rcf-lite 0.21.0 → 0.22.0

package/blueprints/security-auth-magic-link/blueprint.json

@@ -1,36 +1,146 @@
 {
   "slug": "security-auth-magic-link",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "category": "security",
-  "capabilities": ["principalDirectory"],
+  "capabilities": [
+    "principalDirectory"
+  ],
   "contributions": [
-    { "id": "security-auth-magic-link-REQ-001", "kind": "req", "path": "requirements/security-auth-magic-link-req-001.json" },
-    { "id": "security-auth-magic-link-REQ-002", "kind": "req", "path": "requirements/security-auth-magic-link-req-002.json" },
-    { "id": "security-auth-magic-link-REQ-003", "kind": "req", "path": "requirements/security-auth-magic-link-req-003.json" },
-    { "id": "security-auth-magic-link-REQ-004", "kind": "req", "path": "requirements/security-auth-magic-link-req-004.json" },
-    { "id": "security-auth-magic-link-REQ-005", "kind": "req", "path": "requirements/security-auth-magic-link-req-005.json" },
-    { "id": "security-auth-magic-link-REQ-006", "kind": "req", "path": "requirements/security-auth-magic-link-req-006.json" },
-    { "id": "security-auth-magic-link-REQ-007", "kind": "req", "path": "requirements/security-auth-magic-link-req-007.json" },
-    { "id": "security-auth-magic-link-REQ-008", "kind": "req", "path": "requirements/security-auth-magic-link-req-008.json" },
-    { "id": "security-auth-magic-link-REQ-009", "kind": "req", "path": "requirements/security-auth-magic-link-req-009.json" },
-    { "id": "security-auth-magic-link-REQ-010", "kind": "req", "path": "requirements/security-auth-magic-link-req-010.json" },
-    { "id": "security-auth-magic-link-REQ-011", "kind": "req", "path": "requirements/security-auth-magic-link-req-011.json" },
-    { "id": "security-auth-magic-link-US-3101", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3101.json" },
-    { "id": "security-auth-magic-link-US-3102", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3102.json" },
-    { "id": "security-auth-magic-link-US-3103", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3103.json" },
-    { "id": "security-auth-magic-link-US-3104", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3104.json" },
-    { "id": "security-auth-magic-link-US-3105", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3105.json" },
-    { "id": "security-auth-magic-link-US-3106", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3106.json" },
-    { "id": "security-auth-magic-link-US-3107", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3107.json" },
-    { "id": "security-auth-magic-link-US-3108", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3108.json" },
-    { "id": "security-auth-magic-link-US-3109", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3109.json" },
-    { "id": "security-auth-magic-link-US-3110", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3110.json" },
-    { "id": "security-auth-magic-link-US-3111", "kind": "us", "path": "user-stories/security-auth-magic-link-us-3111.json" },
-    { "id": "TAC-501-security-auth-magic-link-manager", "kind": "tac", "path": "tacs/tac-501-security-auth-magic-link-manager.json" },
-    { "id": "TAC-502-security-auth-magic-link-session-manager", "kind": "tac", "path": "tacs/tac-502-security-auth-magic-link-session-manager.json" },
-    { "id": "TAC-503-security-auth-magic-link-login-routes", "kind": "tac", "path": "tacs/tac-503-security-auth-magic-link-login-routes.json" },
-    { "id": "TAC-504-security-auth-magic-link-email-delivery-adapter", "kind": "tac", "path": "tacs/tac-504-security-auth-magic-link-email-delivery-adapter.json" },
-    { "id": "TAC-505-security-auth-magic-link-principal-registry", "kind": "tac", "path": "tacs/tac-505-security-auth-magic-link-principal-registry.json" },
+    {
+      "id": "security-auth-magic-link-REQ-001",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-001.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-002",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-002.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-003",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-003.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-004",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-004.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-005",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-005.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-006",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-006.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-007",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-007.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-008",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-008.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-009",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-009.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-010",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-010.json"
+    },
+    {
+      "id": "security-auth-magic-link-REQ-011",
+      "kind": "req",
+      "path": "requirements/security-auth-magic-link-req-011.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3101",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3101.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3102",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3102.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3103",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3103.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3104",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3104.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3105",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3105.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3106",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3106.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3107",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3107.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3108",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3108.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3109",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3109.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3110",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3110.json"
+    },
+    {
+      "id": "security-auth-magic-link-US-3111",
+      "kind": "us",
+      "path": "user-stories/security-auth-magic-link-us-3111.json"
+    },
+    {
+      "id": "TAC-501-security-auth-magic-link-manager",
+      "kind": "tac",
+      "path": "tacs/tac-501-security-auth-magic-link-manager.json"
+    },
+    {
+      "id": "TAC-502-security-auth-magic-link-session-manager",
+      "kind": "tac",
+      "path": "tacs/tac-502-security-auth-magic-link-session-manager.json"
+    },
+    {
+      "id": "TAC-503-security-auth-magic-link-login-routes",
+      "kind": "tac",
+      "path": "tacs/tac-503-security-auth-magic-link-login-routes.json"
+    },
+    {
+      "id": "TAC-504-security-auth-magic-link-email-delivery-adapter",
+      "kind": "tac",
+      "path": "tacs/tac-504-security-auth-magic-link-email-delivery-adapter.json"
+    },
+    {
+      "id": "TAC-505-security-auth-magic-link-principal-registry",
+      "kind": "tac",
+      "path": "tacs/tac-505-security-auth-magic-link-principal-registry.json"
+    },
     {
       "id": "ADR-501-security-auth-magic-link-model",
       "kind": "adr",
@@ -38,9 +148,25 @@
       "scope": "global",
       "topic": "authModel"
     },
-    { "id": "ADR-502-security-auth-magic-link-token-secrecy", "kind": "adr", "path": "adrs/adr-502-security-auth-magic-link-token-secrecy.json" },
-    { "id": "ADR-503-security-auth-magic-link-anti-enumeration-budget", "kind": "adr", "path": "adrs/adr-503-security-auth-magic-link-anti-enumeration-budget.json" },
-    { "id": "ADR-504-security-auth-magic-link-session-lifecycle", "kind": "adr", "path": "adrs/adr-504-security-auth-magic-link-session-lifecycle.json" },
-    { "id": "ADR-505-security-auth-magic-link-rate-limiting", "kind": "adr", "path": "adrs/adr-505-security-auth-magic-link-rate-limiting.json" }
+    {
+      "id": "ADR-502-security-auth-magic-link-token-secrecy",
+      "kind": "adr",
+      "path": "adrs/adr-502-security-auth-magic-link-token-secrecy.json"
+    },
+    {
+      "id": "ADR-503-security-auth-magic-link-anti-enumeration-budget",
+      "kind": "adr",
+      "path": "adrs/adr-503-security-auth-magic-link-anti-enumeration-budget.json"
+    },
+    {
+      "id": "ADR-504-security-auth-magic-link-session-lifecycle",
+      "kind": "adr",
+      "path": "adrs/adr-504-security-auth-magic-link-session-lifecycle.json"
+    },
+    {
+      "id": "ADR-505-security-auth-magic-link-rate-limiting",
+      "kind": "adr",
+      "path": "adrs/adr-505-security-auth-magic-link-rate-limiting.json"
+    }
   ]
 }

