rcf-lite 0.21.0 → 0.22.0

package/rcf/test-suites/ts-070.json

@@ -0,0 +1,62 @@
+{
+  "createdAt": "2026-09-06T17:02:27.310Z",
+  "updatedAt": "2026-09-06T17:02:29.479Z",
+  "purpose": "Cover AC-4001-1..6 via unit tests over the shipped persistence-data-postgres blueprint shape, applies-clean behaviour, DELIBERATE conflict surface on persistenceStore and migrationDiscipline, six Node-only probe module contract, induced-failure switches, and shelf-doc consistency.",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-4001-1",
+    "AC-4001-2",
+    "AC-4001-3",
+    "AC-4001-4",
+    "AC-4001-5",
+    "AC-4001-6"
+  ],
+  "id": "TS-070",
+  "usId": "US-4001",
+  "title": "persistence-data-postgres v1.0.0 shelf shape, conflict-on-topics-surface, six-probe module contract and shelf-doc consistency",
+  "testCases": [
+    {
+      "id": "TC-070-blueprint-json-shape",
+      "acId": "AC-4001-1",
+      "description": "Cover AC-4001-1 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/persistence-data-postgres-anatomy.test.js::blueprint.json declares 26 contributions with capabilities relationalStore and suggestedCompanions logging and errorHandling (TC-070-blueprint-json-shape)"
+    },
+    {
+      "id": "TC-070-applies-clean-no-persistence",
+      "acId": "AC-4001-2",
+      "description": "Cover AC-4001-2 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/persistence-data-postgres-anatomy.test.js::apply persistence-data-postgres on a bare scratch project writes 26 contributions and validate plus strict audits exit zero (TC-070-applies-clean-no-persistence)"
+    },
+    {
+      "id": "TC-070-conflict-with-d1",
+      "acId": "AC-4001-3",
+      "description": "Cover AC-4001-3 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/persistence-data-postgres-anatomy.test.js::apply persistence-data-postgres on a d1-applied scratch project surfaces globalAdrTopic conflict on persistenceStore and migrationDiscipline (TC-070-conflict-with-d1)"
+    },
+    {
+      "id": "TC-070-probe-anchor-ids-cross-check",
+      "acId": "AC-4001-4",
+      "description": "Cover AC-4001-4 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/persistence-data-postgres-anatomy.test.js::every probe module exports the section 3.2 verdict envelope with an anchorAcId matching a contributed AC id (TC-070-probe-anchor-ids-cross-check)"
+    },
+    {
+      "id": "TC-070-fixture-and-switches",
+      "acId": "AC-4001-5",
+      "description": "Cover AC-4001-5 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/persistence-data-postgres-anatomy.test.js::sample-app fixture ships docker-compose.yml, migrations, store.mjs, recovery.mjs, and its README documents both induced-failure switches (TC-070-fixture-and-switches)"
+    },
+    {
+      "id": "TC-070-shelf-doc-consistency",
+      "acId": "AC-4001-6",
+      "description": "Cover AC-4001-6 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/persistence-data-postgres-anatomy.test.js::section 6a table gains a relationalStore row and every shipped blueprint docs/topics.md gains a persistence-data-postgres row at 27101-27899 / 28xx (TC-070-shelf-doc-consistency)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/test-suites/ts-071.json

@@ -0,0 +1,62 @@
+{
+  "createdAt": "2026-09-06T17:50:13.712Z",
+  "updatedAt": "2026-09-06T17:51:32.845Z",
+  "purpose": "Cover AC-4101-1..6 via unit tests over the shipped object-storage-s3 blueprint shape (contribution count, capabilities, suggestedCompanions, ADR standardsTraceClause), applies-clean-with-secrets and refuses-without behaviour, six Node-only probe module contract with anchorAcId cross-check, induced-failure switch documentation on the fixture README, and shelf-doc consistency (section 6a table row for objectStorage, shelf-wide docs/topics.md row for object-storage-s3 at 28101-28899 / 29xx).",
+  "testLevel": "unit",
+  "acIds": [
+    "AC-4101-1",
+    "AC-4101-2",
+    "AC-4101-3",
+    "AC-4101-4",
+    "AC-4101-5",
+    "AC-4101-6"
+  ],
+  "id": "TS-071",
+  "usId": "US-4101",
+  "title": "object-storage-s3 v1.0.0 shelf shape, apply-on-secrets-present, apply-refusal-on-bare, six-probe module contract, induced-failure switches and shelf-doc consistency",
+  "testCases": [
+    {
+      "id": "TC-071-blueprint-json-shape",
+      "acId": "AC-4101-1",
+      "description": "Cover AC-4101-1 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::blueprint.json declares 21 contributions with capabilities objectStorage, suggestedCompanions logging and errorHandling, and standardsTraceClause on every ADR entry (TC-071-blueprint-json-shape)"
+    },
+    {
+      "id": "TC-071-applies-clean-with-secrets",
+      "acId": "AC-4101-2",
+      "description": "Cover AC-4101-2 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::apply object-storage-s3 lands 21 contributions on a scratch project with security-secrets-management applied (TC-071-applies-clean-with-secrets)"
+    },
+    {
+      "id": "TC-071-apply-refusal-and-override",
+      "acId": "AC-4101-3",
+      "description": "Cover AC-4101-3 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::apply object-storage-s3 refuses on a bare fixture without security-secrets-management and lands with --allow-no-secrets-yet (TC-071-apply-refusal-and-override)"
+    },
+    {
+      "id": "TC-071-probe-anchor-ids-cross-check",
+      "acId": "AC-4101-4",
+      "description": "Cover AC-4101-4 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::every probe module exports the section 3.2 verdict envelope with an anchorAcId matching a contributed AC id (TC-071-probe-anchor-ids-cross-check)"
+    },
+    {
+      "id": "TC-071-fixture-and-switches",
+      "acId": "AC-4101-5",
+      "description": "Cover AC-4101-5 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::sample-app fixture ships docker-compose.yml, package.json, src/object-store.mjs, src/secrets.mjs, and its README documents docker and podman and the four wired induced-failure switches (TC-071-fixture-and-switches)"
+    },
+    {
+      "id": "TC-071-shelf-doc-consistency",
+      "acId": "AC-4101-6",
+      "description": "Cover AC-4101-6 via anatomy test",
+      "status": "pending",
+      "testPointer": "test/blueprint/object-storage-s3-anatomy.test.js::section 6a table gains an objectStorage row and every shipped blueprint docs/topics.md gains an object-storage-s3 row at 28101-28899 / 29xx (TC-071-shelf-doc-consistency)"
+    }
+  ],
+  "status": "draft"
+}

