rcf-lite 0.20.0 → 0.22.0

package/rcf/user-stories/us-2001.json

@@ -0,0 +1,50 @@
+{
+  "createdAt": "2026-09-04T22:10:00.000Z",
+  "updatedAt": "2026-09-04T22:10:00.000Z",
+  "usId": "US-2001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-020",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-dashboard blueprint ships on the shelf with its packaged design-guidance asset and probe pack refuses ship on a broken dashboard surface",
+  "asA": "shelf consumer applying the application-dashboard v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the packaged design-guidance asset, the Playwright probe pack anchoring primary-KPI position, timeframe refetch fan-out and per-tile state contract, and a sample-app fixture proving the pack passes on a compliant surface and refuses on a broken one",
+  "soThat": "a project consuming rcf-lite gets the dashboard-shape ACs, the operator-facing design guidance the applying agent reads at ship, the pack that runs the three runtime-observable ACs, and a golden fixture the pack refuses on a surface that drops the primary-KPI placement or the timeframe fan-out or the four-state distinction",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2001-1",
+      "description": "The shelf carries blueprints/application-dashboard/blueprint.json declaring slug application-dashboard, version 1.0.0, category application, and 18 contributions (5 REQs, 7 USs, 3 TACs, 3 ADRs); the suggestedCompanions array declares logging and errorHandling with reasons from the ratified spec section 5.3; providesRoles is absent (leaf blueprint per spec; the loader refuses an empty providesRoles array when set, so the leaf-blueprint intent is expressed by omitting the field).",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-2",
+      "description": "rcf define blueprint add ./blueprints/application-dashboard applies the 18 contributions cleanly on a fresh init project; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-3",
+      "description": "The packaged design-guidance asset at blueprints/application-dashboard/assets/guidance/dashboard-design.md exists, carries the eight sections named in the ratified spec section 5.3.1 (primary KPI placement; tile density and count limits; timeframe and filter chrome; loading, empty and error states; colour and contrast; when a table beats a chart, delegating to application-datatable; refresh cadence and staleness; anti-patterns), and carries at least five https:// citations to the sources named in the spec (NN/g dashboard design, Few, Tufte, GOV.UK Design System patterns, WCAG 2.2 Understanding docs).",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-4",
+      "description": "The shipped probe pack blueprints/application-dashboard/probe-packs/application-dashboard.pack.mjs loads via T-0's pack-loader against a scratch project with the blueprint applied; each of its three check ids (AC-19102-1 primary-KPI position, AC-19104-1 timeframe refetch fan-out, AC-19103-1 per-tile state contract) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack's appliesTo predicate references the tacIds seam and binds TAC-2001-application-dashboard-tile-grid.",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-5",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-dashboard/ ships a dependency-free Node HTTP server (server.js) with a start script; when started, its dashboard route renders a tile grid with a primary KPI top-left (data attribute naming its kind from the enum), a chart region reusing the application-charts sample-app markup shape, a timeframe preset picker whose change refetches every tile with the same from/to boundary and updates an as-of ISO-8601 stamp, per-tile four states switchable by query, an export handle listing CSV/PDF/PNG, a request log exposed on window.__dashboardFetches and at /__requests, and CSS that reflows to one column at 360 with the primary KPI first. Running the pack against the fixture returns verdict pass on every check (severity block, aggregate pass).",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-6",
+      "description": "The probe pack refuses ship on a broken fixture: with the primary KPI moved off top-left via the ?break=kpi-position switch, running the pack returns verdict fail on AC-19102-1 at severity block and the aggregate verdict is block; with the timeframe refetch fan-out drift-boundary via ?break=fanout, verdict fail on AC-19104-1 at severity block; with the aria-live and role region attributes dropped via ?break=state-aria, verdict fail on AC-19103-1 at severity block.",
+      "testable": true
+    },
+    {
+      "id": "AC-2001-7",
+      "description": "The pack-browser seam (packages/rcf-lite/src/browser-verify/pack-browser.js) exposes a resize(width, height) method to probe pack authors: on the MCP route the method calls the pinned Playwright MCP's browser_resize tool, on the project route it calls page.setViewportSize({ width, height }), and packs can drive the three breakpoint checks (1440/1024/360) through the new seam.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2101.json

@@ -0,0 +1,45 @@
+{
+  "createdAt": "2026-09-04T23:59:00.000Z",
+  "updatedAt": "2026-09-04T23:59:00.000Z",
+  "usId": "US-2101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-021",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-notifications-in-app blueprint ships on the shelf and its probe pack refuses ship on a broken notifications surface",
+  "asA": "shelf consumer applying the application-notifications-in-app v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring live-region preseeding, the transient toast contract with priority-to-role mapping and timeout floor, and the notification-centre acknowledge round-trip, plus a sample-app fixture proving the pack passes on a compliant surface and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the in-app notifications-shape ACs, the pack that runs the three runtime-observable ACs, and a golden fixture the pack refuses on a surface that lazy-inserts the wrappers, inverts the priority-to-role mapping, dismisses toasts below the WCAG 2.2.1 floor, or drops the acknowledge POST",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2101-1",
+      "description": "The shelf carries blueprints/application-notifications-in-app/blueprint.json declaring slug application-notifications-in-app, version 1.0.0, category application, and 19 contributions (5 REQs, 8 USs, 3 TACs, 3 ADRs); the suggestedCompanions array declares logging and errorHandling with reasons from the ratified spec section 5.4; providesRoles is absent (leaf blueprint per spec; the loader refuses an empty providesRoles array when set, so the leaf-blueprint intent is expressed by omitting the field).",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-2",
