rcf-lite 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -6,6 +6,45 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.22.0] - 2026-09-07
+
+rcf-lite 0.22.0 fills the visual shelf with five application blueprints (empty and error states, file upload with a WCAG keyboard gate, a multi-step forms wizard, a self-service account settings area, and a first-run onboarding tour). Account settings reuses the admin-console capability-gating mechanism, so the five settings surfaces only render when the applied auth blueprint declares the capability. The four shipped auth blueprints and the logging blueprint pick up additive capability declarations in the same release.
+
+Also present on the shelf at this version, ahead of their own 0.23.0 release notes: `persistence-data-postgres` 1.0.0, `object-storage-s3` 1.0.0, and the `security-secrets-management` 1.0.1 minor.
+
+### Added
+
+- **Visual round 4 T-1: `application-empty-error-states` v1.0.0 on the shelf (PR #154).** Ships the eight-state contract (not-found, forbidden, server-error, offline, permission-denied, empty-list, no-search-results, error-boundary), one Playwright probe pack with eight surface-observable checks, three TACs, three ADRs, an RFC 9110 status contract, WCAG 2.2 AA compliance, and the offline write-buffer contract for reconnection.
+- **Visual round 4 T-2: `application-file-upload` v1.0.0 on the shelf (PR #156).** Ships the WCAG 2.5.7 keyboard-alternative gate, a chunked and resumable transport contract, MIME-type, size and virus-scan refusal, tus.io as the elicited alternative transport, four pack checks, and four break switches. Informational: shortened ADR id suffixes on file-upload; elicits declared via ADR entry flags on non-capability blueprints; tus fail-message ordering.
+- **Visual round 4 T-3: `application-forms-wizard` v1.0.0 on the shelf (PR #158).** Ships the GOV.UK task-list and summary-list patterns, per-step validation timing, an error-summary with skip-links, and a save-and-return contract that refuses to ship a default because the draft-store transport is elicited.
+- **Visual round 4 T-4: `application-account-settings` v1.0.0 on the shelf (PR #160).** Ships the five conditional surfaces (profile, security, sessions, notification preferences, theme), reusing the admin-console capability-gating mechanism, a bare-SPA refusal with the `--allow-no-auth-yet` override, a hosted-UI bridge, and five pack checks. Informational: the theme check reads the attribute only.
+- **Visual round 4 T-4 auth minors, in the same PR (PR #160).** `security-auth-clerk` 1.3.0, `security-auth-keycloak` 1.2.0, `security-auth-oauth2` 1.2.0, `security-auth-magic-link` 1.2.0 and `observability-logging` 1.2.0. Additive `capabilities[]` declarations for `credentialSelfService`, `sessionInventory` and `hostedIdentityUi` per vendor and provider; the settings blueprint discovers the applied capability set at apply time and only offers the surfaces the applied auth supports.
+- **Visual round 4 T-5: `application-onboarding-tour` v1.0.0 on the shelf (PR #161).** Ships an ARIA APG dialog-modal tooltip-as-dialog, keyboard-only Escape and focus-return contract, a checklist-on-dashboard collapse-to-settings fallback, completion-state persistence with per-principal or local-storage layers, and four pack checks.
+
+
+## [0.21.0] - 2026-09-05
+
+rcf-lite 0.21.0 adds five visual-feature blueprints to the shelf (data table, charts, dashboard with packaged design guidance, in-app notifications, admin console) and the mechanism that proves them: a blueprint can now ship a Playwright probe pack that rcf verify runs against your running app in a real browser, and the ship gate refuses while a surface check fails. The admin console only offers the surfaces your applied auth blueprint can support. Blueprints can now ask you questions at apply time. The schema floor moves to rcf-schemas 0.6.1.
+
+
+### Added
+
+- **Visual round T-5: capability-declaration mechanism and application-admin-console v1.0.0 blueprint on the shelf (spec 2026-09-04 sections 5.5, 5.5.1, 5.5.2, w-2026-09-04-dave-015).** Introduces the capability-declaration mechanism as three additive optional top-level fields on `blueprint.json`: `capabilities[]` (a non-empty array of lower camelCase strings on `^[a-z][a-zA-Z0-9]*$`, matching the section 6a role naming convention; an identity blueprint declares what it provides), `elicits[]` (each entry `{id (kebab), prompt (no em-dash, no emoji), kind (enum|string|boolean), default?, options? (for kind=enum), when? (predicate on applied capabilities)}` for apply-time answers), and `requiresAppliedCapabilities` (`{capabilities (non-empty camelCase array), allowSkipFlag (kebab CLI flag name), refusalMessageId (string mapping to a bundled message template)}`). Loader validates shape only; the vocabulary lives in `packages/rcf-lite/docs/blueprint-authoring.md` section 6a as a chunk-zero-style table (`principalDirectory`, `roleModel`, `tenancy`, `auditLog`), extended alongside the roles registry. The apply verb discovers applied capabilities via source read-back on `manifest.blueprints[].source` (the applied-blueprint-record schema in rcf-schemas is closed under `additionalProperties:false`; the T-2 core-companions gate's source-read-back precedent applies here); the discovered union is persisted, together with `appliedElicitations` and (when overridden) `allowNoAuthYet` plus a `notes` string, into a per-project sidecar file at `rcf/blueprints/${slug}.applied.json`. The refusal gate returns a new `requiresAppliedCapabilities` rcfError kind; the CLI translates it to exit 3 with the spec 5.5.1 verbatim message printed on stderr (no `[error]` prefix), naming `security-auth-*` explicitly. New CLI flags: `--allow-no-auth-yet` (boolean override for the refusal), `--answer <id>=<value>` (repeatable), `--answers <file>` (JSON object bag). The pack runner extension threads `projectRoot` through the check context so a shipped pack check may declare its own `appliesTo({ projectRoot })` predicate that reads the sidecar; an absent required capability records `applicable: false` on the check record and the aggregate verdict treats it as neither pass nor fail (T-5 refinement of the section 3.3 residual cure). The four shelf auth blueprints adopt `capabilities[]` in v1.1.0/v1.2.0 minor bumps landing in the same PR per spec Q2 default: `security-auth-magic-link` 1.0.0 -> 1.1.0 `[principalDirectory]` (no `roleModel`; that is Baz's explicit example, so a bare-magic-link project gets no roles surface), `security-auth-clerk` 1.1.0 -> 1.2.0 `[principalDirectory, roleModel]`, `security-auth-oauth2` 1.0.0 -> 1.1.0 `[principalDirectory, roleModel]`, `security-auth-keycloak` 1.0.0 -> 1.1.0 `[principalDirectory, roleModel]`. Each ships a fresh `CHANGELOG.md` entry naming the capabilities and citing spec section 5.5.2. Ships `blueprints/application-admin-console/` v1.0.0 with 23 contributions (six REQs on the console shell with no dead links to unapplied capabilities, users conditional on `principalDirectory`, roles conditional on `roleModel` with the Owner + Admin + Member + Viewer baseline, orgs conditional on `tenancy`, audit-log conditional on `auditLog`, and the access-denied and request-access states per WCAG; nine USs 21101-21109 binding sixteen runtime-observable ACs plus the conditional-refusal apply-time behaviour; four TACs 2201-2204 on the console shell, the apply-time capability discovery, the permission matrix as an ARIA APG grid, and the audit view consuming `application-datatable`; four ADRs 2201-2204 on the capability vocabulary, Owner + Admin + Member + Viewer baseline with elicited additions, invite transport with email default delegated to the email sibling and elicited, and audit-log retention window elicited). The blueprint declares `requiresAppliedCapabilities: {capabilities: ["principalDirectory"], allowSkipFlag: "allow-no-auth-yet", refusalMessageId: "application-admin-console-bare-spa"}`, four elicits (`baseline-roles` when `roleModel`, `tenancy-shape` when `tenancy`, `invite-transport` always, `audit-retention-days` when `auditLog`), and `suggestedCompanions` `logging` and `errorHandling` with the ratified spec's reasons; `providesRoles` is absent per spec 5.5.3 (the console is a consumer of `principalDirectory`, never a provider). Ships `probe-packs/application-admin-console.pack.mjs` with four capability-gated checks anchored to blueprint AC ids, every check carrying its own `appliesTo({ projectRoot })` predicate reading the applied sidecar so an absent capability records `applicable: false`: `AC-21102-1` users directory when `principalDirectory` is applied (verifies the `[data-surface="users"]` region enumerates users by `data-user-id`, the role column suppresses when `roleModel` is not applied, and the access-denied route renders a `[data-action="request-access"]` control), `AC-21103-1` permission matrix when `roleModel` is applied (verifies the outer element carries `role="grid"`, ranks carry `role="row"`, permission columns carry `role="columnheader"`, role rank leftmost cells carry `role="rowheader"`, inner cells carry `role="gridcell"`, and every cell announces the exact permission string via `aria-label` on focus per WCAG 4.1.3), `AC-21104-1` org switcher when `tenancy` is applied (verifies the `[data-role="org-switcher"]` control on the shell header), `AC-21105-1` audit-log when `auditLog` is applied (verifies every audit row is enumerable by `data-audit-id` and carries `actor / target / before / after / timestamp / correlationId` columns). Pack-level `appliesTo` names BOTH `tacIds` AND `route` (the two legal source-scan seams). Fifth blueprint on the shelf that ships a Playwright probe pack under the T-0 runner extension; consumes `application-datatable` (T-1) for the users and audit surfaces. Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/` with `PORT` env (default 3000), `ADMIN_CONSOLE_CAPS` env or `?caps=` query switch selecting which surfaces exist, `?asAdmin=false` to simulate a non-admin principal on the access-denied route, break switches for the negative runs (`?break=matrix-grid` drops `role="grid"` on the matrix, `?break=denied` drops the request-access control, `?break=audit-fields` drops the `correlationId` column), and `window.__adminFetches` plus `/__requests` mirroring every request. The fixture ships its own `README.md` naming PORT, `ADMIN_CONSOLE_CAPS`, every `?caps=` combination, every break switch, and the two-line manual boot for the gate reviewer per the T-1 gate discipline. Every runtime-observable AC that is not bound to a pack check appears in the blueprint README's "Known mechanism-reach gaps" section individually per the T-1 gate discipline (`blueprint-authoring-checklist.md` section 6.g): AC-21101-2 primary nav landmark shape, AC-21102-2 per-row invite / deactivate control shape, AC-21103-2 elicited additional roles rank order, AC-21105-2 datatable shell consumption on the audit view, AC-21106-1 wider WCAG structure on the access-denied region, AC-21107-1 client-side sidecar fetch, AC-21108-1 `providesRoles` absent (chain-scope, probed by anatomy tests), AC-21109-1 and AC-21109-2 apply-time refusal and override (CLI-scope, probed by mechanism unit tests). Blueprint-authoring section 6a's capability vocabulary table extends the roles registry chunk-zero-style; the shelf band table gains an `application-admin-console` row (21101-21899 / 22xx / none) in `packages/rcf-lite/docs/blueprint-authoring.md` section 5 and every applying blueprint's `docs/topics.md`. Pins `@stravica-ai/rcf-schemas` 0.6.0 -> 0.6.1 in `packages/rcf-lite/package.json` in its own commit (the 0.6.1 minor adds the additive optional `browserVerificationRecord.probePacks[]` field that lets a non-dry-run `rcf verify browser --probe-pack <slug>` persist the pack results into the manifest, per visual round spec section 3.4 and the T-4 gate P1 hand-off). Repo chain extended with REQ-022 (mechanism) / REQ-023 (admin-console shelf ship) / US-2201 / US-2301 / TS-051 / TS-052 / FBS-041 / FBS-042 / CN-128..133, covered by `test/blueprint/capabilities-loader.test.js`, `test/blueprint/capabilities-apply.test.js`, `test/blueprint/capabilities-auth-minors.test.js` and `test/blueprint/application-admin-console-anatomy.test.js` (16 new tests, all passing on Node 24.14.0). Trace: `projects/blueprint-library/specs/visual-round-spec-2026-09-04.md` sections 5.5, 5.5.1, 5.5.2, 5.5.3, section 6.1, section 9 (T-5 rows).
+
+- **Visual round T-4: application-notifications-in-app v1.0.0 blueprint on the shelf with its Playwright probe pack, sample-app fixture and the family-prefix reservation for sibling channels (spec 2026-09-04 section 5.4, w-2026-09-04-dave-014).** The rcf-lite shelf ships `blueprints/application-notifications-in-app/` with 19 contributions (five REQs covering live-region preseeding on every declared route, transient toast contract with priority-to-role mapping and one-shot announcement, notification centre inbox with retention and acknowledge round-trip, per-user preferences UI with category silence and sibling delegation, and delivery-attempt log with operator-readable rows; eight USs binding runtime-observable ACs plus three cross-cutting cases (page load with backlog, background event, disjoint-content contract); three TACs on the live-region wrappers with the toast factory, the centre inbox with retention and acknowledge round-trip, and the preferences UI with sibling delegation; three ADRs on the priority-to-role mapping polite/status vs assertive/alert per WCAG 4.1.3 and the ARIA APG alert pattern, the six-second toast timeout floor per WCAG 2.2.1 Timing Adjustable with elicited overrides above the floor, and the thirty-day centre retention window with elicited overrides). The blueprint suggests the `logging` (delivery-log write path, acknowledge round-trip record) and `errorHandling` (assertive-slot alert internal error record) companions with the ratified spec's reasons; `providesRoles` is absent (leaf blueprint per spec; the loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). No new global topics are claimed. Reserves the `application-notifications-` family prefix as a name-only doc reservation (per spec Q3 default) for the sibling in-app-adjacent channels the shelf will grow into (`-email`, `-push`, `-webhook`); the reservation is documented as a paragraph in the blueprint README and as reserved rows in the blueprint's own `docs/topics.md` registry (bands claimed at ship, not predicted). The shipped `probe-packs/application-notifications-in-app.pack.mjs` ships three browser-verify checks anchored to blueprint AC ids, every check carrying a `description` field per spec section 9: `AC-20101-1` live-region preseeded on every declared route (both `[data-live-region="polite"]` with `aria-live="polite"` and `[data-live-region="assertive"]` with `role="alert"` present AND empty in the DOM at page load, enumerated by the per-element `[data-live-region]` attribute per the T-3 gate discipline); the AC-20101-1 description carries the word `preseeded` per spec section 9 T-4 row. `AC-20102-1` transient toast contract with priority-to-role mapping (info to polite/status, error to assertive/alert per ADR-2101), one-shot announcement (disjoint-content across the two wrappers), and timeout measured against the ADR-2102 six-second floor via `data-shown-at`/`data-dismissed-at` timestamps on the toast element (bounded polling, no six-second sleep in the pack). `AC-20103-1` centre acknowledge round-trip enumerated by `data-notification-id` (per-element attribute per T-3 gate discipline, never by `role="listitem"` on the container alone); a Tab-reachable acknowledge control POSTs `POST /api/notifications/acknowledge`, the server responds 2xx, and the item's `data-acknowledged` flips to `true` on the response; reconciled through both `window.__notificationFetches` (client-side) and `GET /__requests` (server-side). The pack's `appliesTo` predicate scopes to any FBS binding `TAC-2101-application-notifications-in-app-live-region` or whose nav model routes name a notifications-centre path, referencing BOTH `tacIds` AND `route` as the two legal source-scan seams. Fourth blueprint on the shelf that ships a Playwright probe pack under the T-0 runner extension; consumes the T-3 pack-browser `resize(width, height)` seam only for future minor bumps (v1.0.0 does not exercise breakpoint reflow in the pack). Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app/` (one Node HTTP server rendering the main application shell, the notification centre inbox with a seeded backlog of three notifications inside the retention window, and the preferences UI with per-category silence toggles and disabled sibling-channel digest sections). PORT env var (default 3000). Four break switches for the negative runs: `?break=preseed` (wrappers inserted lazily after the first event, fails AC-20101-1); `?break=role` (error toast rendered as status in polite wrapper, info toast rendered as alert in assertive wrapper, fails AC-20102-1); `?break=timeout` (toast dismissed after two seconds and shell root advertises `data-toast-timeout-floor-seconds="2"`, fails AC-20102-1); `?break=ack` (acknowledge click handler is a no-op, no POST and no DOM update, fails AC-20103-1). The fixture ships its own `README.md` naming PORT, every query switch and break switch, and the two-line manual boot for the gate reviewer per the T-1 gate discipline. The shelf band registry row for `application-notifications-in-app` (20101-20899 / 21xx / none) is appended to every existing blueprint's `docs/topics.md` at ship and to the central `packages/rcf-lite/docs/blueprint-authoring.md` shelf-wide band registry; the T-5 `application-admin-console` slot at 21101-21899 / 22xx sits next above per the ratified spec. Every runtime-observable AC that is not bound to a pack check appears in the blueprint README's "Known mechanism-reach gaps" section individually per the T-1 gate discipline (`blueprint-authoring-checklist.md` section 6.g): AC-20101-2 factory identity across route changes; AC-20102-2 toast factory library shape; AC-20103-2 centre factory library shape; AC-20104-1 preferences category silence round-trip; AC-20104-2 sibling-channel disabled state lift when a sibling ships; AC-20105-1 delivery-log endpoint shape; AC-20105-2 delivery-log companion-boundary; AC-20106-1 page-load-with-backlog polite-queue count; AC-20107-1 background-vs-operator toast indistinguishable; AC-20108-1 continuous disjoint-content assertion. Repo chain extended with REQ-021 / US-2101 / AC-2101-1..6 / TS-050 / FBS-040 / CN-124..127, covered by `test/blueprint/application-notifications-in-app-anatomy.test.js`. Trace: `projects/blueprint-library/specs/visual-round-spec-2026-09-04.md` section 5.4, section 6.1, section 9 (T-4 rows). Independent track (T-4 does not depend on the earlier tracks beyond T-0); admin-console T-5 depends on datatable but not on this track.