package/rcf/user-stories/us-2401.json

@@ -0,0 +1,62 @@
+{
+  "createdAt": "2026-09-06T15:38:51.042Z",
+  "updatedAt": "2026-09-06T15:38:51.042Z",
+  "asA": "shelf consumer applying the application-empty-error-states v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the eight named states of the empty and error catalogue, the recovery-action router across parent-surface search request-access and retry, the offline state with the write-buffer contract, and a sample-app fixture proving the pack passes on a compliant surface and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the eight-state contract with a runtime-verified pack, the least-privilege surface for the 500 and 403 states, and a golden fixture the pack refuses on a surface that leaks a stack trace, leaks a resource id, drops a recovery affordance, or drops the polite live-region wrapper",
+  "description": "US-2401 anchors the shelf-shape acceptance criteria for the T-1 track: shelf carries blueprint.json with the ratified shape, contributions apply cleanly on a fresh init project, the pack cross-checks against contributed AC ids, the sample-app fixture serves every state on the honest branch, and the break switches refuse on the negative branch. The blueprint contributes 19 to 24 further AC records on its own USs 22101 to 22108; those are covered by the pack against the fixture and by the anatomy test that walks the contributions.",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2401-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shelf carries blueprints/application-empty-error-states/blueprint.json declaring slug application-empty-error-states, version 1.0.0, category application, and 19 to 24 contributions in the 5 REQ / 8 US / 3 TAC / 3 ADR groups per spec section 5.1; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.1; providesRoles is absent; capabilities is absent or empty; requiresAppliedCapabilities is absent (no auth required)."
+    },
+    {
+      "id": "AC-2401-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "rcf define blueprint add ./blueprints/application-empty-error-states applies the 19 contributions cleanly on a fresh init project (exit 0, contribution count matches blueprint.json); rcf define validate on the scratch project reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project."
+    },
+    {
+      "id": "AC-2401-3",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shipped probe pack blueprints/application-empty-error-states/probe-packs/application-empty-error-states.pack.mjs loads via T-0s pack-loader against a scratch project with the blueprint applied; each of its eight check ids (AC-22101-1 through AC-22108-1) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack-level appliesTo predicate references BOTH tacIds and route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source."
+    },
+    {
+      "id": "AC-2401-4",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/ ships a dependency-free Node HTTP server (server.js) with a start script; every one of the eight states renders on its default branch and is selectable via ?state=<name>; PORT env overrides the bind port (default 3000, never binds 4200); the fixture responds LISTENING <port> once bound."
+    },
+    {
+      "id": "AC-2401-5",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The probe pack refuses ship on each broken fixture branch: ?break=stack-trace re-adds a stack trace to the 500 state so AC-22103-1 fails at severity block; ?break=leak-id re-adds the resource id to the forbidden and permission-denied surfaces so AC-22102-1 or AC-22104-1 fails at severity block; ?break=no-recovery drops the recovery control from the empty-list state so AC-22106-1 fails at severity block; ?break=no-live-region drops the polite live-region wrapper so AC-22105-1 (offline reconnection announcement) fails at severity block."
+    },
+    {
+      "id": "AC-2401-6",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The eight enumerated named states appear identically across the scope paragraph in the blueprint README, the packs checks[] list, the guide, and the docs/topics.md registry table; a grep sweep for each state slug (not-found, forbidden, server-error, offline, permission-denied, empty-list, no-search-results, error-boundary) confirms every occurrence is accounted for and no state is silently dropped."
+    },
+    {
+      "id": "AC-2401-7",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The blueprint README lists every runtime-observable AC the pack does NOT bind directly under Known mechanism-reach gaps, individually per AC id; the blueprint CHANGELOG.md carries a single 1.0.0 entry naming the eight state contracts, the pack checks, the recovery-action router and the offline strategy ADR; docs/topics.md carries the shelf id band registry table extended with the T-1 row (application-empty-error-states 22101-22899 / 23xx)."
+    }
+  ],
+  "tacIds": [],
+  "tags": [
+    "blueprint:application-empty-error-states"
+  ],
+  "version": "0.1.0",
+  "status": "draft",
+  "usId": "US-2401",
+  "prdId": "PRD-001",
+  "reqId": "REQ-024",
+  "title": "The application-empty-error-states blueprint ships on the shelf with its eight-state pack and sample-app fixture; the pack refuses on the four break switches"
+}