+      "description": "rcf define blueprint add ./blueprints/application-notifications-in-app applies the 19 contributions cleanly on a fresh init project; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-3",
+      "description": "The shipped probe pack blueprints/application-notifications-in-app/probe-packs/application-notifications-in-app.pack.mjs loads via T-0's pack-loader against a scratch project with the blueprint applied; each of its three check ids (AC-20101-1 live-region preseeding, AC-20102-1 transient toast contract, AC-20103-1 centre acknowledge round-trip) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the AC-20101-1 description contains the word 'preseeded' per section 9 T-4 row; the pack's appliesTo predicate references BOTH tacIds and route (the two legal source-scan seams).",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-4",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-notifications-in-app/ ships a dependency-free Node HTTP server (server.js) with a start script; when started, its main route preseeds both live-region wrappers ([data-live-region=\"polite\"] with aria-live=polite AND [data-live-region=\"assertive\"] with role=alert), both empty at page load; the notification centre route lists a seeded backlog of notifications each carrying data-notification-id, a keyboard-reachable [data-action=\"acknowledge\"] control and a [data-action=\"mark-read\"] control, plus one [data-action=\"mark-all-read\"] control; the preferences route lists per-category silence toggles and sibling-channel digest sections disabled by default; POST /api/notifications/acknowledge round-trips and updates the seeded row's acknowledgedAt; GET /api/delivery-log returns {rows:[]} with the seeded backlog; window.__notificationFetches and /__requests mirror every client-side fetch record.",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-5",
+      "description": "The probe pack refuses ship on each broken fixture: with ?break=preseed the wrappers are inserted lazily after the first event so AC-20101-1 fails at severity block; with ?break=role the priority-to-role mapping is inverted (error toast in polite/status, info toast in assertive/alert) so AC-20102-1 fails at severity block; with ?break=timeout the toast dismisses after two seconds and the shell root advertises a two-second floor so AC-20102-1 fails at severity block on both the shell-declared floor and the WCAG six-second floor; with ?break=ack the acknowledge click handler is a no-op so AC-20103-1 fails at severity block.",
+      "testable": true
+    },
+    {
+      "id": "AC-2101-6",
+      "description": "The blueprint's family-prefix reservation (application-notifications- reserved for the sibling channels -email, -push, -webhook per Baz decision 2026-09-04) is documented as a paragraph in the blueprint README AND as a row in the shelf band registry table in every applying blueprint's docs/topics.md (marked as a doc-only reservation with no shipped blueprint).",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2201.json

@@ -0,0 +1,60 @@
+{
+  "createdAt": "2026-09-05T01:30:00.000Z",
+  "updatedAt": "2026-09-05T01:30:00.000Z",
+  "usId": "US-2201",
+  "prdId": "PRD-001",
+  "reqId": "REQ-022",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The capability-declaration mechanism lands in the loader and apply verb; the four shelf auth blueprints adopt it in v1.1.0 minor bumps",
+  "asA": "shelf consumer applying a consumer blueprint that gates surfaces on identity or platform capabilities",
+  "iWant": "the blueprint loader to accept capabilities[], elicits[] and requiresAppliedCapabilities on blueprint.json with shape validation, the apply verb to discover applied capabilities by reading each applied blueprint's source blueprint.json, refuse admin-console-shaped applies with the spec 5.5.1 verbatim message when no required capability is applied and --allow-no-auth-yet is absent, prompt an elicitation phase gated by the discovered capabilities, and persist appliedCapabilities and appliedElicitations to rcf/blueprints/${slug}.applied.json; and the four shelf auth blueprints to declare capabilities[] in v1.1.0 minor bumps landing in the same PR",
+  "soThat": "a project applying admin-console (or any future capability-gated blueprint) gets deterministic apply-time surface configuration, a bare-SPA apply is refused with the operator-friendly message the spec ratified, custom-auth projects elicit their answers into a persistent record the console reads, and the four shelf auth blueprints announce their identity capability set in one release train per spec Q2 default",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2201-1",
+      "description": "The blueprint loader accepts an optional capabilities[] top-level field on blueprint.json: when present it must be a non-empty array of lower camelCase strings on ^[a-z][a-zA-Z0-9]*$, and a malformed value refuses with a validation rcfError naming the field. LoadedBlueprint exposes capabilities[] verbatim.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-2",
+      "description": "The blueprint loader accepts an optional elicits[] top-level field: when present it must be a non-empty array of {id (kebab slug), prompt (non-empty operator-facing string, no em-dashes, no emojis), kind (one of enum, string, boolean), default (matching kind), options (required when kind=enum), when (optional predicate object)} entries; malformed shapes refuse with a validation rcfError naming the entry.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-3",
+      "description": "The blueprint loader accepts an optional requiresAppliedCapabilities top-level object: when present its capabilities[] property is a non-empty array of lower camelCase strings, allowSkipFlag is a kebab slug matching an apply-verb flag name (allow-no-auth-yet in v1), and refusalMessageId is a non-empty string; malformed shapes refuse with a validation rcfError.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-4",
+      "description": "applyBlueprint reads each applied blueprint's source blueprint.json (via the applied record's source field the T-2 core-companions train established) to compute the appliedCapabilities union across the project; when the loaded blueprint declares requiresAppliedCapabilities and the union has no overlap AND the CLI did not pass --allow-no-auth-yet, apply returns an rcfError kind requiresAppliedCapabilities carrying the spec 5.5.1 message body verbatim with the currently-applied blueprints list substituted, and the CLI exits 3 with that message on stderr naming security-auth-*.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-5",
