rcf-lite 0.25.0 → 0.27.0

package/CHANGELOG.md

@@ -6,6 +6,51 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.27.0] - 2026-09-11
+
+rcf-lite 0.27.0 is a shelf-wide hardening release. Every shipped blueprint has been re-verified against the 2026-09-08 authoring criteria: every requirement is backed at the REQ layer, every user story carries a sufficient acceptance-criteria set with disposition and owner references, and chain-consistency lint reports zero on every slug. Shipped prose is now customer-facing throughout: internal workflow labels, operator names, work-item and dispatch identifiers, and long dashes are gone. CI adds a hard register-scan gate and flips the chain-consistency lint gate to hard mode over the monorepo-root shelf. One CLI reliability fix lands alongside: the `rcf audit view` SIGINT handler is now installed before the readiness line is written, closing a race with Node's default signal disposition. Nothing here is breaking.
+
+### Fixed
+
+- **`rcf audit view` SIGINT handler race (PR #192).** `src/cli/view.js:main` installed the `SIGINT` and `SIGTERM` handlers AFTER writing the `rcf audit view server listening at ...` line, so a caller that keyed on the readiness line and immediately sent `SIGINT` could deliver the signal in the window between the stdout flush and `process.on('SIGINT', ...)` calling into `sigaction`, and the child would be killed by Node's default disposition instead of running its own clean-shutdown path. The `rcf view SIGINT triggers a clean shutdown within the 2s budget` test intermittently failed on CI with `expected a self-directed exit, got killed by SIGINT`. Handlers are now installed before the readiness write; the ordering is a documented contract with a deterministic in-process regression test (`SIGINT/SIGTERM handlers before writing the "listening at" line`) that drives `viewMain` with an injected `onSignal` and asserts install-order against stdout-write-order.
+
+### Changed
+
+- **Shelf-wide hardening pass, criteria a, b and c (PRs #185, #186, #187, #188, #189, #190, #191).** Seven family passes bring every shipped blueprint on the root shelf to the 2026-09-08 authoring criteria: criterion a (every requirement is backed at the REQ layer with a `deliveredBy` reference to a delivering TAC or ADR), criterion b (every user story carries a sufficient acceptance-criteria set, each row marked `fixed` or `template` per section 7b with an `ownerRef` where a TAC contract is observed), and criterion c (chain-consistency lint reports zero on pass 1 and pass 2 for every slug with no suppressions). Coverage across the families: observability, delivery and email (5 slugs, PR #185); edge (4 slugs, PR #186); platform (4 slugs, PR #187); security (5 slugs, PR #188); application core (6 slugs, PR #189); persistence, deploy, messaging, jobs and object storage (8 slugs, PR #190); application tail (7 slugs, PR #191). Each family closes the chain-contradiction specimens named in its brief and moves the shelf-wide unsuppressed-finding total towards zero.
+- **Shelf-wide register sweep and hard-mode lint gates (PR #193).** Every shipped blueprint under `blueprints/` is swept for customer-facing register: internal operator names, work-item and dispatch identifiers, host names, hardening and train labels, and long dashes are removed from shipped prose. The register scan is zero on all 39 slugs including their CHANGELOG entries. `packages/rcf-lite/scripts/run-register-scan.mjs` lands as a Node scanner and is wired into `.github/workflows/ci.yml` as a hard step above the consistency lint, which now runs in hard mode over the monorepo-root shelf (`RCF_LINT_SHELF: root`, `RCF_LINT_MODE: hard`) and reports zero unsuppressed findings on both passes. 38 blueprints take a register patch bump with the note "Register: neutral wording in shipped prose (no capability change)"; the affected anatomy tests and cross-blueprint version pins move in step.
+- **Criterion-f P0 and P1 closure across the shelf (PRs #196, #194, #197, #195).** Four waves close every P0 and P1 criterion-f finding recorded against the shelf in the 2026-09-10 adversarial review. Wave 1 closes seven P0 and eight P1 findings on the security family (PR #196: `security-auth-keycloak`, `security-auth-clerk`, `security-auth-oauth2`, `security-auth-magic-link`, `security-secrets-management`). Wave 2 closes four P0 and eighteen P1 findings on the edge and platform families (PR #194). Wave 3 closes eight P1 dimension-d single-definition-ownership references across seven blueprints and adds two dimension-b refusal acceptance criteria on `application-spa` (PR #197). Wave 5 closes every remaining P0, P1 and P2 recorded against the seven application-tail blueprints (PR #195: `application-admin-console`, `application-onboarding-tour`, `application-account-settings`, `application-empty-error-states`, `application-file-upload`, `application-forms-wizard`, `application-notifications-in-app`), minting new requirements where an elicit prompt was previously unbacked at the REQ layer.
+- **Criterion-f wave 4 P2 and P3 tail across seven families (PRs #198, #199, #200, #201, #202, #204, #206).** Wave 4 closes the criterion-f P2 and P3 residue on the edge (PR #198), object storage (PR #199), deploy (PR #200), security (PR #201), platform (PR #202), messaging (PR #204) and application (PR #206) families. Findings closed on this wave include the last of the shipped-prose register residue (README, guide, ADR consequences), acceptance-criteria vendor citations added where a `vendorCitation` was missing, and a small number of dimension-b acceptance-criteria refinements. Each affected slug takes a patch bump and the anatomy tests move in step.
+- **Criterion-e positive-evidence skip-path conformance on the Cloudflare families (PRs #203, #205).** Every account-bound skip result on the Cloudflare edge and platform families now carries a discrete `reason` field naming the exact unset environment variable, mirrored on `extra`, and the fixture READMEs declare those variables under a "Declared env vars" section. Coverage: `edge-cloudflare-tunnel`, `edge-cloudflare-rate-limiting`, `edge-cloudflare-access` and `edge-cloudflare-turnstile` (PR #203); `platform-cloudflare-kv`, `platform-cloudflare-durable-objects` and `platform-cloudflare-cron-triggers` (PR #205). One incidental probe fix: the cron `platform-cloudflare-cron-triggers` unset-second-tier branch is rewritten from an unreachable `verdict: fail` to a declared skip (positive-evidence rules treat a fail without evidence as a fail regardless of the verdict field, so the branch could never surface).
+
+#### Also in this release
+
+- **Application-charts AC-18105-3 (PR #193).** Prose narrowed to WCAG 1.4.11 to match its `vendorCitation`.
+
+## [0.26.0] - 2026-09-09
+
+rcf-lite 0.26.0 is a hardening and authoring release. The Cloudflare-platform blueprints on the shelf pick up real-account probe drivers with positive evidence and one shared account-token env matrix, the blueprint authoring standard gains three new sections (7c REQ-layer sufficiency, 7d positive-evidence verification, 7e single-definition ownership) plus RULE 16 for the managed agent block, and `rcf define blueprint` gains a `lint-consistency` verb, a per-slug disposition ledger, an apply-time disposition prompt and an identity-register field on the seeded profile. The schema floor moves to `@stravica-ai/rcf-schemas` 0.6.2. Nothing here is breaking.
+
+### Added
+