package/rcf/user-stories/us-2501.json

@@ -0,0 +1,58 @@
+{
+  "createdAt": "2026-09-06T16:55:12.496Z",
+  "updatedAt": "2026-09-06T16:56:03.586Z",
+  "description": "US-2501 anchors the shelf-shape acceptance criteria for the T-2 track: shelf carries blueprint.json with the ratified shape, contributions apply cleanly on a fresh init project, the pack cross-checks against contributed AC ids, the sample-app fixture serves both transport branches (multipart POST default and tus.io elicited alternative) on the honest branch, and the break switches refuse on the negative branch. The blueprint contributes further AC records on its own USs 23101 to 23107; those are covered by the pack against the fixture and by the anatomy test that walks the contributions.",
+  "usId": "US-2501",
+  "prdId": "PRD-001",
+  "reqId": "REQ-025",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-file-upload blueprint ships on the shelf with its four-check pack and sample-app fixture; the pack refuses on the four break switches",
+  "asA": "shelf consumer applying the application-file-upload v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the four surface-observable checks of the file-upload contract (input surface with a labelled file input plus drop-zone plus keyboard alternative, transport contract with a chunked path and a refusal contract, and a progress announcer with a polite tick and an assertive completion), and a sample-app fixture proving the pack passes on both transport branches multipart POST and tus.io and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the WCAG 2.5.7 dragging-movements safe file-upload contract with a runtime-verified pack, one recommended transport with two elicited alternatives, and a golden fixture the pack refuses on a surface that drops the file input, drops the polite live-region, ships a refused file to the server or collapses the chunked path",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2501-1",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shelf carries blueprints/application-file-upload/blueprint.json declaring slug application-file-upload, version 1.0.0, category application, and 18 to 22 contributions in the 5 REQ / 7 US / 3 TAC / 3 ADR groups per spec section 5.2; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.2; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities is absent."
+    },
+    {
+      "id": "AC-2501-2",
+      "testable": true,
+      "scope": "runtime",
+      "description": "rcf define blueprint add ./blueprints/application-file-upload applies the 18 contributions cleanly on a fresh init project (exit 0, contribution count matches blueprint.json); rcf define validate on the scratch project reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project."
+    },
+    {
+      "id": "AC-2501-3",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The shipped probe pack blueprints/application-file-upload/probe-packs/application-file-upload.pack.mjs loads via T-0s pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-23101-1 input surface, AC-23102-1 progress announcer, AC-23103-1 refusal contract, AC-23104-1 chunked transport) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack-level appliesTo predicate references BOTH tacIds and route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source."
+    },
+    {
+      "id": "AC-2501-4",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-file-upload/ ships a dependency-free Node HTTP server (server.js) with a start script; on the multipart POST default branch the four states idle, uploading, refused and complete render honestly and per-file plus aggregate progress ticks fire through the polite live-region wrapper; on the ?transport=tus branch chunked PATCH uploads carry an Upload-Offset header per chunk and the assertive completion announcement fires; PORT env overrides the bind port (default 3000, never binds 4200); the fixture responds LISTENING <port> once bound."
+    },
+    {
+      "id": "AC-2501-5",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The probe pack refuses ship on each broken fixture branch: ?break=no-input drops the file input leaving only the drop-zone so AC-23101-1 fails at severity block (WCAG 2.5.7 keyboard alternative gone); ?break=no-live-region drops the polite live-region wrapper so AC-23102-1 fails at severity block; ?break=send-refused sends a refused file to the server so AC-23103-1 fails at severity block (a POST for the refused filename is observed on the network); ?break=no-chunks collapses the chunked path to a single POST so AC-23104-1 fails at severity block (no Upload-Offset header on any request)."
+    },
+    {
+      "id": "AC-2501-6",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The four fixture states (idle, uploading, refused, complete) and the two transport slugs (multipart, tus) appear identically across the scope paragraph in the blueprint README, the packs checks[] list, the guide, the fixture README and the docs/topics.md registry table; a grep sweep for each slug confirms every occurrence is accounted for and no state or transport is silently dropped."
+    },
+    {
+      "id": "AC-2501-7",
+      "testable": true,
+      "scope": "runtime",
+      "description": "The blueprint README lists every runtime-observable AC the pack does NOT bind directly under Known mechanism-reach gaps, individually per AC id; the blueprint CHANGELOG.md carries a single 1.0.0 entry naming the input contract, the progress contract, the refusal contract, the transport contract with the multipart default and the tus.io elicited alternative, the completion contract, the pack checks, the sample-app fixture and the three ADRs; docs/topics.md carries the shelf id band registry table extended with the T-2 row (application-file-upload 23101-23899 / 24xx)."
+    }
+  ]
+}