+      "description": "When --allow-no-auth-yet is passed on the CLI and the blueprint's allowSkipFlag matches, apply proceeds and the applied-record sidecar rcf/blueprints/${slug}.applied.json is written with allowNoAuthYet: true and a notes string naming the no-auth-yet state; the manifest applied record's schema-closed fields remain untouched.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-6",
+      "description": "The elicitation phase reads --answer <id>=<value> repeatable arguments and --answers <file> (a JSON object mapping id to value) at apply time; every elicit entry whose when predicate resolves true against the discovered applied-capability set is prompted (on a TTY) or read from the answer bag (non-interactive) with the declared kind coerced (boolean from y/yes/n/no, enum against options, string trimmed); a missing required answer refuses with a validation rcfError naming the id.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-7",
+      "description": "On a clean apply, apply writes rcf/blueprints/${slug}.applied.json containing {slug, version, appliedAt, appliedCapabilities: [...], appliedElicitations: {id: value, ...}, allowNoAuthYet?: bool, notes?: string}; the sidecar is idempotent (re-apply on the same version rewrites the same file) and the manifest.blueprints[] applied record is unchanged in shape.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-8",
+      "description": "The four shelf auth blueprints declare capabilities[] in v1.1.0 minor bumps landing in the same PR: security-auth-magic-link 1.0.0 -> 1.1.0 capabilities: [principalDirectory]; security-auth-clerk 1.1.0 -> 1.2.0 capabilities: [principalDirectory, roleModel]; security-auth-oauth2 1.0.0 -> 1.1.0 capabilities: [principalDirectory, roleModel]; security-auth-keycloak 1.0.0 -> 1.1.0 capabilities: [principalDirectory, roleModel]. Each blueprint's CHANGELOG.md carries a new entry naming the capabilities added and citing this train (Baz Q2 default 2026-09-04, spec section 5.5.2). No other change to the four blueprints.",
+      "testable": true
+    },
+    {
+      "id": "AC-2201-9",
+      "description": "docs/blueprint-authoring.md section 6a extends the roles registry with the capability vocabulary table (principalDirectory, roleModel, tenancy, auditLog with meaning columns and shelf-provider(s) columns) and cross-references capabilities[] and requiresAppliedCapabilities in the loader as sibling fields to providesRoles and suggestedCompanions.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2301.json

@@ -0,0 +1,51 @@
+{
+  "createdAt": "2026-09-05T01:30:00.000Z",
+  "updatedAt": "2026-09-05T01:30:00.000Z",
+  "usId": "US-2301",
+  "prdId": "PRD-001",
+  "reqId": "REQ-023",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-admin-console blueprint ships on the shelf; its probe pack fires only on applied capabilities and refuses on a broken admin surface",
+  "asA": "shelf consumer applying the application-admin-console v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files with a users, roles, orgs, audit-log surface set that self-configures from the applied capability declarations, the Playwright probe pack whose four checks each gate their fire on the applied capability, and a sample-app fixture proving the pack passes on a compliant surface, records applicable: false where the capability is absent, and refuses on the three break switches",
+  "soThat": "a project consuming rcf-lite gets a vendor-neutral admin console conditional on what identity blueprint is applied, no dead links to unapplied capabilities, the pack that proves the ARIA APG grid pattern on the permission matrix, the request-log ACs on the audit view, and a golden fixture the pack refuses on a surface that loses the grid roles, drops the request-access control, or writes an audit entry missing the correlation id",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2301-1",
+      "description": "The shelf carries blueprints/application-admin-console/blueprint.json declaring slug application-admin-console, version 1.0.0, category application, 23 contributions in the 6 REQ / 9 US / 4 TAC / 4 ADR groups per spec section 5.5; requiresAppliedCapabilities.capabilities is [principalDirectory] with allowSkipFlag: allow-no-auth-yet; elicits[] declares baselineRoles (when roleModel), tenancyShape (when tenancy), inviteTransport, and auditRetentionDays (when auditLog); suggestedCompanions declares logging and errorHandling with reasons from spec section 5.5; providesRoles is absent per spec 5.5.3.",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-2",
+      "description": "rcf define blueprint add ./blueprints/application-admin-console --allow-no-auth-yet applies the 23 contributions cleanly on a fresh init project with only application-spa applied; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project; the sidecar rcf/blueprints/application-admin-console.applied.json declares allowNoAuthYet: true and an appliedCapabilities: [] union.",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-3",
+      "description": "rcf define blueprint add ./blueprints/application-admin-console on a project with only application-spa applied exits 3 with a stderr message beginning 'application-admin-console requires at least one applied security-auth-*' and naming the currently-applied blueprints; nothing is written to disk (no contributions, no sidecar, no manifest entry).",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-4",
+      "description": "rcf define blueprint add ./blueprints/application-admin-console on a project with security-auth-magic-link 1.1.0 applied applies cleanly; the sidecar's appliedCapabilities reads exactly [principalDirectory] with no roleModel; rcf define blueprint add on a project with security-auth-clerk 1.2.0 + observability-logging applied produces appliedCapabilities [principalDirectory, roleModel, auditLog] (order-agnostic).",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-5",
