rcf-lite 0.25.0 → 0.27.0

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25101.json

@@ -13,13 +13,29 @@
       "id": "AC-25101-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given an authenticated principal AND an applied auth blueprint declaring principalDirectory, GET /account renders the shell as an ARIA APG tabs region [role=\"tablist\"] with one [role=\"tab\"] per applied capability plus the always-on profile tab; a tab whose capability is not in the applied set does NOT render (no disabled shell). Probed by pack check AC-25101-1."
+      "description": "Given an authenticated principal AND an applied auth blueprint declaring principalDirectory, GET /account renders the shell as an ARIA APG tabs region [role=\"tablist\"] with one [role=\"tab\"] per applied capability plus the always-on profile tab; a tab whose capability is not in the applied set does NOT render (no disabled shell). Probed by pack check AC-25101-1.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/tabs/",
+        "verifiedOn": "2026-09-10"
+      }
     },
     {
       "id": "AC-25101-2",
       "testable": true,
       "scope": "runtime",
-      "description": "The shell landmark is <nav data-role=\"account-settings-nav\" aria-label=\"Account settings\"> with a single accessible name; heading order follows h1 (page) then h2 (active tab) per WCAG 2.4.6."
+      "description": "The shell landmark is <nav data-role=\"account-settings-nav\" aria-label=\"Account settings\"> with a single accessible name; heading order follows h1 (page) then h2 (active tab) per WCAG 2.4.6.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25101-3",
+      "description": "When an unauthenticated principal requests /account, the shell routes to the shared forbidden state (application-empty-error-states), presents a sign-in link and renders no profile data.",
+      "given": "a request for /account without a valid principal on any applied auth blueprint",
+      "when": "the shell resolves the route",
+      "then": "the forbidden state renders with a sign-in link, no profile form is written to the DOM and no principal identifiers appear in the response body",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -30,5 +46,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25102.json

@@ -13,7 +13,32 @@
       "id": "AC-25102-1",
       "testable": true,
       "scope": "runtime",
-      "description": "GET /account/profile renders a <form data-surface=\"profile\"> with inputs carrying autocomplete tokens \"name\" on the full-name field, \"email\" on the email field, \"bday\" on the birthday field and \"country\" on the country field; save-success renders <div role=\"status\" aria-live=\"polite\">Profile saved</div>; save-failure per field carries aria-invalid=\"true\" and aria-describedby pointing to a rendered error message. Probed by pack check AC-25102-1."
+      "description": "GET /account/profile renders a <form data-surface=\"profile\"> with inputs carrying autocomplete tokens \"name\" on the full-name field, \"email\" on the email field, \"bday\" on the birthday field and \"country\" on the country field; save-success renders <div role=\"status\" aria-live=\"polite\">Profile saved</div>; save-failure per field carries aria-invalid=\"true\" and aria-describedby pointing to a rendered error message. Probed by pack check AC-25102-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25102-2",
+      "description": "A profile save that returns a non-2xx or times out surfaces an assertive error toast, preserves the entered values in the DOM (data-form-state=unsaved) and never marks the fields as saved.",
+      "given": "a profile save that returns a non-2xx or times out",
+      "when": "the principal submits",
+      "then": "an assertive error toast appears, data-form-state=unsaved renders and no data-form-state=saved is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25102-3",
+      "description": "Every identifier input carries an appropriate WCAG 1.3.5 autocomplete token (email as email, given-name as given-name, family-name as family-name); a break that removes any of these fails the pack.",
+      "given": "the profile form rendered",
+      "when": "the DOM is inspected",
+      "then": "every identifier input has an autocomplete attribute per WCAG 1.3.5",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#identify-input-purpose",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [
@@ -23,5 +48,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25103.json

