rcf-lite 0.25.0 → 0.27.0

package/blueprints/application-spa/contributions/requirements/application-spa-req-011.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:11-iconography"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-012.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:12-motion"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-013.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:13-state-management"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-014.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:14-offline-degraded"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities.network"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-015.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:15-i18n-readiness"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-203-application-spa-component-library",
+    "field": "responsibilities.hard-coded"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-016.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:16-telemetry"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-017.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:17-copy-hygiene"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities.render"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-018.json

@@ -2,7 +2,7 @@
   "reqId": "application-spa-REQ-018",
   "prdId": "PRD-001",
   "title": "SPA security baselines: CSP, sanitised dynamic HTML, hardened session cookies, no bundled secrets",
-  "description": "The application ships a named Content-Security-Policy, never renders user-influenced data through raw HTML injection without a sanitiser, sets session cookies with Secure, HttpOnly, and SameSite attributes, round-trips form values XSS-safely, and includes no secrets or privileged endpoints in the shipped bundle.",
+  "description": "The application ships a named content-security-policy, never renders user-influenced data through raw HTML injection without a sanitiser, sets session cookies with Secure, HttpOnly, and SameSite attributes, round-trips form values XSS-safely, and includes no secrets or privileged endpoints in the shipped bundle.",
   "category": "security",
   "domain": "security",
   "priority": "must",
@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "category:18-security"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-209-application-spa-csp-styled-adherence-probe",
+    "field": "responsibilities.content-security-policy"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-019.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "quality-bar:accessibility"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-020.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "quality-bar:typography"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/requirements/application-spa-req-021.json

@@ -11,8 +11,12 @@
     "blueprint:application-spa",
     "quality-bar:performance"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-08-19T09:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-201-application-spa-app-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-spa/contributions/tacs/tac-201-application-spa-app-shell.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-201-application-spa-app-shell",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "status": "approved",
   "name": "Application shell and navigation",
   "purpose": "Owns the persistent frame around every route: top navigation, optional side navigation, skip-link, landmark structure, and the outlet the router renders into.",
@@ -11,7 +11,8 @@
     "Expose ARIA landmarks (banner, navigation, main, contentinfo) and the skip-link as the first focusable element.",
     "Own keyboard behaviour for shell-level interaction: Tab traversal, arrow-key movement within menus, Escape closing overlays.",
     "Host the global surfaces that outlive routes: network-state banner (application-spa-REQ-014), toast region, and theme toggle.",
-    "Apply safe-area insets so shell chrome clears hardware cutouts (application-spa-REQ-003)."
+    "Apply safe-area insets so shell chrome clears hardware cutouts (application-spa-REQ-003).",
+    "Own the return-to state on the client-side router: on an unauthenticated visit to a protected route the originally requested path is captured, preserved across the sign-in flow (including a sign-out and re-authentication), and used as the post-sign-in landing (application-spa-REQ-009 deep-link and return-to behaviour)."
   ],
   "internalStructure": "A shell layout component wrapping the router outlet; navigation data is declarative (the route inventory from application-spa-REQ-001), not hand-wired per link.",
   "interfaces": [
@@ -41,5 +42,5 @@
   ],
   "tradeoffs": "A single persistent shell trades a little initial bundle weight for consistent navigation, one focus-management seam, and one place to verify landmarks.",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-202-application-spa-theme-system.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-202-application-spa-theme-system",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Theme system and design tokens",
   "purpose": "Realises the semantic token layer (colour, spacing, radius, typography, elevation, motion) in both themes and owns theme selection, persistence-data-sqlite, and application.",

package/blueprints/application-spa/contributions/tacs/tac-203-application-spa-component-library.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-203-application-spa-component-library",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Component library",
   "purpose": "The single source of interactive and presentational primitives listed in application-spa-REQ-006; application screens compose these, they do not restyle them.",

package/blueprints/application-spa/contributions/tacs/tac-204-application-spa-client-data-layer.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-204-application-spa-client-data-layer",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Client data layer",
   "purpose": "Owns server-state caching, request lifecycle, invalidation, optimistic updates, and offline queueing; the seam between the UI and the wire.",