package/rcf/user-stories/us-2601.json

@@ -0,0 +1,51 @@
+{
+  "createdAt": "2026-09-06T19:03:26.530Z",
+  "updatedAt": "2026-09-06T19:07:14.938Z",
+  "description": "US-2601 anchors the shelf-shape acceptance criteria for the T-3 track: shelf carries blueprint.json with the ratified shape, contributions apply cleanly on a fresh init project, the pack cross-checks against contributed AC ids, the sample-app fixture serves the four wizard surfaces honestly and drives both save-and-return transports on their query branches, and the break switches refuse on the negative branch. The blueprint contributes further AC records on its own USs 24101 to 24108; those are covered by the pack against the fixture and by the anatomy test that walks the contributions.",
+  "usId": "US-2601",
+  "prdId": "PRD-001",
+  "reqId": "REQ-026",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-forms-wizard blueprint ships on the shelf with its four-check pack and sample-app fixture; the pack refuses on the four break switches",
+  "asA": "shelf consumer applying the application-forms-wizard v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the four surface-observable checks of the wizard contract (task-list contract with the closed GOV.UK vocabulary, error-summary contract with the top-of-page summary and aria bindings, summary-review pattern with the change-per-row and answer retention, and save-and-return contract with a server-side draft table or a client-side local buffer with a sync tick), and a sample-app fixture proving the pack passes on the honest render of the four wizard surfaces and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets the WCAG 2.2 AA compliant multi-step forms contract with a runtime-verified pack, the GOV.UK Design System task-list pattern out of the box, one recommended navigation posture with an elicited alternative, two save-and-return transports with no default so the abandoned-draft loss class does not ship silently, and a golden fixture the pack refuses on a surface that swaps a state string away from the closed vocabulary, drops the error summary, drops answer retention on the summary review, or drops the draft transport altogether",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2601-1",
+      "description": "The shelf carries blueprints/application-forms-wizard/blueprint.json declaring slug application-forms-wizard, version 1.0.0, category application, and 19 contributions in the 5 REQ / 8 US / 3 TAC / 3 ADR groups per spec section 5.3; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.3; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities is absent.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-2",
+      "description": "rcf define blueprint add ./blueprints/application-forms-wizard applies the 19 contributions cleanly on a fresh init project (exit 0, contribution count matches blueprint.json); rcf define validate on the scratch project reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-3",
+      "description": "The shipped probe pack blueprints/application-forms-wizard/probe-packs/application-forms-wizard.pack.mjs loads via T-0 pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-24101-1 task-list, AC-24103-1 error-summary, AC-24104-1 summary-review, AC-24105-1 save-and-return) resolves to an AC id contributed by the blueprint per T-0 AC-1701-3; every check carries a description field per spec section 9; the pack-level appliesTo predicate references BOTH tacIds and route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-4",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-forms-wizard/ ships a dependency-free Node HTTP server (server.js) with a start script; on the honest branch /task-list renders the ARIA progressbar wrapper plus one step row per manifest entry with a data-step-state from the closed GOV.UK vocabulary; /step/2?refused=1 pre-renders the error-summary shape with a heading, one skip link per failed field and aria-invalid=\"true\" on the field with aria-describedby to the message; /summary?seed=complete renders one summary-list section per step with data-summary-row entries and a data-recovery=\"change\" link per row; /step/1?draft-store=server&preseed=1 writes into the in-memory drafts table so GET /drafts returns the persisted fields, and /step/1?draft-store=local&preseed=1 writes to window.localStorage under draft:application-forms-wizard:<step-slug> and renders [data-sync-tick] carrying an ISO-8601 timestamp; PORT env overrides the bind port (default 3000, never binds 4200); the fixture prints LISTENING <port> once bound.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-5",
+      "description": "The probe pack refuses ship on each broken fixture branch: ?break=task-list-vocab swaps a step-state string away from the closed GOV.UK vocabulary so AC-24101-1 fails at severity block; ?break=no-summary drops the [data-surface=\"error-summary\"] region on the refused step so AC-24103-1 fails at severity block; ?break=no-retain wipes every unedited answer on the edit-and-save round-trip so AC-24104-1 fails at severity block; ?break=no-draft drops the draft transport altogether so AC-24105-1 fails at severity block on both branches (no POST to /drafts, no localStorage write, no data-sync-tick element).",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-6",
+      "description": "The four state slugs from the closed GOV.UK vocabulary (Cannot start yet, Not started, In progress, Completed), the two save-and-return transport slugs (server-draft-table, client-local-buffer), the four break switches and the four probe-pack check ids appear identically across the scope paragraph in the blueprint README, the pack checks[] list, the guide, the fixture README and the docs/topics.md registry table; a grep sweep for each slug confirms every occurrence is accounted for and no vocabulary string is silently dropped.",
+      "testable": true
+    },
+    {
+      "id": "AC-2601-7",
+      "description": "The blueprint README lists every runtime-observable AC the pack does NOT bind directly under Known mechanism-reach gaps, individually per AC id; the blueprint CHANGELOG.md carries a single 1.0.0 entry naming the task-list contract, the per-step validation timing rule, the error-summary contract, the summary-review pattern, the save-and-return contract with the two transports, the pack checks, the sample-app fixture and the three ADRs; docs/topics.md carries the shelf id band registry table extended with the T-3 row (application-forms-wizard 24101-24899 / 25xx) and the cross-reference to application-empty-error-states for the no-in-progress empty state.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2701.json

@@ -0,0 +1,55 @@
+{