@@ -13,7 +13,18 @@
       "id": "AC-25103-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When credentialSelfService is in the applied capability set, GET /account/security renders <div data-surface=\"security\" data-branch=\"self-service\"> containing a [data-role=\"change-password\"] form and a [data-role=\"mfa-management\"] region. Absent from render when credentialSelfService is not applied. Probed by pack check AC-25105-1 (unified security check)."
+      "description": "When credentialSelfService is in the applied capability set, GET /account/security renders <div data-surface=\"security\" data-branch=\"self-service\"> containing a [data-role=\"change-password\"] form and a [data-role=\"mfa-management\"] region. Absent from render when credentialSelfService is not applied. Probed by pack check AC-25105-1 (unified security check).",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25103-2",
+      "description": "The self-service credential-change surface never accepts a new password without a fresh reauthentication when the elicited reauth-window says so (REQ-007); a submit without a passing reauth refuses with REAUTH_REQUIRED.",
+      "given": "credentialSelfService applied with reauth-window > 0 and the current session past the elapsed threshold",
+      "when": "the principal submits a new password",
+      "then": "the submit refuses with REAUTH_REQUIRED and no credential change occurs",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -23,5 +34,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25104.json

@@ -13,7 +13,28 @@
       "id": "AC-25104-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When hostedIdentityUi is in the applied capability set AND the operator elicited security-surface-shape=hosted-link-out, GET /account/security renders <a data-role=\"hosted-link-out\" href=\"{hosted-identity-url}\" rel=\"noopener\"> with an accessible label carrying the destination provider name; when security-surface-shape=hosted-embed, renders <iframe data-role=\"hosted-embed\" title=\"Account security\" src=\"{hosted-identity-url}\" sandbox=\"allow-scripts allow-forms allow-same-origin\">. Probed by pack check AC-25105-1."
+      "description": "When hostedIdentityUi is in the applied capability set AND the operator elicited security-surface-shape=hosted-link-out, GET /account/security renders <a data-role=\"hosted-link-out\" href=\"{hosted-identity-url}\" rel=\"noopener\"> with an accessible label carrying the destination provider name; when security-surface-shape=hosted-embed, renders <iframe data-role=\"hosted-embed\" title=\"Account security\" src=\"{hosted-identity-url}\" sandbox=\"allow-scripts allow-forms allow-same-origin\">. Probed by pack check AC-25105-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25104-2",
+      "description": "When security-surface-shape is hosted-link-out, the surface renders an <a> element carrying data-role=hosted-link-out and href={hosted-identity-url}; a missing hosted-identity-url elicit answer refuses at apply with HOSTED_URL_MISSING. Applying agent sets: hosted-identity-url.",
+      "given": "hostedIdentityUi applied with security-surface-shape=hosted-link-out and hosted-identity-url set",
+      "when": "the security route renders",
+      "then": "the DOM carries an <a data-role=\"hosted-link-out\" href={hosted-identity-url}> element; missing URL refuses at apply",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-25104-3",
+      "description": "When security-surface-shape is hosted-embed, the surface renders an <iframe data-role=\"hosted-embed\" title=\"Account security\" src={hosted-identity-url}> element; the iframe carries a defined title for screen readers. Applying agent sets: hosted-identity-url.",
+      "given": "hostedIdentityUi applied with security-surface-shape=hosted-embed",
+      "when": "the security route renders",
+      "then": "the DOM carries the described iframe with a non-empty title",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -23,5 +44,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25105.json