package/blueprints/application-spa/contributions/tacs/tac-205-application-spa-forms-engine.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-205-application-spa-forms-engine",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Forms and validation engine",
   "purpose": "Shared machinery for field state, validation timing, error binding, and submit orchestration per application-spa-REQ-007.",

package/blueprints/application-spa/contributions/tacs/tac-206-application-spa-telemetry.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-206-application-spa-telemetry",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Telemetry and error reporting",
   "purpose": "Emits journey checkpoint events, error-boundary reports, and performance marks per application-spa-REQ-016 under the naming scheme in ADR-209-application-spa-telemetry-naming.",

package/blueprints/application-spa/contributions/tacs/tac-207-application-spa-token-adherence-probe.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-207-application-spa-token-adherence-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Token adherence probe",
   "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). Watchpost run4 demonstrated that declaring the discipline does not compel the shipped surface: build cycles ran green while raw hex values sat in component stylesheets. This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit when the discipline is violated, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",

package/blueprints/application-spa/contributions/tacs/tac-208-application-spa-icon-adherence-probe.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-208-application-spa-icon-adherence-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Icon adherence probe",
   "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). Watchpost run4 shipped zero icons across eight surfaces while the build cycle ran green; declaring the discipline is not the same as compelling it. This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit when a component sidesteps the alias registry, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",

package/blueprints/application-spa/contributions/tacs/tac-209-application-spa-csp-styled-adherence-probe.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-209-application-spa-csp-styled-adherence-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "status": "approved",
   "name": "Styled-under-shipped-CSP adherence probe",
   "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). Watchpost run4 demonstrated the mechanism-reach gap this probe cures: FBS-011 declared a strict CSP (style-src 'self', no unsafe-inline), FBS-013/015 rendered inline <style> blocks, every existing UI-bearing gate passed (28 styled screenshots, browser-verify green), and yet every production page rendered unstyled at deploy because the harness bypassed the production security-header path. This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
@@ -12,7 +12,7 @@
     "For every enumerated route: navigate a real headless browser to the served URL, capture the response `content-security-policy` header, capture the response body, read the browser's final URL after any redirect chain resolves, run getComputedStyle on document.body, and record the results (AC-1131-1, AC-1131-2, AC-1131-3).",
     "Refuse the run when any captured CSP declares 'unsafe-inline' or 'unsafe-eval' on style-src, when style-src is absent, or when style-src is served as a wildcard (AC-1131-1).",
     "Refuse the run when any captured response body contains a `<style` substring (case-insensitive), including <style> injected by templating helpers (AC-1131-2).",
-    "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, watchpost run4 partial-acceptance gap w-2026-08-24-003).",
+    "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, the watchpost run4 partial-acceptance class defect).",
     "Refuse the run when the computed body backgroundColor for any route is the browser default (`rgba(0, 0, 0, 0)` / `transparent`) or when the computed body fontFamily resolves to an empty value; both indicate the shipped stylesheet did NOT reach the runtime surface under the production headers (AC-1131-3).",
     "Issue a same-origin GET against the linked stylesheet URL through the same server instance and refuse when the response is not 200 with content-type `text/css` (AC-1131-4).",
     "Write a JSON report at a stable relative path (`reports/csp-styled-adherence.json` under the configured report directory, matching the delivery-ci-workflows per-gate report shape of TAC-702) naming: every route probed, the CSP header captured, whether an inline <style> was detected, the computed background and fontFamily values, the stylesheet GET verdict, and an ok / fail verdict (AC-1131-5).",
@@ -55,7 +55,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a real browser and a running server for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the mechanism-reach gap at watchpost run4 proved was missing: build cycles ran green and shipped an unstyled surface because no gate exercised the production header path with a real browser. Driving the shipped construction (not a bespoke harness) is the load-bearing choice; refusing app.inject() satisfaction is deliberate. The requirement that verification runs THROUGH the shipped headers is what makes the AC bite; a probe that stamps its own headers would recreate the class defect it exists to refuse. The v1.0.1 landed-path refusal cures a second gap the same class defect exposed: Playwright's `page.goto` follows redirects by default and returns the FINAL response, so a session-broken authenticated route silently 302'ing to a styled /login left every downstream styled-body assertion validating the login page instead of the requested surface (watchpost partial-acceptance w-2026-08-24-003 / AC-1601-14). Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes the gap without coupling the probe to session-lane internals.",
+  "tradeoffs": "The probe requires a real browser and a running server for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the mechanism-reach gap at watchpost run4 proved was missing: build cycles ran green and shipped an unstyled surface because no gate exercised the production header path with a real browser. Driving the shipped construction (not a bespoke harness) is the load-bearing choice; refusing app.inject() satisfaction is deliberate. The requirement that verification runs THROUGH the shipped headers is what makes the AC bite; a probe that stamps its own headers would recreate the class defect it exists to refuse. The v1.0.1 landed-path refusal cures a second gap the same class defect exposed: Playwright's `page.goto` follows redirects by default and returns the FINAL response, so a session-broken authenticated route silently 302'ing to a styled /login left every downstream styled-body assertion validating the login page instead of the requested surface (the watchpost partial-acceptance class defect). Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes the gap without coupling the probe to session-lane internals.",
   "createdAt": "2026-08-24T10:30:00Z",
   "updatedAt": "2026-08-31T11:15:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-210-application-spa-external-dependency-provisioning-probe.json