+  "createdAt": "2026-09-06T21:11:39.906Z",
+  "updatedAt": "2026-09-06T21:12:11.457Z",
+  "usId": "US-2701",
+  "prdId": "PRD-001",
+  "reqId": "REQ-027",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-account-settings blueprint ships on the shelf with its 5-check pack and sample-app fixture; the pack refuses on the four break switches; the four auth minors and the observability-logging minor bump ship in the same PR with the extended section 6a capability table",
+  "asA": "shelf consumer applying the application-account-settings v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the five surface-observable checks (shell tabs, profile autocomplete, security branch, sessions dialog-modal, theme radiogroup) with capability-gated appliesTo, and a sample-app fixture proving the pack passes on the honest render of the five conditional surfaces and fails on the four break switches; the four auth blueprint minor bumps and the observability-logging minor bump riding the same PR extending the section 6a capability table with credentialSelfService sessionInventory and hostedIdentityUi",
+  "soThat": "a project consuming rcf-lite gets the WCAG 2.2 AA compliant account-settings surface with a runtime-verified pack that gates on the applied capability set (no bespoke work when magic-link is applied and only profile activates; the security surface renders self-service on Keycloak or hosted-link-out on Clerk; the sessions surface renders on any applied sessionInventory provider including observability-logging as the logging-projection provider), one recommended default per elicit where honest and no recommended default on security-surface-shape where dishonest",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2701-1",
+      "description": "The shelf carries blueprints/application-account-settings/blueprint.json declaring slug application-account-settings, version 1.0.0, category application, and 24 contributions in the 6 REQ / 10 US / 4 TAC / 4 ADR groups per spec section 5.4; suggestedCompanions declares logging and errorHandling with reasons; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities declares principalDirectory with allowSkipFlag allow-no-auth-yet and refusalMessageId application-account-settings-bare-spa.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-2",
+      "description": "The shelf carries blueprints/application-account-settings/blueprint.json declaring slug application-account-settings, version 1.0.0, category application, and 24 contributions in the 6 REQ / 10 US / 4 TAC / 4 ADR groups per spec section 5.4; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.4; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities declares principalDirectory with allowSkipFlag allow-no-auth-yet and refusalMessageId application-account-settings-bare-spa.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-3",
+      "description": "rcf define blueprint add ./blueprints/application-account-settings applies the 24 contributions cleanly on a fresh init project with security-auth-magic-link applied (exit 0, contribution count matches blueprint.json); the applied sidecar records appliedCapabilities principalDirectory only; a fresh init project with no auth applied refuses at exit 3 with the [application-account-settings-bare-spa] refusal message; --allow-no-auth-yet applies with allowNoAuthYet true and a scaffolding-pass note on the sidecar.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-4",
+      "description": "The shipped probe pack blueprints/application-account-settings/probe-packs/application-account-settings.pack.mjs loads via T-0 pack-loader against a scratch project with the blueprint applied; each of its five check ids (AC-25101-1 shell, AC-25102-1 profile, AC-25105-1 security, AC-25106-1 sessions, AC-25108-1 theme) resolves to an AC id contributed by the blueprint; every check carries a description field; the pack-level appliesTo predicate references BOTH tacIds AND route; every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-5",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/ ships a dependency-free Node HTTP server (server.js) with a start script; on the honest branch /account renders the ARIA APG tabs shell whose tabs mirror the CAPS env; /account/profile renders the form with autocomplete tokens name email bday country; /account/security?security-surface-shape=self-service renders the change-password and mfa-management regions when credentialSelfService is in CAPS; /account/sessions renders one row per session with data-session-id and a terminate control on non-current rows plus the ARIA dialog-modal; /account/theme renders the radiogroup with light dark system and persists per the ACCOUNT_SETTINGS_THEME_PERSIST env; PORT env overrides the bind port (default 3000, never binds 4200).",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-6",
+      "description": "The probe pack fails on each broken fixture branch: ?break=leak-tab renders the security tab even when neither credentialSelfService nor hostedIdentityUi is in CAPS so AC-25101-1 fails at severity block; ?break=no-autocomplete drops the autocomplete tokens on the profile form so AC-25102-1 fails at severity block; ?break=no-dialog removes the terminate confirmation dialog so AC-25106-1 fails at severity block; ?break=no-persist drops the theme persistence write so AC-25108-1 does not fail on this fixture-side signal directly but the data-persist attribute mismatch triggers the fail.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-7",
+      "description": "The four capability strings principalDirectory credentialSelfService sessionInventory hostedIdentityUi and the security surface shape enum self-service hosted-link-out hosted-embed appear identically across README, guide, pack checks[] descriptions and docs/topics.md registry; the section 6a capability table in packages/rcf-lite/docs/blueprint-authoring.md lists credentialSelfService sessionInventory and hostedIdentityUi with the shelf providers named.",
+      "testable": true
+    },
+    {
+      "id": "AC-2701-8",
+      "description": "README lists mechanism-reach gaps individually per AC id per checklist section 6.g; CHANGELOG carries one 1.0.0 entry naming the auth minors and the observability-logging minor that ride the same PR; docs/topics.md carries the T-4 shelf registry row and the cross-references to application-empty-error-states and application-admin-console; the four amended auth blueprints each carry a README latest note and a CHANGELOG entry naming the new capabilities and the account-settings consumer; the observability-logging blueprint carries the same.",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-2801.json