+
+- **Visual round T-3: application-dashboard v1.0.0 blueprint on the shelf with its packaged design-guidance asset, Playwright probe pack, and pack-browser resize seam extension (spec 2026-09-04 section 5.3, w-2026-09-04-dave-012).** The rcf-lite shelf ships `blueprints/application-dashboard/` with 18 contributions (five REQs covering shell composition, primary-KPI visual hierarchy on the F-scan, per-tile four-state contract, timeframe and filter chrome refetch fan-out, and export handle with format delegation to charts; seven USs binding runtime-observable ACs plus one on packaged-guidance adherence; three TACs on the tile grid with CSS Grid position semantics and breakpoint reflow, the timeframe picker and filter chrome with the refetch fan-out contract, and the export handle with delegation to the charts render shell; three ADRs on the primary-KPI kinds enum with elicited overrides, timeframe presets with recommendedDefault and auto-refresh off by default, and export formats with recommendedDefault and PNG delegation to the charts render shell). The blueprint suggests the `logging` and `errorHandling` companions with the ratified spec's reasons; `providesRoles` is absent (leaf blueprint per spec; the loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). No new global topics are claimed. Ships `assets/guidance/dashboard-design.md`: eight sections (primary KPI placement; tile density and count limits; timeframe and filter chrome; loading, empty and error states; colour and contrast; when a table beats a chart, delegating to application-datatable; refresh cadence and staleness; anti-patterns) with five `https://` citations from the five named source families (NN/g dashboard design, Few, Tufte, GOV.UK Design System patterns, WCAG 2.2 Understanding docs). Each section names whether the rule hardens into an AC on this blueprint or stays operator guidance. The shipped `probe-packs/application-dashboard.pack.mjs` ships three browser-verify checks anchored to blueprint AC ids, every check carrying a `description` field per spec section 9: `AC-19102-1` primary-KPI position by DOM order and CSS Grid position at 1440, 1024 and 360 (drives the new pack-browser `resize(width, height)` seam to each width); `AC-19104-1` timeframe refetch fan-out (every fetch carries the same `from`/`to`/`preset` trio; every tile's `data-as-of` matches the shell root in ISO-8601 form; request log read from `window.__dashboardFetches` and reconciled against `GET /__requests`); `AC-19103-1` per-tile four-state contract (`role="region"`, `aria-live="polite"`, `data-tile-state`, non-colour distinction across loading / empty / error / populated). The pack's `appliesTo` predicate scopes to any FBS binding `TAC-2001-application-dashboard-tile-grid` or whose nav model routes name a dashboard path. Third blueprint on the shelf that ships a Playwright probe pack under T-0's runner extension. Consumes application-charts through the shared render shell (the dashboard's chart region reuses the charts sample-app markup shape); references application-datatable in the packaged guidance's when-a-table-beats-a-chart section. Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-dashboard/` (one Node HTTP server rendering the five shell regions, a primary-KPI-top-left tile grid with three supporting tiles, a paired chart region, filter chrome, timeframe preset buttons and an export handle listbox). PORT env var (default 3000). Break switches: `?break=kpi-position` (moves the primary tile off top-left, fails AC-19102-1), `?break=fanout` (drifts every second refetch's boundary, fails AC-19104-1), `?break=state-aria` (drops `role="region"` and `aria-live` from tile wrappers, fails AC-19103-1). State pinning through `?tile=<id>&state=<state>`. Request log on `window.__dashboardFetches` and at `GET /__requests`. The fixture ships its own `README.md` naming PORT, every query switch and break switch, and the two-line manual boot for the gate reviewer. Extends the pack-browser seam (`packages/rcf-lite/src/browser-verify/pack-browser.js`) with a `resize(width, height)` method exposed to probe pack authors on both routes: on the MCP route the method calls the pinned Playwright MCP's `browser_resize` tool; on the project route it calls `page.setViewportSize({ width, height })`. Zero new npm dependencies. Both routes coerce arguments through a shared `normaliseDim` helper covered by paired unit tests. The extension is in its own commit; the T-4 notifications-in-app and T-5 admin-console blueprints reuse the seam. Also fixes a T-2 gate follow-up in the charts pack: the three `browser.goto` call sites in `blueprints/application-charts/probe-packs/application-charts.pack.mjs` now navigate with `new URL('', runtimeUrl).toString()` instead of `runtimeUrl + '/'`, so a reviewer CLI `--url` that carries `?break=<mode>` verbatim survives the navigation (charts stays at v1.0.0 with a patch-note entry in its own CHANGELOG). The shelf band registry row for `application-dashboard` (19101-19899 / 20xx / none) is appended to every existing blueprint's `docs/topics.md` at ship and to the central `packages/rcf-lite/docs/blueprint-authoring.md` shelf-wide band registry. Repo chain extended with REQ-020 / US-2001 / AC-2001-1..7 / TS-049 / FBS-039 / CN-119..123, covered by `test/blueprint/application-dashboard-anatomy.test.js` and `test/browser-verify/pack-browser-resize.test.js`. Trace: `projects/blueprint-library/specs/visual-round-spec-2026-09-04.md` section 5.3, section 5.3.1 (packaged guidance shape), section 6.1, section 9 (T-3 rows). Unblocks tracks T-4 (notifications-in-app) and T-5 (admin-console, which composes on datatable, on the dashboard's tile-grid pattern and on the resize seam for its own breakpoint-scoped visual ACs).