+- **Blueprint chain-consistency lint verb: `rcf define blueprint lint-consistency <source>` (PR #183).** Two passes over one blueprint's own JSON and markdown. Pass 1 checks single-definition ownership: HTTP-header and env-var casing drift between an owning TAC's interfaces, internal structure, responsibilities or purpose and any other artefact, plus an `undeclaredRestatement` finding when an AC restates a token owned by a TAC interface without an `ownerRef.tacId` reference. Pass 2 checks REQ delivery: `reqNoDelivery` when a REQ description carries a promise phrase (must, requires, guarantees, ceiling, never, invariant, on boot, at boot, event) without a `deliveredBy` link into a TAC or ADR, and `reqDeliveryNotCarried` when the named TAC or field is absent or does not appear in the TAC's responsibilities or interfaces. Exit 0 on clean, exit 3 on unsuppressed findings, exit 2 on usage error. `--json` emits the envelope `{ blueprint, findings[], verdict, passCounts }`. Pass-1 findings are suppressible via a `## Known chain-consistency-lint suppressions` section on the blueprint README (one row per finding id with a one-sentence reason); pass-2 findings are not suppressible. A soft-mode CI lint step runs the verb across the shelf so authoring drift surfaces on every PR without blocking the merge yet.
+- **Per-slug disposition ledger and `rcf define blueprint dispositions <slug> [--json]` verb (PR #183).** A ledger file at `rcf/blueprints/<slug>.disposition.json` sits alongside the existing applied sidecar and carries one record per contributed AC with an `action` (`pending-disposition`, `pending-operator`, `accepted`, `adjusted`, `dropped`, `escalated-as-defect`), optional `reason`, `resolvedAt`, `resolvedBy`, `escalatedAt`, `escalatedToOperator`, `defectUrl`, and an optional `sourceDisposition` of `fixed` or `template`. Written on a fresh `rcf define blueprint add`; a re-apply leaves an existing ledger byte-identical so operator edits are never clobbered. The read-only `dispositions` verb prints one line per record with action, reason and resolution timestamp, or the raw ledger with `--json`. Exit 0 always; a missing ledger is a legitimate zero state. Schema follow-up: a `$defs/blueprintDispositionLedger` shape lands on `@stravica-ai/rcf-schemas` in a later release; for now the writer guards the record shape inline.
+- **Apply-time disposition prompt (PR #183).** After a fresh `rcf define blueprint add` the CLI prints a canonical prompt naming the newly initialised ledger and the disposition vocabulary, so an operator lands on the ledger before the next verify. Suppressible with `--no-disposition-prompt`.
+- **Identity register field on the seeded profile (PR #183).** The identity seed template gains a `## Register` section under `## Working preferences` with the three-value vocabulary (`productOwner`, `engineer`, `unstated`) seeded to `unstated`. Register capture stays a managed-block flow, so `cli/init.js` is unchanged; existing projects pick up the field on the next `rcf doctor --fix` sweep of the managed block.
+- **Blueprint authoring standard sections 7c, 7d, 7e (PR #182).** Section 7c (REQ-layer sufficiency): every capability token declared on `blueprint.json:capabilities[]` and every option value on `elicits[]` is backed by at least one must-priority requirement; a blueprint without an `elicits` key is legal only when no apply-time answer is named anywhere in the requirements, guide or TAC records. Section 7d (positive-evidence verification): every verification artefact asserts positive evidence of the property it exists to protect (a request id, a response body excerpt, a created-then-deleted resource id in an inventory diff, or a real deploy record), never the absence of a previously seen bad signature; env vars are declared on the fixture, and `accountBoundSkipped: true` is legal only when the account env is unset and paired with an exact non-empty `reason`. Section 7e (single-definition ownership and authoring order): every named contract is defined exactly once in one owning artefact (TAC for wire shapes and interfaces, ADR for behaviour decisions, REQ for externally promised properties with a `deliveredBy` link into the delivering TAC or ADR); US, AC and guide reference the owner rather than restating it, and authoring order follows. RULE 16 lands in `guidance/managed/agent-instructions-block.md` so applying agents inherit both disciplines from the managed block on the next `rcf doctor --fix` sweep.
+- **Ten new blueprint-authoring-checklist rows in section 6 (PR #182).** Three rows from section 7c, five from section 7d, two from section 7e; the block hash and the `harness-template.md` fragment regenerate via `scripts/gen-managed-artefacts.mjs`.
+- **Positive-evidence remap at record composition (PR #182).** `packages/rcf-lite/src/browser-verify/manifest-writer.js:composeBrowserVerificationRecord` remaps a `checks[]` or `preChecks[]` record with `verdict: 'pass'` and neither an `evidence` field nor `accountBoundSkipped: true` (with a non-empty `reason`) to `verdict: 'fail'` with `detail: 'positive-evidence-missing'`. The remap fires at record composition so the composed record is what the manifest carries and the fail surfaces at the ship gate. `pack-runner.js` carries `evidence`, `accountBoundSkipped` and `reason` through from each check's and pre-check's `run` outcome so the composer sees the fields.
+- **H-2 Cloudflare-platform probe integrity (PR #179).** The Cloudflare-platform blueprints on the shelf (`platform-cloudflare-kv`, `platform-cloudflare-durable-objects`, `messaging-queue-cloudflare`, `edge-cloudflare-tunnel`) pick up real-account probe drivers that assert positive evidence: KV re-anchor and observability on cache-aside miss/hit, DO storage round-trip with anchor coverage, queue real concurrency with dead-letter observation, tunnel connector health and hostname routing. The `packages/rcf-lite/test/fixtures/cf-platform/` fixture README gains a "Declared env vars" section naming the first-tier `CI_HAS_CLOUDFLARE_ACCOUNT` gate and the four second-tier variables the account-bound branches read (`CF_ACCOUNT_ID`, `CF_API_TOKEN`, `CF_KV_NAMESPACE_ID`, `CF_WORKER_NAME`), so a runner without those env vars sees clean `accountBoundSkipped: true` rows with a stated reason rather than a silent pass.
+
+### Changed
+
+- **Schema floor: `@stravica-ai/rcf-schemas` 0.6.1 to 0.6.2.** No new required fields on shipped artefacts; picks up the shape work that supports the disposition-ledger record and the identity-register field.
+
+#### Also in this release
+
+- **`object-storage-s3` v1.0.0 to v1.1.0 (PR #177).** The Hetzner Object Storage adapter lands as the follow-up sibling to the R2 first adapter shipped in 0.23.0, per the 0.25.0 headline. The blueprint bumps but the rcf-lite package version does not bump for this alone; it rides along in this release.
+- **`deploy-hetzner-server` v1.0.0 to v1.0.1 (PR #178).** Real-path fix for the cloud-init render path resolution so an applied project on Node 24 finds the template through the resolved module directory rather than the workspace-relative path.
+- **Blueprint authoring notes on AC sufficiency and fixed-vs-template dispositions (PRs #180, #181).** Two docs-only additions to `packages/rcf-lite/docs/blueprint-authoring.md` that pair with the section 7c and disposition-ledger work: how many ACs are enough for a given US, and how a contributed AC's `sourceDisposition` reads as `fixed` (delivered verbatim) or `template` (adjusted at apply time).
+
 ## [0.25.0] - 2026-09-08
 
