads the sidecar file the apply verb writes; a runtime probe against manifest.blueprints[] would be more dynamic but ties the shell to the deploy-target having filesystem read access, which not every deploy target grants. The sidecar contract is deterministic and cacheable.",
+  "notes": "Known mechanism-reach gap: the shell contract cannot prove keyboard focus does not escape the surface in every frameworks rendering; project-side smoke tests supplement the pack. See README `Known mechanism-reach gaps`.",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2202-application-admin-console-capability-discovery.json

@@ -0,0 +1,44 @@
+{
+  "tacId": "TAC-2202-application-admin-console-capability-discovery",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Capability discovery",
+  "purpose": "Owns the apply-time reader that inspects every applied blueprints source blueprint.json for its capabilities[] declaration and composes the union as appliedCapabilities. Owns the write side that persists the discovered union plus elicit answers into rcf/blueprints/application-admin-console.applied.json. Runs at apply time (packages/rcf-lite/src/blueprint/capabilities.js); the shell reads the sidecar the runtime writes.",
+  "responsibilities": [
+    "Enumerate manifest.blueprints[] and read each applied blueprints source blueprint.json to extract its capabilities[] (AC-21107-1).",
+    "Compose the union of applied capabilities as a sorted string array (deterministic sidecar output).",
+    "Run the elicitation phase gated on the discovered capabilities: an elicit whose when.requiresCapability list has no overlap with the union does not prompt (AC-21109-2).",
+    "Write the sidecar file with appliedCapabilities[], appliedElicitations{}, allowNoAuthYet? and notes? (AC-21107-1)."
+  ],
+  "internalStructure": "Two helpers: discoverAppliedCapabilities(applied, projectRoot) reads and unions; writeSidecar({slug, version, appliedAt, appliedCapabilities, appliedElicitations, allowNoAuthYet?, notes?}) writes the file. Both live in packages/rcf-lite/src/blueprint/capabilities.js.",
+  "interfaces": [
+    {
+      "name": "discoverAppliedCapabilities",
+      "kind": "function",
+      "description": "Returns { union: string[], perSlug: Record<slug, string[]> }."
+    },
+    {
+      "name": "runElicitationPhase",
+      "kind": "function",
+      "description": "Applies each elicits[] entry against the discovered capability set and coerces answers per kind."
+    },
+    {
+      "name": "writeSidecar",
+      "kind": "function",
+      "description": "Writes rcf/blueprints/${slug}.applied.json."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Blueprint loader",
+      "kind": "external",
+      "description": "Reads each applied blueprints source blueprint.json."
+    }
+  ],
+  "tradeoffs": "Source read-back rather than a schema-carried appliedCapabilities field on the applied record: the rcf-schemas 0.6.0 appliedBlueprintRecord is closed under additionalProperties:false, so a new field cannot land without a schema minor bump. The sidecar decouples the mechanism from the schema release cycle. A future rcf-schemas minor may add appliedCapabilities directly on the applied record and this TAC would move the write there; the sidecar would remain a supported read path for backward compatibility.",
+  "notes": "Reads the applied recordss source string. When the source is a library-qualified ref (wsd:auth-oauth2), the source blueprint is not on this local tree and the reader returns an empty capabilities list; the applied record is skipped from the union.",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2203-application-admin-console-permission-matrix.json