+
+- **Visual round T-2: application-charts v1.0.0 blueprint on the shelf with its Playwright probe pack (spec 2026-09-04 section 5.2, w-2026-09-04-dave-013).** The rcf-lite shelf ships `blueprints/application-charts/` with 15 contributions (four REQs covering the chart form set, non-colour distinction, text-alternative table, and keyboard traversal for interactive charts; six USs binding runtime-observable ACs; two TACs for the render shell and the keyboard traversal contract; three ADRs for the elicited chart engine with the canvas-only-no-text-alternative refusal rule, the accessible-defaults categorical palette light and dark, and reduced-motion respect via the application-spa motion tokens). The blueprint suggests the `logging` and `errorHandling` companions with the ratified spec's reasons; `providesRoles` is absent (leaf blueprint per spec). No new global topics are claimed. The shipped `probe-packs/application-charts.pack.mjs` ships three browser-verify checks anchored to blueprint AC ids, every check carrying a `description` field per spec section 9: `AC-18102-1` non-colour distinction (every series carries a non-colour cue such as `data-pattern`, `stroke-dasharray`, hatched fill or marker shape PLUS a direct label at the series), `AC-18103-1` text-alternative table (a `<table>` in the same landmark as the chart, cell-per-value, focus-reachable through a labelled control), `AC-18104-1` keyboard traversal (every data point tab-focusable with the announced string `<seriesName>, <xValue>, <yValue> <unit>` on focus, and `prefers-reduced-motion: reduce` suppresses transitions). The pack's `appliesTo` predicate scopes to any FBS binding `TAC-1901-application-charts-render-shell` or whose nav model routes name a chart or dashboard path. Second blueprint on the shelf that ships a Playwright probe pack under T-0's runner extension; leaf blueprint the T-3 application-dashboard build consumes. Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-charts/` (one Node HTTP server rendering a two-series bar chart and a two-series line chart with paired text-alternative tables, focus-reachable data points announcing the format, and a reduced-motion media rule), driven by the shipped `start` script on `PORT` (default 3000). Three `?break=<mode>` query switches drive the negative runs: `?break=table` drops the text-alternative table (fails AC-18103-1), `?break=pattern` drops the data-pattern attributes (fails AC-18102-1), `?break=keyboard` drops tabindex and aria-label on data points (fails AC-18104-1). The fixture ships its own `README.md` naming PORT, every query switch and break switch, and the two-line manual boot for the gate reviewer (visual round T-2 discipline carried from the T-1 gate). The shelf band registry row for `application-charts` (18101-18899 / 19xx / none) is appended to every existing blueprint's `docs/topics.md` at ship and to the central `packages/rcf-lite/docs/blueprint-authoring.md` shelf-wide band registry. Vision-deficiency emulation is a runner-seam gap today (`emulateVisionDeficiency` is not on the pack browser API); AC-18102-1 is proven at the DOM level per the T-1 gate discipline, and the blueprint's `README.md` names it and the other mechanism-reach gaps individually (checklist 6.g). Repo chain extended with REQ-019 / US-1901 / AC-1901-1..5 / TS-048 / FBS-038 / CN-116..118, covered by `test/blueprint/application-charts-anatomy.test.js`. Trace: `projects/blueprint-library/specs/visual-round-spec-2026-09-04.md` section 5.2, section 6.1, section 9 (T-2 rows). Unblocks track T-3 (application-dashboard, which composes on charts for the chart region).
+
+- **Visual round T-1: application-datatable v1.0.0 blueprint on the shelf with its Playwright probe pack (spec 2026-09-04 section 5.1, w-2026-09-04-dave-011).** The rcf-lite shelf ships `blueprints/application-datatable/` with 22 contributions (six REQs covering the table shell, sort semantics, filter chrome, selection and bulk actions, four-state region contract, and the non-drag keyboard column-visibility / reorder / resize path; nine USs binding 27 runtime-observable ACs; three TACs for the shell, the query adapter, and the selection model; four ADRs for the ARIA APG pattern choice, URL-state serialisation, page size, and selection persistence). The blueprint suggests the `logging` and `errorHandling` companions with the ratified spec's reasons; no new global topics are claimed. The shipped `probe-packs/application-datatable.pack.mjs` ships six browser-verify checks anchored to blueprint AC ids: `AC-17101-1` sort click reorders rows, `AC-17102-1` filter chrome text-search issues `q=<value>`, `AC-17103-2` pagination announcement in an `aria-live="polite"` region reading `Page N of M`, `AC-17104-3` bulk-action confirmation dialog returns focus to the originating row on close, `AC-17105-1` four state regions each render inside `role="region"` with `aria-live="polite"`, `AC-17106-1` column reorder has a non-drag keyboard alternative (WCAG 2.5.7). The pack's `appliesTo` predicate scopes to any FBS binding `TAC-1801-application-datatable-shell` or whose nav model routes name a datatable path. First blueprint on the shelf that ships a Playwright probe pack under T-0's runner extension. Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-datatable/` (one Node HTTP server realising every surface the six checks probe honestly enough for the pack to run green, driven by the shipped `start` script on `PORT`). The shelf band registry row for `application-datatable` (17101-17899 / 18xx / none) is appended to every existing blueprint's `docs/topics.md` at ship. Repo chain extended with REQ-018 / US-1801 / AC-1801-1..5 / TS-047 / FBS-037 / CN-113..115, covered by `test/blueprint/application-datatable-anatomy.test.js`. Also fixes a T-0 defect (tracked under w-2026-09-04-dave-020): `pack-loader.readContributedAcIds` now resolves contribution paths relative to the blueprint's `contributions/` subdirectory (the loader.js convention for real shelf blueprints), with a legacy fall-back to the blueprint root for the T-0 pack-loader tests. Trace: `projects/blueprint-library/specs/visual-round-spec-2026-09-04.md` section 5.1, section 6.1, section 9 (T-1 rows). Unblocks tracks T-2 (charts), T-3 (dashboard, which composes on datatable's recent-items strip), T-4 (notifications-in-app) and T-5 (admin-console, which composes on datatable for users and audit views).
+
+- **Visual round T-0: blueprint-shipped browser-verify probe packs and the applicability predicate (spec 2026-09-04, w-2026-09-04-dave-016).** `rcf verify browser` gains a probe-pack pass that runs after invariants and after auth-smoke. A blueprint SHIPS a Playwright probe pack at `blueprints/<slug>/probe-packs/<pack-name>.pack.{js,mjs}` exporting a default object with `packName`, semver `version`, `blueprintSlug`, an `appliesTo({ fbs, uiBaseline, manifest })` predicate, and a non-empty `checks[]` array. The loader (`src/browser-verify/pack-loader.js`) discovers packs on every applied blueprint (`manifest.blueprints[]`), imports each module dynamically, validates against the pack schema (`src/browser-verify/pack-schema.js`), and cross-checks every `checks[].id` against the AC ids the blueprint contributes through its US contribution files. Load-time refusals (exit 2, one diagnostic per fault) fire on: an `appliesTo` predicate whose source references none of `route` / `navModel` / `path`, `tacIds`, or the `blueprint:` US-tag prefix (the default `() => true` is caught); a packName that does not start with the blueprint's slug; a check id the blueprint does not contribute; non-semver version; duplicate check or pre-check ids; a broken pack module. The runner (`src/browser-verify/pack-runner.js`) invokes each check's `run({ browser, fetch, runtimeUrl, route, theme })`, folds results into `browserVerification.probePacks[]` on the composed record, and skips checks whose `dependsOn` names a failing pre-check with verdict `skipped` and detail `skipped-by-pre-check:<preCheckId>`. `aggregateVerdict` extends to block on any severity=block pack fail or pre-check fail; warn on any severity=warn fail with no block. A pack whose `appliesTo` returns false for an FBS is recorded with `applicable: false` and contributes no verdict, curing the run-4 "auth-smoke fires on all UI-bearing FBS" residual. `rcf verify browser <fbs-id> --probe-pack <name>` restricts one run to one pack; an unknown name exits 2 with a diagnostic naming the discovered packs. Docs: `packages/rcf-lite/docs/blueprint-authoring.md` section 8c ("Visual-surface probe packs"), a paired row on `packages/rcf-lite/docs/blueprint-authoring-checklist.md` section 6, and a `rcf verify browser` reference on `packages/rcf-lite/docs/verify-reference.md`. Zero new npm dependencies; the runner-provisioned Playwright MCP (`PLAYWRIGHT_MCP_VERSION` in `src/verify/engine/launcher.js`) is the browser access seam.
+
+Trace: `projects/blueprint-library/specs/visual-round-spec-2026-09-04.md` sections 2.1, 3, 6.1, 9 (T-0 rows). Unblocks tracks T-1..T-5 (datatable, charts, dashboard, notifications-in-app, admin-console).