package/blueprints/security-auth-magic-link/docs/topics.md

@@ -28,7 +28,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
-| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
 | security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
 | security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
@@ -40,6 +40,13 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 US 3101-3111 sit at the LOW end of the 3101-3899 band on purpose. A project-side story that mechanically derives from `security-auth-magic-link-REQ-011` into the number `3111` would collide against security-auth-magic-link-US-3111 in this package; the band leaves headroom at the HIGH end (US 3181-3899) so a project's own stories anchored to security-auth-magic-link REQs can allocate without conflict.
 

package/blueprints/security-auth-oauth2/CHANGELOG.md

@@ -1,5 +1,9 @@
 # security-auth-oauth2 CHANGELOG
 
+## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, Baz Q2 default)
+
+- Declares `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory, hostedIdentityUi]` on `blueprint.json`. Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round T-4 `application-account-settings` blueprint to gate the security surface across both self-service and hosted-link-out branches (`AC-25105-1`) and the sessions surface (`AC-25106-1`). The three added capabilities are provider-conditional per spec section 5.4.2 vendor variation note: an OAuth2 provider (Auth0, Cognito, Azure AD, Okta) that ships a hosted account portal supplies `hostedIdentityUi`; a provider that exposes an account-management endpoint supplies `credentialSelfService`; a provider that exposes a session inventory endpoint supplies `sessionInventory`. A project on an OAuth2 provider without one of these surfaces sets the corresponding capability to false via a project-scoped ADR override; the account-settings blueprint suppresses the surface accordingly.
+
 ## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
 