@@ -13,13 +13,61 @@
       "id": "AC-25105-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When sessionInventory is in the applied capability set, GET /account/sessions renders <div data-surface=\"sessions\"> containing a table whose rows are enumerated by data-session-id, each row carrying [data-column=\"device\"], [data-column=\"lastActive\"] and a [data-action=\"terminate\"] control. Absent when sessionInventory is not applied. Probed by pack check AC-25106-1."
+      "description": "When sessionInventory is in the applied capability set, GET /account/sessions renders <div data-surface=\"sessions\"> containing a table whose rows are enumerated by data-session-id, each row carrying [data-column=\"device\"], [data-column=\"lastActive\"] and a [data-action=\"terminate\"] control. Absent when sessionInventory is not applied. Probed by pack check AC-25106-1.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-25105-2",
       "testable": true,
       "scope": "runtime",
-      "description": "Clicking [data-action=\"terminate\"] opens <div role=\"dialog\" aria-modal=\"true\" data-role=\"terminate-confirm\" aria-labelledby=\"terminate-confirm-heading\"> with the row focus-trapped inside the dialog; on confirm the row is removed and <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> is announced; focus returns to the neighbouring row on close."
+      "description": "Clicking [data-action=\"terminate\"] opens <div role=\"dialog\" aria-modal=\"true\" data-role=\"terminate-confirm\" aria-labelledby=\"terminate-confirm-heading\"> with the row focus-trapped inside the dialog; on confirm the row is removed and <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> is announced; focus returns to the neighbouring row on close.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/dialog-modal/",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-25105-3",
+      "description": "When the read of the session inventory fails (a non-2xx from the applied provider or a timeout), the sessions surface renders an error state naming the failure and no row is rendered as if terminated; a retry control is keyboard-reachable.",
+      "given": "the applied provider returns a non-2xx or times out on sessionInventory.list()",
+      "when": "the /account/sessions route renders",
+      "then": "the surface shows an inventory-read-failed banner, no data-session-id rows appear as terminated, and a retry control is keyboard-reachable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-25105-4",
+      "description": "When the terminate-write fails on a session (a non-2xx from revoke() or a timeout), the row remains in the DOM with data-terminate-outcome=failed, the polite live region announces the failure, and no data-role=session-terminated-announce fires.",
+      "given": "a principal invokes terminate on a session row and the provider rejects revoke()",
+      "when": "the terminate write resolves",
+      "then": "the row remains with data-terminate-outcome=failed, the polite live region announces the failure and no session-terminated-announce is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-25105-5",
+      "description": "The current session row carries data-current-session=true and its terminate control refuses (data-action=terminate is absent or renders disabled with an aria-describedby explanation) so a principal cannot accidentally terminate their own session from within the surface.",
+      "given": "the sessions inventory carries a row with currentSession=true",
+      "when": "the surface renders",
+      "then": "the current row carries data-current-session=true and its terminate control is disabled with an aria-describedby explanation",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
     }
   ],
   "tacIds": [
@@ -29,5 +77,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25106.json

@@ -4,16 +4,35 @@
   "reqId": "application-account-settings-REQ-004",
   "version": "1.0.0",
   "status": "approved",
-  "title": "Sessions surface hoists session inventory from an applied logging companion",
-  "asA": "authenticated principal on a project where the logger is the session store",
-  "iWant": "the sessions surface to read the applied logging companion inventory when sessionInventory arrives from observability-logging rather than from an auth blueprint",
-  "soThat": "the composition is the same regardless of which applied blueprint declared sessionInventory",
+  "title": "Sessions surface reads session inventory from the applied auth provider only",
+  "asA": "shelf consumer applying application-account-settings with an auth blueprint that declares sessionInventory",
+  "iWant": "the sessions surface to read the applied auth providers inventory verbatim, without restating the shape locally",
+  "soThat": "the shape of a session row is owned by the auth blueprint and never drifts on the account-settings side",
   "acceptanceCriteria": [
     {
       "id": "AC-25106-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The sessions surface reads sessionInventory from the union of applied capabilities across auth AND logging providers; the render contract of AC-25105-1 is identical whether the capability was supplied by an auth blueprint (security-auth-clerk 1.3.0, security-auth-keycloak 1.2.0, security-auth-oauth2 1.2.0) or by observability-logging 1.2.0."
+      "description": "The sessions surface reads sessionInventory from the applied auth provider (security-auth-clerk 1.3.0+, security-auth-keycloak 1.2.0+, security-auth-oauth2 1.2.0+); the render contract of AC-25105-1 is identical regardless of which auth blueprint supplied the capability. observability-logging 1.3.0 no longer provides sessionInventory and is not consulted on this surface.",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-25106-2",
+      "description": "When two auth blueprints applied both declare sessionInventory, the sessions surface reads exactly one of them (the first in the applied source order) and never merges rows across providers; a divergent shape between providers refuses the render with SESSION_PROVIDER_CONFLICT.",
+      "given": "two applied auth blueprints both declaring sessionInventory",
+      "when": "the sessions route renders",
+      "then": "the surface reads the first providers inventory only, no cross-provider merge occurs and a divergent-shape observation refuses with SESSION_PROVIDER_CONFLICT",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
     }
   ],
   "tacIds": [
@@ -23,5 +42,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25107.json

