rcf-lite 0.20.0 → 0.22.0

package/blueprints/application-admin-console/contributions/adrs/adr-2202-application-admin-console-baseline-roles.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-2202-application-admin-console-baseline-roles",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Owner + Admin + Member + Viewer baseline; elicited additions per project",
+  "context": "A permission matrix needs a starting role set. SaaS UI research 2026 (industry sources including Auth0, Okta, Clerk internal role catalogues; NN/g admin-console pattern research) converges on the four-role Owner + Admin + Member + Viewer baseline as the modal starter posture. Every project has its own domain-specific additions (SupportAgent, Auditor, Reviewer), so the baseline is the floor, not the ceiling.",
+  "decision": "v1.0.0 declares Owner, Admin, Member, Viewer as the baseline four role labels the console renders in the matrix. The project elicits additional labels at apply time via the baselineRoles elicit (when the roleModel capability is applied); the baseline four render first, additions after. The four labels are prose, not code: a projects auth blueprint may map them to internal role ids at surface time.",
+  "consequences": "A fresh project applying admin-console with clerk (declares roleModel) gets a working matrix at Owner + Admin + Member + Viewer immediately; a project with domain-specific roles adds them via the elicit answer without a code change. The mapping between baseline label and internal role id is the applying projects concern (industry practice: label vs id decoupling).",
+  "alternativesConsidered": [
+    {
+      "name": "Elicit the entire role set",
+      "summary": "No baseline; every project elicits their own four-plus roles.",
+      "reasonNotChosen": "Adds friction for the modal case (the Owner/Admin/Member/Viewer baseline covers most greenfield projects) and pushes cognitive load onto the operator every apply."
+    },
+    {
+      "name": "Ship only two roles (Admin + User)",
+      "summary": "A tighter baseline.",
+      "reasonNotChosen": "The Admin/User binary loses the distinction between an operator (Admin), a paying customer (Member) and a shared read-only stakeholder (Viewer) that SaaS UI research treats as a load-bearing shape."
+    }
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/adrs/adr-2203-application-admin-console-invite-transport.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-2203-application-admin-console-invite-transport",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Invite transport: email default (delegated to the email sibling), elicited",
+  "context": "A users surface invite action needs a delivery transport. The shelf ships an email sibling under the application-notifications family (application-notifications-email, reserved as a family-prefix); a projects transport preference varies (email is the modal case; a Slack- or Teams-first workplace prefers a chat transport; an in-app-only demo needs no external transport).",
+  "decision": "v1.0.0 declares email as the recommended default invite transport; the console delegates delivery to the applied application-notifications-email sibling when present, otherwise records the invite as a pending event on the notification centre for a later transport to pick up. The transport is elicited at apply time via the inviteTransport elicit (enum: email, in-app-only, custom), so the console does not hardcode the delivery path.",
+  "consequences": "A project on the modal SaaS shape (email invite) gets a working invite path once application-notifications-email lands (currently reserved). A project that wants in-app-only invites picks that at apply. A future custom transport declares its own capability and the console delegates via the same elicit.",
+  "alternativesConsidered": [
+    {
+      "name": "Hard-code email as the transport",
+      "summary": "The invite always writes to the email sibling.",
+      "reasonNotChosen": "Refuses in-app-only demos and projects that want a chat-first workplace, and couples the console tightly to one shelf sibling."
+    }
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/adrs/adr-2204-application-admin-console-audit-retention.json