 - Declares `capabilities: [principalDirectory, roleModel]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump), and it is consumed by the visual round T-5 `application-admin-console` blueprint at apply time to gate surfaces on what the applied identity blueprint actually provides.

package/blueprints/security-auth-oauth2/README.md

@@ -2,6 +2,9 @@
 
 The eleventh content blueprint on the rcf-build-lite blueprint mechanism, category `security`. A vendor-neutral sibling to `security-auth-magic-link` and `security-auth-clerk` on the `authModel` global topic: identity is delegated to any OAuth2-compatible IdP the project selects (Google, GitHub, Microsoft, Okta, Auth0, a corporate ADFS-fronted OIDC, a self-hosted `node-oidc-provider`) through a fixed provider-abstraction contract. The project owns the flow controller (authorisation-code + PKCE state machine), the provider adapter (pluggable record validation and JWKS fetch), the session-bridge (opaque-handle project session, no provider tokens in the browser), and an optional provider selector. Targeted at small greenfield rcf-lite projects that want delegated identity without vendor commitment; larger deployments supersede vendor-neutral posture with a vendor-committed sibling (`security-auth-clerk`, `security-auth-keycloak` when it ships) or with a project-level ADR.
 
+
+> Latest: **v1.2.0** (visual round T-4, 2026-09-06). `capabilities: [principalDirectory, roleModel, credentialSelfService, sessionInventory, hostedIdentityUi]`. See [CHANGELOG.md](CHANGELOG.md).
+
 ## Apply
 
 ```

package/blueprints/security-auth-oauth2/blueprint.json

@@ -1,34 +1,140 @@
 {
   "slug": "security-auth-oauth2",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "category": "security",
-  "capabilities": ["principalDirectory", "roleModel"],
+  "capabilities": [
+    "principalDirectory",
+    "roleModel",
+    "credentialSelfService",
+    "sessionInventory",
+    "hostedIdentityUi"
+  ],
   "contributions": [
-    { "id": "security-auth-oauth2-REQ-001", "kind": "req", "path": "requirements/security-auth-oauth2-req-001.json" },
-    { "id": "security-auth-oauth2-REQ-002", "kind": "req", "path": "requirements/security-auth-oauth2-req-002.json" },
-    { "id": "security-auth-oauth2-REQ-003", "kind": "req", "path": "requirements/security-auth-oauth2-req-003.json" },
-    { "id": "security-auth-oauth2-REQ-004", "kind": "req", "path": "requirements/security-auth-oauth2-req-004.json" },
-    { "id": "security-auth-oauth2-REQ-005", "kind": "req", "path": "requirements/security-auth-oauth2-req-005.json" },
-    { "id": "security-auth-oauth2-REQ-006", "kind": "req", "path": "requirements/security-auth-oauth2-req-006.json" },
-    { "id": "security-auth-oauth2-REQ-007", "kind": "req", "path": "requirements/security-auth-oauth2-req-007.json" },
-    { "id": "security-auth-oauth2-REQ-008", "kind": "req", "path": "requirements/security-auth-oauth2-req-008.json" },
-    { "id": "security-auth-oauth2-REQ-009", "kind": "req", "path": "requirements/security-auth-oauth2-req-009.json" },
-    { "id": "security-auth-oauth2-REQ-010", "kind": "req", "path": "requirements/security-auth-oauth2-req-010.json" },
-    { "id": "security-auth-oauth2-US-10101", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10101.json" },
-    { "id": "security-auth-oauth2-US-10102", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10102.json" },
-    { "id": "security-auth-oauth2-US-10103", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10103.json" },
-    { "id": "security-auth-oauth2-US-10104", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10104.json" },
-    { "id": "security-auth-oauth2-US-10105", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10105.json" },
-    { "id": "security-auth-oauth2-US-10106", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10106.json" },
-    { "id": "security-auth-oauth2-US-10107", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10107.json" },
-    { "id": "security-auth-oauth2-US-10108", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10108.json" },
-    { "id": "security-auth-oauth2-US-10109", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10109.json" },
-    { "id": "security-auth-oauth2-US-10110", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10110.json" },
-    { "id": "security-auth-oauth2-US-10111", "kind": "us", "path": "user-stories/security-auth-oauth2-us-10111.json" },