+      "description": "The shipped probe pack blueprints/application-admin-console/probe-packs/application-admin-console.pack.mjs loads via T-0's pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-21102-1, AC-21103-1, AC-21104-1, AC-21105-1) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; each check's appliesTo predicate reads manifest.blueprints[]/${slug}.applied.json capabilities and returns false when the required capability is absent so the check records applicable: false; the pack-level appliesTo predicate references BOTH tacIds and route.",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-6",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/ ships a dependency-free Node HTTP server (server.js) with a start script; CAPS env or ?caps= query switch selects which surfaces exist mirroring the applied capability set (principalDirectory, roleModel, tenancy, auditLog, or comma combinations thereof); the console shell nav only links applied surfaces; the users directory table enumerates every row by data-user-id inside the role=table region; the permission matrix renders under role=grid with role=row on every rank, role=rowheader on the leftmost cell of each role rank, role=columnheader on every permission header, role=gridcell on inner cells, and each cell announces the exact permission string on focus via aria-label; the org switcher is present only when tenancy is applied; the audit-log table enumerates every row by data-audit-id and every audit entry carries actor, target, before, after, timestamp, and correlationId in inspectable columns; an access-denied route renders a request-access control routed to a POST /api/request-access endpoint; window.__adminFetches and /__requests mirror every request.",
+      "testable": true
+    },
+    {
+      "id": "AC-2301-7",
+      "description": "The probe pack refuses ship on each broken fixture: with ?break=matrix-grid the permission matrix drops the role=grid attributes so AC-21103-1 fails at severity block; with ?break=denied the access-denied route drops the request-access control so AC-21102-1's negative branch (a principal without admin scope) fails at severity block; with ?break=audit-fields the audit entries omit the correlationId column so AC-21105-1 fails at severity block."
+      ,
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2401.json

@@ -0,0 +1,62 @@
+{
+  "createdAt": "2026-09-06T15:38:51.042Z",
+  "updatedAt": "2026-09-06T15:38:51.042Z",
+  "asA": "shelf consumer applying the application-empty-error-states v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the eight named states of the empty and error catalogue, the recovery-action router across parent-surface search request-access and retry, the offline state with the write-buffer contract, and a sample-app fixture proving the pack passes on a compliant surface and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the eight-state contract with a runtime-verified pack, the least-privilege surface for the 500 and 403 states, and a golden fixture the pack refuses on a surface that leaks a stack trace, leaks a resource id, drops a recovery affordance, or drops the polite live-region wrapper",
+  "description": "US-2401 anchors the shelf-shape acceptance criteria for the T-1 track: shelf carries blueprint.json with the ratified shape, contributions apply cleanly on a fresh init project, the pack cross-checks against contributed AC ids, the sample-app fixture serves every state on the honest branch, and the break switches refuse on the negative branch. The blueprint contributes 19 to 24 further AC records on its own USs 22101 to 22108; those are covered by the pack against the fixture and by the anatomy test that walks the contributions.",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2401-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shelf carries blueprints/application-empty-error-states/blueprint.json declaring slug application-empty-error-states, version 1.0.0, category application, and 19 to 24 contributions in the 5 REQ / 8 US / 3 TAC / 3 ADR groups per spec section 5.1; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.1; providesRoles is absent; capabilities is absent or empty; requiresAppliedCapabilities is absent (no auth required)."
+    },
+    {
+      "id": "AC-2401-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "rcf define blueprint add ./blueprints/application-empty-error-states applies the 19 contributions cleanly on a fresh init project (exit 0, contribution count matches blueprint.json); rcf define validate on the scratch project reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project."
+    },
+    {
+      "id": "AC-2401-3",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shipped probe pack blueprints/application-empty-error-states/probe-packs/application-empty-error-states.pack.mjs loads via T-0s pack-loader against a scratch project with the blueprint applied; each of its eight check ids (AC-22101-1 through AC-22108-1) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack-level appliesTo predicate references BOTH tacIds and route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source."
+    },
+    {
+      "id": "AC-2401-4",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/ ships a dependency-free Node HTTP server (server.js) with a start script; every one of the eight states renders on its default branch and is selectable via ?state=<name>; PORT env overrides the bind port (default 3000, never binds 4200); the fixture responds LISTENING <port> once bound."
+    },
+    {
+      "id": "AC-2401-5",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The probe pack refuses ship on each broken fixture branch: ?break=stack-trace re-adds a stack trace to the 500 state so AC-22103-1 fails at severity block; ?break=leak-id re-adds the resource id to the forbidden and permission-denied surfaces so AC-22102-1 or AC-22104-1 fails at severity block; ?break=no-recovery drops the recovery control from the empty-list state so AC-22106-1 fails at severity block; ?break=no-live-region drops the polite live-region wrapper so AC-22105-1 (offline reconnection announcement) fails at severity block."
+    },
+    {
+      "id": "AC-2401-6",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The eight enumerated named states appear identically across the scope paragraph in the blueprint README, the packs checks[] list, the guide, and the docs/topics.md registry table; a grep sweep for each state slug (not-found, forbidden, server-error, offline, permission-denied, empty-list, no-search-results, error-boundary) confirms every occurrence is accounted for and no state is silently dropped."
+    },
+    {
+      "id": "AC-2401-7",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The blueprint README lists every runtime-observable AC the pack does NOT bind directly under Known mechanism-reach gaps, individually per AC id; the blueprint CHANGELOG.md carries a single 1.0.0 entry naming the eight state contracts, the pack checks, the recovery-action router and the offline strategy ADR; docs/topics.md carries the shelf id band registry table extended with the T-1 row (application-empty-error-states 22101-22899 / 23xx)."