@@ -0,0 +1,20 @@
+{
+  "adrId": "ADR-2204-application-admin-console-audit-retention",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Audit-log retention window: elicited (default 90 days when auditLog is applied)",
+  "context": "The audit view reads the applied logging companions event stream. Retention windows are domain-specific (finance and healthcare regulations push retention to years; consumer SaaS often trims to 90 days for storage cost and privacy hygiene). The console does not own the retention decision; the applying project does.",
+  "decision": "v1.0.0 declares audit-log retention as an elicited parameter (auditRetentionDays elicit, kind:string default \"90\", when: auditLog is applied). The console renders the audit view with the elicited window; the applied logging companion is responsible for actually enforcing the retention at the write layer. The console suppresses the audit view when the auditLog capability is not applied.",
+  "consequences": "A projects audit view honours the elicited window; the write-side retention is the loggers job (the console does not delete rows from the log). A project on a heavily-regulated domain elicits a longer window at apply; a consumer SaaS defaults to 90 days.",
+  "alternativesConsidered": [
+    {
+      "name": "Hard-code a 90-day retention",
+      "summary": "The console reads the last 90 days only.",
+      "reasonNotChosen": "Refuses regulated-domain projects that need to render older entries in the surface; the retention question is authentically the projects, not the shelfs."
+    }
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-001.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-admin-console-REQ-001",
+  "prdId": "PRD-001",
+  "title": "The application ships an admin-console shell with navigation across the applied capability set and no dead links",
+  "description": "The application realises an admin-console surface whose navigation, on load, reads the applied blueprints capability declarations (via source read-back on manifest.blueprints[]) and renders links only for the surfaces the applied capabilities enable. A surface whose gating capability is not applied is neither linked nor reachable from the shell. The shell is the base surface REQ-002 to REQ-006 elaborate on.",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round spec section 5.5, REQ 1 of the admin-console blueprint.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:01-shell"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-002.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-admin-console-REQ-002",
+  "prdId": "PRD-001",
+  "title": "Users surface conditional on principalDirectory, with directory, invite, deactivate, last-active columns",
+  "description": "When an applied blueprint declares the principalDirectory capability, the console renders a users route: a directory table listing every principal identified by data-user-id, an invite control per row for a principal without an active session, a deactivate control per row for an active principal, and last-active plus status columns. A principal without admin scope reaching /admin renders an access-denied state (REQ-006) with a request-access control routed to a notification. The users table is a datatable (T-1 consumer) with the same ARIA APG contract.",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round spec section 5.5, REQ 2 of the admin-console blueprint.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:02-users"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-003.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-admin-console-REQ-003",
+  "prdId": "PRD-001",
+  "title": "Roles surface conditional on roleModel, with Owner + Admin + Member + Viewer baseline and permission matrix",
+  "description": "When an applied blueprint declares the roleModel capability, the console renders a roles route: the Owner + Admin + Member + Viewer baseline (elicited additions per ADR-2202), and a permission matrix as an ARIA APG grid (rows = roles, columns = permissions, cells = allowed/denied). Each cell announces the exact permission string as it takes focus (WCAG 4.1.3). The matrix suppresses when roleModel is not applied.",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round spec section 5.5, REQ 3 of the admin-console blueprint.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:03-roles"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-004.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-admin-console-REQ-004",
+  "prdId": "PRD-001",
+  "title": "Orgs surface conditional on tenancy, with switcher and org-scoped invites",
+  "description": "When an applied blueprint declares the tenancy capability, the console renders an orgs route: an org switcher control on the shell and an org-scoped invite path from the users surface. The tenancy capability today has no shelf provider (reserved for a future application-tenancy-orgs blueprint per spec section 11); the surface is suppressed until that provider ships.",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round spec section 5.5, REQ 4 of the admin-console blueprint.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:04-orgs"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-005.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-admin-console-REQ-005",
+  "prdId": "PRD-001",
+  "title": "Audit-log surface conditional on the auditLog capability (via the applied logging companion), reading the delivered event stream",
+  "description": "When the auditLog capability is applied (through the observability-logging companion or a future dedicated audit blueprint), the console renders an audit-log route: an audit table listing every entry identified by data-audit-id and carrying actor, target, before, after, timestamp, and correlationId columns; per-actor filter chrome and per-target filter chrome; retention window per ADR-2204. Consumes application-datatable (T-1) for the table shell.",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round spec section 5.5, REQ 5 of the admin-console blueprint.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:05-audit"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-006.json

@@ -0,0 +1,18 @@
+{
+  "reqId": "application-admin-console-REQ-006",
+  "prdId": "PRD-001",
+  "title": "Access-denied and request-access states per WCAG 2.2 AA",
+  "description": "A principal without admin scope reaching an admin route renders an access-denied state under WCAG 2.4.6 Headings and Labels and 3.3.4 Error Prevention: a heading naming the denied action, an explanation of why access was refused, and a request-access control routed to a POST /api/request-access endpoint the applied notification blueprint delivers on. The request-access control is keyboard-reachable and announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3).",
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "Per visual round spec section 5.5, REQ 6 of the admin-console blueprint.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:06-access-denied"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2201-application-admin-console-shell.json