@@ -0,0 +1,34 @@
+{
+  "tacId": "TAC-2203-application-admin-console-permission-matrix",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Permission matrix",
+  "purpose": "Owns the roles surface: renders the permission matrix as an ARIA APG grid (role=\"grid\" on the outer element, role=\"row\" on every rank, role=\"rowheader\" on the leftmost cell of each role rank, role=\"columnheader\" on every permission column header, role=\"gridcell\" on inner cells). Each cell announces its permission string on focus (WCAG 4.1.3).",
+  "responsibilities": [
+    "Render the ARIA APG grid pattern per WAI-ARIA Authoring Practices Guide (AC-21103-1).",
+    "Render the Owner + Admin + Member + Viewer baseline in the first four rank rows; elicited additional roles rendered after (AC-21103-2).",
+    "Announce every cells permission string plus allowed/denied state via aria-label on focus (AC-21103-1, WCAG 4.1.3)."
+  ],
+  "internalStructure": "One grid module: computes the matrix rank layout, renders the header rank and the role ranks, wires focus management for two-dimensional keyboard navigation, and drives aria-label from a permission catalogue map. Framework-agnostic per shell contract.",
+  "interfaces": [
+    {
+      "name": "renderMatrix",
+      "kind": "factory",
+      "description": "renderMatrix({ roles: RoleSpec[], permissions: PermissionSpec[], matrix: Record<roleId, Record<permissionId, boolean>> }) -> { mount(rootElement), unmount() }."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Admin-console shell",
+      "kind": "tac",
+      "tacId": "TAC-2201-application-admin-console-shell",
+      "description": "The matrix mounts inside the shell page-layout."
+    }
+  ],
+  "tradeoffs": "A grid pattern is more expensive to implement than a plain table but is the correct pattern for a keyboard-interactive matrix (per ARIA APG guidance). The pack asserts the pattern is present, not that every cell announces on focus perfectly in every framework: a project-side keyboard smoke complements the pack.",
+  "notes": "Consumes the datatable pattern-choice contract (ADR-1801, table vs grid per interactivity) at the shell edge, without namespacing conflicts because admin-console does not contribute an ADR on datatable pattern.",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2204-application-admin-console-audit-view.json

@@ -0,0 +1,40 @@
+{
+  "tacId": "TAC-2204-application-admin-console-audit-view",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Audit view",
+  "purpose": "Owns the audit-log surface: consumes the application-datatable shell (T-1) for filter chrome, pagination, four state regions and the row enumeration contract. Renders every audit entry with actor / target / before / after / timestamp / correlationId columns; the correlation id is the join key with the applied logging companion.",
+  "responsibilities": [
+    "Render every audit entry inside the datatable shell (AC-21105-1, AC-21105-2).",
+    "Enumerate every row by data-audit-id and expose every column via data-column (AC-21105-1).",
+    "Render per-actor and per-target filter chrome via the datatable query adapter (AC-21105-2)."
+  ],
+  "internalStructure": "A datatable adapter module: maps the audit event stream to the datatable columnsSpec, exposes the entry ids via data-audit-id, and threads the correlationId column through the datatable render.",
+  "interfaces": [
+    {
+      "name": "renderAuditView",
+      "kind": "factory",
+      "description": "renderAuditView({ eventStream, columns, retentionWindow }) -> { mount(rootElement), unmount() }."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Datatable shell",
+      "kind": "tac",
+      "tacId": "TAC-1801-application-datatable-shell",
+      "description": "Consumed for the table shell contract; the audit view supplies columnsSpec and queryAdapter and delegates the DOM to the datatable."
+    },
+    {
+      "name": "Admin-console shell",
+      "kind": "tac",
+      "tacId": "TAC-2201-application-admin-console-shell",
+      "description": "The audit view mounts inside the shell page-layout."
+    }
+  ],
+  "tradeoffs": "Consuming the datatable shell rather than reimplementing gets ARIA APG grid + WCAG state regions for free; it constrains the audit views UI to the datatable contract. A future audit-specific timeline view supersedes this TAC in its own realisation.",
+  "notes": "The retention window is elicited (ADR-2204); the surface itself is capability-gated on auditLog (from the applied logging companion).",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21101.json

@@ -0,0 +1,34 @@
+{
+  "usId": "application-admin-console-US-21101",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The console shell reads the applied capabilities at load and renders navigation only for surfaces that are gated on an applied capability",
+  "asA": "admin operator opening the console for the first time",
+  "iWant": "the console shell to inspect the applied capability set and render navigation only for surfaces whose gating capability is applied",
+  "soThat": "I do not click a link that leads to a surface the project cannot realise on the applied identity blueprint",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21101-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at deploy time) and, for each of principalDirectory, roleModel, tenancy, auditLog, renders a nav item ONLY when the capability is present in appliedCapabilities[]. A nav item that would route to a non-applied surface is neither rendered nor keyboard-reachable."
+    },
+    {
+      "id": "AC-21101-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shell has a single primary nav landmark (role=\"navigation\" or a nav element) with an accessible name naming the console."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21102.json