 rcf-lite 0.25.0 opens the Hetzner line with three blueprints in one round: a Hetzner Cloud server as the shipped Linux VM shape with the estate hardening baseline and a snapshot cadence, a docker-compose platform on top with healthchecks, secrets as file mounts and a first-class reverse-proxy artefact, and a Cloudflare Tunnel bridge that composes with Access when Zero Trust is applied and drops to public-hostname mode when it is not. Every real-account probe across the round ships accountBoundSkipped pending the Hetzner and Cloudflare token vault ruling; the local probes carry the ship-time verdicts. The follow-up Hetzner Object Storage adapter ships as a sequential PR under `object-storage-s3` v1.1.0 after this release; the rcf-lite package version does not bump for it.

package/blueprints/application-account-settings/CHANGELOG.md

@@ -1,6 +1,39 @@
 # application-account-settings CHANGELOG
 
-## 1.0.0 (visual round T-4, spec 2026-09-06 section 5.4)
+## 1.2.0 (2026-09-10)
+
+### Added
+
+- REQ-009: custom-auth-provides-* runtime clauses covering the four boolean elicits with a per-token clause on the applied capability union.
+- Vendor citations on AC-25101-1 (APG tabs), AC-25102-3 (WCAG 1.3.5), AC-25105-2 (APG dialog) and AC-25108-2 (APG radio).
+
+### Changed
+
+- ADR-2604.decision references `blueprint.json.elicits[id=reauth-window].options` (never|5|15|60) via ownerRef.
+- TAC-2604.tradeoffs references the manifest's `reauth-window` default (`15`) via ownerRef; `sessionRecord` shape references the session-verifier owner (`TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory`) via ownerRef.
+- REQ-003.deliveredBy retargeted to `TAC-2603.interfaces.renderSecuritySurface`.
+- REQ-006.deliveredBy retargeted to `TAC-2601.responsibilities.renderThemeSurface` (new responsibility carrying the theme-persistence clauses).
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (2026-09-10, hardening pass)
+
+### Added
+
+- REQ-007 (reauth-window option coverage) and US-25111: never, 5, 15 and 60 each carry a defined runtime clause tied to the applied auth providers session inventory (owner TAC-1003-security-auth-clerk-session-verifier interfaces.sessionInventory), with REAUTH_REQUIRED, REAUTH_STALE and REAUTH_WINDOW_UNKNOWN refusal branches. Closes review finding [application-account-settings] F-1.
+- Failure-path acceptance criteria on US-25101 (unauthenticated /account routes to the forbidden state with sign-in link and no profile data), US-25105 (inventory read failure, terminate write failure, current-session protection). Closes findings F-2 and F-3.
+
+### Changed
+
+- sessionInventory prose corrected across README (provider table row and companion paragraph), blueprint.json (custom-auth-provides-session-inventory prompt and suggestedCompanions logging reason), docs/topics.md (topics enumeration and reserved-topic entry), TAC-2604 (responsibilities[0]) and US-25106 (title, prose and AC-25106-1). observability-logging 1.3.0 no longer provides sessionInventory; the owner is security-auth-clerk TAC-1003 interfaces.sessionInventory and equivalent TACs on other auth blueprints. requiresAppliedCapabilities remains [principalDirectory]. Closes routed finding F-5 from the review.
+- Every REQ now carries a deliveredBy link into TAC-2601, TAC-2603 or TAC-2604.
+- Every AC on every user story now carries an explicit disposition (fixed or template); ACs that observe a session-inventory row carry ownerRef into TAC-1003.
+- TAC-2601 responsibilities extended with renderProfileSurface, renderPreferencesSurface and renderCorrelationId; TAC-2604 extended with reauthWindowGate and sessionInventoryConsumer.
+- Review fix pass (2026-09-10): elicit-token coverage tightened on REQ-003 to name `self-service`, `hosted-link-out` and `hosted-embed` literally alongside the branch prose; principalDirectory named literally in REQ-001; template ACs on US-25104, US-25108 and US-25101 carry an `Applying agent sets: <elicit-id>.` clause; anatomy test name at TC-056-shelf-doc-consistency renamed to say observability-logging drops sessionInventory; README register scrubbed (no operator names). Closes review-fix-pass findings F-1, F-2, O-1.
+
+## 1.0.0 (visual round, spec 2026-09-06 section 5.4)
 
 - First shipped version. Introduces the account-settings shell (ARIA APG tabs, WCAG 2.4.6 landmark), the profile surface (WCAG 1.3.5 autocomplete tokens, aria-live save-status), the security surface (self-service branch and hosted-UI branch through ADR-2602's elicited security-surface-shape), the sessions surface (ARIA APG dialog-modal terminate flow, aria-live session-terminated announcement, current-session cannot terminate itself), the notification-preferences surface (per-category silence, per-channel opt-in) and the theme surface (light/dark/system radiogroup persisted per ADR-2603's elicited theme-persistence).
 - Declares `requiresAppliedCapabilities: [principalDirectory]` with `refusalMessageId: application-account-settings-bare-spa` and `allowSkipFlag: allow-no-auth-yet`. The refusal template ships in this PR's mechanism minor at `packages/rcf-lite/src/blueprint/capabilities.js` (`buildRefusalMessage`). The Q3 gate (a project declaring neither `credentialSelfService` nor `hostedIdentityUi`) is enforced through the shell's tab-suppression rule (AC-25101-1 probed by the pack), the mechanism's silent gating of the `security-surface-shape` elicit (its `when` predicate refuses), and the surface-side hosted-UI bridge TAC-2603 refusal (documented mechanism-reach gap under AC-25110-1).
@@ -8,5 +41,5 @@
 - Ships four regular elicits (`security-surface-shape`, `hosted-identity-url`, `theme-persistence`, `reauth-window`) whose `when` predicates gate on the applied capability set.
 - Ships a Playwright probe pack under `probe-packs/application-account-settings.pack.mjs` with five checks anchored to `AC-25101-1` (shell tabs mirror caps), `AC-25102-1` (profile autocomplete tokens), `AC-25105-1` (security branch matches applied + elicit), `AC-25106-1` (sessions rows and dialog-modal) and `AC-25108-1` (theme radiogroup and persistence). Every check gates via `readAppliedCapabilities(projectRoot)`; an absent capability records `verdict: skipped` per spec section 3.3.
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/` realising the five conditional surfaces honestly plus four break switches (`?break=leak-tab`, `?break=no-autocomplete`, `?break=no-dialog`, `?break=no-persist`) driving the negative runs.
-- Composes on `application-empty-error-states` (T-1) for the forbidden and empty-history states; no bespoke access-denied UI is invented here.
+- Composes on `application-empty-error-states` for the forbidden and empty-history states; no bespoke access-denied UI is invented here.
 - Rides with the auth blueprints minor bumps (`security-auth-clerk` 1.3.0, `security-auth-keycloak` 1.2.0, `security-auth-oauth2` 1.2.0, `security-auth-magic-link` 1.2.0 doc-only) and the `observability-logging` 1.2.0 minor bump (declares `sessionInventory` as the logging-projection provider), extending the section 6a capability table with `credentialSelfService`, `sessionInventory` and `hostedIdentityUi`.