@@ -0,0 +1,40 @@
+{
+  "tacId": "TAC-2201-application-admin-console-shell",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Admin-console shell",
+  "purpose": "Owns the rendered admin-console surface: the top-level nav landmark, the surface-manifest read at load, the conditional rendering of every applied surface (users, roles, orgs, audit), the access-denied and request-access states, and the shared page layout every surface renders within. The shell is the base surface every AC in this blueprint anchors on.",
+  "responsibilities": [
+    "Read the applied capability sidecar (rcf/blueprints/application-admin-console.applied.json) at load and configure the surface set (AC-21101-1, AC-21107-1).",
+    "Render a single primary navigation landmark carrying an accessible name and rendering only applied surfaces (AC-21101-1, AC-21101-2).",
+    "Render the access-denied state for a non-admin principal reaching any admin route with a keyboard-reachable request-access control announcing its state (AC-21106-1).",
+    "Delegate the users, roles, orgs and audit surfaces to their respective TACs (TAC-2201 through TAC-2204)."
+  ],
+  "internalStructure": "One shell module that mounts the surface, reads the applied capabilities sidecar, and renders the nav landmark, the page-layout scaffolding, and the route-level containers for each conditional surface. The framework is not prescribed; the shell interfaces are what the project realises against React, Vue, Svelte or vanilla DOM.",
+  "interfaces": [
+    {
+      "name": "renderShell",
+      "kind": "factory",
+      "description": "renderShell({ capsSidecarUrl, surfaceRegistry, accessGuard }) -> { mount(rootElement), unmount() }. The project supplies the capsSidecarUrl (where the sidecar is served from), the surfaceRegistry (maps a capability string to a surface component), and the accessGuard (returns whether the current principal has admin scope)."
+    },
+    {
+      "name": "capabilitiesSidecar",
+      "kind": "shape",
+      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Capability discovery",
+      "kind": "tac",
+      "tacId": "TAC-2202-application-admin-console-capability-discovery",
+      "description": "The shell reads the surface-manifest through discovery."
+    }
+  ],
+  "tradeoffs": "The shell reads the sidecar file the apply verb writes; a runtime probe against manifest.blueprints[] would be more dynamic but ties the shell to the deploy-target having filesystem read access, which not every deploy target grants. The sidecar contract is deterministic and cacheable.",
+  "notes": "Known mechanism-reach gap: the shell contract cannot prove keyboard focus does not escape the surface in every frameworks rendering; project-side smoke tests supplement the pack. See README `Known mechanism-reach gaps`.",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2202-application-admin-console-capability-discovery.json

@@ -0,0 +1,44 @@
+{
+  "tacId": "TAC-2202-application-admin-console-capability-discovery",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Capability discovery",
+  "purpose": "Owns the apply-time reader that inspects every applied blueprints source blueprint.json for its capabilities[] declaration and composes the union as appliedCapabilities. Owns the write side that persists the discovered union plus elicit answers into rcf/blueprints/application-admin-console.applied.json. Runs at apply time (packages/rcf-lite/src/blueprint/capabilities.js); the shell reads the sidecar the runtime writes.",
+  "responsibilities": [
+    "Enumerate manifest.blueprints[] and read each applied blueprints source blueprint.json to extract its capabilities[] (AC-21107-1).",
+    "Compose the union of applied capabilities as a sorted string array (deterministic sidecar output).",
+    "Run the elicitation phase gated on the discovered capabilities: an elicit whose when.requiresCapability list has no overlap with the union does not prompt (AC-21109-2).",
+    "Write the sidecar file with appliedCapabilities[], appliedElicitations{}, allowNoAuthYet? and notes? (AC-21107-1)."
+  ],
+  "internalStructure": "Two helpers: discoverAppliedCapabilities(applied, projectRoot) reads and unions; writeSidecar({slug, version, appliedAt, appliedCapabilities, appliedElicitations, allowNoAuthYet?, notes?}) writes the file. Both live in packages/rcf-lite/src/blueprint/capabilities.js.",
+  "interfaces": [
+    {
+      "name": "discoverAppliedCapabilities",
+      "kind": "function",
+      "description": "Returns { union: string[], perSlug: Record<slug, string[]> }."
+    },
+    {
+      "name": "runElicitationPhase",
+      "kind": "function",
+      "description": "Applies each elicits[] entry against the discovered capability set and coerces answers per kind."
+    },
+    {
+      "name": "writeSidecar",
+      "kind": "function",
+      "description": "Writes rcf/blueprints/${slug}.applied.json."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Blueprint loader",
+      "kind": "external",
+      "description": "Reads each applied blueprints source blueprint.json."
+    }
+  ],
+  "tradeoffs": "Source read-back rather than a schema-carried appliedCapabilities field on the applied record: the rcf-schemas 0.6.0 appliedBlueprintRecord is closed under additionalProperties:false, so a new field cannot land without a schema minor bump. The sidecar decouples the mechanism from the schema release cycle. A future rcf-schemas minor may add appliedCapabilities directly on the applied record and this TAC would move the write there; the sidecar would remain a supported read path for backward compatibility.",
+  "notes": "Reads the applied recordss source string. When the source is a library-qualified ref (wsd:auth-oauth2), the source blueprint is not on this local tree and the reader returns an empty capabilities list; the applied record is skipped from the union.",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2203-application-admin-console-permission-matrix.json