@@ -2,10 +2,10 @@
   "tacId": "TAC-210-application-spa-external-dependency-provisioning-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "External-service-dependency provisioning adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the deployment-gate class defect the watchpost first-production review caught (w-2026-08-24-005, w-2026-08-24-006): the only login path (magic-link email) shipped inert because RESEND_API_KEY was a placeholder, the gap was filed as a 'quirk' in status.md rather than blocked at sign-off, and a real key existed in the estate all along. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md quirk line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the deployment-gate class defect the watchpost first-production review caught: the only login path (magic-link email) shipped inert because RESEND_API_KEY was a placeholder, the gap was filed as a 'quirk' in status.md rather than blocked at sign-off, and a real key existed in the estate all along. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md quirk line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1132-5, AC-1132-6).",
     "Accept configuration naming (i) the path of the application's external-service-dependency manifest, (ii) how to boot the target server for handshake evidence (a Node module or command that starts the same server instance the production entry point starts, with the same route registration and middleware stack), (iii) the path of the ratified-deferrals store the deferral records live in, and (iv) the report directory (AC-1132-1, AC-1132-3, AC-1132-4).",

package/blueprints/application-spa/contributions/tacs/tac-211-application-spa-core-flow-e2e-probe.json

@@ -2,10 +2,10 @@
   "tacId": "TAC-211-application-spa-core-flow-e2e-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Core-flow end-to-end adherence probe",
-  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. Watchpost first production (w-2026-08-24-005) demonstrated the deployment-gate class defect this probe cures: the app was signed off as DEPLOYED, admin access was reachable only via ssh-minted tokens because magic-link email never worked in production, and the authentication core flow was never proven end-to-end in the shipped runtime. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. Watchpost first production demonstrated the deployment-gate class defect this probe cures: the app was signed off as DEPLOYED, admin access was reachable only via ssh-minted tokens because magic-link email never worked in production, and the authentication core flow was never proven end-to-end in the shipped runtime. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1133-5, AC-1133-6).",
     "Accept configuration naming (i) the path of the application's core-flow manifest, (ii) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration, the same production security-header stack, and the same middleware), (iii) how to reach real external-service providers (the deferrals-permission is the same shape as TAC-210 accepts for its 'deferred' entries), and (iv) the report directory (AC-1133-1, AC-1133-2, AC-1133-4).",