-    { "id": "TAC-1101-security-auth-oauth2-flow-controller", "kind": "tac", "path": "tacs/tac-1101-security-auth-oauth2-flow-controller.json" },
-    { "id": "TAC-1102-security-auth-oauth2-provider-adapter", "kind": "tac", "path": "tacs/tac-1102-security-auth-oauth2-provider-adapter.json" },
-    { "id": "TAC-1103-security-auth-oauth2-session-bridge", "kind": "tac", "path": "tacs/tac-1103-security-auth-oauth2-session-bridge.json" },
-    { "id": "TAC-1104-security-auth-oauth2-provider-selector", "kind": "tac", "path": "tacs/tac-1104-security-auth-oauth2-provider-selector.json" },
+    {
+      "id": "security-auth-oauth2-REQ-001",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-001.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-002",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-002.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-003",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-003.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-004",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-004.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-005",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-005.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-006",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-006.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-007",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-007.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-008",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-008.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-009",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-009.json"
+    },
+    {
+      "id": "security-auth-oauth2-REQ-010",
+      "kind": "req",
+      "path": "requirements/security-auth-oauth2-req-010.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10101",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10101.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10102",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10102.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10103",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10103.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10104",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10104.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10105",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10105.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10106",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10106.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10107",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10107.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10108",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10108.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10109",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10109.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10110",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10110.json"
+    },
+    {
+      "id": "security-auth-oauth2-US-10111",
+      "kind": "us",
+      "path": "user-stories/security-auth-oauth2-us-10111.json"
+    },
+    {
+      "id": "TAC-1101-security-auth-oauth2-flow-controller",
+      "kind": "tac",
+      "path": "tacs/tac-1101-security-auth-oauth2-flow-controller.json"
+    },
+    {
+      "id": "TAC-1102-security-auth-oauth2-provider-adapter",
+      "kind": "tac",
+      "path": "tacs/tac-1102-security-auth-oauth2-provider-adapter.json"
+    },
+    {
+      "id": "TAC-1103-security-auth-oauth2-session-bridge",
+      "kind": "tac",
+      "path": "tacs/tac-1103-security-auth-oauth2-session-bridge.json"
+    },
+    {
+      "id": "TAC-1104-security-auth-oauth2-provider-selector",
+      "kind": "tac",
+      "path": "tacs/tac-1104-security-auth-oauth2-provider-selector.json"
+    },
     {
       "id": "ADR-1101-security-auth-oauth2-auth-model",
       "kind": "adr",
@@ -36,10 +142,30 @@
       "scope": "global",
       "topic": "authModel"
     },
-    { "id": "ADR-1102-security-auth-oauth2-provider-abstraction-contract", "kind": "adr", "path": "adrs/adr-1102-security-auth-oauth2-provider-abstraction-contract.json" },
-    { "id": "ADR-1103-security-auth-oauth2-pkce-discipline", "kind": "adr", "path": "adrs/adr-1103-security-auth-oauth2-pkce-discipline.json" },
-    { "id": "ADR-1104-security-auth-oauth2-session-bridge-shape", "kind": "adr", "path": "adrs/adr-1104-security-auth-oauth2-session-bridge-shape.json" },