@@ -0,0 +1,34 @@
+{
+  "usId": "application-admin-console-US-21102",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Users surface lists principals when principalDirectory is applied, and renders access-denied for non-admin",
+  "asA": "admin operator managing user directory",
+  "iWant": "a users route that lists every principal identified by data-user-id with invite, deactivate, last-active and status columns when the applied auth blueprint declares principalDirectory; and an access-denied state with a request-access control for a principal without admin scope",
+  "soThat": "I can see and act on the identity set the applied auth blueprint provides, and non-admin users have a clear next step when they hit the console",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21102-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given an authenticated admin AND an applied auth blueprint declaring principalDirectory, the users table lists every principal with data-user-id on each row, a role column (only when roleModel is applied; else suppressed), a last-active timestamp, and a status column; a principal without admin scope reaching /admin renders an access-denied state with a \"request access\" control routing to POST /api/request-access. Probed by application-admin-console pack check AC-21102-1."
+    },
+    {
+      "id": "AC-21102-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Each row exposes an invite control for a principal without an active session (data-action=\"invite\") and a deactivate control for an active principal (data-action=\"deactivate\"); the controls are keyboard-reachable buttons."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21103.json

@@ -0,0 +1,34 @@
+{
+  "usId": "application-admin-console-US-21103",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Roles surface renders the permission matrix as an ARIA APG grid when roleModel is applied",
+  "asA": "admin operator reviewing role permissions",
+  "iWant": "the roles route to render Owner, Admin, Member, Viewer as rows and the permission catalogue as columns in a proper ARIA APG grid, each cell announcing its permission string on focus",
+  "soThat": "sighted, keyboard-only and screen-reader users all perceive the same permission model",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21103-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given the roles surface AND an applied auth blueprint declaring roleModel, the permission matrix renders as an ARIA APG grid: role=\"grid\" on the outer element, role=\"row\" on every rank (including the header rank), role=\"columnheader\" on every permission column header, role=\"rowheader\" on the leftmost cell of each role rank, role=\"gridcell\" on every inner cell, and each cell carries an aria-label announcing the exact permission string plus the allowed/denied state on focus (WCAG 4.1.3). Probed by pack check AC-21103-1."
+    },
+    {
+      "id": "AC-21103-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The baseline role set is Owner, Admin, Member, Viewer (ADR-2202); elicited additional roles rendered as extra rank rows, with the baseline four rendered first and additions after."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2203-application-admin-console-permission-matrix"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21104.json

@@ -0,0 +1,28 @@
+{
+  "usId": "application-admin-console-US-21104",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Orgs surface renders an org switcher and org-scoped invite only when tenancy is applied",
+  "asA": "admin operator on a multi-tenant project",
+  "iWant": "the shell to expose an org switcher and the users surface to expose an org-scoped invite when the applied blueprints declare the tenancy capability",
+  "soThat": "the console lets me operate on one org at a time without mixing directories across tenants",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21104-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given an applied blueprint declaring tenancy, the shell renders an org switcher control (data-role=\"org-switcher\") on the console header; the users invite path renders an org selector. When tenancy is not applied, neither control is rendered nor reachable. Probed by pack check AC-21104-1."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21105.json