@@ -0,0 +1,34 @@
+{
+  "tacId": "TAC-2203-application-admin-console-permission-matrix",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Permission matrix",
+  "purpose": "Owns the roles surface: renders the permission matrix as an ARIA APG grid (role=\"grid\" on the outer element, role=\"row\" on every rank, role=\"rowheader\" on the leftmost cell of each role rank, role=\"columnheader\" on every permission column header, role=\"gridcell\" on inner cells). Each cell announces its permission string on focus (WCAG 4.1.3).",
+  "responsibilities": [
+    "Render the ARIA APG grid pattern per WAI-ARIA Authoring Practices Guide (AC-21103-1).",
+    "Render the Owner + Admin + Member + Viewer baseline in the first four rank rows; elicited additional roles rendered after (AC-21103-2).",
+    "Announce every cells permission string plus allowed/denied state via aria-label on focus (AC-21103-1, WCAG 4.1.3)."
+  ],
+  "internalStructure": "One grid module: computes the matrix rank layout, renders the header rank and the role ranks, wires focus management for two-dimensional keyboard navigation, and drives aria-label from a permission catalogue map. Framework-agnostic per shell contract.",
+  "interfaces": [
+    {
+      "name": "renderMatrix",
+      "kind": "factory",
+      "description": "renderMatrix({ roles: RoleSpec[], permissions: PermissionSpec[], matrix: Record<roleId, Record<permissionId, boolean>> }) -> { mount(rootElement), unmount() }."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Admin-console shell",
+      "kind": "tac",
+      "tacId": "TAC-2201-application-admin-console-shell",
+      "description": "The matrix mounts inside the shell page-layout."
+    }
+  ],
+  "tradeoffs": "A grid pattern is more expensive to implement than a plain table but is the correct pattern for a keyboard-interactive matrix (per ARIA APG guidance). The pack asserts the pattern is present, not that every cell announces on focus perfectly in every framework: a project-side keyboard smoke complements the pack.",
+  "notes": "Consumes the datatable pattern-choice contract (ADR-1801, table vs grid per interactivity) at the shell edge, without namespacing conflicts because admin-console does not contribute an ADR on datatable pattern.",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2204-application-admin-console-audit-view.json