+
+- **Visual round T-0 follow-up: real headless browser for probe packs, boot fallback for the runtime URL, layout goldens regenerated for the extended chain (spec 2026-09-04 sections 3.3 to 3.5, w-2026-09-04-dave-016 follow-up).** The `packBrowser` seam is now a real headless Playwright browser rather than a stub. Provisioning goes through the pinned Playwright MCP server (`PLAYWRIGHT_MCP_VERSION` in `src/verify/engine/launcher.js`, spawned as `npx -y @playwright/mcp@<pin>`) via a new thin in-package JSON-RPC 2.0 stdio client (`src/browser-verify/pack-browser.js`); when the consuming project already resolves `playwright` from its own `node_modules`, the CLI takes that cheaper direct route and exposes the identical small API to packs: `goto`, `snapshot` (accessibility-tree text), `evaluate`, `click`, `type`, `press`, `screenshot`, `close`. Zero new npm dependencies, no LLM call, no ambient MCP config leaked. The CLI provisions the browser only when at least one applicable pack is loaded; `--no-browser` disables provisioning entirely. Packs may declare `boot: { bootCommand, waitForUrl, waitForSelector }` (`src/browser-verify/boot.js`): when the runtime URL is unreachable the CLI spawns `bootCommand` from the project root (cwd = project root, no shell), polls `waitForUrl` (default cap 60s), optionally polls the browser snapshot for `waitForSelector` (default cap 10s, soft-failure), runs the packs, then stops the process it started (SIGTERM, SIGKILL fallback after 3s). When the runtime is already answering, the boot block is skipped and the running server is used unchanged (Baz ruling 2026-09-04: the dev server is the normal path). `--no-boot` disables the fallback. The layout-regression Phase 3.6 baseline (`test/view/fixtures/phase-3-6-static.html`) was regenerated on Node 24.14.0 for the REQ-017 chain addition. Chain: US-1701 extended with AC-1701-7 (real browser seam) and AC-1701-8 (boot fallback); TS-046 with paired TCs; CN-111 anchors `pack-browser.js#createPackBrowser` and CN-112 anchors `boot.js#bootIfNeeded`; FBS-036 bindings extended.
+
 ## [0.20.0] - 2026-09-04
 
 Optional evaluation node in the RCF chain. An acceptance criterion whose outcome cannot be checked deterministically is marked at define time, an evaluation is attached with its own pass threshold, and audit, verify and finalise refuse to ship while it is missing. An explicit opt-out records its reason on the manifest. The schema floor moves to rcf-schemas 0.6.0.

package/blueprints/application-account-settings/CHANGELOG.md

@@ -0,0 +1,12 @@
+# application-account-settings CHANGELOG
+
+## 1.0.0 (visual round T-4, spec 2026-09-06 section 5.4)
+
+- First shipped version. Introduces the account-settings shell (ARIA APG tabs, WCAG 2.4.6 landmark), the profile surface (WCAG 1.3.5 autocomplete tokens, aria-live save-status), the security surface (self-service branch and hosted-UI branch through ADR-2602's elicited security-surface-shape), the sessions surface (ARIA APG dialog-modal terminate flow, aria-live session-terminated announcement, current-session cannot terminate itself), the notification-preferences surface (per-category silence, per-channel opt-in) and the theme surface (light/dark/system radiogroup persisted per ADR-2603's elicited theme-persistence).
+- Declares `requiresAppliedCapabilities: [principalDirectory]` with `refusalMessageId: application-account-settings-bare-spa` and `allowSkipFlag: allow-no-auth-yet`. The refusal template ships in this PR's mechanism minor at `packages/rcf-lite/src/blueprint/capabilities.js` (`buildRefusalMessage`). The Q3 gate (a project declaring neither `credentialSelfService` nor `hostedIdentityUi`) is enforced through the shell's tab-suppression rule (AC-25101-1 probed by the pack), the mechanism's silent gating of the `security-surface-shape` elicit (its `when` predicate refuses), and the surface-side hosted-UI bridge TAC-2603 refusal (documented mechanism-reach gap under AC-25110-1).
+- Ships four capability-gated custom-auth elicits (`custom-auth-provides-principal-directory`, `custom-auth-provides-credential-self-service`, `custom-auth-provides-session-inventory`, `custom-auth-provides-hosted-identity-ui`) that let a project ship its own auth surface without a shelf `security-auth-*` blueprint.
+- Ships four regular elicits (`security-surface-shape`, `hosted-identity-url`, `theme-persistence`, `reauth-window`) whose `when` predicates gate on the applied capability set.
+- Ships a Playwright probe pack under `probe-packs/application-account-settings.pack.mjs` with five checks anchored to `AC-25101-1` (shell tabs mirror caps), `AC-25102-1` (profile autocomplete tokens), `AC-25105-1` (security branch matches applied + elicit), `AC-25106-1` (sessions rows and dialog-modal) and `AC-25108-1` (theme radiogroup and persistence). Every check gates via `readAppliedCapabilities(projectRoot)`; an absent capability records `verdict: skipped` per spec section 3.3.
+- Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/` realising the five conditional surfaces honestly plus four break switches (`?break=leak-tab`, `?break=no-autocomplete`, `?break=no-dialog`, `?break=no-persist`) driving the negative runs.
+- Composes on `application-empty-error-states` (T-1) for the forbidden and empty-history states; no bespoke access-denied UI is invented here.
+- Rides with the auth blueprints minor bumps (`security-auth-clerk` 1.3.0, `security-auth-keycloak` 1.2.0, `security-auth-oauth2` 1.2.0, `security-auth-magic-link` 1.2.0 doc-only) and the `observability-logging` 1.2.0 minor bump (declares `sessionInventory` as the logging-projection provider), extending the section 6a capability table with `credentialSelfService`, `sessionInventory` and `hostedIdentityUi`.

package/blueprints/application-account-settings/README.md

@@ -0,0 +1,114 @@
+# Account settings blueprint (v1.0.0)
+
+Vendor-neutral account-settings surface for an rcf-lite application. Surfaces are CONDITIONAL on what the applied identity blueprints and companion blueprints declare via `capabilities[]`. Ships the settings shell with an ARIA APG tabs region (no dead links to unapplied capabilities), a WCAG 1.3.5 profile surface (always active), a security surface with a self-service branch (password change, MFA) and a hosted-UI branch (link-out or embed), a sessions surface with an ARIA APG dialog-modal terminate flow, a notification preferences surface and a theme surface with light/dark/system. Reuses the visual round T-5 capability grammar and the apply-time discovery, refusal and custom-auth elicitation the spec section 5.4 ratifies. Ships a Playwright probe pack under `probe-packs/application-account-settings.pack.mjs` whose five checks are capability-gated: an absent capability records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3).
+
+## Apply
+
+```
+rcf define blueprint add <path-to>/blueprints/application-account-settings
+```
+
+Refuses with exit 3 and the spec 5.4.1 verbatim message on a project with no applied blueprint declaring `principalDirectory` unless `--allow-no-auth-yet` is passed for a scaffolding pass. Prompts the elicitation phase for parameters whose `when` predicate resolves true against the discovered applied-capability set. Writes a sidecar `rcf/blueprints/application-account-settings.applied.json` capturing the discovered `appliedCapabilities`, the elicit answers, and (when overridden) the scaffolding note. Consumes the `logging` and `errorHandling` companions when they resolve to an applied provider or a registered library; falls back to the shelf providers otherwise.