+    }
+  ],
+  "tacIds": [],
+  "tags": [
+    "blueprint:application-empty-error-states"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "usId": "US-2401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-024",
+  "title": "The application-empty-error-states blueprint ships on the shelf with its eight-state pack and sample-app fixture; the pack refuses on the four break switches"
+}

package/rcf/user-stories/us-2501.json

@@ -0,0 +1,58 @@
+{
+  "createdAt": "2026-09-06T16:55:12.496Z",
+  "updatedAt": "2026-09-06T16:56:03.586Z",
+  "description": "US-2501 anchors the shelf-shape acceptance criteria for the T-2 track: shelf carries blueprint.json with the ratified shape, contributions apply cleanly on a fresh init project, the pack cross-checks against contributed AC ids, the sample-app fixture serves both transport branches (multipart POST default and tus.io elicited alternative) on the honest branch, and the break switches refuse on the negative branch. The blueprint contributes further AC records on its own USs 23101 to 23107; those are covered by the pack against the fixture and by the anatomy test that walks the contributions.",
+  "usId": "US-2501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-025",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-file-upload blueprint ships on the shelf with its four-check pack and sample-app fixture; the pack refuses on the four break switches",
+  "asA": "shelf consumer applying the application-file-upload v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the four surface-observable checks of the file-upload contract (input surface with a labelled file input plus drop-zone plus keyboard alternative, transport contract with a chunked path and a refusal contract, and a progress announcer with a polite tick and an assertive completion), and a sample-app fixture proving the pack passes on both transport branches multipart POST and tus.io and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the WCAG 2.5.7 dragging-movements safe file-upload contract with a runtime-verified pack, one recommended transport with two elicited alternatives, and a golden fixture the pack refuses on a surface that drops the file input, drops the polite live-region, ships a refused file to the server or collapses the chunked path",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2501-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shelf carries blueprints/application-file-upload/blueprint.json declaring slug application-file-upload, version 1.0.0, category application, and 18 to 22 contributions in the 5 REQ / 7 US / 3 TAC / 3 ADR groups per spec section 5.2; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.2; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities is absent."
+    },
+    {
+      "id": "AC-2501-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "rcf define blueprint add ./blueprints/application-file-upload applies the 18 contributions cleanly on a fresh init project (exit 0, contribution count matches blueprint.json); rcf define validate on the scratch project reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project."
+    },
+    {
+      "id": "AC-2501-3",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shipped probe pack blueprints/application-file-upload/probe-packs/application-file-upload.pack.mjs loads via T-0s pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-23101-1 input surface, AC-23102-1 progress announcer, AC-23103-1 refusal contract, AC-23104-1 chunked transport) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack-level appliesTo predicate references BOTH tacIds and route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source."
+    },
+    {
+      "id": "AC-2501-4",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/ ships a dependency-free Node HTTP server (server.js) with a start script; on the multipart POST default branch the four states idle, uploading, refused and complete render honestly and per-file plus aggregate progress ticks fire through the polite live-region wrapper; on the ?transport=tus branch chunked PATCH uploads carry an Upload-Offset header per chunk and the assertive completion announcement fires; PORT env overrides the bind port (default 3000, never binds 4200); the fixture responds LISTENING <port> once bound."
+    },
+    {
+      "id": "AC-2501-5",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The probe pack refuses ship on each broken fixture branch: ?break=no-input drops the file input leaving only the drop-zone so AC-23101-1 fails at severity block (WCAG 2.5.7 keyboard alternative gone); ?break=no-live-region drops the polite live-region wrapper so AC-23102-1 fails at severity block; ?break=send-refused sends a refused file to the server so AC-23103-1 fails at severity block (a POST for the refused filename is observed on the network); ?break=no-chunks collapses the chunked path to a single POST so AC-23104-1 fails at severity block (no Upload-Offset header on any request)."
+    },
+    {
+      "id": "AC-2501-6",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The four fixture states (idle, uploading, refused, complete) and the two transport slugs (multipart, tus) appear identically across the scope paragraph in the blueprint README, the packs checks[] list, the guide, the fixture README and the docs/topics.md registry table; a grep sweep for each slug confirms every occurrence is accounted for and no state or transport is silently dropped."
+    },
+    {
+      "id": "AC-2501-7",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The blueprint README lists every runtime-observable AC the pack does NOT bind directly under Known mechanism-reach gaps, individually per AC id; the blueprint CHANGELOG.md carries a single 1.0.0 entry naming the input contract, the progress contract, the refusal contract, the transport contract with the multipart default and the tus.io elicited alternative, the completion contract, the pack checks, the sample-app fixture and the three ADRs; docs/topics.md carries the shelf id band registry table extended with the T-2 row (application-file-upload 23101-23899 / 24xx)."