@@ -0,0 +1,55 @@
+{
+  "createdAt": "2026-09-06T23:03:12.225Z",
+  "updatedAt": "2026-09-06T23:04:29.543Z",
+  "usId": "US-2801",
+  "prdId": "PRD-001",
+  "reqId": "REQ-028",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The application-onboarding-tour blueprint ships on the shelf with its 4-check pack and sample-app fixture; the pack refuses on the four break switches; the tour composes on dashboard notifications-in-app account-settings and the SPA with the documented fallback per Q4 when no persistence blueprint is applied",
+  "asA": "shelf consumer applying the application-onboarding-tour v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files, the Playwright probe pack anchoring the four surface-observable checks (step-container focus and Escape, tooltip-as-dialog contract, checklist slot with dashboard-when-applied and settings-page-when-not, completion-state persistence per the elicited store shape) with the pack composing on the applied blueprint set (dashboard for the anchor slot, notifications-in-app for the completion announcement, account-settings for the restart control, any auth for the per-principal state) and a sample-app fixture proving the pack passes on both the ?apps=dashboard and ?apps= (empty) branches plus multiple ?store= branches and refuses on the four break switches",
+  "soThat": "a project consuming rcf-lite gets a WCAG 2.2 AA compliant onboarding-tour surface (2.1.1 Keyboard, 2.1.2 No Keyboard Trap, 2.4.11 Focus Not Obscured Minimum, 2.4.3 Focus Order) built on the ARIA APG dialog-modal pattern, a first-run checklist that renders on the dashboard shell when application-dashboard is applied and collapses to the settings page when not, three-to-five steps with per-step content owned by the project voice, one recommended default per elicit (dismissal policy dismiss-permanently, completion-state store spa-local-storage per Q4 when no persistence blueprint is applied, checklist anchor derived at apply time), and a documented restart-tour affordance on the settings surface",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-2801-1",
+      "description": "The shelf carries blueprints/application-onboarding-tour/blueprint.json declaring slug application-onboarding-tour, version 1.0.0, category application, and 17 to 22 contributions in the 4 REQ / 7 US / 3 TAC / 3 ADR groups per spec section 5.5; suggestedCompanions declares logging and errorHandling with reasons from spec section 5.5; providesRoles is absent; capabilities is absent; requiresAppliedCapabilities is absent (no hard dependency; documented Q4 fallback spa-local-storage when no persistence blueprint is applied).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-2",
+      "description": "The 3 ADR JSON documents under blueprints/application-onboarding-tour/contributions/adrs/ validate against rcf-schemas 0.6.1 ADR shape; the ADR contribution entries in blueprint.json carry a non-null standardsTraceClause per spec section 8a.4 (dialog-modal pattern for ADR-2701, WCAG 2.5.3 or generic enterprise practice for ADR-2702 and ADR-2703 as honest); ADR-2701 dismissal-policy declares recommendedDefault true elicited true; ADR-2702 completion-store-shape declares elicited true with the Q4 default spa-local-storage; ADR-2703 checklist-anchor declares elicited true with the default derived at apply time.",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-3",
+      "description": "rcf define blueprint add ./blueprints/application-onboarding-tour applies the 17 contributions cleanly on a fresh init project (exit 0; contribution count matches blueprint.json); the applied sidecar records appliedElicitations for dismissal policy completion-state store checklist anchor tour-step-manifest per-step-content-voice; no requiresAppliedCapabilities refusal fires (T-5 has no hard dependency).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-4",
+      "description": "The shipped probe pack blueprints/application-onboarding-tour/probe-packs/application-onboarding-tour.pack.mjs loads via the T-0 pack-loader against a scratch project with the blueprint applied; each of its four check ids (AC-26101-1 step-container focus and Escape, AC-26102-1 tooltip-as-dialog contract, AC-26103-1 checklist slot with dashboard-when-applied and settings-page-when-not, AC-26104-1 completion-state persistence) resolves to an AC id contributed by the blueprint; every check carries a description field; the pack-level appliesTo predicate references BOTH tacIds AND route (via the operator-configured tour-anchor path glob); every URL string is composed by the withUrl(runtimeUrl, path) helper and no bare string concatenation appears in the pack source; the tooltip-as-dialog check uses browser.resize(1440, 900) and browser.resize(360, 640) to probe focus-not-obscured (WCAG 2.4.11).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-5",
+      "description": "The sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-onboarding-tour/ ships a dependency-free Node HTTP server (server.js) with a start script; on the honest branch /tour renders the tooltip-as-dialog opened on the first step (role=dialog, aria-labelledby to the step heading, focus moves to the tooltip on open, focus returns to the anchor on close); Escape dismisses the tour; Tab traverses tour controls in DOM order and Enter activates the next step; ?apps=dashboard renders the checklist as a <details open> on the dashboard-top anchor; ?apps= (empty) renders the checklist as a <details> (closed) on the settings-page anchor; ?store=<spa-local-storage|spa-session-storage|server-side-per-principal> selects the completion-store backend; ?first-run=<0|1> gates the auto-open; PORT env overrides the bind port (default 3000, never binds 4200).",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-6",
+      "description": "The probe pack fails on each broken fixture branch: ?break=no-role drops role=dialog on the tooltip so AC-26102-1 fails at severity block; ?break=focus-escape allows Tab to escape the tooltip to the underlying surface so AC-26101-1 fails at severity block; ?break=no-collapse drops the <details> collapse contract on the checklist slot so AC-26103-1 fails at severity block; ?break=no-persist drops the completion-state write so AC-26104-1 fails at severity block. The aggregate verdict on each break switch reports fail.",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-7",
+      "description": "The four surface-observable checks (AC-26101-1 step-container, AC-26102-1 tooltip-as-dialog, AC-26103-1 checklist-slot, AC-26104-1 completion-state) appear identically across README, guide, pack checks[] descriptions, and docs/topics.md registry; the topics.md T-5 row lists the four cross-references (application-dashboard, application-notifications-in-app, application-account-settings, application-spa) with the compose reason in one line each; the Q4 default (spa-local-storage) is named on ADR-2702 and README with the same rationale.",
+      "testable": true
+    },
+    {
+      "id": "AC-2801-8",
+      "description": "README lists mechanism-reach gaps individually per AC id per checklist section 6.g (T-1 gate discipline); CHANGELOG carries one 1.0.0 entry naming the four checks, the checklist collapse contract and the Q4 fallback; guide/application-onboarding-tour.md exists and names the ARIA APG dialog-modal pattern with a URL, the WCAG 2.2 AA success criteria (2.1.1, 2.1.2, 2.4.3, 2.4.11) with links, the fixture READMEs manual boot line, and the Q4 fallback rationale; packages/rcf-lite/CHANGELOG.md is NOT edited (the round-close release PR owns the 0.22.0 entry).",
+      "testable": true
+    }
+  ]
+}