@@ -0,0 +1,40 @@
+{
+  "tacId": "TAC-2204-application-admin-console-audit-view",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Audit view",
+  "purpose": "Owns the audit-log surface: consumes the application-datatable shell (T-1) for filter chrome, pagination, four state regions and the row enumeration contract. Renders every audit entry with actor / target / before / after / timestamp / correlationId columns; the correlation id is the join key with the applied logging companion.",
+  "responsibilities": [
+    "Render every audit entry inside the datatable shell (AC-21105-1, AC-21105-2).",
+    "Enumerate every row by data-audit-id and expose every column via data-column (AC-21105-1).",
+    "Render per-actor and per-target filter chrome via the datatable query adapter (AC-21105-2)."
+  ],
+  "internalStructure": "A datatable adapter module: maps the audit event stream to the datatable columnsSpec, exposes the entry ids via data-audit-id, and threads the correlationId column through the datatable render.",
+  "interfaces": [
+    {
+      "name": "renderAuditView",
+      "kind": "factory",
+      "description": "renderAuditView({ eventStream, columns, retentionWindow }) -> { mount(rootElement), unmount() }."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Datatable shell",
+      "kind": "tac",
+      "tacId": "TAC-1801-application-datatable-shell",
+      "description": "Consumed for the table shell contract; the audit view supplies columnsSpec and queryAdapter and delegates the DOM to the datatable."
+    },
+    {
+      "name": "Admin-console shell",
+      "kind": "tac",
+      "tacId": "TAC-2201-application-admin-console-shell",
+      "description": "The audit view mounts inside the shell page-layout."
+    }
+  ],
+  "tradeoffs": "Consuming the datatable shell rather than reimplementing gets ARIA APG grid + WCAG state regions for free; it constrains the audit views UI to the datatable contract. A future audit-specific timeline view supersedes this TAC in its own realisation.",
+  "notes": "The retention window is elicited (ADR-2204); the surface itself is capability-gated on auditLog (from the applied logging companion).",
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21101.json

@@ -0,0 +1,34 @@
+{
+  "usId": "application-admin-console-US-21101",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The console shell reads the applied capabilities at load and renders navigation only for surfaces that are gated on an applied capability",
+  "asA": "admin operator opening the console for the first time",
+  "iWant": "the console shell to inspect the applied capability set and render navigation only for surfaces whose gating capability is applied",
+  "soThat": "I do not click a link that leads to a surface the project cannot realise on the applied identity blueprint",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21101-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at deploy time) and, for each of principalDirectory, roleModel, tenancy, auditLog, renders a nav item ONLY when the capability is present in appliedCapabilities[]. A nav item that would route to a non-applied surface is neither rendered nor keyboard-reachable."
+    },
+    {
+      "id": "AC-21101-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shell has a single primary nav landmark (role=\"navigation\" or a nav element) with an accessible name naming the console."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21102.json

@@ -0,0 +1,34 @@
+{
+  "usId": "application-admin-console-US-21102",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Users surface lists principals when principalDirectory is applied, and renders access-denied for non-admin",
+  "asA": "admin operator managing user directory",
+  "iWant": "a users route that lists every principal identified by data-user-id with invite, deactivate, last-active and status columns when the applied auth blueprint declares principalDirectory; and an access-denied state with a request-access control for a principal without admin scope",
+  "soThat": "I can see and act on the identity set the applied auth blueprint provides, and non-admin users have a clear next step when they hit the console",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21102-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given an authenticated admin AND an applied auth blueprint declaring principalDirectory, the users table lists every principal with data-user-id on each row, a role column (only when roleModel is applied; else suppressed), a last-active timestamp, and a status column; a principal without admin scope reaching /admin renders an access-denied state with a \"request access\" control routing to POST /api/request-access. Probed by application-admin-console pack check AC-21102-1."
+    },
+    {
+      "id": "AC-21102-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Each row exposes an invite control for a principal without an active session (data-action=\"invite\") and a deactivate control for an active principal (data-action=\"deactivate\"); the controls are keyboard-reachable buttons."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21103.json

@@ -0,0 +1,34 @@
+{
+  "usId": "application-admin-console-US-21103",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Roles surface renders the permission matrix as an ARIA APG grid when roleModel is applied",
+  "asA": "admin operator reviewing role permissions",
+  "iWant": "the roles route to render Owner, Admin, Member, Viewer as rows and the permission catalogue as columns in a proper ARIA APG grid, each cell announcing its permission string on focus",
+  "soThat": "sighted, keyboard-only and screen-reader users all perceive the same permission model",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21103-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given the roles surface AND an applied auth blueprint declaring roleModel, the permission matrix renders as an ARIA APG grid: role=\"grid\" on the outer element, role=\"row\" on every rank (including the header rank), role=\"columnheader\" on every permission column header, role=\"rowheader\" on the leftmost cell of each role rank, role=\"gridcell\" on every inner cell, and each cell carries an aria-label announcing the exact permission string plus the allowed/denied state on focus (WCAG 4.1.3). Probed by pack check AC-21103-1."
+    },
+    {
+      "id": "AC-21103-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The baseline role set is Owner, Admin, Member, Viewer (ADR-2202); elicited additional roles rendered as extra rank rows, with the baseline four rendered first and additions after."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2203-application-admin-console-permission-matrix"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21104.json