+
+## Anatomy
+
+| Piece | Where | What |
+|---|---|---|
+| Metadata | `blueprint.json` | Slug, version 1.0.0, category `application`, `requiresAppliedCapabilities: [principalDirectory]`, `elicits[]` (four custom-auth capability provides plus security-surface-shape, hosted-identity-url, theme-persistence, reauth-window), `suggestedCompanions: [logging, errorHandling]`, 24 contributions in the 25xxx / 26xx bands |
+| Doc set | `contributions/` | 6 REQs, 10 USs (13 runtime-observable ACs), 4 TACs, 4 ADRs |
+| Probe pack | `probe-packs/application-account-settings.pack.mjs` | Five capability-gated browser-verify checks anchored to AC-25101-1, AC-25102-1, AC-25105-1, AC-25106-1, AC-25108-1 |
+| Guide | `guide/application-account-settings.md` | Operator-facing: when to reach, when not, mechanism-reach gaps |
+| Coordination vocabulary | `docs/topics.md` | Shelf id band registry update; no new global topics claimed; cross-references application-empty-error-states (T-1) and application-admin-console (T-5) |
+| Sample-app fixture | `packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/` | Dependency-free Node HTTP server the pack is probed against on the shelf gate |
+
+## Conditionality: what surfaces render when
+
+| Applied capability | Surface | Rendered by |
+|---|---|---|
+| `principalDirectory` | Profile (`/account/profile`) always available | Any applied auth blueprint (magic-link, clerk, oauth2, keycloak). |
+| `credentialSelfService` OR `hostedIdentityUi` | Security (`/account/security`) | credentialSelfService: Keycloak from 1.2.0, OAuth2 from 1.2.0 (provider-conditional). hostedIdentityUi: Clerk from 1.3.0, OAuth2 from 1.2.0 (provider-conditional). Neither present: security tab suppressed AND the Q3 refusal fires at apply if the operator answers `--answer security-surface-shape=...`. |
+| `sessionInventory` | Sessions (`/account/sessions`) | Clerk from 1.3.0, Keycloak from 1.2.0, OAuth2 from 1.2.0, or observability-logging from 1.2.0 (as the logging-projection provider). Magic-link does NOT declare it. |
+| `application-notifications-in-app` applied | Notification preferences (`/account/notifications`) | Suppressed when the notifications-in-app blueprint is not applied. |
+| `application-spa` applied | Theme (`/account/theme`) | Suppressed when the SPA blueprint is not applied. |
+| (none) | Unauthenticated principal | Composes on `application-empty-error-states` (T-1) forbidden state; no bespoke access-denied UI. |
+
+## Bare-SPA refusal
+
+On a project with only `application-spa` applied (no auth), the apply exits 3 with:
+
+```
+application-account-settings requires at least one applied security-auth-* blueprint,
+or an operator override with --allow-no-auth-yet.
+
+Applied blueprints on this project:
+  application-spa v1.5.0
+
+Suggested next steps:
+  1. Apply an auth blueprint first:
+       rcf define blueprint add security-auth-magic-link
+     (or security-auth-clerk, security-auth-oauth2, security-auth-keycloak)
+  2. Override for a scaffolding pass (surfaces will refuse at apply until an
+     auth blueprint is applied):
+       rcf define blueprint add application-account-settings --allow-no-auth-yet
+```
+
+The override records a note on the sidecar's `notes` field so `rcf define validate` reads back and flags surfaces that never activated.
+
+## Q3 gate: security surface has no home
+
+A project that declares `principalDirectory` (so apply is not refused at the bare-SPA gate) but NEITHER `credentialSelfService` NOR `hostedIdentityUi`:
+
+1. Silently drops any `--answer security-surface-shape=<any>` at apply (the general elicits mechanism gates the answer via the `when` predicate; the sidecar records no `security-surface-shape` entry).
+2. Renders the shell WITHOUT a security tab (AC-25101-1, probed by the pack).
+3. Refuses the security surface at load time through TAC-2603 hosted-ui-bridge if a project-side FBS renders `/account/security` regardless (project-side enforcement per AC-25110-1 known mechanism-reach gap, spec section 5.4.1).
+
+No `auth managed elsewhere` placeholder ships from the shipped shell surface. Per Baz decision Q3 in the ratified spec, the shell never lies about a surface that has no home.
+
+## Custom-auth projects (auth outside the shelf)
+
+A project that ships its own auth surface (no shelf `security-auth-*` blueprint applied) supplies capability answers via the elicitation phase:
+
+```
+rcf define blueprint add ./blueprints/application-account-settings \
+  --answer custom-auth-provides-principal-directory=true \
+  --answer custom-auth-provides-credential-self-service=true \
+  --answer security-surface-shape=self-service
+```
+
+Answers land on `rcf/blueprints/application-account-settings.applied.json`'s `appliedElicitations{}` map. The `when` predicate on each elicit gates whether the prompt fires: `security-surface-shape` only fires when `credentialSelfService` OR `hostedIdentityUi` is applied (through the shelf or through the custom-auth elicits); `hosted-identity-url` only fires when `hostedIdentityUi` is applied; `theme-persistence` is unconditional (a project that does not apply the SPA blueprint records the answer and the shell simply suppresses the theme tab).
+
+## The one runtime gate
+
+`probe-packs/application-account-settings.pack.mjs` ships five checks the `rcf verify browser` runner invokes on any FBS whose surface matches the pack's `appliesTo` predicate (an FBS that binds `TAC-2601-application-account-settings-shell` or whose nav model routes name an `/account`, `/settings` or `/profile` path). Each check ALSO carries its own `appliesTo` predicate that reads the applied capability sidecar and returns false when the required capability is absent; the check records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3, T-5 residual cure).
+
+Each check drives the real Playwright browser the runner provisions (through the pinned Playwright MCP or the consuming project's own `playwright` installation), reads the accessibility tree and the DOM, and returns a verdict.
+
+## Quality bar
+
+ARIA APG tabs pattern on the shell (TAC-2601); role="tablist" on the nav landmark with `aria-label="Account settings"`, role="tab" on each entry with `aria-selected="true"` on the active tab (WCAG 2.4.6). ARIA APG dialog-modal on the sessions terminate flow (TAC-2604, AC-25105-2); role="dialog" with aria-modal="true" and aria-labelledby to the heading, focus-trap, focus-return on close, polite live-region announcement on the confirm. WCAG 1.3.5 autocomplete tokens on every editable identifier on the profile surface (AC-25102-1). WCAG 3.3.8 Accessible Authentication Minimum on the security surface (ADR-2602). WCAG 3.3.4 Error Prevention on high-value changes gated by the reauth-window elicit (ADR-2604). The security-surface-shape default is elicited (ADR-2602 records no default: the shape leaks the vendor's identity architecture and no default is honest across all four combinations).
+
+## Known mechanism-reach gaps
+
+Runtime-observable ACs the pack does NOT bind directly (checklist section 6.g), listed individually:
+
+- **AC-25101-2 (single primary nav landmark accessible name shape).** The pack's AC-25101-1 asserts the landmark's `aria-label` is present; a future v1.1.0 minor bump can add a heading-order assertion (h1 page, h2 active tab).
+- **AC-25103-1 (self-service branch details beyond password + MFA regions).** The pack's AC-25105-1 confirms the two roles render; a future v1.1.0 minor bump can extend AC-25105-1 with a keyboard-flow assertion.
+- **AC-25104-1 (hosted-embed sandbox token beyond allow-scripts).** The pack's AC-25105-1 confirms `allow-scripts` in the sandbox; the wider token set is documented on ADR-2602 but not additionally asserted.
+- **AC-25105-2 (session-terminate focus-trap behaviour).** The pack's AC-25106-1 asserts the dialog is present and correctly wired; the focus-trap and focus-return behaviour is asserted at fixture-read time and by the project-side smoke tests, not by the pack's browser evaluate at v1.
+- **AC-25107-1 (notification-preferences surface capability discovery).** The pack does NOT probe the notifications surface at v1.0.0; the shell tabs check (AC-25101-1) confirms the tab renders only when `application-notifications-in-app` is applied via the fixture's `?apps=` switch. A future v1.1.0 minor bump can add a dedicated notifications surface check.
+- **AC-25109-1 and AC-25109-2 (apply-time refusal and override).** Probed by the mechanism unit tests, not by the browser pack. The gate reviewer runs the CLI directly.
+- **AC-25110-1 (Q3 apply-time refusal for a missing security capability).** Probed by the mechanism unit tests via the extended `runElicitationPhase` refusal path (added in this PR), not by the browser pack.
+
+## Known schema follow-ups
+
+The applied-blueprint sidecar at `rcf/blueprints/application-account-settings.applied.json` uses the schema shape T-5 admin-console established (no `verdict: skipped` field on the applied-record; the pack runtime records `verdict: skipped` per-check per spec section 3.3, and rcf-schemas 0.6.1 has no `applicable: false` field for the record). A future rcf-schemas minor may adopt the `appliedCapabilities[]` field on the applied-blueprint record directly; the sidecar path stays supported for backward compatibility.
+
+## Companions
+
+`suggestedCompanions` declares `logging` (every rendered account surface writes one request-scoped log line with the correlation identifier; the sessions surface reads a session inventory from `observability-logging` 1.2.0+ when configured) and `errorHandling` (profile-save, security-flow and session-terminate failures construct internal error records). Neither is required to apply the blueprint; the audit-history surface is deferred to v1.1.0.
+
+## Consumers
+
+The forbidden and empty-history states MAP to `application-empty-error-states` (T-1)'s `forbidden` and `empty-list` states. Every project applying `application-account-settings` MUST also apply `application-empty-error-states` if they want the shipped access-denied state; the shell composes on the empty-error-states components rather than inventing bespoke UI.
+
+The sessions and notification-preferences surfaces reuse the `application-datatable` (round-3 T-1) table shell contract when the project renders them through the datatable factory.

package/blueprints/application-account-settings/blueprint.json

@@ -0,0 +1,234 @@
+{
+  "slug": "application-account-settings",
+  "version": "1.0.0",
+  "category": "application",
+  "requiresAppliedCapabilities": {
+    "capabilities": [
+      "principalDirectory"
+    ],
+    "allowSkipFlag": "allow-no-auth-yet",
+    "refusalMessageId": "application-account-settings-bare-spa"
+  },
+  "elicits": [
+    {
+      "id": "custom-auth-provides-principal-directory",
+      "prompt": "Custom auth: does your projects own auth identify principals a users surface (and the account-settings profile surface) can read?",
+      "kind": "boolean",
+      "default": false,
+      "providesCapability": "principalDirectory"
+    },
+    {
+      "id": "custom-auth-provides-credential-self-service",
+      "prompt": "Custom auth: does your projects own auth expose a credential self-service surface (password change, MFA management, email change) the security tab can render in-place?",
+      "kind": "boolean",
+      "default": false,
+      "providesCapability": "credentialSelfService"
+    },
+    {
+      "id": "custom-auth-provides-session-inventory",
+      "prompt": "Custom auth: does your projects own auth (or logging companion) expose an inventory of active sessions with device labels and a terminate action?",
+      "kind": "boolean",
+      "default": false,
+      "providesCapability": "sessionInventory"
+    },
+    {
+      "id": "custom-auth-provides-hosted-identity-ui",
+      "prompt": "Custom auth: does your project point at a hosted identity portal (sign-in, sign-up, account, security) the security tab can link out to or embed?",
+      "kind": "boolean",
+      "default": false,
+      "providesCapability": "hostedIdentityUi"
+    },
+    {
+      "id": "security-surface-shape",
+      "prompt": "Security surface shape: self-service (renders the in-place password change and MFA surface), hosted-link-out (renders a link to your hosted portal) or hosted-embed (renders your hosted portal in an iframe).",
+      "kind": "enum",
+      "options": [
+        "self-service",
+        "hosted-link-out",
+        "hosted-embed"
+      ],
+      "when": {
+        "requiresCapability": [
+          "credentialSelfService",
+          "hostedIdentityUi"
+        ]
+      }
+    },
+    {
+      "id": "hosted-identity-url",
+      "prompt": "Hosted identity URL: the destination the security surface links out to or embeds when security-surface-shape is hosted-*. Ignored on self-service.",
+      "kind": "string",
+      "default": "",
+      "when": {
+        "requiresCapability": [
+          "hostedIdentityUi"
+        ]
+      }
+    },
+    {
+      "id": "theme-persistence",
+      "prompt": "Theme persistence: spa-local-storage (per-browser default), server-scoped (per-principal), or none (defers to prefers-color-scheme).",
+      "kind": "enum",
+      "options": [
+        "spa-local-storage",
+        "server-scoped",
+        "none"
+      ],
+      "default": "spa-local-storage"
+    },
+    {
+      "id": "reauth-window",
+      "prompt": "Re-authenticate window in minutes for high-value changes (password change, MFA change, session terminate, account delete). Enter never, 5, 15 or 60.",
+      "kind": "enum",
+      "options": [
+        "never",
+        "5",
+        "15",
+        "60"
+      ],
+      "default": "15"
+    }
+  ],
+  "suggestedCompanions": [
+    {
+      "role": "logging",
+      "reason": "Every rendered account surface writes one request-scoped log line with the correlation identifier; a logging companion supplies the factory the pipeline calls. When the logging companion also declares sessionInventory (observability-logging 1.2.0+), the sessions surface reads the inventory from the log projection."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "Profile-save failures, security-flow failures and session-terminate failures construct internal error records; an error-handling companion supplies the record factory and the boundary the empty-error-states blueprint renders."
+    }
+  ],
+  "contributions": [
+    {
+      "id": "application-account-settings-REQ-001",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-001.json"
+    },
+    {
+      "id": "application-account-settings-REQ-002",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-002.json"
+    },
+    {
+      "id": "application-account-settings-REQ-003",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-003.json"
+    },
+    {
+      "id": "application-account-settings-REQ-004",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-004.json"
+    },
+    {
+      "id": "application-account-settings-REQ-005",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-005.json"
+    },
+    {
+      "id": "application-account-settings-REQ-006",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-006.json"
+    },
+    {
+      "id": "application-account-settings-US-25101",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25101.json"
+    },
+    {
+      "id": "application-account-settings-US-25102",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25102.json"
+    },
+    {
+      "id": "application-account-settings-US-25103",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25103.json"
+    },
+    {
+      "id": "application-account-settings-US-25104",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25104.json"
+    },
+    {
+      "id": "application-account-settings-US-25105",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25105.json"
+    },
+    {
+      "id": "application-account-settings-US-25106",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25106.json"
+    },
+    {
+      "id": "application-account-settings-US-25107",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25107.json"
+    },
+    {
+      "id": "application-account-settings-US-25108",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25108.json"
+    },
+    {
+      "id": "application-account-settings-US-25109",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25109.json"
+    },
+    {
+      "id": "application-account-settings-US-25110",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25110.json"
+    },
+    {
+      "id": "TAC-2601-application-account-settings-shell",
+      "kind": "tac",
+      "path": "tacs/tac-2601-application-account-settings-shell.json"
+    },
+    {
+      "id": "TAC-2602-application-account-settings-capability-discovery",
+      "kind": "tac",
+      "path": "tacs/tac-2602-application-account-settings-capability-discovery.json"
+    },
+    {
+      "id": "TAC-2603-application-account-settings-hosted-ui-bridge",
+      "kind": "tac",
+      "path": "tacs/tac-2603-application-account-settings-hosted-ui-bridge.json"
+    },
+    {
+      "id": "TAC-2604-application-account-settings-session-store",
+      "kind": "tac",
+      "path": "tacs/tac-2604-application-account-settings-session-store.json"
+    },
+    {
+      "id": "ADR-2601-application-account-settings-capability-vocabulary",
+      "kind": "adr",
+      "path": "adrs/adr-2601-application-account-settings-capability-vocabulary.json",
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-2602-application-account-settings-security-surface-shape",
+      "kind": "adr",
+      "path": "adrs/adr-2602-application-account-settings-security-surface-shape.json",
+      "recommendedDefault": false,
+      "elicited": true,
+      "standardsTraceClause": "WCAG 3.3.8 Accessible Authentication (Minimum)"
+    },
+    {
+      "id": "ADR-2603-application-account-settings-theme-persistence",
+      "kind": "adr",
+      "path": "adrs/adr-2603-application-account-settings-theme-persistence.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-2604-application-account-settings-reauth-window",
+      "kind": "adr",
+      "path": "adrs/adr-2604-application-account-settings-reauth-window.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "WCAG 3.3.4 Error Prevention (Legal, Financial, Data)"
+    }
+  ]
+}

package/blueprints/application-account-settings/contributions/adrs/adr-2601-application-account-settings-capability-vocabulary.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-2601-application-account-settings-capability-vocabulary",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Capability vocabulary: credentialSelfService, sessionInventory, hostedIdentityUi additions plus auditLog reuse",
+  "context": "The account-settings blueprint composes on the section 6a capability grammar visual round T-5 ratified. The T-4 spec (section 5.4.2) adds three capability strings the auth vendors need to declare in order for the security and sessions surfaces to render, and reuses auditLog where a project wants a self-view audit history rendered on the account surface (deferred: not a v1 surface but named in the vocabulary so a future minor bump can wire it without a chunk-zero edit).",
+  "decision": "v1.0.0 ratifies three additions to the section 6a capability table: credentialSelfService (in-place password change, MFA management, email change surface), sessionInventory (active-session listing with device labels and a terminate write), and hostedIdentityUi (link-out or embed to a hosted account portal). The auditLog capability continues to route via observability-logging. The three new strings follow the same shape rule (lower camelCase, ^[a-z][a-zA-Z0-9]*$) validated on the loader; the vocabulary lives in the section 6a table extended in the same PR.",
+  "consequences": "A bare-magic-link project gets a profile surface only; a Keycloak project gets profile plus security (self-service) plus sessions; a Clerk project gets profile plus security (hosted-link-out or embed) plus sessions; an OAuth2 project gets what the vendor declares. A future account-audit-history surface lands as a v1.1.0 minor bump reusing auditLog with no new vocabulary.",
+  "alternativesConsidered": [
+    {
+      "name": "Alternative approach considered",
+      "summary": "A single accountSelfService capability covering the security AND sessions AND theme surfaces was considered but conflates surfaces that vendors ship on different roadmaps: Keycloak has credentialSelfService without hostedIdentityUi, Clerk has hostedIdentityUi without a self-service equivalent. Separating them lets each vendor declare what it actually ships and lets the blueprint compose honestly.",
+      "reasonNotChosen": "See the decision text; the chosen shape composes cleanly with the applied blueprint set the spec section 5.4 names."