package/rcf/user-stories/us-4001.json

@@ -0,0 +1,69 @@
+{
+  "createdAt": "2026-09-06T16:59:00.000Z",
+  "updatedAt": "2026-09-06T16:59:00.000Z",
+  "usId": "US-4001",
+  "prdId": "PRD-001",
+  "reqId": "REQ-040",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The persistence-data-postgres blueprint ships on the shelf; six Node-only probes pass against a live postgres:17-alpine container and refuse on each induced failure",
+  "asA": "shelf consumer applying the persistence-data-postgres v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files with 26 contributions and six probes, a sample-app fixture that boots postgres:17-alpine and applies three toy forward-only migrations, and gate-runnable proof that every probe passes on the canonical fixture state and refuses on each induced-failure switch",
+  "soThat": "a rcf-lite project applying this blueprint gets a facade contract over pg with numbered forward-only migrations, prepared-statement discipline, transactional atomicity, a two-path recovery model, and pool posture per deploy target, with runtime-observable ACs proven by probes the HQ gate runs against a real Postgres container rather than a simulated harness",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-4001-1",
+      "description": "The shelf carries blueprints/persistence-data-postgres/blueprint.json declaring slug persistence-data-postgres, version 1.0.0, category persistence, 26 contributions in the 7 REQ / 10 US / 4 TAC / 5 ADR groups per infra round 5 spec section 5.1; capabilities is [relationalStore]; suggestedCompanions declares logging and errorHandling with spec section 5.1 reasons; providesRoles is absent; requiresAppliedCapabilities is absent.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "jq queries against blueprints/persistence-data-postgres/blueprint.json",
+      "then": "jq .slug returns persistence-data-postgres; jq .version returns 1.0.0; jq .contributions | length returns 26; jq .capabilities | index(relationalStore) returns 0; jq .suggestedCompanions | length returns 2",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-2",
+      "description": "rcf define blueprint add ./blueprints/persistence-data-postgres applies the 26 contributions cleanly on a fresh init project with no other persistence blueprint applied; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "given": "a fresh rcf init scratch project with no persistence-* blueprint applied",
+      "when": "rcf define blueprint add ./blueprints/persistence-data-postgres runs, then rcf define validate, then rcf audit coverage --strict, then rcf audit eval coverage --strict",
+      "then": "every command exits 0; the scratch project's rcf tree contains the 26 contributions; no globalAdrTopic conflict is raised",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-3",
+      "description": "rcf define blueprint add ./blueprints/persistence-data-postgres on a scratch project with persistence-data-d1 already applied surfaces a DELIBERATE conflict on the persistenceStore and migrationDiscipline global-ADR topics per the round-2 pattern; the tree is untouched by the failed add.",
+      "given": "a fresh rcf init scratch project with persistence-data-d1 v1.0.0 already applied",
+      "when": "rcf define blueprint add ./blueprints/persistence-data-postgres runs against the scratch project",
+      "then": "the add refuses with a globalAdrTopic conflict list containing persistenceStore and migrationDiscipline; the scratch project's rcf tree does not carry persistence-data-postgres contributions after the refusal",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-4",
+      "description": "The six probe modules under blueprints/persistence-data-postgres/contributions/probes/ each pass against a running postgres:17-alpine container brought up from the sample-app fixture: facade-round-trip asserts facadeReady fires and the round-trip returns; migration-apply asserts three migrations apply inside individual transactions and schema_version advances to 3; prepared-statement-scan asserts every pg.query first-argument node is a static string literal; transaction-atomicity asserts a rollback fires with the failing statement index; recovery-restore-round-trip asserts row-count and checksum equality between source and restored databases; pool-posture-smoke asserts twenty concurrent queries return with no timeout. Each per-blueprint probe report at .rcf/reports/blueprints/persistence-data-postgres/<probe-name>.json carries aggregateVerdict pass.",
+      "given": "the sample-app fixture at packages/rcf-lite/test/fixtures/infra-postgres/ with docker compose up -d postgres running and the fixture applied",
+      "when": "each of the six run-<probe-name>.mjs shims runs against the fixture in sequence",
+      "then": "every shim exits 0; every per-blueprint report file carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id on the blueprint",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-5",
+      "description": "The sample-app fixture's induced-failure switches surface each probe's negative-run behaviour: SIMULATE_MIGRATION_FAILURE=true makes run-migration-apply.mjs exit non-zero with the failing migration filename in its report and the transaction rolled back; SIMULATE_CONSTRAINT_VIOLATION=true names the transaction-atomicity probe's rollback observation. Every negative-run report carries aggregateVerdict fail on the AC anchored to the observation the switch corrupts.",
+      "given": "the sample-app fixture with docker compose up -d postgres running",
+      "when": "the migration-apply probe runs with SIMULATE_MIGRATION_FAILURE=true, and the transaction-atomicity probe runs with SIMULATE_CONSTRAINT_VIOLATION=true",
+      "then": "the migration-apply shim exits non-zero and its report at .rcf/reports/blueprints/persistence-data-postgres/migration-apply.json carries aggregateVerdict fail with the failing migration filename in a detail field; the transaction-atomicity probe records the rollback event with statementIndex 1 as evidence of the constraint-violation semantics",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4001-6",
+      "description": "The blueprint ships a sample-app fixture, a README, a CHANGELOG, a guide, and a docs/topics.md entry; the shelf-wide id-band registry table gains a persistence-data-postgres row at US band 27101-27899 / ADR-TAC suffix block 28xx across every shipped blueprint's docs/topics.md; packages/rcf-lite/docs/blueprint-authoring.md section 6a capability-declaration table gains one row for relationalStore per infra round 5 spec section 5.6.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "grep queries walk every blueprint's docs/topics.md and the section 6a table",
+      "then": "packages/rcf-lite/docs/blueprint-authoring.md contains a table row beginning | relationalStore |; every shipped blueprint's docs/topics.md carries a row beginning | persistence-data-postgres | with the 27101-27899 band and 28xx suffix; blueprints/persistence-data-postgres/README.md, CHANGELOG.md, guide/persistence-data-postgres.md, docs/topics.md, and packages/rcf-lite/test/fixtures/infra-postgres/ all exist; the fixture README names the docker and podman incantations and the two induced-failure switches",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ]
+}