@@ -0,0 +1,34 @@
+{
+  "usId": "application-admin-console-US-21105",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Audit-log surface renders the audit stream with correlation id when auditLog is applied",
+  "asA": "admin operator reviewing change history",
+  "iWant": "an audit-log route that lists every entry identified by data-audit-id with actor, target, before, after, timestamp and correlationId columns when the applied logging companion emits an audit stream",
+  "soThat": "I can trace a specific change through the logging pipelines correlation record",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21105-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given a role change AND the auditLog capability applied (via observability-logging or a dedicated audit blueprint), an audit-log entry writes with actor, target, before, after, timestamp, and correlationId from the logging companion; the entry surfaces on the audit view table where every row is enumerable by data-audit-id and every cell exposes its column via a data-column attribute. Probed by pack check AC-21105-1."
+    },
+    {
+      "id": "AC-21105-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The audit view consumes the application-datatable shell (TAC-2204 depends on TAC-1801-application-datatable-shell), so filter chrome, pagination and the four state regions inherit from the datatable contract."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2204-application-admin-console-audit-view"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21106.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21106",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Access-denied state renders a keyboard-reachable request-access control",
+  "asA": "a non-admin user routed to an admin URL",
+  "iWant": "a clearly-labelled access-denied state naming why access was refused and a keyboard-reachable request-access control",
+  "soThat": "I can request access without leaving the app or contacting an admin out of band",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21106-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "A non-admin principal reaching /admin renders a role=\"region\" with an accessible name naming the denied action (WCAG 2.4.6), a paragraph explaining why access was refused (WCAG 3.3.4), and a request-access control (data-action=\"request-access\") routed to POST /api/request-access. The control announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3)."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21107.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21107",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Console shell surfaces are self-configured from the applied capability sidecar at deploy time, not from client-side inference",
+  "asA": "admin operator opening the console the same way in every deploy environment",
+  "iWant": "the shell to read the applied capability set from a deterministic sidecar file, not to infer from a client-side probe",
+  "soThat": "a preview build renders the same nav a production build renders on the same commit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21107-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at build time) as a build asset served under a stable path (e.g. /admin/caps.json); the shell never runs a runtime probe against manifest.blueprints[] over the network. The sidecar payload keys are appliedCapabilities[], appliedElicitations{} and allowNoAuthYet? per the mechanism spec."
+    }
+  ],
+  "tacIds": [
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21108.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21108",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The console does not declare providesRoles per spec 5.5.3; the mechanism composes at the capability edge instead",
+  "asA": "shelf author reasoning about future admin-console-shaped blueprints",
+  "iWant": "admin-console v1.0.0 to not declare providesRoles[]; composition with a second admin-console-shaped blueprint happens via capabilities[] and the crossBlueprintOwnership conflict path",
+  "soThat": "a specialised console (a vertical admin-console) declares its own capabilities[] and the mechanism reasons about the composition through one grammar, not two",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21108-1",
+      "testable": true,
+      "scope": "library",
+      "description": "blueprint.json does not declare providesRoles (per spec 5.5.3); the loader is happy (providesRoles is optional). A future admin-console-shaped blueprint composes via capabilities[] and the crossBlueprintOwnership conflict on the same slug family, not via providesRoles[]."
+    }
+  ],
+  "tacIds": [
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21109.json

@@ -0,0 +1,33 @@
+{
+  "usId": "application-admin-console-US-21109",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Console apply refuses on a bare SPA with the spec 5.5.1 message and honours --allow-no-auth-yet",
+  "asA": "operator applying the admin-console on a project with no auth blueprint yet",
+  "iWant": "the apply to refuse with exit 3 and a message naming security-auth-* explicitly, or to accept an --allow-no-auth-yet override that records a scaffolding-note on the sidecar",
+  "soThat": "a scaffolding pass can land the console files without hiding the fact that the surfaces will refuse at runtime until an auth blueprint is applied",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21109-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "rcf define blueprint add ./blueprints/application-admin-console on a project with no applied blueprint declaring principalDirectory (and without --allow-no-auth-yet) exits 3; the stderr message begins with \"application-admin-console requires at least one applied security-auth-*\", lists the currently-applied blueprints on the project, and prints the \"Suggested next steps\" block including the four shelf auth slugs. No contribution files are written; the sidecar is not created."
+    },
+    {
+      "id": "AC-21109-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "With --allow-no-auth-yet passed, the apply proceeds and writes rcf/blueprints/application-admin-console.applied.json with allowNoAuthYet:true and a notes string naming the \"no auth yet\" state; a later rcf define validate reads the sidecar and flags the ungated surfaces."
+    }
+  ],
+  "tacIds": [
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/docs/topics.md

