rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22105.json

@@ -13,7 +13,38 @@
       "id": "AC-22105-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given navigator.onLine simulated false via the runtime seam (page.setOffline(true) on the project route, an offline endpoint on the sample-app route the pack uses instead), the offline state renders inside role=\"region\" with a read-only banner naming offline mode. A synthetic write buffers to window.__offlineBuffer with an idempotency token and a monotonic sequence. On the reconnect signal (navigator.onLine true or the sample-app /probe/offline?reconnect route) the polite live-region wrapper with data-live-region=\"polite\" carries a reconnection announcement. The pack drives /probe/offline, reads the banner, the buffer entry and the polite wrapper text."
+      "description": "Given navigator.onLine simulated false via the runtime seam (page.setOffline(true) on the project route, an offline endpoint on the sample-app route the pack uses instead), the offline state renders inside role=\"region\" with a read-only banner naming offline mode. A synthetic write buffers to window.__offlineBuffer with an idempotency token and a monotonic sequence. On the reconnect signal (navigator.onLine true or the sample-app /probe/offline?reconnect route) the polite live-region wrapper with data-live-region=\"polite\" carries a reconnection announcement. The pack drives /probe/offline, reads the banner, the buffer entry and the polite wrapper text.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22105-2",
+      "description": "On reconnection, the offline buffer flushes in the order of enqueue: each buffered write is replayed with the stable token it was buffered under, and a successful write removes the entry from the buffer.",
+      "given": "a buffer with two writes enqueued while offline",
+      "when": "navigator.onLine transitions to true and the buffer flushes",
+      "then": "the two writes are replayed in the order they were enqueued, each keyed by its stable token, and each success removes the entry",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22105-3",
+      "description": "When a buffered write returns a non-2xx or times out on replay, the entry stays in the buffer, its retry-count increments, a banner announces the failure via the polite live region, and no downstream surface renders as if the write had succeeded.",
+      "given": "a buffer with one write enqueued and the flush replay returns a non-2xx or times out",
+      "when": "the flush runs",
+      "then": "the entry remains in the buffer with retryCount incremented, the polite live region announces the failure and no downstream surface reflects the write",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22105-4",
+      "description": "The buffer refuses to enqueue two writes with the same stable token (idempotency of a retried operation): the second enqueue is a no-op and the buffer size remains 1.",
+      "given": "a buffer that already contains a write with token T",
+      "when": "the client attempts to enqueue a second write with the same token T",
+      "then": "the second enqueue is a no-op, the buffer size stays at 1 and no duplicate replay fires on flush",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +56,5 @@
     "state:offline"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22106.json

@@ -13,7 +13,18 @@
       "id": "AC-22106-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a listing endpoint returning an empty array, the empty-list state renders inside role=\"region\" with a data-visual=\"empty-list\" wrapper (distinct from data-visual=\"loading\" and data-visual=\"loaded\") and a keyboard-reachable [data-recovery=\"create\"] control. The pack drives /probe/empty-list, reads the region and the wrapper attribute, and asserts the recovery control exists and carries an accessible name."
+      "description": "Given a listing endpoint returning an empty array, the empty-list state renders inside role=\"region\" with a data-visual=\"empty-list\" wrapper (distinct from data-visual=\"loading\" and data-visual=\"loaded\") and a keyboard-reachable [data-recovery=\"create\"] control. The pack drives /probe/empty-list, reads the region and the wrapper attribute, and asserts the recovery control exists and carries an accessible name.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22106-2",
+      "description": "When the recovery-action router has no recovery configured for a state, the router refuses to render a recovery control and renders an explicit no-recovery notice naming the state; a broken configuration (a recovery-shape enum outside the closed set) is refused at apply.",
+      "given": "an empty-list state with no configured create/clear/invite recovery",
+      "when": "the surface renders",
+      "then": "a no-recovery notice renders naming the state and no false recovery control appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +36,5 @@
     "state:empty-list"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22107.json

@@ -13,7 +13,28 @@
       "id": "AC-22107-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a search or filter yielding zero rows, the no-search-results state renders inside role=\"region\" with a data-visual=\"no-search-results\" wrapper distinct from empty-list, echoing the query terms verbatim inside a data-query wrapper, and a keyboard-reachable [data-recovery=\"clear-filters\"] control that removes the search parameters on click. The pack drives /probe/search?q=needle, reads the region, the wrapper attribute, the echoed query and the recovery control."
+      "description": "Given a search or filter yielding zero rows, the no-search-results state renders inside role=\"region\" with a data-visual=\"no-search-results\" wrapper distinct from empty-list, echoing the query terms verbatim inside a data-query wrapper, and a keyboard-reachable [data-recovery=\"clear-filters\"] control that removes the search parameters on click. The pack drives /probe/search?q=needle, reads the region, the wrapper attribute, the echoed query and the recovery control.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22107-2",
+      "description": "The surface echoes the exact search query verbatim in the DOM (data-query attribute or visible text) so a screen reader can name the searched term; a query containing special characters is escaped for HTML but never truncated.",
+      "given": "a no-search-results state on the query \"foo & bar\"",
+      "when": "the surface renders",
+      "then": "the DOM carries the query verbatim (HTML-escaped) and no truncation occurs",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22107-3",
+      "description": "When the clear-filters recovery is fired and the underlying reload fails, the surface stays on the no-search-results state and the polite live region announces the failure; no false clear-success is emitted.",
+      "given": "a no-search-results state and a failing clear-filters reload",
+      "when": "the principal activates clear-filters",
+      "then": "the surface stays on no-search-results, the polite live region announces the failure and no clear-success is announced",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +46,5 @@
     "state:no-search-results"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/contributions/user-stories/application-empty-error-states-us-22108.json

@@ -13,7 +13,32 @@
       "id": "AC-22108-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a synthetic client-side render exception thrown via page.evaluate (or the sample-app /probe/error-boundary?crash=1 route), the error-boundary state renders inside role=\"alert\" with a keyboard-reachable [data-recovery=\"retry\"] control, a plain summary line and no stack-frame content matching the sensitive-pattern list. The pack drives /probe/error-boundary?crash=1, reads the region, the retry control and the document text for pattern hits."
+      "description": "Given a synthetic client-side render exception thrown via page.evaluate (or the sample-app /probe/error-boundary?crash=1 route), the error-boundary state renders inside role=\"alert\" with a keyboard-reachable [data-recovery=\"retry\"] control, a plain summary line and no stack-frame content matching the sensitive-pattern list. The pack drives /probe/error-boundary?crash=1, reads the region, the retry control and the document text for pattern hits.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-22108-2",
+      "description": "The error-boundary state renders under role=\"alert\" so it is announced by screen readers as it appears without requiring focus; the announcement carries the class of failure (never the error stack).",
+      "given": "a client-side render exception in a child component",
+      "when": "the error-boundary catches it",
+      "then": "the rendered surface carries role=\"alert\" and the announced text names the class only",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/alert/",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-22108-3",
+      "description": "When the route-level recovery from an error-boundary fails (a subsequent navigation throws again), the surface renders the outer shell error state and never loops the client-side render exception; a retry counter caps at 3 before surfacing a hard-refresh recommendation.",
+      "given": "a repeated failure in the same route",
+      "when": "the recovery navigation fires and the render fails again",
+      "then": "the outer shell error state renders, no infinite loop occurs and after 3 retries a hard-refresh recommendation appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -25,5 +50,5 @@
     "state:error-boundary"
   ],
   "createdAt": "2026-09-06T15:40:00Z",
-  "updatedAt": "2026-09-06T15:40:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-empty-error-states/probe-packs/application-empty-error-states.pack.mjs

@@ -11,9 +11,9 @@
 //   AC-22107-1 no-search-results (distinct visual wrapper, echoed query, clear-filters recovery)
 //   AC-22108-1 error-boundary (role=alert, retry control, no stack detail)
 //
-// Every check drives the real Playwright browser the T-0 runner
+// Every check drives the real Playwright browser the runner
 // injects. URLs are composed by the withUrl(runtimeUrl, path) helper
-// per the round 3 T-3 fix train; no bare string concatenation.
+// per the round 3 fix train; no bare string concatenation.
 //
 // Sample-app fixture:
 // packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/
@@ -50,6 +50,34 @@ const RESOURCE_ID_PATTERNS = [
   { name: 'resource-slug-hint', re: /\b(?:resource|id|slug|handle)=[A-Za-z0-9._-]+/i },
 ];
 
+// Fixture-seeded exact tokens. The pack asserts the surface renders
+// these exact values so a check cannot pass on any syntactically valid
+// look-alike; the fixture server is the single source of truth for
+// them and the pack rejects a mismatch.
+const SEEDED_FIXTURE_TOKENS = {
+  forbidden: {
+    requestId: 'req-forbidden-000001',
+    safeResponse: 'The workspace exists but its details are hidden from unauthorised viewers.',
+    // Known secret the pack SEEDS into the exercised /probe/forbidden request
+    // context (?resource=<seededSecretResourceId>). The rendered surface must
+    // redact it: the exact string must be absent from the response body while
+    // the [data-safe-response] redaction marker is present.
+    seededSecretResourceId: 'seeded-secret-widget-forbidden-a7f3c1',
+  },
+  serverError: {
+    correlationId: 'cid-server-000001',
+    safeError: 'The server hit an internal failure. The support team has the request id below.',
+  },
+  permissionDenied: {
+    causeClass: 'scope-missing',
+    requestId: 'req-perm-000001',
+  },
+  errorBoundary: {
+    errorClass: 'render-failure',
+    correlationId: 'cid-boundary-000001',
+  },
+};
+
 function firstSensitiveMatch(text, patterns) {
   if (typeof text !== 'string') return null;
   for (const { name, re } of patterns) {
@@ -66,7 +94,7 @@ export default {
   // Applies to any FBS that realises the state-machine TAC or whose
   // navModel routes name the operator-configured error-shell path.
   // References BOTH `tacIds` AND `route` per the loader source-scan
-  // rule (T-0 AC-1701-3, cross-check with authoring standard 8c).
+  // rule (AC-1701-3, cross-check with authoring standard 8c).
   appliesTo: ({ fbs }) => {
     const routes = fbs?.designStage?.navModel?.routes ?? [];
     const tacIds = fbs?.contextRequirements?.tacIds ?? [];
@@ -110,7 +138,10 @@ export default {
       description: 'forbidden state renders inside a region with a request-access control and the rendered surface refuses to include a resource id, resource name or path-shape token',
       run: async ({ browser, runtimeUrl }) => {
         if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
-        await browser.goto(withUrl(runtimeUrl, '/probe/forbidden'));
+        // Seed the known secret into the exercised request context via a query param on the forbidden path;
+        // the fixture receives the seeded value but never echoes it in the response body in normal mode.
+        const seededSecret = SEEDED_FIXTURE_TOKENS.forbidden.seededSecretResourceId;
+        await browser.goto(withUrl(runtimeUrl, `/probe/forbidden?resource=${encodeURIComponent(seededSecret)}`));
         const dom = await browser.evaluate(() => {
           const region = document.querySelector('[data-surface="forbidden"]');
           if (!region) return { present: false };
@@ -119,12 +150,27 @@ export default {
         });
         if (!dom.present) return { verdict: 'fail', detail: 'forbidden region [data-surface="forbidden"] not found' };
         if (!dom.hasControl) return { verdict: 'fail', detail: 'forbidden region missing [data-action="request-access"] control' };
-        // Least-privilege posture: no resource-id shape, no source path leaking through.
+        // positive-marker gate: fixture seeds a known secret in the request context; the surface must render the safe-response marker plus a request-id, and the pack asserts absence of the leaked secret alongside the positive marker.
+        const positive = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="forbidden"]');
+          const safe = region.querySelector('[data-safe-response]');
+          const rid = region.querySelector('[data-request-id]');
+          return {
+            hasSafeMarker: !!safe,
+            safeText: safe ? safe.textContent.trim() : null,
+            requestId: rid ? rid.getAttribute('data-request-id') : null,
+          };
+        });
+        if (!positive.hasSafeMarker) return { verdict: 'fail', detail: 'forbidden region missing positive [data-safe-response] redaction marker' };
+        if (positive.safeText !== SEEDED_FIXTURE_TOKENS.forbidden.safeResponse) return { verdict: 'fail', detail: `forbidden region [data-safe-response] did not match seeded safe body: got ${JSON.stringify(positive.safeText)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.forbidden.safeResponse)}` };
+        if (positive.requestId !== SEEDED_FIXTURE_TOKENS.forbidden.requestId) return { verdict: 'fail', detail: `forbidden region [data-request-id] did not match seeded id: got ${JSON.stringify(positive.requestId)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.forbidden.requestId)}` };
+        // Positive redaction assertion: the exact seeded secret MUST be absent from the response body.
+        if (dom.text.includes(seededSecret)) return { verdict: 'fail', detail: `forbidden surface leaked the seeded secret resource id ${JSON.stringify(seededSecret)} into the response body` };
         const leak = firstSensitiveMatch(dom.text, RESOURCE_ID_PATTERNS);
         if (leak) return { verdict: 'fail', detail: `forbidden surface leaked ${leak.name}: ${leak.match}` };
         const path = firstSensitiveMatch(dom.text, SENSITIVE_PATTERNS.filter((p) => p.name.startsWith('source-path')));
         if (path) return { verdict: 'fail', detail: `forbidden surface leaked ${path.name}: ${path.match}` };
-        return { verdict: 'pass', detail: 'forbidden region clean; request-access control present' };
+        return { verdict: 'pass', detail: `forbidden region carries positive safe-response marker; requestId=${positive.requestId}; seeded secret ${JSON.stringify(seededSecret)} absent from body and [data-safe-response] marker present with seeded body` };
       },
     },
     {
@@ -142,9 +188,23 @@ export default {
         });
         if (!dom.present) return { verdict: 'fail', detail: 'server-error region [data-surface="server-error"] not found' };
         if (!dom.hasRetry) return { verdict: 'fail', detail: 'server-error region missing [data-recovery="retry"] control' };
+        // positive-marker gate: fixture seeds a known safe-error body; the surface must render the safe-error marker plus a correlation id, and the pack asserts absence of a stack trace alongside the positive marker.
+        const positive = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="server-error"]');
+          const safe = region.querySelector('[data-safe-error]');
+          const cid = region.querySelector('[data-correlation-id]');
+          return {
+            hasSafeMarker: !!safe,
+            safeText: safe ? safe.textContent.trim() : null,
+            correlationId: cid ? cid.getAttribute('data-correlation-id') : null,
+          };
+        });
+        if (!positive.hasSafeMarker) return { verdict: 'fail', detail: 'server-error region missing positive [data-safe-error] body marker' };
+        if (positive.safeText !== SEEDED_FIXTURE_TOKENS.serverError.safeError) return { verdict: 'fail', detail: `server-error region [data-safe-error] did not match seeded safe body: got ${JSON.stringify(positive.safeText)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.serverError.safeError)}` };
+        if (positive.correlationId !== SEEDED_FIXTURE_TOKENS.serverError.correlationId) return { verdict: 'fail', detail: `server-error region [data-correlation-id] did not match seeded id: got ${JSON.stringify(positive.correlationId)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.serverError.correlationId)}` };
         const leak = firstSensitiveMatch(dom.text, SENSITIVE_PATTERNS);
         if (leak) return { verdict: 'fail', detail: `server-error surface leaked ${leak.name}: ${leak.match}` };
-        return { verdict: 'pass', detail: 'server-error region clean; retry control present' };
+        return { verdict: 'pass', detail: `server-error region carries positive safe-error marker; correlationId=${positive.correlationId}` };
       },
     },
     {
@@ -168,9 +228,21 @@ export default {
         if (!dom.present) return { verdict: 'fail', detail: 'permission-denied region [data-surface="permission-denied"] not found' };
         if (!dom.causeText) return { verdict: 'fail', detail: 'permission-denied region missing [data-cause] class-level cause' };
         if (!dom.hasControl) return { verdict: 'fail', detail: 'permission-denied region missing [data-action="request-access"] control' };
+        // positive-marker gate: fixture seeds an exact cause-class token; the surface must expose it on [data-cause-class] with a request id, and the pack asserts absence of any resource-id shape alongside the positive marker.
+        const positive = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="permission-denied"]');
+          const cls = region.querySelector('[data-cause-class]');
+          const rid = region.querySelector('[data-request-id]');
+          return {
+            causeClass: cls ? cls.getAttribute('data-cause-class') : null,
+            requestId: rid ? rid.getAttribute('data-request-id') : null,
+          };
+        });
+        if (positive.causeClass !== SEEDED_FIXTURE_TOKENS.permissionDenied.causeClass) return { verdict: 'fail', detail: `permission-denied region [data-cause-class] did not match seeded token: got ${JSON.stringify(positive.causeClass)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.permissionDenied.causeClass)}` };
+        if (positive.requestId !== SEEDED_FIXTURE_TOKENS.permissionDenied.requestId) return { verdict: 'fail', detail: `permission-denied region [data-request-id] did not match seeded id: got ${JSON.stringify(positive.requestId)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.permissionDenied.requestId)}` };
         const leak = firstSensitiveMatch(dom.causeText, RESOURCE_ID_PATTERNS);
         if (leak) return { verdict: 'fail', detail: `permission-denied cause leaked ${leak.name}: ${leak.match}` };
-        return { verdict: 'pass', detail: `cause=${JSON.stringify(dom.causeText)}` };
+        return { verdict: 'pass', detail: `cause-class=${positive.causeClass} requestId=${positive.requestId}` };
       },
     },
     {
@@ -275,9 +347,21 @@ export default {
         if (!dom.present) return { verdict: 'fail', detail: 'error-boundary region [data-surface="error-boundary"] not found' };
         if (dom.role !== 'alert') return { verdict: 'fail', detail: `error-boundary region role expected "alert", got ${JSON.stringify(dom.role)}` };
         if (!dom.hasRetry) return { verdict: 'fail', detail: 'error-boundary region missing [data-recovery="retry"] control' };
+        // positive-marker gate: the boundary must expose a safe error-class token and a correlation id; the pack asserts absence of stack detail alongside the positive markers.
+        const positive = await browser.evaluate(() => {
+          const region = document.querySelector('[data-surface="error-boundary"]');
+          const cls = region.querySelector('[data-error-class]');
+          const cid = region.querySelector('[data-correlation-id]');
+          return {
+            errorClass: cls ? cls.getAttribute('data-error-class') : null,
+            correlationId: cid ? cid.getAttribute('data-correlation-id') : null,
+          };
+        });
+        if (positive.errorClass !== SEEDED_FIXTURE_TOKENS.errorBoundary.errorClass) return { verdict: 'fail', detail: `error-boundary region [data-error-class] did not match seeded token: got ${JSON.stringify(positive.errorClass)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.errorBoundary.errorClass)}` };
+        if (positive.correlationId !== SEEDED_FIXTURE_TOKENS.errorBoundary.correlationId) return { verdict: 'fail', detail: `error-boundary region [data-correlation-id] did not match seeded id: got ${JSON.stringify(positive.correlationId)}, expected ${JSON.stringify(SEEDED_FIXTURE_TOKENS.errorBoundary.correlationId)}` };
         const leak = firstSensitiveMatch(dom.text, SENSITIVE_PATTERNS);
         if (leak) return { verdict: 'fail', detail: `error-boundary surface leaked ${leak.name}: ${leak.match}` };
-        return { verdict: 'pass', detail: 'error-boundary role=alert, retry control present, no stack detail' };
+        return { verdict: 'pass', detail: `error-boundary carries error-class=${positive.errorClass} correlationId=${positive.correlationId}; no stack detail` };
       },
     },
   ],

package/blueprints/application-error-handling/CHANGELOG.md

@@ -0,0 +1,17 @@
+# application-error-handling CHANGELOG
+
+## 1.0.3 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.0.2 (application-core completion pass, 2026-09-09)
+
+- Adds top-level elicits[] block on blueprint.json declaring the one apply-time answer (classification-additions); backed by REQ-003 naming the transient/permanent/unknown defaults and the elicited-additions grammar per section 7c.
+- Adds refusal-path ACs to US-16102 (stack-and-path scrubbing, non-Error throw defaults, mid-stream exception connection close), US-16104 (non-object context refusal, nested-and-array redaction, circular context handling), US-16105 (permanent no-Retry-After, unknown mapped as permanent, elicited-category retry contract), US-16106 (no-companion fallback stderr JSON single line, direct console.error passthrough, companion factory throw fallback), US-16107 (null-injection refusal, stub invocation contract, transportWriter throw recovery). US-16101 and US-16103 also extended with clean-shutdown preservation, browser-runtime path, double-throw handling, deep cause chain, cause-context redaction and null-vs-undefined cause discipline. Every story now at the 7a floor (4-5 ACs per story, 30 ACs total).
+
+## 1.0.1 (application-core hardening, 2026-09-09)
+
+- hardening pass: chain-consistency lint zero (pass1 + pass2); added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed `boundaryFor` and `transportWriter` restatements on AC-16107-1 via ownerRef back to TAC-1701.
+- Added AC-16101-2 (unhandled promise rejection: one record under the `unknown` category, process terminates with exit code 1) covering the 2026-09-08 review finding F-1 on TAC-1701.responsibilities[0].
+
+

package/blueprints/application-error-handling/blueprint.json

@@ -1,27 +1,112 @@
 {
   "slug": "application-error-handling",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "category": "application",
-  "providesRoles": ["errorHandling"],
+  "providesRoles": [
+    "errorHandling"
+  ],
   "suggestedCompanions": [
-    { "role": "logging", "reason": "The internal error record emits through the logging companion, not direct stdout or stderr writes; a logging companion supplies the factory the boundary calls." }
+    {
+      "role": "logging",
+      "reason": "The internal error record emits through the logging companion, not direct stdout or stderr writes; a logging companion supplies the factory the boundary calls."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "classification-additions",
+      "prompt": "Additional error classification categories the project adds to the recommended default set (transient, permanent, unknown). Comma-separated kebab or dotted-namespace tokens (rate-limited, quota-exceeded, dependency-degraded); refused at boot otherwise. Applied alongside the defaults.",
+      "kind": "string",
+      "default": ""
+    }
   ],
   "contributions": [
-    { "id": "application-error-handling-REQ-001", "kind": "req", "path": "requirements/application-error-handling-req-001.json" },
-    { "id": "application-error-handling-REQ-002", "kind": "req", "path": "requirements/application-error-handling-req-002.json" },
-    { "id": "application-error-handling-REQ-003", "kind": "req", "path": "requirements/application-error-handling-req-003.json" },
-    { "id": "application-error-handling-REQ-004", "kind": "req", "path": "requirements/application-error-handling-req-004.json" },
-    { "id": "application-error-handling-US-16101", "kind": "us", "path": "user-stories/application-error-handling-us-16101.json" },
-    { "id": "application-error-handling-US-16102", "kind": "us", "path": "user-stories/application-error-handling-us-16102.json" },
-    { "id": "application-error-handling-US-16103", "kind": "us", "path": "user-stories/application-error-handling-us-16103.json" },
-    { "id": "application-error-handling-US-16104", "kind": "us", "path": "user-stories/application-error-handling-us-16104.json" },
-    { "id": "application-error-handling-US-16105", "kind": "us", "path": "user-stories/application-error-handling-us-16105.json" },
-    { "id": "application-error-handling-US-16106", "kind": "us", "path": "user-stories/application-error-handling-us-16106.json" },
-    { "id": "application-error-handling-US-16107", "kind": "us", "path": "user-stories/application-error-handling-us-16107.json" },
-    { "id": "TAC-1701-application-error-handling-boundary", "kind": "tac", "path": "tacs/tac-1701-application-error-handling-boundary.json" },
-    { "id": "TAC-1702-application-error-handling-record-factory", "kind": "tac", "path": "tacs/tac-1702-application-error-handling-record-factory.json" },
-    { "id": "ADR-1701-application-error-handling-record-shape", "kind": "adr", "path": "adrs/adr-1701-application-error-handling-record-shape.json", "scope": "global", "topic": "errorHandling" },
-    { "id": "ADR-1702-application-error-handling-classification-vocabulary", "kind": "adr", "path": "adrs/adr-1702-application-error-handling-classification-vocabulary.json", "recommendedDefault": true, "elicited": true, "standardsTraceClause": "generic enterprise practice" },
-    { "id": "ADR-1703-application-error-handling-transport-mapping", "kind": "adr", "path": "adrs/adr-1703-application-error-handling-transport-mapping.json", "recommendedDefault": true, "elicited": false, "standardsTraceClause": "generic enterprise practice" }
+    {
+      "id": "application-error-handling-REQ-001",
+      "kind": "req",
+      "path": "requirements/application-error-handling-req-001.json"
+    },
+    {
+      "id": "application-error-handling-REQ-002",
+      "kind": "req",
+      "path": "requirements/application-error-handling-req-002.json"
+    },
+    {
+      "id": "application-error-handling-REQ-003",
+      "kind": "req",
+      "path": "requirements/application-error-handling-req-003.json"
+    },
+    {
+      "id": "application-error-handling-REQ-004",
+      "kind": "req",
+      "path": "requirements/application-error-handling-req-004.json"
+    },
+    {
+      "id": "application-error-handling-US-16101",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16101.json"
+    },
+    {
+      "id": "application-error-handling-US-16102",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16102.json"
+    },
+    {
+      "id": "application-error-handling-US-16103",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16103.json"
+    },
+    {
+      "id": "application-error-handling-US-16104",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16104.json"
+    },
+    {
+      "id": "application-error-handling-US-16105",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16105.json"
+    },
+    {
+      "id": "application-error-handling-US-16106",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16106.json"
+    },
+    {
+      "id": "application-error-handling-US-16107",
+      "kind": "us",
+      "path": "user-stories/application-error-handling-us-16107.json"
+    },
+    {
+      "id": "TAC-1701-application-error-handling-boundary",
+      "kind": "tac",
+      "path": "tacs/tac-1701-application-error-handling-boundary.json"
+    },
+    {
+      "id": "TAC-1702-application-error-handling-record-factory",
+      "kind": "tac",
+      "path": "tacs/tac-1702-application-error-handling-record-factory.json"
+    },
+    {
+      "id": "ADR-1701-application-error-handling-record-shape",
+      "kind": "adr",
+      "path": "adrs/adr-1701-application-error-handling-record-shape.json",
+      "scope": "global",
+      "topic": "errorHandling"
+    },
+    {
+      "id": "ADR-1702-application-error-handling-classification-vocabulary",
+      "kind": "adr",
+      "path": "adrs/adr-1702-application-error-handling-classification-vocabulary.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-1703-application-error-handling-transport-mapping",
+      "kind": "adr",
+      "path": "adrs/adr-1703-application-error-handling-transport-mapping.json",
+      "recommendedDefault": true,
+      "elicited": false,
+      "standardsTraceClause": "generic enterprise practice"
+    }
   ]
 }

package/blueprints/application-error-handling/contributions/adrs/adr-1701-application-error-handling-record-shape.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-1701-application-error-handling-record-shape",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Internal error record shape: code, category, message, correlationId, cause chain, redacted context",
   "context": "Without a shared record shape, every consumer of error data (log ingestion pipelines, alerting rules, wire-response mappers, retry policies) invents its own view. The record loses information at each hop and downstream tools reconstruct it from string parsing. The 'errorHandling' global topic is minted here (distinct from 'errorEnvelope', which stays with application-api-rest as the REST wire shape): errorHandling is the internal record shape and the uncaught-exception boundary; errorEnvelope is the wire format one transport chooses to translate the record into.",

package/blueprints/application-error-handling/contributions/adrs/adr-1702-application-error-handling-classification-vocabulary.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-1702-application-error-handling-classification-vocabulary",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Classification vocabulary: transient, permanent, unknown by recommended default; operator elicits additions",
   "context": "Retry policies are the difference between a self-healing system and a burning one. Classification at the source (where the code knows whether the failure was a transient network blip or a permanent authorisation refusal) puts the decision where the information is; classifying downstream on the wire is the source of most retry-storm outages. The recommended default set is deliberately small; per-domain additions land through elicited additions.",

package/blueprints/application-error-handling/contributions/adrs/adr-1703-application-error-handling-transport-mapping.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-1703-application-error-handling-transport-mapping",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "The transport blueprint's error-envelope ADR writes the wire shape from the internal record; delegation via TAC-1701 writeErrorResponse",
   "context": "The internal record shape (ADR-1701) is transport-agnostic; the wire envelope is a transport-specific decision. For REST, application-api-rest owns 'errorEnvelope' with an RFC 7807-style body plus code/correlationId fields. For gRPC or message-consumer transports, a future transport blueprint claims its own errorEnvelope-family topic. The boundary must delegate the mapping so this blueprint does not have to know every transport.",

package/blueprints/application-error-handling/contributions/requirements/application-error-handling-req-001.json

@@ -7,9 +7,16 @@
   "domain": "application",
   "priority": "must",
   "rationale": "The most common source of production outages in unchecked applications is an uncaught exception that terminates the process with no diagnostic, or a framework-level exception that produces a mis-shaped response the caller cannot interpret. The two boundaries close both classes at the earliest possible surface.",
-  "tags": ["blueprint:application-error-handling", "category:01-boundary"],
-  "version": "1.0.0",
+  "tags": [
+    "blueprint:application-error-handling",
+    "category:01-boundary"
+  ],
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-04T12:20:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1701-application-error-handling-boundary",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-error-handling/contributions/requirements/application-error-handling-req-002.json

@@ -7,9 +7,16 @@
   "domain": "application",
   "priority": "must",
   "rationale": "A stable record shape lets one log-side query find every error by category, one transport-side handler write the wire envelope by category, and one alerting rule filter by code. Without a shared shape, every consumer invents its own view, and the record becomes lossy at each hop.",
-  "tags": ["blueprint:application-error-handling", "category:02-record-shape"],
-  "version": "1.0.0",
+  "tags": [
+    "blueprint:application-error-handling",
+    "category:02-record-shape"
+  ],
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-04T12:20:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1701-application-error-handling-boundary",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-error-handling/contributions/requirements/application-error-handling-req-003.json

@@ -7,9 +7,16 @@
   "domain": "application",
   "priority": "must",
   "rationale": "Retry policies are the difference between a self-healing system and a burning one. Classifying errors at the source (where the code knows whether the failure was a transient network blip or a permanent authorisation refusal) puts the decision where the information is; classifying downstream on the wire message is the source of most retry-storm outages.",
-  "tags": ["blueprint:application-error-handling", "category:03-classification"],
-  "version": "1.0.0",
+  "tags": [
+    "blueprint:application-error-handling",
+    "category:03-classification"
+  ],
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-04T12:20:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1701-application-error-handling-boundary",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-error-handling/contributions/requirements/application-error-handling-req-004.json

@@ -7,9 +7,16 @@
   "domain": "application",
   "priority": "must",
   "rationale": "The logging companion owns the redaction boundary, the correlation identifier propagation, the environment/service/version stamping and the level filter. Bypassing it for error emission produces lines that ingestion pipelines cannot parse alongside the rest of the logs and PII the redaction pass would have caught. The fallback stderr path exists so a project that has not applied a logging companion still gets a diagnostic.",
-  "tags": ["blueprint:application-error-handling", "category:04-emission-through-logging"],
-  "version": "1.0.0",
+  "tags": [
+    "blueprint:application-error-handling",
+    "category:04-emission-through-logging"
+  ],
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-04T12:20:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1701-application-error-handling-boundary",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-error-handling/contributions/tacs/tac-1701-application-error-handling-boundary.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-1701-application-error-handling-boundary",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Error-handling boundary",
   "purpose": "Owns the two boundaries a application error-handling contract requires: the process-level uncaught-exception boundary and the framework-level request-pipeline boundary. Both accept a runtime exception, invoke the record factory (TAC-1702), emit the record through the applied logging companion factory, and hand the record to the transport response writer per ADR-1703. Substitutable interface for hermetic tests.",

package/blueprints/application-error-handling/contributions/tacs/tac-1702-application-error-handling-record-factory.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-1702-application-error-handling-record-factory",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Error record factory",
   "purpose": "Owns the construction of every internal error record. Threads the operator-elicited redaction categories (from the applied logging companion) into a shared factory that gates the record shape (code + category required per ADR-1701), redacts the context field at construction (AC-16104-1), preserves the cause chain across nested wrappings (AC-16103-2), and returns an immutable record every downstream consumer can trust.",