+    }
+  ]
+}

package/rcf/user-stories/us-2601.json

@@ -0,0 +1,51 @@
+{
+  "createdAt": "2026-09-06T19:03:26.530Z",
+  "updatedAt": "2026-09-06T19:07:14.938Z",
+  "description": "US-2601 anchors the shelf-shape acceptance criteria for the T-3 track: shelf carries blueprint.json with the ratified shape, contributions apply cleanly on a fresh init project, the pack cross-checks against contributed AC ids, the sample-app fixture serves the four wizard surfaces honestly and drives both save-and-return transports on their query branches, and the break switches refuse on the negative branch. The blueprint contributes further AC records on its own USs 24101 to 24108; those are covered by the pack against the fixture and by the anatomy test that walks the contributions.",
+  "usId": "US-2601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-026",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-forms-wizard blueprint ships on the shelf with its four-check pack and sample-app fixture; the pack refuses on the four break switches",
+  "asA": "shelf consumer applying the application-forms-wizard v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the four surface-observable checks of the wizard contract (task-list contract with the closed GOV.UK vocabulary, error-summary contract with the top-of-page summary and aria bindings, summary-review pattern with the change-per-row and answer retention, and save-and-return contract with a server-side draft table or a client-side local buffer with a sync tick), and a sample-app fixture proving the pack passes on the honest render of the four wizard surfaces and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the WCAG 2.2 AA compliant multi-step forms contract with a runtime-verified pack, the GOV.UK Design System task-list pattern out of the box, one recommended navigation posture with an elicited alternative, two save-and-return transports with no default so the abandoned-draft loss class does not ship silently, and a golden fixture the pack refuses on a surface that swaps a state string away from the closed vocabulary, drops the error summary, drops answer retention on the summary review, or drops the draft transport altogether",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2601-1",
+      "description": "The shelf carries blueprints/application-forms-wizard/blueprint.json declaring slug application-forms-wizard, version 1.0.0, category application, and 19 contributions in the 5 REQ / 8 US / 3 TAC / 3 ADR groups per spec section 5.3; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.3; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities is absent.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-2",
+      "description": "rcf define blueprint add ./blueprints/application-forms-wizard applies the 19 contributions cleanly on a fresh init project (exit 0, contribution count matches blueprint.json); rcf define validate on the scratch project reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-3",
+      "description": "The shipped probe pack blueprints/application-forms-wizard/probe-packs/application-forms-wizard.pack.mjs loads via T-0 pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-24101-1 task-list, AC-24103-1 error-summary, AC-24104-1 summary-review, AC-24105-1 save-and-return) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack-level appliesTo predicate references BOTH tacIds and route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-4",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-forms-wizard/ ships a dependency-free Node HTTP server (server.js) with a start script; on the honest branch /task-list renders the ARIA progressbar wrapper plus one step row per manifest entry with a data-step-state from the closed GOV.UK vocabulary; /step/2?refused=1 pre-renders the error-summary shape with a heading, one skip link per failed field and aria-invalid=\"true\" on the field with aria-describedby to the message; /summary?seed=complete renders one summary-list section per step with data-summary-row entries and a data-recovery=\"change\" link per row; /step/1?draft-store=server&preseed=1 writes into the in-memory drafts table so GET /drafts returns the persisted fields, and /step/1?draft-store=local&preseed=1 writes to window.localStorage under draft:application-forms-wizard:<step-slug> and renders [data-sync-tick] carrying an ISO-8601 timestamp; PORT env overrides the bind port (default 3000, never binds 4200); the fixture prints LISTENING <port> once bound.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-5",
+      "description": "The probe pack refuses ship on each broken fixture branch: ?break=task-list-vocab swaps a step-state string away from the closed GOV.UK vocabulary so AC-24101-1 fails at severity block; ?break=no-summary drops the [data-surface=\"error-summary\"] region on the refused step so AC-24103-1 fails at severity block; ?break=no-retain wipes every unedited answer on the edit-and-save round-trip so AC-24104-1 fails at severity block; ?break=no-draft drops the draft transport altogether so AC-24105-1 fails at severity block on both branches (no POST to /drafts, no localStorage write, no data-sync-tick element).",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-6",
+      "description": "The four state slugs from the closed GOV.UK vocabulary (Cannot start yet, Not started, In progress, Completed), the two save-and-return transport slugs (server-draft-table, client-local-buffer), the four break switches and the four probe-pack check ids appear identically across the scope paragraph in the blueprint README, the pack checks[] list, the guide, the fixture README and the docs/topics.md registry table; a grep sweep for each slug confirms every occurrence is accounted for and no vocabulary string is silently dropped.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-7",
+      "description": "The blueprint README lists every runtime-observable AC the pack does NOT bind directly under Known mechanism-reach gaps, individually per AC id; the blueprint CHANGELOG.md carries a single 1.0.0 entry naming the task-list contract, the per-step validation timing rule, the error-summary contract, the summary-review pattern, the save-and-return contract with the two transports, the pack checks, the sample-app fixture and the three ADRs; docs/topics.md carries the shelf id band registry table extended with the T-3 row (application-forms-wizard 24101-24899 / 25xx) and the cross-reference to application-empty-error-states for the no-in-progress empty state.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2701.json

@@ -0,0 +1,55 @@
+{
+  "createdAt": "2026-09-06T21:11:39.906Z",
+  "updatedAt": "2026-09-06T21:12:11.457Z",
+  "usId": "US-2701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-027",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-account-settings blueprint ships on the shelf with its 5-check pack and sample-app fixture; the pack refuses on the four break switches; the four auth minors and the observability-logging minor bump ship in the same PR with the extended section 6a capability table",
+  "asA": "shelf consumer applying the application-account-settings v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the five surface-observable checks (shell tabs, profile autocomplete, security branch, sessions dialog-modal, theme radiogroup) with capability-gated appliesTo, and a sample-app fixture proving the pack passes on the honest render of the five conditional surfaces and fails on the four break switches; the four auth blueprint minor bumps and the observability-logging minor bump riding the same PR extending the section 6a capability table with credentialSelfService sessionInventory and hostedIdentityUi",
+  "soThat": "a project consuming rcf-lite gets the WCAG 2.2 AA compliant account-settings surface with a runtime-verified pack that gates on the applied capability set (no bespoke work when magic-link is applied and only profile activates; the security surface renders self-service on Keycloak or hosted-link-out on Clerk; the sessions surface renders on any applied sessionInventory provider including observability-logging as the logging-projection provider), one recommended default per elicit where honest and no recommended default on security-surface-shape where dishonest",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2701-1",
+      "description": "The shelf carries blueprints/application-account-settings/blueprint.json declaring slug application-account-settings, version 1.0.0, category application, and 24 contributions in the 6 REQ / 10 US / 4 TAC / 4 ADR groups per spec section 5.4; suggestedCompanions declares logging and errorHandling with reasons; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities declares principalDirectory with allowSkipFlag allow-no-auth-yet and refusalMessageId application-account-settings-bare-spa.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-2",
+      "description": "The shelf carries blueprints/application-account-settings/blueprint.json declaring slug application-account-settings, version 1.0.0, category application, and 24 contributions in the 6 REQ / 10 US / 4 TAC / 4 ADR groups per spec section 5.4; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.4; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities declares principalDirectory with allowSkipFlag allow-no-auth-yet and refusalMessageId application-account-settings-bare-spa.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-3",
+      "description": "rcf define blueprint add ./blueprints/application-account-settings applies the 24 contributions cleanly on a fresh init project with security-auth-magic-link applied (exit 0, contribution count matches blueprint.json); the applied sidecar records appliedCapabilities principalDirectory only; a fresh init project with no auth applied refuses at exit 3 with the [application-account-settings-bare-spa] refusal message; --allow-no-auth-yet applies with allowNoAuthYet true and a scaffolding-pass note on the sidecar.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-4",
+      "description": "The shipped probe pack blueprints/application-account-settings/probe-packs/application-account-settings.pack.mjs loads via T-0 pack-loader against a scratch project with the blueprint applied; each of its five check ids (AC-25101-1 shell, AC-25102-1 profile, AC-25105-1 security, AC-25106-1 sessions, AC-25108-1 theme) resolves to an AC id contributed by the blueprint; every check carries a description field; the pack-level appliesTo predicate references BOTH tacIds AND route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-5",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/ ships a dependency-free Node HTTP server (server.js) with a start script; on the honest branch /account renders the ARIA APG tabs shell whose tabs mirror the CAPS env; /account/profile renders the form with autocomplete tokens name email bday country; /account/security?security-surface-shape=self-service renders the change-password and mfa-management regions when credentialSelfService is in CAPS; /account/sessions renders one row per session with data-session-id and a terminate control on non-current rows plus the ARIA dialog-modal; /account/theme renders the radiogroup with light dark system and persists per the ACCOUNT_SETTINGS_THEME_PERSIST env; PORT env overrides the bind port (default 3000, never binds 4200).",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-6",
+      "description": "The probe pack fails on each broken fixture branch: ?break=leak-tab renders the security tab even when neither credentialSelfService nor hostedIdentityUi is in CAPS so AC-25101-1 fails at severity block; ?break=no-autocomplete drops the autocomplete tokens on the profile form so AC-25102-1 fails at severity block; ?break=no-dialog removes the terminate confirmation dialog so AC-25106-1 fails at severity block; ?break=no-persist drops the theme persistence write so AC-25108-1 does not fail on this fixture-side signal directly but the data-persist attribute mismatch triggers the fail.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-7",
+      "description": "The four capability strings principalDirectory credentialSelfService sessionInventory hostedIdentityUi and the security surface shape enum self-service hosted-link-out hosted-embed appear identically across README, guide, pack checks[] descriptions and docs/topics.md registry; the section 6a capability table in packages/rcf-lite/docs/blueprint-authoring.md lists credentialSelfService sessionInventory and hostedIdentityUi with the shelf providers named.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-8",
+      "description": "README lists mechanism-reach gaps individually per AC id per checklist section 6.g; CHANGELOG carries one 1.0.0 entry naming the auth minors and the observability-logging minor that ride the same PR; docs/topics.md carries the T-4 shelf registry row and the cross-references to application-empty-error-states and application-admin-console; the four amended auth blueprints each carry a README latest note and a CHANGELOG entry naming the new capabilities and the account-settings consumer; the observability-logging blueprint carries the same.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2801.json

@@ -0,0 +1,55 @@
+{
+  "createdAt": "2026-09-06T23:03:12.225Z",
+  "updatedAt": "2026-09-06T23:04:29.543Z",
+  "usId": "US-2801",
+  "prdId": "PRD-001",
+  "reqId": "REQ-028",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-onboarding-tour blueprint ships on the shelf with its 4-check pack and sample-app fixture; the pack refuses on the four break switches; the tour composes on dashboard notifications-in-app account-settings and the SPA with the documented fallback per Q4 when no persistence blueprint is applied",