@@ -0,0 +1,28 @@
+{
+  "usId": "application-admin-console-US-21104",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Orgs surface renders an org switcher and org-scoped invite only when tenancy is applied",
+  "asA": "admin operator on a multi-tenant project",
+  "iWant": "the shell to expose an org switcher and the users surface to expose an org-scoped invite when the applied blueprints declare the tenancy capability",
+  "soThat": "the console lets me operate on one org at a time without mixing directories across tenants",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21104-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given an applied blueprint declaring tenancy, the shell renders an org switcher control (data-role=\"org-switcher\") on the console header; the users invite path renders an org selector. When tenancy is not applied, neither control is rendered nor reachable. Probed by pack check AC-21104-1."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21105.json

@@ -0,0 +1,34 @@
+{
+  "usId": "application-admin-console-US-21105",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Audit-log surface renders the audit stream with correlation id when auditLog is applied",
+  "asA": "admin operator reviewing change history",
+  "iWant": "an audit-log route that lists every entry identified by data-audit-id with actor, target, before, after, timestamp and correlationId columns when the applied logging companion emits an audit stream",
+  "soThat": "I can trace a specific change through the logging pipelines correlation record",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21105-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "Given a role change AND the auditLog capability applied (via observability-logging or a dedicated audit blueprint), an audit-log entry writes with actor, target, before, after, timestamp, and correlationId from the logging companion; the entry surfaces on the audit view table where every row is enumerable by data-audit-id and every cell exposes its column via a data-column attribute. Probed by pack check AC-21105-1."
+    },
+    {
+      "id": "AC-21105-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The audit view consumes the application-datatable shell (TAC-2204 depends on TAC-1801-application-datatable-shell), so filter chrome, pagination and the four state regions inherit from the datatable contract."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell",
+    "TAC-2204-application-admin-console-audit-view"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21106.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21106",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Access-denied state renders a keyboard-reachable request-access control",
+  "asA": "a non-admin user routed to an admin URL",
+  "iWant": "a clearly-labelled access-denied state naming why access was refused and a keyboard-reachable request-access control",
+  "soThat": "I can request access without leaving the app or contacting an admin out of band",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21106-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "A non-admin principal reaching /admin renders a role=\"region\" with an accessible name naming the denied action (WCAG 2.4.6), a paragraph explaining why access was refused (WCAG 3.3.4), and a request-access control (data-action=\"request-access\") routed to POST /api/request-access. The control announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3)."
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21107.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21107",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Console shell surfaces are self-configured from the applied capability sidecar at deploy time, not from client-side inference",
+  "asA": "admin operator opening the console the same way in every deploy environment",
+  "iWant": "the shell to read the applied capability set from a deterministic sidecar file, not to infer from a client-side probe",
+  "soThat": "a preview build renders the same nav a production build renders on the same commit",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21107-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at build time) as a build asset served under a stable path (e.g. /admin/caps.json); the shell never runs a runtime probe against manifest.blueprints[] over the network. The sidecar payload keys are appliedCapabilities[], appliedElicitations{} and allowNoAuthYet? per the mechanism spec."
+    }
+  ],
+  "tacIds": [
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21108.json

@@ -0,0 +1,27 @@
+{
+  "usId": "application-admin-console-US-21108",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The console does not declare providesRoles per spec 5.5.3; the mechanism composes at the capability edge instead",
+  "asA": "shelf author reasoning about future admin-console-shaped blueprints",
+  "iWant": "admin-console v1.0.0 to not declare providesRoles[]; composition with a second admin-console-shaped blueprint happens via capabilities[] and the crossBlueprintOwnership conflict path",
+  "soThat": "a specialised console (a vertical admin-console) declares its own capabilities[] and the mechanism reasons about the composition through one grammar, not two",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21108-1",
+      "testable": true,
+      "scope": "library",
+      "description": "blueprint.json does not declare providesRoles (per spec 5.5.3); the loader is happy (providesRoles is optional). A future admin-console-shaped blueprint composes via capabilities[] and the crossBlueprintOwnership conflict on the same slug family, not via providesRoles[]."
+    }
+  ],
+  "tacIds": [
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-05T01:30:00Z",
+  "updatedAt": "2026-09-05T01:30:00Z"
+}