package/blueprints/application-account-settings/README.md

@@ -1,6 +1,6 @@
 # Account settings blueprint (v1.0.0)
 
-Vendor-neutral account-settings surface for an rcf-lite application. Surfaces are CONDITIONAL on what the applied identity blueprints and companion blueprints declare via `capabilities[]`. Ships the settings shell with an ARIA APG tabs region (no dead links to unapplied capabilities), a WCAG 1.3.5 profile surface (always active), a security surface with a self-service branch (password change, MFA) and a hosted-UI branch (link-out or embed), a sessions surface with an ARIA APG dialog-modal terminate flow, a notification preferences surface and a theme surface with light/dark/system. Reuses the visual round T-5 capability grammar and the apply-time discovery, refusal and custom-auth elicitation the spec section 5.4 ratifies. Ships a Playwright probe pack under `probe-packs/application-account-settings.pack.mjs` whose five checks are capability-gated: an absent capability records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3).
+Vendor-neutral account-settings surface for an rcf-lite application. Surfaces are CONDITIONAL on what the applied identity blueprints and companion blueprints declare via `capabilities[]`. Ships the settings shell with an ARIA APG tabs region (no dead links to unapplied capabilities), a WCAG 1.3.5 profile surface (always active), a security surface with a self-service branch (password change, MFA) and a hosted-UI branch (link-out or embed), a sessions surface with an ARIA APG dialog-modal terminate flow, a notification preferences surface and a theme surface with light/dark/system. Reuses the visual round capability grammar and the apply-time discovery, refusal and custom-auth elicitation the spec section 5.4 ratifies. Ships a Playwright probe pack under `probe-packs/application-account-settings.pack.mjs` whose five checks are capability-gated: an absent capability records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3).
 
 ## Apply
 
@@ -18,7 +18,7 @@ Refuses with exit 3 and the spec 5.4.1 verbatim message on a project with no app
 | Doc set | `contributions/` | 6 REQs, 10 USs (13 runtime-observable ACs), 4 TACs, 4 ADRs |
 | Probe pack | `probe-packs/application-account-settings.pack.mjs` | Five capability-gated browser-verify checks anchored to AC-25101-1, AC-25102-1, AC-25105-1, AC-25106-1, AC-25108-1 |
 | Guide | `guide/application-account-settings.md` | Operator-facing: when to reach, when not, mechanism-reach gaps |
-| Coordination vocabulary | `docs/topics.md` | Shelf id band registry update; no new global topics claimed; cross-references application-empty-error-states (T-1) and application-admin-console (T-5) |
+| Coordination vocabulary | `docs/topics.md` | Shelf id band registry update; no new global topics claimed; cross-references application-empty-error-states and application-admin-console |
 | Sample-app fixture | `packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/` | Dependency-free Node HTTP server the pack is probed against on the shelf gate |
 
 ## Conditionality: what surfaces render when
@@ -27,10 +27,10 @@ Refuses with exit 3 and the spec 5.4.1 verbatim message on a project with no app
 |---|---|---|
 | `principalDirectory` | Profile (`/account/profile`) always available | Any applied auth blueprint (magic-link, clerk, oauth2, keycloak). |
 | `credentialSelfService` OR `hostedIdentityUi` | Security (`/account/security`) | credentialSelfService: Keycloak from 1.2.0, OAuth2 from 1.2.0 (provider-conditional). hostedIdentityUi: Clerk from 1.3.0, OAuth2 from 1.2.0 (provider-conditional). Neither present: security tab suppressed AND the Q3 refusal fires at apply if the operator answers `--answer security-surface-shape=...`. |
-| `sessionInventory` | Sessions (`/account/sessions`) | Clerk from 1.3.0, Keycloak from 1.2.0, OAuth2 from 1.2.0, or observability-logging from 1.2.0 (as the logging-projection provider). Magic-link does NOT declare it. |
+| `sessionInventory` | Sessions (`/account/sessions`) | Clerk from 1.3.0, Keycloak from 1.2.0, OAuth2 from 1.2.0. Owner: security-auth-clerk TAC-1003-security-auth-clerk-session-verifier field interfaces.sessionInventory (the shape any auth blueprint declaring the capability agrees to). Magic-link does NOT declare it; observability-logging 1.3.0 no longer declares it. |
 | `application-notifications-in-app` applied | Notification preferences (`/account/notifications`) | Suppressed when the notifications-in-app blueprint is not applied. |
 | `application-spa` applied | Theme (`/account/theme`) | Suppressed when the SPA blueprint is not applied. |
-| (none) | Unauthenticated principal | Composes on `application-empty-error-states` (T-1) forbidden state; no bespoke access-denied UI. |
+| (none) | Unauthenticated principal | Composes on `application-empty-error-states` forbidden state; no bespoke access-denied UI. |
 
 ## Bare-SPA refusal
 
@@ -62,7 +62,7 @@ A project that declares `principalDirectory` (so apply is not refused at the bar
 2. Renders the shell WITHOUT a security tab (AC-25101-1, probed by the pack).
 3. Refuses the security surface at load time through TAC-2603 hosted-ui-bridge if a project-side FBS renders `/account/security` regardless (project-side enforcement per AC-25110-1 known mechanism-reach gap, spec section 5.4.1).
 
-No `auth managed elsewhere` placeholder ships from the shipped shell surface. Per Baz decision Q3 in the ratified spec, the shell never lies about a surface that has no home.
+No `auth managed elsewhere` placeholder ships from the shipped shell surface. Per the ratified spec Q3 decision, the shell never lies about a surface that has no home.
 