@@ -0,0 +1,35 @@
+# application-admin-console: coordination vocabulary
+
+## Global topics
+
+The blueprint claims no new global topics at v1.0.0. The console is a consumer of the identity capability set the applied auth blueprints declare through `capabilities[]`; every ADR (capability vocabulary, baseline roles, invite transport, audit retention) is non-global.
+
+## Deliberately unclaimed topics
+
+- `roleModel` (the shape of a role catalogue: id/label/permission tuples). Reserved for the applied auth blueprint's ADR set; the console reads the applied `roleModel` label vocabulary through the elicited `baseline-roles` answer and does not mint its own role-model global topic.
+- `principalDirectory` (the shape of a principal record). Reserved for the applied auth blueprint's ADR set for the same reason.
+- `tenancy` (the shape of an organisation abstraction). Reserved for a future `application-tenancy-orgs` blueprint (spec section 11).
+- `auditLog` (the audit event stream shape). Reserved for the applied logging companion's ADR set, or a future dedicated audit-log blueprint.
+
+## Shelf id band and suffix block
+
+| Blueprint | US band | ADR/TAC suffix block | Status | Global topics |
+|---|---|---|---|---|
+| application-datatable | 17101-17899 | 18xx | shipped v1.0.0 | none |
+| application-charts | 18101-18899 | 19xx | shipped v1.0.0 | none |
+| application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
+| application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
+| application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+
+The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 5.
+
+## Probe pack
+
+`probe-packs/application-admin-console.pack.mjs` ships four capability-gated checks anchored to blueprint AC ids:
+
+- `AC-21102-1` users directory (fires only when `principalDirectory` is applied)
+- `AC-21103-1` permission matrix (fires only when `roleModel` is applied)
+- `AC-21104-1` org switcher (fires only when `tenancy` is applied)
+- `AC-21105-1` audit-log surface (fires only when `auditLog` is applied)
+
+The pack applies to any FBS binding `TAC-2201-application-admin-console-shell` or whose navModel routes name an admin path. See `packages/rcf-lite/docs/blueprint-authoring.md` section 8c for the pack authoring rules.

package/blueprints/application-admin-console/guide/application-admin-console.md

@@ -0,0 +1,29 @@
+# application-admin-console: operator guide
+
+## When to reach for it
+
+Your project applies at least one shelf `security-auth-*` blueprint (or a custom identity source declaring `principalDirectory` via the elicitation phase). You need an admin console that identifies principals, manages roles, and reads a change history. You want the console to configure itself from the applied capability set rather than demand configuration.
+
+## When NOT to reach for it
+
+You are shipping a fully-featured, opinionated admin product (Retool, an internal admin CMS, a bespoke ops console). Adopt this blueprint only when a vendor-neutral shell composed from the applied identity blueprint suits your project better than a fixed opinionated console.
+
+You want an anonymous product (no principal directory, no roles). The blueprint refuses at apply on a bare SPA; `--allow-no-auth-yet` accepts the refusal for a scaffolding pass but the surfaces will not activate until an identity capability is applied.
+
+## What stays your call
+
+- Which shelf auth blueprint you apply first (or whether you supply custom auth via the elicitation phase).
+- The elicited additional role labels beyond Owner + Admin + Member + Viewer.
+- The invite transport (email, in-app-only, or custom).
+- The tenancy shape (per-user, per-org, or both) if you apply a tenancy blueprint.
+- The audit-log retention window (default 90 days).
+
+## Mechanism-reach gaps
+
+The blueprint's README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack; the shipped v1.0.0 pack anchors the four load-bearing surface checks. Combine with the T-1 datatable pack to reach the users and audit shells' state-region contract.
+
+## Promotion signals
+
+- The role catalogue label vocabulary drifts across three or more applied auth blueprints: candidate for a `roleModel` global topic in a v1.1.0 minor.
+- The tenancy shape needs a real shelf provider: candidate for the `application-tenancy-orgs` blueprint (spec section 11).
+- A dedicated audit-log blueprint ships: candidate for the console to consume it directly via `capabilities: ["auditLog"]` rather than through the logging companion.