+  "asA": "shelf consumer applying the application-onboarding-tour v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the four surface-observable checks (step-container focus and Escape, tooltip-as-dialog contract, checklist slot with dashboard-when-applied and settings-page-when-not, completion-state persistence per the elicited store shape) with the pack composing on the applied blueprint set (dashboard for the anchor slot, notifications-in-app for the completion announcement, account-settings for the restart control, any auth for the per-principal state) and a sample-app fixture proving the pack passes on both the ?apps=dashboard and ?apps= (empty) branches plus multiple ?store= branches and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets a WCAG 2.2 AA compliant onboarding-tour surface (2.1.1 Keyboard, 2.1.2 No Keyboard Trap, 2.4.11 Focus Not Obscured Minimum, 2.4.3 Focus Order) built on the ARIA APG dialog-modal pattern, a first-run checklist that renders on the dashboard shell when application-dashboard is applied and collapses to the settings page when not, three-to-five steps with per-step content owned by the project voice, one recommended default per elicit (dismissal policy dismiss-permanently, completion-state store spa-local-storage per Q4 when no persistence blueprint is applied, checklist anchor derived at apply time), and a documented restart-tour affordance on the settings surface",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2801-1",
+      "description": "The shelf carries blueprints/application-onboarding-tour/blueprint.json declaring slug application-onboarding-tour, version 1.0.0, category application, and 17 to 22 contributions in the 4 REQ / 7 US / 3 TAC / 3 ADR groups per spec section 5.5; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.5; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities is absent (no hard dependency; documented Q4 fallback spa-local-storage when no persistence blueprint is applied).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-2",
+      "description": "The 3 ADR JSON documents under blueprints/application-onboarding-tour/contributions/adrs/ validate against rcf-schemas 0.6.1 ADR shape; the ADR contribution entries in blueprint.json carry a non-null standardsTraceClause per spec section 8a.4 (dialog-modal pattern for ADR-2701, WCAG 2.5.3 or generic enterprise practice for ADR-2702 and ADR-2703 as honest); ADR-2701 dismissal-policy declares recommendedDefault true elicited true; ADR-2702 completion-store-shape declares elicited true with the Q4 default spa-local-storage; ADR-2703 checklist-anchor declares elicited true with the default derived at apply time.",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-3",
+      "description": "rcf define blueprint add ./blueprints/application-onboarding-tour applies the 17 contributions cleanly on a fresh init project (exit 0; contribution count matches blueprint.json); the applied sidecar records appliedElicitations for dismissal policy completion-state store checklist anchor tour-step-manifest per-step-content-voice; no requiresAppliedCapabilities refusal fires (T-5 has no hard dependency).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-4",
+      "description": "The shipped probe pack blueprints/application-onboarding-tour/probe-packs/application-onboarding-tour.pack.mjs loads via the T-0 pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-26101-1 step-container focus and Escape, AC-26102-1 tooltip-as-dialog contract, AC-26103-1 checklist slot with dashboard-when-applied and settings-page-when-not, AC-26104-1 completion-state persistence) resolves to an AC id contributed by the blueprint; every check carries a description field; the pack-level appliesTo predicate references BOTH tacIds AND route (via the operator-configured tour-anchor path glob); every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source; the tooltip-as-dialog check uses browser.resize(1440, 900) and browser.resize(360, 640) to probe focus-not-obscured (WCAG 2.4.11).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-5",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-onboarding-tour/ ships a dependency-free Node HTTP server (server.js) with a start script; on the honest branch /tour renders the tooltip-as-dialog opened on the first step (role=dialog, aria-labelledby to the step heading, focus moves to the tooltip on open, focus returns to the anchor on close); Escape dismisses the tour; Tab traverses tour controls in DOM order and Enter activates the next step; ?apps=dashboard renders the checklist as a <details open> on the dashboard-top anchor; ?apps= (empty) renders the checklist as a <details> (closed) on the settings-page anchor; ?store=<spa-local-storage|spa-session-storage|server-side-per-principal> selects the completion-store backend; ?first-run=<0|1> gates the auto-open; PORT env overrides the bind port (default 3000, never binds 4200).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-6",
+      "description": "The probe pack fails on each broken fixture branch: ?break=no-role drops role=dialog on the tooltip so AC-26102-1 fails at severity block; ?break=focus-escape allows Tab to escape the tooltip to the underlying surface so AC-26101-1 fails at severity block; ?break=no-collapse drops the <details> collapse contract on the checklist slot so AC-26103-1 fails at severity block; ?break=no-persist drops the completion-state write so AC-26104-1 fails at severity block. The aggregate verdict on each break switch reports fail.",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-7",
+      "description": "The four surface-observable checks (AC-26101-1 step-container, AC-26102-1 tooltip-as-dialog, AC-26103-1 checklist-slot, AC-26104-1 completion-state) appear identically across README, guide, pack checks[] descriptions, and docs/topics.md registry; the topics.md T-5 row lists the four cross-references (application-dashboard, application-notifications-in-app, application-account-settings, application-spa) with the compose reason in one line each; the Q4 default (spa-local-storage) is named on ADR-2702 and README with the same rationale.",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-8",
+      "description": "README lists mechanism-reach gaps individually per AC id per checklist section 6.g (T-1 gate discipline); CHANGELOG carries one 1.0.0 entry naming the four checks, the checklist collapse contract and the Q4 fallback; guide/application-onboarding-tour.md exists and names the ARIA APG dialog-modal pattern with a URL, the WCAG 2.2 AA success criteria (2.1.1, 2.1.2, 2.4.3, 2.4.11) with links, the fixture READMEs manual boot line, and the Q4 fallback rationale; packages/rcf-lite/CHANGELOG.md is NOT edited (the round-close release PR owns the 0.22.0 entry).",
+      "testable": true
+    }
+  ]
+}