 ## Custom-auth projects (auth outside the shelf)
 
@@ -79,7 +79,7 @@ Answers land on `rcf/blueprints/application-account-settings.applied.json`'s `ap
 
 ## The one runtime gate
 
-`probe-packs/application-account-settings.pack.mjs` ships five checks the `rcf verify browser` runner invokes on any FBS whose surface matches the pack's `appliesTo` predicate (an FBS that binds `TAC-2601-application-account-settings-shell` or whose nav model routes name an `/account`, `/settings` or `/profile` path). Each check ALSO carries its own `appliesTo` predicate that reads the applied capability sidecar and returns false when the required capability is absent; the check records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3, T-5 residual cure).
+`probe-packs/application-account-settings.pack.mjs` ships five checks the `rcf verify browser` runner invokes on any FBS whose surface matches the pack's `appliesTo` predicate (an FBS that binds `TAC-2601-application-account-settings-shell` or whose nav model routes name an `/account`, `/settings` or `/profile` path). Each check ALSO carries its own `appliesTo` predicate that reads the applied capability sidecar and returns false when the required capability is absent; the check records `verdict: skipped` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3, residual cure).
 
 Each check drives the real Playwright browser the runner provisions (through the pinned Playwright MCP or the consuming project's own `playwright` installation), reads the accessibility tree and the DOM, and returns a verdict.
 
@@ -101,14 +101,14 @@ Runtime-observable ACs the pack does NOT bind directly (checklist section 6.g),
 
 ## Known schema follow-ups
 
-The applied-blueprint sidecar at `rcf/blueprints/application-account-settings.applied.json` uses the schema shape T-5 admin-console established (no `verdict: skipped` field on the applied-record; the pack runtime records `verdict: skipped` per-check per spec section 3.3, and rcf-schemas 0.6.1 has no `applicable: false` field for the record). A future rcf-schemas minor may adopt the `appliedCapabilities[]` field on the applied-blueprint record directly; the sidecar path stays supported for backward compatibility.
+The applied-blueprint sidecar at `rcf/blueprints/application-account-settings.applied.json` uses the schema shape admin-console established (no `verdict: skipped` field on the applied-record; the pack runtime records `verdict: skipped` per-check per spec section 3.3, and rcf-schemas 0.6.1 has no `applicable: false` field for the record). A future rcf-schemas minor may adopt the `appliedCapabilities[]` field on the applied-blueprint record directly; the sidecar path stays supported for backward compatibility.
 
 ## Companions
 
-`suggestedCompanions` declares `logging` (every rendered account surface writes one request-scoped log line with the correlation identifier; the sessions surface reads a session inventory from `observability-logging` 1.2.0+ when configured) and `errorHandling` (profile-save, security-flow and session-terminate failures construct internal error records). Neither is required to apply the blueprint; the audit-history surface is deferred to v1.1.0.
+`suggestedCompanions` declares `logging` (every rendered account surface writes one request-scoped log line with the correlation identifier) and `errorHandling` (profile-save, security-flow and session-terminate failures construct internal error records). Neither is required to apply the blueprint; the audit-history surface is deferred to v1.1.0.
 
 ## Consumers
 
-The forbidden and empty-history states MAP to `application-empty-error-states` (T-1)'s `forbidden` and `empty-list` states. Every project applying `application-account-settings` MUST also apply `application-empty-error-states` if they want the shipped access-denied state; the shell composes on the empty-error-states components rather than inventing bespoke UI.
+The forbidden and empty-history states MAP to `application-empty-error-states`'s `forbidden` and `empty-list` states. Every project applying `application-account-settings` MUST also apply `application-empty-error-states` if they want the shipped access-denied state; the shell composes on the empty-error-states components rather than inventing bespoke UI.
 
-The sessions and notification-preferences surfaces reuse the `application-datatable` (round-3 T-1) table shell contract when the project renders them through the datatable factory.
+The sessions and notification-preferences surfaces reuse the `application-datatable` (round-3) table shell contract when the project renders them through the datatable factory.

package/blueprints/application-account-settings/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-account-settings",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "category": "application",
   "requiresAppliedCapabilities": {
     "capabilities": [
@@ -26,7 +26,7 @@
     },
     {
       "id": "custom-auth-provides-session-inventory",
-      "prompt": "Custom auth: does your projects own auth (or logging companion) expose an inventory of active sessions with device labels and a terminate action?",
+      "prompt": "Custom auth: does your projects own auth expose an inventory of active sessions with device labels and a terminate action?",
       "kind": "boolean",
       "default": false,
       "providesCapability": "sessionInventory"
@@ -92,7 +92,7 @@
   "suggestedCompanions": [
     {
       "role": "logging",
-      "reason": "Every rendered account surface writes one request-scoped log line with the correlation identifier; a logging companion supplies the factory the pipeline calls. When the logging companion also declares sessionInventory (observability-logging 1.2.0+), the sessions surface reads the inventory from the log projection."
+      "reason": "Every rendered account surface writes one request-scoped log line with the correlation identifier; a logging companion supplies the factory the pipeline calls. sessionInventory is owned by security-auth-clerk TAC-1003-security-auth-clerk-session-verifier interfaces.sessionInventory (and by the equivalent TAC on any auth blueprint that declares it); observability-logging does not provide it as of 1.3.0."
     },
     {
       "role": "errorHandling",
@@ -100,6 +100,11 @@
     }
   ],
   "contributions": [
+    {
+      "id": "application-account-settings-REQ-009",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-009.json"
+    },
     {
       "id": "application-account-settings-REQ-001",
       "kind": "req",
@@ -130,6 +135,11 @@
       "kind": "req",
       "path": "requirements/application-account-settings-req-006.json"
     },
+    {
+      "id": "application-account-settings-REQ-007",
+      "kind": "req",
+      "path": "requirements/application-account-settings-req-007.json"
+    },
     {
       "id": "application-account-settings-US-25101",
       "kind": "us",
@@ -180,6 +190,16 @@
       "kind": "us",
       "path": "user-stories/application-account-settings-us-25110.json"
     },
+    {
+      "id": "application-account-settings-US-25111",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25111.json"
+    },
+    {
+      "id": "application-account-settings-US-25112",
+      "kind": "us",
+      "path": "user-stories/application-account-settings-us-25112.json"
+    },
     {
       "id": "TAC-2601-application-account-settings-shell",
       "kind": "tac",