-    { "id": "ADR-1105-security-auth-oauth2-refresh-token-posture", "kind": "adr", "path": "adrs/adr-1105-security-auth-oauth2-refresh-token-posture.json" },
-    { "id": "ADR-1106-security-auth-oauth2-multi-provider-routing", "kind": "adr", "path": "adrs/adr-1106-security-auth-oauth2-multi-provider-routing.json" }
+    {
+      "id": "ADR-1102-security-auth-oauth2-provider-abstraction-contract",
+      "kind": "adr",
+      "path": "adrs/adr-1102-security-auth-oauth2-provider-abstraction-contract.json"
+    },
+    {
+      "id": "ADR-1103-security-auth-oauth2-pkce-discipline",
+      "kind": "adr",
+      "path": "adrs/adr-1103-security-auth-oauth2-pkce-discipline.json"
+    },
+    {
+      "id": "ADR-1104-security-auth-oauth2-session-bridge-shape",
+      "kind": "adr",
+      "path": "adrs/adr-1104-security-auth-oauth2-session-bridge-shape.json"
+    },
+    {
+      "id": "ADR-1105-security-auth-oauth2-refresh-token-posture",
+      "kind": "adr",
+      "path": "adrs/adr-1105-security-auth-oauth2-refresh-token-posture.json"
+    },
+    {
+      "id": "ADR-1106-security-auth-oauth2-multi-provider-routing",
+      "kind": "adr",
+      "path": "adrs/adr-1106-security-auth-oauth2-multi-provider-routing.json"
+    }
   ]
 }

package/blueprints/security-auth-oauth2/docs/topics.md

@@ -39,7 +39,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
-| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
 | security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
 | security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
@@ -51,6 +51,13 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 US 10101-10111 sit at the LOW end of the 10101-10899 band on purpose. A project-side story that mechanically derives from a security-auth-oauth2 REQ id into the number `10111` would collide against security-auth-oauth2-US-10111 in this package; the band leaves headroom at the HIGH end (US 10181-10899) so a project's own stories anchored to security-auth-oauth2 REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/blueprints/security-secrets-management/CHANGELOG.md

@@ -0,0 +1,11 @@
+# security-secrets-management changelog
+
+## 1.0.1 - 2026-09-06
+
+Additive minor: declares `capabilities: ["secretsProvider"]` on `blueprint.json` so consumer blueprints can gate composition on an applied secrets-management surface via the T-5 capability mechanism. No REQ / US / TAC / ADR contribution changes; the `secretRef` opaque-string contract, the elicited-parameters shape, and the shipped secretsSource semantics are unchanged. First consumer at v1.0.1: `object-storage-s3` v1.0.0 declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` so `rcf define blueprint add object-storage-s3` on a project that has not applied security-secrets-management exits 3 with the stable message id on stderr; the override records a note on `source.notes` for later reconciliation.
+
+Landed via infra round 5 T-2 (spec section 5.2, Baz decision 6) folded into PR #157 per HQ ruling on the runner-gap find; same-PR minor pattern as round-4 T-4 auth minors.
+
+## 1.0.0 - 2026-08-31
+
+Initial release. `secretRef` opaque-string contract, elicited-parameters (secretsSource, environment mapping), scope-global ADR on `secretsSource`.

package/blueprints/security-secrets-management/blueprint.json

@@ -1,7 +1,8 @@
 {
   "slug": "security-secrets-management",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "category": "security",
+  "capabilities": ["secretsProvider"],
   "contributions": [
     { "id": "security-secrets-management-REQ-001", "kind": "req", "path": "requirements/security-secrets-management-req-001.json" },
     { "id": "security-secrets-management-REQ-002", "kind": "req", "path": "requirements/security-secrets-management-req-002.json" },

package/blueprints/security-secrets-management/docs/topics.md

@@ -28,7 +28,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | persistence-data-sqlite | 5101-5899 | 6xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
 | delivery-ci-workflows | 6101-6899 | 7xx | shipped v2.0.0 (renamed from ci-pipeline) | `ciGates`, `strictCoverageGate`, `releaseArtefacts` |
 | observability-essentials | 7101-7899 | 8xx | shipped v2.0.0 | `statusPageContract` |
-| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.0 | `secretsSource` |