@@ -13,7 +13,18 @@
       "id": "AC-25107-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When application-notifications-in-app is in the applied-blueprint set, GET /account/notifications renders <div data-surface=\"notifications\"> with [data-role=\"category-silence\"] entries per category and [data-role=\"channel-opt-in\"] entries per channel; save-success and save-failure announcements follow the profile surface contract. Absent when notifications-in-app is not applied. Probed by pack check AC-25107-1."
+      "description": "When application-notifications-in-app is in the applied-blueprint set, GET /account/notifications renders <div data-surface=\"notifications\"> with [data-role=\"category-silence\"] entries per category and [data-role=\"channel-opt-in\"] entries per channel; save-success and save-failure announcements follow the profile surface contract. Absent when notifications-in-app is not applied. Probed by pack check AC-25107-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25107-2",
+      "description": "When application-notifications-in-app is not applied, the preferences tab is suppressed (not linked in the settings navigation and returning 404 on direct URL); no preferences form is written to the DOM.",
+      "given": "application-notifications-in-app not applied",
+      "when": "the settings shell renders",
+      "then": "no preferences link appears in navigation, /account/preferences is unreachable and no preferences form is in the DOM",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -23,5 +34,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25108.json

@@ -13,7 +13,32 @@
       "id": "AC-25108-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When application-spa is in the applied-blueprint set, GET /account/theme renders <div data-surface=\"theme\" role=\"radiogroup\" aria-label=\"Theme\"> containing three <input type=\"radio\" name=\"theme\" value=\"light|dark|system\"> options; selecting an option flips the data-theme attribute on the html element and persists per the theme-persistence elicit (spa-local-storage default, server-scoped, or none). Probed by pack check AC-25108-1."
+      "description": "When application-spa is in the applied-blueprint set, GET /account/theme renders <div data-surface=\"theme\" role=\"radiogroup\" aria-label=\"Theme\"> containing three <input type=\"radio\" name=\"theme\" value=\"light|dark|system\"> options; selecting an option flips the data-theme attribute on the html element and persists per the theme-persistence elicit (spa-local-storage default, server-scoped, or none). Probed by pack check AC-25108-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25108-2",
+      "description": "The theme surface renders a radiogroup with exactly three options (light, dark, system) using role=\"radiogroup\" and role=\"radio\", each with an accessible name; a break that omits a radio fails the pack.",
+      "given": "application-spa applied and the theme route renders",
+      "when": "the DOM is inspected",
+      "then": "the theme control is a radiogroup with three radios named light, dark and system",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/radio/",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-25108-3",
+      "description": "When theme-persistence is spa-local-storage, the theme choice persists across principal loads via localStorage; when server-scoped, the choice persists via the applied server endpoint; when none, the choice resets to system on load. Applying agent sets: theme-persistence.",
+      "given": "each theme-persistence value applied in turn",
+      "when": "the principal picks a theme and reloads",
+      "then": "spa-local-storage persists via localStorage, server-scoped persists via the server endpoint, none resets to system",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -23,5 +48,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25109.json