package/blueprints/application-account-settings/contributions/adrs/adr-2601-application-account-settings-capability-vocabulary.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Capability vocabulary: credentialSelfService, sessionInventory, hostedIdentityUi additions plus auditLog reuse",
-  "context": "The account-settings blueprint composes on the section 6a capability grammar visual round T-5 ratified. The T-4 spec (section 5.4.2) adds three capability strings the auth vendors need to declare in order for the security and sessions surfaces to render, and reuses auditLog where a project wants a self-view audit history rendered on the account surface (deferred: not a v1 surface but named in the vocabulary so a future minor bump can wire it without a chunk-zero edit).",
+  "context": "The account-settings blueprint composes on the section 6a capability grammar visual round ratified. The spec (section 5.4.2) adds three capability strings the auth vendors need to declare in order for the security and sessions surfaces to render, and reuses auditLog where a project wants a self-view audit history rendered on the account surface (deferred: not a v1 surface but named in the vocabulary so a future minor bump can wire it without a chunk-zero edit).",
   "decision": "v1.0.0 ratifies three additions to the section 6a capability table: credentialSelfService (in-place password change, MFA management, email change surface), sessionInventory (active-session listing with device labels and a terminate write), and hostedIdentityUi (link-out or embed to a hosted account portal). The auditLog capability continues to route via observability-logging. The three new strings follow the same shape rule (lower camelCase, ^[a-z][a-zA-Z0-9]*$) validated on the loader; the vocabulary lives in the section 6a table extended in the same PR.",
   "consequences": "A bare-magic-link project gets a profile surface only; a Keycloak project gets profile plus security (self-service) plus sessions; a Clerk project gets profile plus security (hosted-link-out or embed) plus sessions; an OAuth2 project gets what the vendor declares. A future account-audit-history surface lands as a v1.1.0 minor bump reusing auditLog with no new vocabulary.",
   "alternativesConsidered": [

package/blueprints/application-account-settings/contributions/adrs/adr-2604-application-account-settings-reauth-window.json

@@ -2,12 +2,12 @@
   "adrId": "ADR-2604-application-account-settings-reauth-window",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Re-authenticate before high-value changes (default: enabled)",
-  "context": "A high-value change (password change, MFA change, session terminate, account delete) that runs on the same session that opened the surface is a phishing risk when the session is stale. WCAG 3.3.4 (Error Prevention on legal, financial and data-changing actions) applies. The spec section 5.4 marks reauth-window as elicited with recommendedDefault true, meaning re-authenticate is enabled by default.",
-  "decision": "reauth-window is elicited (enum: never | 5m | 15m | 60m). Recommended default: 15m. A high-value change fires the re-authenticate flow when the session was last authenticated more than reauth-window minutes ago. A project that ships a short-lived session token (reauth-window irrelevant because the session itself expires within minutes) may set never; ADR records the choice and the risk. The re-authenticate flow itself is owned by the applied auth blueprint; this ADR names the trigger, not the implementation.",
-  "consequences": "A stolen laptop with an unlocked session cannot terminate every other session without re-authenticating within 15 minutes. The re-authenticate cost is a modal prompt on the operators sessions view, not a full sign-out flow.",
+  "context": "A high-value change (password change, MFA change, session terminate, account delete) that runs on the same session that opened the surface is a phishing risk when the session is stale. WCAG 3.3.4 (Error Prevention on legal, financial and data-changing actions) applies. The spec section 5.4 marks reauth-window as elicited; the manifest elicit `blueprint.json.elicits[id=reauth-window]` owns the option set (its `.options`) and the recommended default (its `.default`).",
+  "decision": "reauth-window is elicited as an enum owned by `blueprint.json.elicits[id=reauth-window]`; the option vocabulary lives on its `.options` and the recommended default on its `.default` (this ADR does not restate either). A high-value change fires the re-authenticate flow when the session was last authenticated more than the elicited number of minutes ago; the disable-the-trigger case is whichever option the manifest elicit documents for that (this ADR does not name it). The re-authenticate flow itself is owned by the applied auth blueprint; this ADR names the trigger, not the implementation.",
+  "consequences": "A stolen laptop with an unlocked session cannot terminate every other session without re-authenticating within the elicited window. The re-authenticate cost is a modal prompt on the operators sessions view, not a full sign-out flow.",
   "alternativesConsidered": [
     {
       "name": "Alternative approach considered",
@@ -16,5 +16,5 @@
     }
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-001.json

@@ -2,7 +2,11 @@
   "reqId": "application-account-settings-REQ-001",
   "prdId": "PRD-001",
   "title": "Settings shell with no dead links to unapplied capabilities and ARIA APG tabs",
-  "description": "The settings shell renders a single primary tabs region (ARIA APG tabs pattern) whose entries mirror the union of applied capabilities discovered via readAppliedCapabilities. A tab whose capability is not applied does NOT render (no dead link, no disabled shell). A principal without an authenticated session reaching /account routes to the access-denied state through application-empty-error-states (T-1) with a sign-in link; no bespoke access-denied UI is invented here. Landmark, headings, focus order per WCAG 2.4.6.",
+  "description": "The settings shell renders a single primary tabs region (ARIA APG tabs pattern) whose entries mirror the union of applied capabilities discovered via readAppliedCapabilities. The applied capability floor is principalDirectory: the shell reads the current authenticated principal (name, email, id) from the applied principalDirectory provider on first render and passes the identity to every child surface without re-reading it per tab switch. A tab whose capability is not applied does NOT render (no dead link, no disabled shell). A principal without an authenticated session reaching /account routes to the access-denied state through application-empty-error-states with a sign-in link; no bespoke access-denied UI is invented here. Landmark, headings, focus order per WCAG 2.4.6.",
+  "deliveredBy": {
+    "tacId": "TAC-2601-application-account-settings-shell",
+    "field": "responsibilities.renderShell"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Profile surface always available with autocomplete tokens per WCAG 1.3.5",
   "description": "The profile surface (/account/profile) is unconditional (any authenticated principal reaches it) and renders a form with WCAG 1.3.5 autocomplete tokens on every editable identifier (name, email, bday, country). Save success announces via aria-live polite (\"Profile saved\"). Save failure per field renders aria-invalid true with aria-describedby to the per-field error message and focus moves to the first invalid field (WCAG 3.3.1 Error Identification).",
+  "deliveredBy": {
+    "tacId": "TAC-2601-application-account-settings-shell",
+    "field": "responsibilities.renderProfileSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-003.json

@@ -2,7 +2,11 @@
   "reqId": "application-account-settings-REQ-003",
   "prdId": "PRD-001",
   "title": "Security surface conditional on credentialSelfService OR hostedIdentityUi",
-  "description": "The security surface (/account/security) renders when the applied capability set contains credentialSelfService (self-service branch: password change, MFA setup, session-based sign-out) or hostedIdentityUi (link-out or embed branch: rendering an operator-elicited href or handle). When NEITHER capability is applied, the security tab does not render and the surface refuses at apply with the two-remedy message (declare a capability, or drop the security tab from scope) per spec Q3.",
+  "description": "The security surface (/account/security) renders when the applied capability set contains credentialSelfService (self-service branch of the security-surface-shape elicit: password change, MFA setup, session-based sign-out) or hostedIdentityUi (hosted-link-out or hosted-embed branch of the security-surface-shape elicit: hosted-link-out surfaces an operator-elicited href through the hosted-identity-url handle; hosted-embed surfaces the same handle inside a same-origin iframe when the applied hosted-identity provider names an embed clause). When NEITHER capability is applied, the security tab does not render and the surface refuses at apply with the two-remedy message (declare a capability, or drop the security tab from scope) per spec Q3.",
+  "deliveredBy": {
+    "tacId": "TAC-2603-application-account-settings-hosted-ui-bridge",
+    "field": "interfaces.renderSecuritySurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-account-settings",
     "category:03-security"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Sessions surface conditional on sessionInventory",
   "description": "The sessions surface (/account/sessions) renders when sessionInventory is applied. Lists active sessions in a table enumerated by data-session-id with device label, last-active timestamp and terminate control. Terminate opens an ARIA APG dialog-modal (role=dialog, aria-modal=true, aria-labelledby to the heading, focus trap, focus returns to the row on close) confirming the action; on submit the row disappears from the table and a polite \"Session ended\" announcement fires (WCAG 4.1.3 Status Messages).",
+  "deliveredBy": {
+    "tacId": "TAC-2604-application-account-settings-session-store",
+    "field": "interfaces.sessionInventoryConsumer"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Notification preferences surface conditional on application-notifications-in-app applied",
   "description": "The notification-preferences surface (/account/notifications) renders when application-notifications-in-app is applied. Provides a per-category silence control and a per-channel opt-in (in-app, email, push where channels apply). The blueprint does NOT own the notification model; it delegates the model to the applied blueprint and renders the operator interface only. Save-success and save-failure announcements follow the profile surface contract.",
+  "deliveredBy": {
+    "tacId": "TAC-2601-application-account-settings-shell",
+    "field": "responsibilities.renderPreferencesSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Theme surface conditional on application-spa applied with theme-persistence elicit",
   "description": "The theme surface (/account/theme) renders when application-spa is applied. Renders a light/dark/system radiogroup (ARIA APG radiogroup, keyboard reachable) and persists the choice per the theme-persistence elicit (spa-local-storage default, server-scoped, or none). Choice takes effect immediately (data-theme attribute on the html element flips) and honours the users prefers-color-scheme when set to system.",
+  "deliveredBy": {
+    "tacId": "TAC-2601-application-account-settings-shell",
+    "field": "responsibilities.renderThemeSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-account-settings",
     "category:06-theme"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "application-account-settings-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Reauth window: never, 5, 15, 60 each carry a defined trigger for high-value changes",
+  "description": "The security and sessions surfaces honour the elicited reauth-window with a runtime clause per option, applied before a high-value change (credential change, session termination, MFA enrolment). `never` bypasses reauthentication for any interval since the last successful sign-in and permits the high-value action to proceed with only the standard confirmation dialog. `5`, `15` and `60` denote a minute-count: when more than that many minutes have elapsed since the principal's last successful sign-in (as recorded on the applied auth providers session inventory), the surface presents a reauth prompt before the high-value action; the action refuses with REAUTH_REQUIRED until the reauth prompt returns success, then proceeds. The comparison uses the last-active timestamp on the current session record from the applied provider (security-auth-clerk TAC-1003 sessionInventory or the equivalent TAC on another auth blueprint), never a local clock. The reauth prompt never accepts the current session's own credentials as sufficient for the reauth without a fresh challenge (a fresh password entry, a fresh MFA challenge or a fresh magic-link click).",
+  "deliveredBy": {
+    "tacId": "TAC-2604-application-account-settings-session-store",
+    "field": "responsibilities.reauthWindowGate"
+  },
+  "category": "functional",
+  "domain": "security",
+  "priority": "must",
+  "rationale": "The elicit offers four windows but no requirement described what each option does. A project that chose 15 inherited `never` behaviour silently because no chain link asked after the elapsed-minutes gate. Requiring a per-option clause turns the elicit into a chain-linked check the reauth prompts appearance proves.",
+  "tags": [
+    "blueprint:application-account-settings",
+    "category:07-reauth-window"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-009.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-account-settings-REQ-009",
+  "prdId": "PRD-001",
+  "title": "Custom-auth capability declarations bind the four provides-* booleans to the applied capability set",
+  "description": "When the applying project runs its own auth (no shipped security-auth-* blueprint) and answers the four custom-auth-provides-* boolean elicits, the account-settings shell binds each answer to the appliedCapabilities union with a runtime clause per token: when `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is `true` the union includes `principalDirectory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-credential-self-service]` is `true` the union includes `credentialSelfService` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-session-inventory]` is `true` the union includes `sessionInventory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-hosted-identity-ui]` is `true` the union includes `hostedIdentityUi` and `false` omits it. The sidecar the shell reads reflects the exact union the boolean answers produce.",
+  "deliveredBy": {
+    "tacId": "TAC-2602-application-account-settings-capability-discovery",
+    "field": "responsibilities.runElicitationPhase"
+  },
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "The four provides-* booleans produced capabilities in the applied union without a chained clause; requiring one runtime clause per token turns each boolean answer into a must-observable binding on the sidecar the shell reads.",
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-account-settings/contributions/tacs/tac-2601-application-account-settings-shell.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-2601-application-account-settings-shell",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Account settings shell",
   "purpose": "Owns the rendered settings surface: the top-level tabs landmark, the surface-manifest read at load, the conditional rendering of every applied surface (profile always; security, sessions, notifications, theme conditional), the tabs interaction contract (ARIA APG), and the shared page layout every surface renders within. The shell is the base surface every AC in this blueprint anchors on.",
@@ -11,7 +11,11 @@
     "Render a single primary navigation landmark carrying an accessible name and rendering only applied surfaces (AC-25101-1, AC-25101-2).",
     "Render the profile surface unconditionally as the active tab on /account (AC-25102-1).",
     "Delegate the security, sessions, notification-preferences and theme surfaces to their respective TACs (TAC-2603, TAC-2604) or render inline for notifications and theme.",
-    "Route unauthenticated principals to the empty-error-states forbidden state (T-1) rather than inventing a bespoke denied UI."
+    "Route unauthenticated principals to the empty-error-states forbidden state rather than inventing a bespoke denied UI.",
+    "renderProfileSurface: mount the profile tab as the active tab on /account, always available (AC-25102-1).",
+    "renderPreferencesSurface: mount the notification-preferences tab when application-notifications-in-app is applied (AC-25107-1) and the theme tab when application-spa is applied honouring theme-persistence (AC-25108-1).",
+    "renderCorrelationId: write one request-scoped log line per rendered surface, carrying the correlation identifier the applied logging companion supplies.",
+    "renderThemeSurface: mount the theme tab when application-spa is applied, render the light/dark/system ARIA APG radiogroup, persist the choice per the elicited theme-persistence, and flip the data-theme attribute on the html element (REQ-006)."
   ],
   "internalStructure": "One shell module that mounts the surface, reads the applied capabilities sidecar, and renders the tabs landmark, the page-layout scaffolding, and the tabpanel-level containers for each conditional surface. The framework is not prescribed; the shell interfaces are what the project realises against React, Vue, Svelte or vanilla DOM.",
   "interfaces": [
@@ -35,7 +39,7 @@
     }
   ],
   "tradeoffs": "The shell reads the sidecar file the apply verb writes; a runtime probe against manifest.blueprints[] would be more dynamic but ties the shell to the deploy-target having filesystem read access, which not every deploy target grants. The sidecar contract is deterministic and cacheable.",
-  "notes": "Composes on application-empty-error-states (T-1) for the forbidden and empty-list states rather than inventing bespoke denied UI. Known mechanism-reach gap: the shell contract cannot prove keyboard focus does not escape the tabs region in every framework rendering; project-side smoke tests supplement the pack. See README Known mechanism-reach gaps.",
+  "notes": "Composes on application-empty-error-states for the forbidden and empty-list states rather than inventing bespoke denied UI. Known mechanism-reach gap: the shell contract cannot prove keyboard focus does not escape the tabs region in every framework rendering; project-side smoke tests supplement the pack. See README Known mechanism-reach gaps.",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/tacs/tac-2602-application-account-settings-capability-discovery.json