package/rcf/user-stories/us-4101.json

@@ -0,0 +1,69 @@
+{
+  "createdAt": "2026-09-06T17:50:03.129Z",
+  "updatedAt": "2026-09-06T17:50:03.129Z",
+  "asA": "shelf consumer applying the object-storage-s3 v1.0.0 blueprint",
+  "iWant": "the shipped blueprint files with 21 contributions, six probes, and the T-2 side of the shared sample-app fixture that boots MinIO and applies the security-secrets-management shim, plus gate-runnable proof that every probe passes on the canonical fixture state and refuses on each induced-failure switch",
+  "soThat": "a rcf-lite project applying this blueprint gets an S3-shape facade over @aws-sdk/client-s3 or aws4fetch with put/get/delete/list, presigned URLs with bounded TTL, multipart-upload above threshold, a lifecycle-event sink with metadata-only fields, and a compose-time refusal on missing security-secrets-management, with runtime-observable ACs proven by probes the HQ gate runs against a real MinIO container",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-4101-1",
+      "description": "The shelf carries blueprints/object-storage-s3/blueprint.json declaring slug object-storage-s3, version 1.0.0, category object-storage, 21 contributions in the 6 REQ / 8 US / 3 TAC / 4 ADR groups per infra round 5 spec section 5.2; capabilities is [objectStorage]; suggestedCompanions declares logging and errorHandling with spec section 5.2 reasons; providesRoles is absent; requiresAppliedCapabilities is absent; every ADR contribution entry carries a non-null standardsTraceClause per section 8a.2.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "jq queries against blueprints/object-storage-s3/blueprint.json",
+      "then": "jq .slug returns object-storage-s3; jq .version returns 1.0.0; jq .contributions | length returns 21; jq .capabilities returns [objectStorage]; jq .suggestedCompanions | length returns 2; jq .contributions[] | select(.kind==adr) | .standardsTraceClause returns a non-null string for every entry",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-2",
+      "description": "rcf define blueprint add ./blueprints/object-storage-s3 applies the 21 contributions cleanly on a fresh init project with security-secrets-management already applied; rcf define validate reports the tree clean; both rcf audit coverage --strict and rcf audit eval coverage --strict exit 0 on the scratch project.",
+      "given": "a fresh rcf init scratch project with security-secrets-management applied",
+      "when": "rcf define blueprint add ./blueprints/object-storage-s3 runs, then rcf define validate, then rcf audit coverage --strict, then rcf audit eval coverage --strict",
+      "then": "every command exits 0; the scratch project's rcf tree contains the 21 contributions; no globalAdrTopic conflict is raised",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-3",
+      "description": "rcf define blueprint add ./blueprints/object-storage-s3 on a scratch project without security-secrets-management refuses with exit 3 and stable message id object-storage-s3-no-secrets on stderr per REQ-006 and spec section 5.2; the --allow-no-secrets-yet override lands the contributions with a note recorded on source.notes for later reconciliation.",
+      "given": "a fresh rcf init scratch project with no security-secrets-management applied",
+      "when": "rcf define blueprint add ./blueprints/object-storage-s3 runs against the scratch project, then the same command runs with --allow-no-secrets-yet",
+      "then": "the first invocation exits 3 with stderr containing object-storage-s3-no-secrets and naming security-secrets-management and the override flag; the scratch tree does not carry object-storage-s3 contributions after the refusal; the second invocation exits 0 and the applied manifest records a source.notes entry naming the missing predecessor",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-4",
+      "description": "The six probe modules under blueprints/object-storage-s3/contributions/probes/ each pass against a running MinIO container brought up from the shared sample-app fixture: facade-round-trip asserts facadeReady fires with endpointHost and bucketName; put-get-round-trip asserts 1 KiB round-trip byte-equal, list under prefix, and delete round-trip with objectDeleted; presigned-url asserts 200 within TTL, 403 on tampered signature, and floor refusal below 60 s; multipart-upload asserts 10 MiB round-trip byte-equal via multipart with no orphan in-flight uploads; event-secrecy asserts the whitelist and no PII fixture leak; r2-real-account-smoke exits 0 with accountBoundSkipped:true without CI_HAS_CLOUDFLARE_ACCOUNT or runs a real R2 round-trip when the env var is set. Each per-blueprint probe report at .rcf/reports/blueprints/object-storage-s3/<probe-name>.json carries aggregateVerdict pass.",
+      "given": "the shared sample-app fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ with docker compose up -d minio running and the rcf-test bucket created",
+      "when": "each of the six run-<probe-name>.mjs shims runs against the fixture in sequence",
+      "then": "every shim exits 0; every per-blueprint report file carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id on the blueprint",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-5",
+      "description": "The sample-app fixture's induced-failure switches surface each probe's negative-run behaviour: SIMULATE_PART_UPLOAD_FAIL=true drives the multipart-upload probe's AC-28104-2 abort-on-failure path; SIMULATE_PRESIGN_MALFORMED=true drives the presigned-url probe's tampered-signature 403 path; SIMULATE_403_ON_GET=true drives the put-get-round-trip probe's fail on AC-28102-1. Each switched-run report carries aggregateVerdict fail on the AC anchored to the observation the switch corrupts (except SIMULATE_PART_UPLOAD_FAIL which surfaces the pass-on-abort-shape).",
+      "given": "the shared fixture with MinIO running",
+      "when": "each named induced-failure switch is set in turn and the paired probe runs",
+      "then": "SIMULATE_PART_UPLOAD_FAIL true yields multipart-upload report with AC-28104-2 pass and no orphan uploads; SIMULATE_403_ON_GET true yields put-get-round-trip report with aggregateVerdict fail; SIMULATE_PRESIGN_MALFORMED true yields presigned-url first-fetch 403 and aggregateVerdict fail; the fixture README documents each switch and the paired probe",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-4101-6",
+      "description": "The blueprint ships a sample-app fixture entry, a README, a CHANGELOG, a guide, and a docs/topics.md entry; the shelf-wide id-band registry table gains an object-storage-s3 row at US band 28101-28899 / ADR-TAC suffix block 29xx across every shipped blueprint's docs/topics.md; packages/rcf-lite/docs/blueprint-authoring.md section 6a capability-declaration table gains one row for objectStorage per infra round 5 spec section 5.6.",
+      "given": "the shelf tree after this blueprint lands",
+      "when": "grep queries walk every blueprint's docs/topics.md and the section 6a table",
+      "then": "packages/rcf-lite/docs/blueprint-authoring.md contains a table row beginning | objectStorage |; every shipped blueprint's docs/topics.md carries a row beginning | object-storage-s3 | with the 28101-28899 band and 29xx suffix; blueprints/object-storage-s3/README.md, CHANGELOG.md, guide/object-storage-s3.md, docs/topics.md, and packages/rcf-lite/test/fixtures/infra-s3-and-queue/ all exist; the fixture README names docker and podman incantations and four wired induced-failure switches",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "usId": "US-4101",
+  "prdId": "PRD-001",
+  "reqId": "REQ-041",
+  "version": "0.1.0",
+  "status": "draft",
+  "title": "The object-storage-s3 blueprint ships on the shelf with five MinIO probes plus one accountBound R2 smoke"
+}

package/releases/releases.yaml

@@ -40,8 +40,18 @@
 # `npm install rcf-lite`.
 
 feedVersion: 1
-latest: "0.21.0"
+latest: "0.22.0"
 releases:
+  - version: "0.22.0"
+    date: "2026-09-07"
+    breaking: false
+    headlines:
+      - "rcf-lite 0.22.0 fills the visual shelf with five application blueprints (empty and error states, file upload with a WCAG keyboard gate, a multi-step forms wizard, a self-service account settings area, and a first-run onboarding tour)."
+      - "Account settings reuses the admin-console capability-gating mechanism, so the five settings surfaces only render when the applied auth blueprint declares the capability."
+      - "The four shipped auth blueprints and the logging blueprint pick up additive capability declarations in the same release."
+    minAgentAction: null
+    notesUrl: "https://stravica.ai/docs/rcf/changelog/"
+
   - version: "0.21.0"
     date: "2026-09-05"
     breaking: false