@@ -13,13 +13,15 @@
       "id": "AC-25109-1",
       "testable": true,
       "scope": "runtime",
-      "description": "rcf define blueprint add ./blueprints/application-account-settings on a project with no applied blueprint declaring principalDirectory exits 3 and prints the [application-account-settings-bare-spa] refusal message quoting the required capability, the applied-blueprint list and the two suggested next steps."
+      "description": "rcf define blueprint add ./blueprints/application-account-settings on a project with no applied blueprint declaring principalDirectory exits 3 and prints the [application-account-settings-bare-spa] refusal message quoting the required capability, the applied-blueprint list and the two suggested next steps.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-25109-2",
       "testable": true,
       "scope": "runtime",
-      "description": "Passing --allow-no-auth-yet applies the blueprint and writes rcf/blueprints/application-account-settings.applied.json with allowNoAuthYet:true, empty appliedCapabilities and a scaffolding-pass note; rcf define validate flags the sidecar note on read-back."
+      "description": "Passing --allow-no-auth-yet applies the blueprint and writes rcf/blueprints/application-account-settings.applied.json with allowNoAuthYet:true, empty appliedCapabilities and a scaffolding-pass note; rcf define validate flags the sidecar note on read-back.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25110.json

@@ -13,7 +13,18 @@
       "id": "AC-25110-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When no applied blueprint declares credentialSelfService OR hostedIdentityUi and the operator answers --answer security-surface-shape=self-service (or =hosted-link-out or =hosted-embed), apply exits 3 with the two-remedy message: (a) apply an auth blueprint that declares one of the two security capabilities, or (b) drop the security tab from scope by not answering security-surface-shape."
+      "description": "When no applied blueprint declares credentialSelfService OR hostedIdentityUi and the operator answers --answer security-surface-shape=self-service (or =hosted-link-out or =hosted-embed), apply exits 3 with the two-remedy message: (a) apply an auth blueprint that declares one of the two security capabilities, or (b) drop the security tab from scope by not answering security-surface-shape.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25110-2",
+      "description": "The refusal names both remedies: applying an auth blueprint that declares credentialSelfService or hostedIdentityUi, and re-answering security-surface-shape or leaving the elicit unanswered. The refusal message is stable and matches the packaged fixture.",
+      "given": "a project answering security-surface-shape without a supplying capability",
+      "when": "apply runs",
+      "then": "apply refuses naming both remedies and the refusal message matches the packaged fixture verbatim",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -23,5 +34,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25111.json

@@ -0,0 +1,71 @@
+{
+  "usId": "application-account-settings-US-25111",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Every reauth-window option gates the high-value change with a defined behaviour",
+  "asA": "principal on a project applying application-account-settings with reauth-window chosen",
+  "iWant": "the surface to prompt for reauthentication when the elicited window says so and to refuse the high-value change otherwise",
+  "soThat": "a compromised session cannot silently walk through a credential change or a session termination outside the policy the operator elicited",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25111-1",
+      "description": "When reauth-window is `never`, a high-value action (credential change, MFA enrolment, session termination) proceeds after the standard confirmation dialog without an additional reauth prompt.",
+      "given": "reauth-window=never applied",
+      "when": "the principal confirms a high-value action",
+      "then": "the action proceeds after the standard confirmation dialog with no reauth prompt rendered",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25111-2",
+      "description": "When reauth-window is `5` and more than 5 minutes have elapsed since the current session's last-active timestamp from the applied auth providers session inventory, the high-value action refuses with REAUTH_REQUIRED and a reauth prompt renders; the action does not proceed until the reauth prompt returns success.",
+      "given": "reauth-window=5 applied and a session with lastActive older than 5 minutes",
+      "when": "the principal confirms a high-value action",
+      "then": "the action refuses with REAUTH_REQUIRED, a reauth prompt renders and the action proceeds only after the reauth prompt returns success",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+    },
+    {
+      "id": "AC-25111-3",
+      "description": "When reauth-window is `15`, the same behaviour applies with a 15-minute elapsed threshold; when reauth-window is `60`, the threshold is 60 minutes.",
+      "given": "reauth-window=15 or reauth-window=60 applied",
+      "when": "the principal confirms a high-value action after the elapsed threshold",
+      "then": "the action refuses with REAUTH_REQUIRED and a reauth prompt renders; below the threshold no reauth prompt renders",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+    },
+    {
+      "id": "AC-25111-4",
+      "description": "The reauth prompt never accepts the current session credentials as sufficient without a fresh challenge (a fresh password entry, a fresh MFA challenge or a fresh magic-link click); a reauth attempt that reuses only the current session token refuses with REAUTH_STALE.",
+      "given": "any reauth-window not `never` and an elapsed session",
+      "when": "the principal submits the current session token as the reauth",
+      "then": "the reauth refuses with REAUTH_STALE and a fresh challenge is presented",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25111-5",
+      "description": "The elapsed-minutes comparison uses the current session's lastActive from the applied auth providers session inventory, never a client-side clock; when the inventory read fails the surface refuses the high-value action with REAUTH_WINDOW_UNKNOWN and offers a retry.",
+      "given": "any reauth-window not `never` and the session inventory read fails",
+      "when": "the principal confirms a high-value action",
+      "then": "the action refuses with REAUTH_WINDOW_UNKNOWN, a retry control renders keyboard-reachable and no client clock is used",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+    }
+  ],
+  "tacIds": [
+    "TAC-2604-application-account-settings-session-store"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25112.json