+    }
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/adrs/adr-2602-application-account-settings-security-surface-shape.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-2602-application-account-settings-security-surface-shape",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Security surface shape: password vs passkey vs hosted-UI vs link-out per applied auth",
+  "context": "The security surface has four legal shapes depending on the applied auth: self-service password (Keycloak, OAuth2 with a self-service endpoint), self-service passkey (WebAuthn where the auth blueprint declares credentialSelfService and the operator has stood up a passkey flow), hosted link-out to a portal (Clerk, Auth0), or hosted embed of the same portal in an iframe. The spec section 5.4 marks security-surface-shape as elicited with no recommended default because the security surface leaks the vendors identity architecture and no default is honest across all four applied-auth combinations.",
+  "decision": "security-surface-shape is elicited (enum: self-service | hosted-link-out | hosted-embed). No recommended default. Recording no default is the point: the operator picks the shape that matches the applied auth vendors surface. When the elicit is answered but no applied blueprint declares credentialSelfService (for self-service) or hostedIdentityUi (for the two hosted branches), apply refuses (AC-25110-1). The hosted-embed sandbox default is allow-scripts allow-forms allow-same-origin; a project that needs a different token set writes a project-scoped ADR overriding the sandbox.",
+  "consequences": "The operator makes an explicit choice at apply that reads on the sidecar; downstream review has a stable record of which security-surface-shape was elicited. A project that mis-answers (elicits hosted-link-out on a Keycloak project) hits the AC-25110-1 refusal at apply, not at runtime.",
+  "alternativesConsidered": [
+    {
+      "name": "Alternative approach considered",
+      "summary": "Auto-selecting the shape from the applied capability set was considered (self-service when credentialSelfService applied, else hosted-link-out when hostedIdentityUi applied) but the choice is a UX decision the operator owns, not a mechanism inference. Encoding it in the elicit keeps the choice legible.",
+      "reasonNotChosen": "See the decision text; the chosen shape composes cleanly with the applied blueprint set the spec section 5.4 names."
+    }
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/adrs/adr-2603-application-account-settings-theme-persistence.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-2603-application-account-settings-theme-persistence",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Theme persistence: spa-local-storage default, server-scoped or none",
+  "context": "The theme surface persists the light/dark/system choice. The applied SPA blueprint owns per-tab hydration; the account-settings blueprint owns the operator surface for choosing the theme and the persistence hand-off. The spec section 5.4 marks theme-persistence as elicited with recommendedDefault true on spa-local-storage because per-browser persistence is the least-surprising default and it does not require a server round-trip.",
+  "decision": "theme-persistence is elicited (enum: spa-local-storage | server-scoped | none). Recommended default: spa-local-storage. The applied SPA blueprint reads the persisted choice at hydrate time and applies data-theme on the html element before first paint (no flash of unstyled content). A server-scoped persistence writes the choice on the principals record so it follows the user across devices; the account-settings blueprint records the choice through its themeAdapter interface. A \"none\" choice reflects the projects prefers-color-scheme by default and never persists.",
+  "consequences": "A spa-local-storage project honours the users choice per browser tab family, which is the vernacular expectation. A server-scoped project pays the cost of a per-preference write. A none project honours the OS.",
+  "alternativesConsidered": [
+    {
+      "name": "Alternative approach considered",
+      "summary": "Auto-detecting from the applied blueprint set was considered but the choice is a UX decision.",
+      "reasonNotChosen": "See the decision text; the chosen shape composes cleanly with the applied blueprint set the spec section 5.4 names."
+    }
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/adrs/adr-2604-application-account-settings-reauth-window.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-2604-application-account-settings-reauth-window",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Re-authenticate before high-value changes (default: enabled)",
+  "context": "A high-value change (password change, MFA change, session terminate, account delete) that runs on the same session that opened the surface is a phishing risk when the session is stale. WCAG 3.3.4 (Error Prevention on legal, financial and data-changing actions) applies. The spec section 5.4 marks reauth-window as elicited with recommendedDefault true, meaning re-authenticate is enabled by default.",
+  "decision": "reauth-window is elicited (enum: never | 5m | 15m | 60m). Recommended default: 15m. A high-value change fires the re-authenticate flow when the session was last authenticated more than reauth-window minutes ago. A project that ships a short-lived session token (reauth-window irrelevant because the session itself expires within minutes) may set never; ADR records the choice and the risk. The re-authenticate flow itself is owned by the applied auth blueprint; this ADR names the trigger, not the implementation.",
+  "consequences": "A stolen laptop with an unlocked session cannot terminate every other session without re-authenticating within 15 minutes. The re-authenticate cost is a modal prompt on the operators sessions view, not a full sign-out flow.",
+  "alternativesConsidered": [
+    {
+      "name": "Alternative approach considered",
+      "summary": "Always require re-authenticate was considered but every operators surface would trigger it; a windowed policy balances safety and workflow.",
+      "reasonNotChosen": "See the decision text; the chosen shape composes cleanly with the applied blueprint set the spec section 5.4 names."
+    }
+  ],
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-001.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-account-settings-REQ-001",
+  "prdId": "PRD-001",
+  "title": "Settings shell with no dead links to unapplied capabilities and ARIA APG tabs",
+  "description": "The settings shell renders a single primary tabs region (ARIA APG tabs pattern) whose entries mirror the union of applied capabilities discovered via readAppliedCapabilities. A tab whose capability is not applied does NOT render (no dead link, no disabled shell). A principal without an authenticated session reaching /account routes to the access-denied state through application-empty-error-states (T-1) with a sign-in link; no bespoke access-denied UI is invented here. Landmark, headings, focus order per WCAG 2.4.6.",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round 4 spec (2026-09-06) section 5.4, REQ 1 of the account-settings blueprint.",
+  "tags": [
+    "blueprint:application-account-settings",
+    "category:01-shell"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-002.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-account-settings-REQ-002",
+  "prdId": "PRD-001",
+  "title": "Profile surface always available with autocomplete tokens per WCAG 1.3.5",
+  "description": "The profile surface (/account/profile) is unconditional (any authenticated principal reaches it) and renders a form with WCAG 1.3.5 autocomplete tokens on every editable identifier (name, email, bday, country). Save success announces via aria-live polite (\"Profile saved\"). Save failure per field renders aria-invalid true with aria-describedby to the per-field error message and focus moves to the first invalid field (WCAG 3.3.1 Error Identification).",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round 4 spec (2026-09-06) section 5.4, REQ 2 of the account-settings blueprint.",
+  "tags": [
+    "blueprint:application-account-settings",
+    "category:02-profile"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-06T20:55:46Z",
+  "updatedAt": "2026-09-06T20:55:46Z"
+}