+| security-secrets-management | 8101-8899 | 9xx | shipped v1.0.1 | `secretsSource` |
 | security-auth-clerk | 9101-9899 | 10xx | shipped v1.0.0 | `authModel` |
 | security-auth-oauth2 | 10101-10899 | 11xx | shipped v1.0.0 | `authModel` |
 | security-auth-keycloak | 11101-11899 | 12xx | shipped v1.0.0 | `authModel` |
@@ -40,6 +40,13 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-dashboard | 19101-19899 | 20xx | shipped v1.0.0 | none |
 | application-notifications-in-app | 20101-20899 | 21xx | shipped v1.0.0 | none |
 | application-admin-console | 21101-21899 | 22xx | shipped v1.0.0 | none |
+| application-empty-error-states | 22101-22899 | 23xx | shipped v1.0.0 | none |
+| application-file-upload | 23101-23899 | 24xx | shipped v1.0.0 | none |
+| application-forms-wizard | 24101-24899 | 25xx | shipped v1.0.0 | none |
+| application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
+| application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
+| persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
 
 US 8101-8110 sit at the LOW end of the 8101-8899 band on purpose. A project-side story that mechanically derives from a security-secrets-management REQ id into the number `8110` would collide against security-secrets-management-US-8110 in this package; the band leaves headroom at the HIGH end (US 8181-8899) so a project's own stories anchored to security-secrets-management REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 

package/fixtures/canary-manifest.json

@@ -1,9 +1,9 @@
 {
   "registerCanary": [
     {
-      "id": "rc-2026-09-05-001",
-      "createdAt": "2026-09-05T04:18:06.946Z",
-      "buildVersion": "0.21.0-mockdriver",
+      "id": "rc-2026-09-07-001",
+      "createdAt": "2026-09-07T01:33:03.147Z",
+      "buildVersion": "0.22.0-mockdriver",
       "fixturePromptId": "canary-prompt-01",
       "responseWordCount": 55,
       "grades": {
@@ -34,9 +34,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-05-002",
-      "createdAt": "2026-09-05T04:18:06.947Z",
-      "buildVersion": "0.21.0-mockdriver",
+      "id": "rc-2026-09-07-002",
+      "createdAt": "2026-09-07T01:33:03.148Z",
+      "buildVersion": "0.22.0-mockdriver",
       "fixturePromptId": "canary-prompt-02",
       "responseWordCount": 55,
       "grades": {
@@ -67,9 +67,9 @@
       "shipDespiteFailReason": "mock canary driver used; no real subagent was dispatched. This record verifies canary infrastructure only, not the register itself."
     },
     {
-      "id": "rc-2026-09-05-003",
-      "createdAt": "2026-09-05T04:18:06.947Z",
-      "buildVersion": "0.21.0-mockdriver",
+      "id": "rc-2026-09-07-003",
+      "createdAt": "2026-09-07T01:33:03.148Z",
+      "buildVersion": "0.22.0-mockdriver",
       "fixturePromptId": "canary-prompt-03",
       "responseWordCount": 55,
       "grades": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rcf-lite",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "type": "module",
   "description": "One-install tooling for the Requirements Confidence Framework (RCF): the unified `rcf` CLI grouped into the five RCF tool groups (discover, define, build, verify, audit) plus a small core set (init, doctor, guidance, mcp), an MCP server, the live tree viewer and the fresh-context adversarial ship-gate verifier. Consumes @stravica-ai/rcf-schemas.",
   "license": "Apache-2.0",

package/rcf/code-nodes/cn-134.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-134",
+  "path": "../../blueprints/application-empty-error-states/blueprint.json",
+  "implementsAcIds": [
+    "AC-2401-1",
+    "AC-2401-2"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-06T15:39:29.738Z",
+  "updatedAt": "2026-09-06T15:39:29.738Z"
+}

package/rcf/code-nodes/cn-135.json

@@ -0,0 +1,12 @@
+{
+  "cnId": "CN-135",
+  "path": "../../blueprints/application-empty-error-states/probe-packs/application-empty-error-states.pack.mjs",
+  "implementsAcIds": [
+    "AC-2401-3"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-06T15:39:29.906Z",
+  "updatedAt": "2026-09-06T15:39:29.906Z"
+}

package/rcf/code-nodes/cn-136.json

@@ -0,0 +1,13 @@
+{
+  "cnId": "CN-136",
+  "path": "../../packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/server.js",
+  "implementsAcIds": [
+    "AC-2401-4",
+    "AC-2401-5"
+  ],
+  "dependencies": [],
+  "version": "0.1.0",
+  "status": "draft",
+  "createdAt": "2026-09-06T15:39:30.074Z",
+  "updatedAt": "2026-09-06T15:39:30.074Z"
+}