@@ -0,0 +1,77 @@
+{
+  "usId": "application-account-settings-US-25112",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-009",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Custom-auth provides-* boolean elicits each bind one applied-capabilities token on the sidecar",
+  "asA": "operator applying the account-settings on a project running its own auth (no shipped security-auth-* blueprint)",
+  "iWant": "each of the four custom-auth-provides-* boolean elicits to bind its capability token onto the sidecar's appliedCapabilities union with a per-token clause (true adds; false omits)",
+  "soThat": "the shell reads the exact capability union the elicited answers produce and no downstream surface guesses at what a custom auth has declared",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25112-1",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is answered `true`, the sidecar written by the elicitation phase records `principalDirectory` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `principalDirectory` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-principal-directory`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-principal-directory` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `principalDirectory` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2602-application-account-settings-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    },
+    {
+      "id": "AC-25112-2",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-credential-self-service]` is answered `true`, the sidecar written by the elicitation phase records `credentialSelfService` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `credentialSelfService` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-credential-self-service`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-credential-self-service` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `credentialSelfService` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2602-application-account-settings-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    },
+    {
+      "id": "AC-25112-3",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-session-inventory]` is answered `true`, the sidecar written by the elicitation phase records `sessionInventory` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `sessionInventory` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-session-inventory`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-session-inventory` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `sessionInventory` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2602-application-account-settings-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    },
+    {
+      "id": "AC-25112-4",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-hosted-identity-ui]` is answered `true`, the sidecar written by the elicitation phase records `hostedIdentityUi` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `hostedIdentityUi` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-hosted-identity-ui`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-hosted-identity-ui` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `hostedIdentityUi` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2602-application-account-settings-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-2602-application-account-settings-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-account-settings/docs/topics.md

@@ -2,12 +2,12 @@
 
 ## Global topics
 
-The blueprint claims no new global topics at v1.0.0. Account-settings is a consumer of the identity capability set the applied auth blueprints (and the observability-logging companion) declare through `capabilities[]`; every ADR (capability-vocabulary extension, security-surface-shape, theme-persistence, reauth-window) is non-global.
+The blueprint claims no new global topics at v1.0.0. Account-settings is a consumer of the identity capability set the applied auth blueprints declare through `capabilities[]`; every ADR (capability-vocabulary extension, security-surface-shape, theme-persistence, reauth-window) is non-global.
 
 ## Deliberately unclaimed topics
 
 - `themePersistence` (the shape of theme persistence). Reserved for the applied `application-spa` blueprint's own ADR set; the account-settings blueprint offers the operator surface for choosing the theme and hands the persistence to the SPA blueprint via the elicited `theme-persistence` answer.
-- `sessionInventory` (the shape of a session-inventory record). Reserved for the applied provider's ADR set (an auth blueprint, or observability-logging as the logging-projection provider). The account-settings blueprint reads the inventory through the applied provider's interface.
+- `sessionInventory` (the shape of a session-inventory record). Owner: security-auth-clerk TAC-1003-security-auth-clerk-session-verifier field interfaces.sessionInventory (the shape any auth blueprint declaring the capability agrees to). observability-logging 1.3.0 no longer provides it; the account-settings blueprint reads the inventory through the applied auth provider only.
 - `credentialSelfService` (the shape of a credential surface). Reserved for the applied auth blueprint's ADR set for the same reason.
 - `hostedIdentityUi` (the shape of a hosted identity portal). Reserved for the applied auth blueprint's ADR set for the same reason.
 
@@ -26,7 +26,7 @@ The blueprint claims no new global topics at v1.0.0. Account-settings is a consu
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -43,8 +43,8 @@ The shelf-wide band registry lives in `packages/rcf-lite/docs/blueprint-authorin
 
 ## Cross-references
 
-- `application-empty-error-states` (T-1, shipped v1.0.0): the shell composes on the `forbidden` and `empty-list` states rather than inventing bespoke access-denied UI. Every project applying `application-account-settings` should also apply `application-empty-error-states`.
-- `application-admin-console` (T-5, shipped v1.0.0): shares the capability-declaration mechanism (`capabilities[]` on identity blueprints) and the apply-time discovery, refusal and custom-auth elicitation. The two blueprints are separate consumers (the account-settings surface is per-principal; the admin-console surface is per-operator-with-admin-scope) and never render the same surface.
+- `application-empty-error-states` (shipped v1.0.0): the shell composes on the `forbidden` and `empty-list` states rather than inventing bespoke access-denied UI. Every project applying `application-account-settings` should also apply `application-empty-error-states`.
+- `application-admin-console` (shipped v1.0.0): shares the capability-declaration mechanism (`capabilities[]` on identity blueprints) and the apply-time discovery, refusal and custom-auth elicitation. The two blueprints are separate consumers (the account-settings surface is per-principal; the admin-console surface is per-operator-with-admin-scope) and never render the same surface.
 
 ## Probe pack
 

package/blueprints/application-account-settings/guide/application-account-settings.md

@@ -20,7 +20,7 @@ You want an anonymous product (no principal, no profile). The blueprint refuses
 
 ## Mechanism-reach gaps
 
-The blueprint's README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack; the shipped v1.0.0 pack anchors the five load-bearing surface checks. Combine with the round-3 T-1 datatable pack to reach the sessions and notification-preferences shells' state-region contract.
+The blueprint's README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack; the shipped v1.0.0 pack anchors the five load-bearing surface checks. Combine with the round-3 datatable pack to reach the sessions and notification-preferences shells' state-region contract.
 
 ## Promotion signals
 

package/blueprints/application-account-settings/probe-packs/application-account-settings.pack.mjs

@@ -11,12 +11,12 @@
 //   AC-25108-1 theme surface renders the radiogroup and persists per the elicited
 //              theme-persistence (fires when application-spa is applied via caps)
 //
-// Every check drives the real Playwright browser the T-0 runner injects and reads
+// Every check drives the real Playwright browser the runner injects and reads
 // its per-check applicability from the blueprint applied sidecar
 // (rcf/blueprints/application-account-settings.applied.json) written by the apply
 // verb: an absent capability records verdict: skipped and the aggregate treats the
 // check as neither pass nor fail (spec section 3.3, rcf-schemas 0.6.1 has no
-// applicable: false field, per round-3 T-5 precedent).
+// applicable: false field, per round-3 precedent).
 //
 // Sample-app fixture: packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/.
 // The fixture ships CAPS and APPS env / ?caps= / ?apps= switches mirroring the