@@ -2,13 +2,13 @@
   "tacId": "TAC-2602-application-account-settings-capability-discovery",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Account settings capability discovery",
   "purpose": "The apply-time reader that translates the applied blueprint set and any custom-auth elicits into an appliedCapabilities[] array, and enforces the requiresAppliedCapabilities gate.",
   "responsibilities": [
     "Read the union of capabilities[] declarations across applied blueprints (AC-25101-1, AC-25107-1, AC-25108-1).",
-    "Add capabilities the operator asserted through the four custom-auth-provides-* elicits (AC-25101-1).",
+    "runElicitationPhase: Run the elicitation phase gated on the discovered capability set; each `custom-auth-provides-*` boolean binds its `providesCapability` token onto the applied union when true, omits it when false (REQ-009).",
     "Refuse at apply when no applied blueprint declares principalDirectory and --allow-no-auth-yet is not passed (AC-25109-1).",
     "Write the sidecar file capturing appliedCapabilities, appliedElicitations, allowNoAuthYet and any scaffolding note (AC-25109-2)."
   ],
@@ -24,5 +24,5 @@
   "tradeoffs": "The sidecar path is stable and versioned; a schema minor bump on rcf-schemas can promote appliedCapabilities[] onto the applied-record shape directly, at which point the helper reads the manifest record instead. Kept file-scoped for v1.",
   "notes": "Known mechanism-reach gap: a project that declares a capability outside the section 6a vocabulary passes the loader shape check but the shell records no surface for it. Documented in README.",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/tacs/tac-2604-application-account-settings-session-store.json

@@ -2,15 +2,16 @@
   "tacId": "TAC-2604-application-account-settings-session-store",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Session store contract",
   "purpose": "The sessions surface bridge between the applied blueprints session-inventory source and the terminate-write flow.",
   "responsibilities": [
-    "Read the active-session inventory from the applied provider (an auth blueprint declaring sessionInventory, or observability-logging 1.2.0+ as the logging-projection provider) (AC-25105-1, AC-25106-1).",
+    "Read the active-session inventory from the applied provider (an auth blueprint declaring sessionInventory, owned by security-auth-clerk TAC-1003-security-auth-clerk-session-verifier field interfaces.sessionInventory) (AC-25105-1, AC-25106-1).",
     "Render one row per session enumerated by data-session-id with device and last-active columns and a terminate action (AC-25105-1).",
     "Open an ARIA APG dialog-modal on terminate with focus-trap, aria-labelledby to the heading and focus-return to the neighbouring row on close (AC-25105-2).",
-    "Announce the terminate-success via <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> (AC-25105-2)."
+    "Announce the terminate-success via <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> (AC-25105-2).",
+    "reauthWindowGate: honour the option chosen from `blueprint.json.elicits[id=reauth-window].options` by comparing the current session lastActive from the applied auth providers sessionInventory against the elapsed threshold and refusing the high-value action with REAUTH_REQUIRED or REAUTH_STALE or REAUTH_WINDOW_UNKNOWN accordingly (AC-25111-1 through AC-25111-5)."
   ],
   "internalStructure": "One sessions-surface module with a read-inventory helper and a terminate-write helper. The read-inventory helper dispatches to the applied providers session-inventory API; the terminate-write helper dispatches to the same providers terminate API. The framework is not prescribed.",
   "interfaces": [
@@ -22,7 +23,12 @@
     {
       "name": "sessionRecord",
       "kind": "shape",
-      "description": "{ sessionId, deviceLabel, lastActive (ISO-8601), currentSession (boolean) }. The current session cannot be terminated by itself (the operator signs out from the shell instead); the pack asserts the surface renders every session, the terminate control is present on every non-current row, and the current row (data-current-session=\"true\") does not carry the terminate action."
+      "description": "Shape owned by `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` (or the equivalent session-inventory TAC on the applied auth blueprint). The consumer reads that shape without restating it; the pack asserts the surface renders every session, the terminate control is present on every non-current row, and the current row (data-current-session=\"true\") does not carry the terminate action."
+    },
+    {
+      "name": "sessionInventoryConsumer",
+      "kind": "consumer",
+      "description": "Consumer contract on top of the applied auth providers sessionInventory (owner TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory or the equivalent TAC on another auth blueprint). Reads list()/revoke()/revokeAllExceptCurrent() and never restates the row shape."
     }
   ],
   "dependencies": [
@@ -33,8 +39,8 @@
       "description": "The sessions surface reads the applied capability set to gate on sessionInventory."
     }
   ],
-  "tradeoffs": "Re-authenticate before terminate is elicited (reauth-window ADR-2604) with a default of true. A project that ships a short-lived session token can set reauth-window=never; ADR-2604 records the choice and its risk.",
+  "tradeoffs": "Re-authenticate before high-value changes is elicited by the manifest elicit `blueprint.json.elicits[id=reauth-window]`; the default value is owned by that elicit's `.default` field, per ADR-2604. A project that ships a short-lived session token may pick the disable option that elicit exposes; ADR-2604 records the choice and its risk.",
   "notes": "Known mechanism-reach gap: the read-inventory adapter contract cannot prove the applied provider actually returns a device label the operator will recognise (User-Agent parsing varies); the pack asserts the DOM shape.",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}