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1101.json

@@ -2,7 +2,7 @@
   "usId": "application-spa-US-1101",
   "prdId": "PRD-001",
   "reqId": "application-spa-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Declared routes, canonical URLs, breadcrumbs, and not-found surfaces",
   "asA": "user sharing and revisiting links",
@@ -11,12 +11,17 @@
   "acceptanceCriteria": [
     {
       "id": "AC-1101-1",
-      "description": "The project maintains a declared route inventory naming every route; no navigable surface exists outside it.",
+      "description": "The project maintains a declared route inventory naming every route; no navigable surface exists outside it. Applying agent sets: the source location of the declared route inventory (a manifest, module export, or route table) and the enumeration of every reachable navigation target the inventory compares against.",
       "given": "the application source tree",
       "when": "the route inventory is compared against reachable navigation targets",
       "then": "every reachable target appears in the inventory and every inventory entry is reachable",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-201-application-spa-app-shell",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "template"
     },
     {
       "id": "AC-1101-2",
@@ -25,7 +30,8 @@
       "when": "a non-canonical variant of that URL is visited",
       "then": "the application redirects or rewrites to the canonical shape",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1101-3",
@@ -34,7 +40,8 @@
       "when": "the route renders",
       "then": "a breadcrumb trail shows the ancestry and each crumb navigates to its level",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1101-4",
@@ -43,7 +50,12 @@
       "when": "a path outside the route inventory is visited",
       "then": "the 404 surface renders with shell navigation present, not a blank page or silent redirect",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-201-application-spa-app-shell",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-1101-5",
@@ -52,7 +64,8 @@
       "when": "its canonical URL is visited",
       "then": "the 410 surface renders naming the resource as removed",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1101-6",
@@ -61,7 +74,8 @@
       "when": "the URL is opened in a fresh browser session",
       "then": "the route renders its arrival state without client-side navigation first",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1102.json

@@ -2,7 +2,7 @@
   "usId": "application-spa-US-1102",
   "prdId": "PRD-001",
   "reqId": "application-spa-REQ-002",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Navigation shell with visible structure and active states",
   "asA": "user moving between areas of the application",
@@ -11,12 +11,17 @@
   "acceptanceCriteria": [
     {
       "id": "AC-1102-1",
-      "description": "Top navigation renders on every route from the route inventory; sections the signed-in user cannot access are absent, not disabled.",
+      "description": "Top navigation renders on every route from the route inventory; sections the signed-in user cannot access are absent, not disabled. Applying agent sets: the top-navigation section inventory (per applied route inventory).",
       "given": "any declared route",
       "when": "the route renders",
       "then": "the top navigation is present and reflects the route inventory for the current user",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-201-application-spa-app-shell",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "template"
     },
     {
       "id": "AC-1102-2",
@@ -25,16 +30,18 @@
       "when": "the route renders",
       "then": "that section's item is visually active and exposes aria-current",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1102-3",
-      "description": "Side navigation, where the project declares secondary structure, collapses below 1024 into an accessible disclosure pattern rather than disappearing.",
+      "description": "Side navigation, where the project declares secondary structure, collapses below 1024 into an accessible disclosure pattern rather than disappearing. Applying agent sets: whether the project ships secondary navigation, the toggle control that reveals it below the collapse breakpoint (default 1024), the accessible name and expanded/collapsed state text on the toggle.",
       "given": "a project with declared secondary navigation",
       "when": "the viewport is below 1024",
       "then": "secondary navigation is reachable via a toggle with an accessible name and state",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-1102-4",
@@ -43,7 +50,8 @@
       "when": "their rendered shells are compared",
       "then": "navigation structure and behaviour are identical except for active states",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1102-5",
@@ -52,12 +60,13 @@
       "when": "it is inspected or middle-clicked",
       "then": "it exposes an href and opens correctly in a new tab",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-201-application-spa-app-shell"
   ],
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1103.json

@@ -2,7 +2,7 @@
   "usId": "application-spa-US-1103",
   "prdId": "PRD-001",
   "reqId": "application-spa-REQ-002",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Keyboard navigation, skip-link, and landmark roles",
   "asA": "keyboard-only user",
@@ -16,7 +16,8 @@
       "when": "Tab is pressed once from page load",
       "then": "the skip-link receives visible focus and activating it moves focus into main",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-2",
@@ -25,7 +26,8 @@
       "when": "the page is traversed with Tab and Shift-Tab",
       "then": "focus order matches visual order with no unreachable interactive element",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-3",
@@ -34,7 +36,8 @@
       "when": "arrow keys and Tab are pressed",
       "then": "arrows move within the menu and Tab moves focus out of it",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-4",
@@ -43,7 +46,8 @@
       "when": "Escape is pressed",
       "then": "the overlay closes and focus returns to its trigger",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-5",
@@ -52,7 +56,8 @@
       "when": "the accessibility tree is inspected",
       "then": "the four landmarks are present and main is unique",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-6",
@@ -61,7 +66,8 @@
       "when": "standard focus-movement keys are used",
       "then": "focus always has an exit path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [