rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-admin-console/CHANGELOG.md

@@ -1,23 +1,59 @@
 # application-admin-console CHANGELOG
 
+## 1.3.0 (2026-09-10)
+
+### Added
+
+- REQ-009: custom-auth-provides-* runtime clauses covering the four boolean elicits with a per-token clause on the applied capability union sidecar the shell reads.
+- Vendor citations on AC-21103-1 (ARIA APG grid) and AC-21106-1 (WCAG headings-and-labels), verified 2026-09-10.
+
+### Changed
+
+- ADR-2203.decision names the elicit as `blueprint.json.elicits[id=invite-transport]` (drops the camelCase inviteTransport spelling).
+- ADR-2204.decision names the elicit as `blueprint.json.elicits[id=audit-retention-days]`.
+- AC-21111-2 (and AC-21111-5) use `data-org-membership=*` per REQ-008 with ownerRef into REQ-008.
+- TAC-2214 responsibility named `renderAccessGatedSurface` so REQ-014.deliveredBy resolves.
+- AC-21107-1 and AC-21107-2 reference `TAC-2201.interfaces.capabilitiesSidecar` via ownerRef; TAC-2201 shape declares `skippedSources[]`.
+- US-21108 description carries the single-AC legality note verbatim.
+
+## 1.2.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.2.0 (2026-09-10, hardening pass)
+
+### Added
+
+- REQ-007 (invite-transport option coverage) and US-21110: every invite-transport option (email, in-app-only, custom) now carries a runtime clause and a story binding accepted, failed and recorded outcomes with a per-invite audit record. Closes review finding [application-admin-console] F-1.
+- REQ-008 (tenancy-shape option coverage) and US-21111: the elicited tenancy-shape (per-user, per-org, both) now determines directory membership, org switcher entries, invite scope and cross-shape refusal (TENANCY_SHAPE_REFUSAL). Closes review finding [application-admin-console] F-2.
+- Failure-path acceptance criteria on US-21106 (request-access POST failure) and US-21107 (empty union entry for a library-qualified source unavailable locally) closing findings F-3 and F-4; failure-path AC on US-21815 for a gated request with no request.auth closing finding F-5.
+- Vendor citations on the WCAG 2.4.6 / 3.3.4 / 4.1.3 fixed acceptance criteria and on the ARIA APG grid pattern criteria (verified 2026-09-10).
+
+### Changed
+
+- Every REQ now carries a deliveredBy link into TAC-2201, TAC-2203, TAC-2204 or TAC-2214.
+- Every AC on every user story now carries an explicit disposition (fixed or template); template ACs state the values the applying agent sets.
+- TAC-2201 responsibilities now include deliverInvite (per invite-transport branch), tenancyShapeGate (per tenancy shape), delegateUsersSurface, delegateOrgsSurface, renderAccessDenied and renderShell so the deliveredBy fields resolve.
+- Review fix pass (2026-09-10): REQ-005 extended with an audit-retention-days runtime clause naming the string elicit and its refusal branch; US-21105 gained a template AC (AC-21105-3) carrying `Applying agent sets: audit-retention-days.`; README and ADR-2201 register scrubbed (no operator names). Closes review-fix-pass finding F-3 for the audit-retention-days string elicit.
+
 ## 1.1.0 (2026-09-07)
 
 ### Added
 
-- Consume the `zeroTrustGate` capability optionally at apply-time via the shipped `readAppliedCapabilities()` helper (the T-5 visual-round mechanism). When `zeroTrustGate` is in the applied capability set, `/admin/sign-in` renders the Access-gated sign-in surface: `[data-surface=access-gated]` with no local login form, plus a `[data-role=principal-read]` element carrying the principal email read from `request.auth`. When `zeroTrustGate` is absent the surface falls back to the local `security-auth-*` surface with `[data-surface=local-login]` and the existing local form. Additive minor: `requiresAppliedCapabilities.capabilities[]` stays `["principalDirectory"]` (Q4 default per Cloudflare round 6 spec section 5.4.1: making Access-gate hard is a v2.0 change).
+- Consume the `zeroTrustGate` capability optionally at apply-time via the shipped `readAppliedCapabilities()` helper (the visual-round mechanism). When `zeroTrustGate` is in the applied capability set, `/admin/sign-in` renders the Access-gated sign-in surface: `[data-surface=access-gated]` with no local login form, plus a `[data-role=principal-read]` element carrying the principal email read from `request.auth`. When `zeroTrustGate` is absent the surface falls back to the local `security-auth-*` surface with `[data-surface=local-login]` and the existing local form. Additive minor: `requiresAppliedCapabilities.capabilities[]` stays `["principalDirectory"]` (Q4 default per Cloudflare round 6 spec section 5.4.1: making Access-gate hard is a v2.0 change).
 - 6 new contributions on the admin-console shelf entry: 1 REQ (`application-admin-console-REQ-014`), 2 USs (`application-admin-console-US-21815` Access-gated sign-in, `application-admin-console-US-21816` fallback branch), 1 TAC (`TAC-2214-application-admin-console-access-gated-signin-surface`), 1 ADR (`ADR-2214-application-admin-console-consume-zero-trust-gate`, scope global on new topic `adminConsoleSignInSurface` with `standardsTraceClause: Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta)` and `recommendedDefault: true`) and 1 pack check (`AC-21815-1`) on the existing `application-admin-console.pack.mjs`.
 - Sign-in route extension on the shipped `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/` fixture: a new `/admin/sign-in` route that renders the Access-gated or local-login surface based on the applied caps (`?caps=zeroTrustGate` picks the gated branch). The existing `?caps=` combinations are preserved; the `AC-21815-1` pack check exercises both branches.
 
 ### Composition
 
-- Rides the T-4 PR alongside `edge-cloudflare-access` v1.0.0 (round-4 T-4 capability-minor pattern). The Access-gated surface reads `request.auth.email`, which the shipped `edge-cloudflare-access` JWT validator sets after JWKS verification.
+- Rides the PR alongside `edge-cloudflare-access` v1.0.0 (round-4 capability-minor pattern). The Access-gated surface reads `request.auth.email`, which the shipped `edge-cloudflare-access` JWT validator sets after JWKS verification.
 
-## 1.0.0 (visual round T-5, spec 2026-09-04)
+## 1.0.0 (visual round, spec 2026-09-04)
 
 - First ratified version of the shelf's admin-console blueprint. Six REQs (console shell with no dead links, conditional users, conditional roles with Owner + Admin + Member + Viewer baseline, conditional orgs, conditional audit-log, access-denied plus request-access), nine USs 21101-21109 binding 16 runtime-observable ACs, four TACs 2201-2204 (shell, capability discovery, permission matrix, audit view consuming datatable), four ADRs 2201-2204 (capability vocabulary, baseline roles, invite transport, audit retention). No new global topics.
 - Introduces the capability-declaration mechanism: `capabilities[]` on identity blueprints (v1.1.0 minor bumps on magic-link, clerk, oauth2, keycloak land in the same PR per spec Q2 default), `requiresAppliedCapabilities` and `elicits[]` on consumer blueprints, apply-time discovery via source read-back on `manifest.blueprints[]`, exit-3 refusal with the spec 5.5.1 verbatim message on bare-SPA applies, and a `--allow-no-auth-yet` operator override.
-- Persists per-project apply-time state in a sidecar `rcf/blueprints/application-admin-console.applied.json` (the applied-blueprint-record schema in rcf-schemas 0.6.0 is closed under additionalProperties:false; the source-manifest read-back precedent from the T-2 core-companions train applies here). The sidecar carries `appliedCapabilities`, `appliedElicitations`, `allowNoAuthYet?` and `notes?`.
-- Ships `probe-packs/application-admin-console.pack.mjs`: four capability-gated browser-verify checks anchored to AC-21102-1 (users), AC-21103-1 (permission matrix), AC-21104-1 (org switcher), AC-21105-1 (audit-log surface). Each check reads the applied capability sidecar and records `applicable: false` where its required capability is absent (T-5 residual cure). Fifth shipped consumer of T-0's probe-pack runner extension.
+- Persists per-project apply-time state in a sidecar `rcf/blueprints/application-admin-console.applied.json` (the applied-blueprint-record schema in rcf-schemas 0.6.0 is closed under additionalProperties:false; the source-manifest read-back precedent from the core-companions train applies here). The sidecar carries `appliedCapabilities`, `appliedElicitations`, `allowNoAuthYet?` and `notes?`.
+- Ships `probe-packs/application-admin-console.pack.mjs`: four capability-gated browser-verify checks anchored to AC-21102-1 (users), AC-21103-1 (permission matrix), AC-21104-1 (org switcher), AC-21105-1 (audit-log surface). Each check reads the applied capability sidecar and records `applicable: false` where its required capability is absent (residual cure). Fifth shipped consumer of the earlier release probe-pack runner extension.
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/` with `CAPS` env or `?caps=` query switch selecting which surfaces exist, break switches for the negative runs (matrix-grid, denied, audit-fields), and the mandatory README for the gate reviewer.
-- Consumes `application-datatable` (T-1) for the users and audit surfaces; declares `suggestedCompanions` logging and errorHandling.
+- Consumes `application-datatable` for the users and audit surfaces; declares `suggestedCompanions` logging and errorHandling.
 - Does NOT declare `providesRoles` per spec 5.5.3 (the console is a consumer of `principalDirectory`, never a provider).

package/blueprints/application-admin-console/README.md

@@ -26,7 +26,7 @@ Refuses with exit 3 and the spec 5.5.1 verbatim message on a project with no app
 | Applied capability | Surface | Rendered by |
 |---|---|---|
 | `principalDirectory` | Users directory (`/admin/users`) | Any applied auth blueprint (magic-link, clerk, oauth2, keycloak). |
-| `roleModel` | Permission matrix (`/admin/roles`) | Clerk, OAuth2, Keycloak. Magic-link does NOT declare it, so a bare-magic-link project gets NO roles surface (Baz's example, spec section 5.5). |
+| `roleModel` | Permission matrix (`/admin/roles`) | Clerk, OAuth2, Keycloak. Magic-link does NOT declare it, so a bare-magic-link project gets NO roles surface (per the ratified spec section 5.5 worked example). |
 | `tenancy` | Org switcher (`/admin/orgs`), org-scoped invites | Reserved for a future `application-tenancy-orgs` blueprint (spec section 11). No shelf provider today. |
 | `auditLog` | Audit-log surface (`/admin/audit`) | Via the applied `observability-logging` companion (implicit), or a future dedicated audit-log blueprint. |
 | (none) | Access-denied + request-access | Always renders for a non-admin principal reaching `/admin/*`. |
@@ -68,7 +68,7 @@ Answers land on `rcf/blueprints/application-admin-console.applied.json`'s `appli
 
 ## The one runtime gate
 
-`probe-packs/application-admin-console.pack.mjs` ships four checks the `rcf verify browser` runner invokes on any FBS whose surface matches the pack's `appliesTo` predicate (an FBS that binds `TAC-2201-application-admin-console-shell` or whose nav model routes name an admin path). Each check ALSO carries its own `appliesTo` predicate that reads the applied capability sidecar and returns false when the required capability is absent; the check records `applicable: false` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3, T-5 residual cure). This is exactly the residual pattern the spec named: the surface does not exist, so the pack does not fire.
+`probe-packs/application-admin-console.pack.mjs` ships four checks the `rcf verify browser` runner invokes on any FBS whose surface matches the pack's `appliesTo` predicate (an FBS that binds `TAC-2201-application-admin-console-shell` or whose nav model routes name an admin path). Each check ALSO carries its own `appliesTo` predicate that reads the applied capability sidecar and returns false when the required capability is absent; the check records `applicable: false` and the aggregate verdict treats it as neither pass nor fail (spec section 3.3, residual cure). This is exactly the residual pattern the spec named: the surface does not exist, so the pack does not fire.
 
 Each check drives the real Playwright browser the runner provisions (through the pinned Playwright MCP or the consuming project's own `playwright` installation), reads the accessibility tree and the DOM, and returns a verdict.
 
@@ -83,7 +83,7 @@ Runtime-observable ACs the pack does NOT bind directly (checklist section 6.g),
 - **AC-21101-2 (single primary nav landmark with accessible name).** Present on the fixture as `<nav data-role="primary-nav" aria-label="Admin console">`; the pack asserts the fixture renders the four surfaces but does not additionally probe the landmark's accessible name. A v1.1.0 minor bump can add a landmark-shape check driven by the accessibility tree.
 - **AC-21102-2 (per-row invite / deactivate control shape).** Present on the fixture as `[data-action="invite"]` and `[data-action="deactivate"]` buttons; the pack's AC-21102-1 check confirms the users directory renders row ids but does not additionally exercise the invite / deactivate click paths. A v1.1.0 minor bump can extend AC-21102-1 with a click-round-trip.
 - **AC-21103-2 (elicited additional roles rendered after the baseline four).** Present on the fixture as the Owner + Admin + Member + Viewer rank order; the pack's AC-21103-1 confirms the grid roles and per-cell announcements but does not additionally probe elicited-role position. A v1.1.0 minor bump can read the sidecar's `appliedElicitations.baseline-roles` and compare rank order.
-- **AC-21105-2 (audit view consumes the datatable shell TAC).** Realised on the fixture by rendering the audit table with the same column contract; the pack's AC-21105-1 confirms the correlation-id column but does not additionally probe the datatable shell's four state regions on the audit view. Datatable's own pack (T-1) still covers those on projects that render the audit view through the datatable factory.
+- **AC-21105-2 (audit view consumes the datatable shell TAC).** Realised on the fixture by rendering the audit table with the same column contract; the pack's AC-21105-1 confirms the correlation-id column but does not additionally probe the datatable shell's four state regions on the audit view. Datatable's own pack still covers those on projects that render the audit view through the datatable factory.
 - **AC-21106-1 (access-denied region accessibility structure beyond the request-access control).** The pack's AC-21102-1 check probes the request-access control on the denied branch; the wider WCAG structure (heading, explanation, polite live region wiring) is present on the fixture but not additionally asserted. A v1.1.0 minor bump can add an axe-core sweep on the denied region.
 - **AC-21107-1 (sidecar file served under a stable path).** The pack reads the sidecar from `projectRoot`; the CLIENT-side read (over the network at load time) is a runtime-observable surface the pack does not additionally probe. A v1.1.0 minor bump can add a probe that reads `/admin/caps.json` on the fixture and diffs against the applied sidecar.
 - **AC-21108-1 (providesRoles absent on the blueprint).** A chain-scope AC probed by the anatomy tests, not by the browser pack.
@@ -95,4 +95,4 @@ Runtime-observable ACs the pack does NOT bind directly (checklist section 6.g),
 
 ## Consumers
 
-The audit view consumes `application-datatable` (T-1) for its table shell contract. Every project applying `application-admin-console` should also apply `application-datatable` if they want the ARIA APG table pattern, filter chrome, four state regions and pagination on the audit view.
+The audit view consumes `application-datatable` for its table shell contract. Every project applying `application-admin-console` should also apply `application-datatable` if they want the ARIA APG table pattern, filter chrome, four state regions and pagination on the audit view.

package/blueprints/application-admin-console/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-admin-console",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "category": "application",
   "requiresAppliedCapabilities": {
     "capabilities": [
@@ -129,6 +129,21 @@
       "kind": "req",
       "path": "requirements/application-admin-console-req-006.json"
     },
+    {
+      "id": "application-admin-console-REQ-007",
+      "kind": "req",
+      "path": "requirements/application-admin-console-req-007.json"
+    },
+    {
+      "id": "application-admin-console-REQ-008",
+      "kind": "req",
+      "path": "requirements/application-admin-console-req-008.json"
+    },
+    {
+      "id": "application-admin-console-REQ-009",
+      "kind": "req",
+      "path": "requirements/application-admin-console-req-009.json"
+    },
     {
       "id": "application-admin-console-US-21101",
       "kind": "us",
@@ -174,6 +189,21 @@
       "kind": "us",
       "path": "user-stories/application-admin-console-us-21109.json"
     },
+    {
+      "id": "application-admin-console-US-21110",
+      "kind": "us",
+      "path": "user-stories/application-admin-console-us-21110.json"
+    },
+    {
+      "id": "application-admin-console-US-21111",
+      "kind": "us",
+      "path": "user-stories/application-admin-console-us-21111.json"
+    },
+    {
+      "id": "application-admin-console-US-21112",
+      "kind": "us",
+      "path": "user-stories/application-admin-console-us-21112.json"
+    },
     {
       "id": "TAC-2201-application-admin-console-shell",
       "kind": "tac",

package/blueprints/application-admin-console/contributions/adrs/adr-2201-application-admin-console-capability-vocabulary.json

@@ -5,9 +5,9 @@
   "version": "1.0.0",
   "status": "accepted",
   "title": "Capability vocabulary: principalDirectory, roleModel, tenancy, auditLog as the v1 capability set",
-  "context": "Admin-console surfaces are conditional on what the applied identity blueprint provides. The vocabulary must be small (four strings today), extensible (the section 6a table is chunk-zero, so a future capability lands with a docs edit and no code change), and grounded in industry practice (SaaS UI research, IAM literature). Baz decision 5 (2026-09-04) is that the initial four capabilities are principalDirectory, roleModel, tenancy and auditLog.",
+  "context": "Admin-console surfaces are conditional on what the applied identity blueprint provides. The vocabulary must be small (four strings today), extensible (the section 6a table is chunk-zero, so a future capability lands with a docs edit and no code change), and grounded in industry practice (SaaS UI research, IAM literature). The ratified 2026-09-04 shelf decision 5 lands the initial four capabilities as principalDirectory, roleModel, tenancy and auditLog.",
   "decision": "v1.0.0 declares four capability strings the applied identity blueprints can declare in their capabilities[] field: principalDirectory (identifies principals for a users surface); roleModel (declares operator-visible role labels for a permission matrix); tenancy (declares an organisation abstraction the console can switch across); auditLog (emits an event stream the audit view can read). The vocabulary lives in packages/rcf-lite/docs/blueprint-authoring.md section 6a as a table extending the roles registry; the loader validates capability SHAPE (lower camelCase on ^[a-z][a-zA-Z0-9]*$), not the vocabulary. A future capability lands by adding a table row and adopting it on an identity blueprints minor bump.",
-  "consequences": "The console renders only surfaces the applied capabilities enable, so a bare magic-link project gets a users surface but no roles surface (per Bazs verbatim example). A future dedicated audit-log blueprint declaring auditLog directly (rather than through observability-logging) composes cleanly. A new capability lands additively.",
+  "consequences": "The console renders only surfaces the applied capabilities enable, so a bare magic-link project gets a users surface but no roles surface (per the ratified spec section 5.5 worked example). A future dedicated audit-log blueprint declaring auditLog directly (rather than through observability-logging) composes cleanly. A new capability lands additively.",
   "alternativesConsidered": [
     {
       "name": "Encode the vocabulary in code as an enum",

package/blueprints/application-admin-console/contributions/adrs/adr-2203-application-admin-console-invite-transport.json

@@ -2,11 +2,11 @@
   "adrId": "ADR-2203-application-admin-console-invite-transport",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
-  "title": "Invite transport: email default (delegated to the email sibling), elicited",
-  "context": "A users surface invite action needs a delivery transport. The shelf ships an email sibling under the application-notifications family (application-notifications-email, reserved as a family-prefix); a projects transport preference varies (email is the modal case; a Slack- or Teams-first workplace prefers a chat transport; an in-app-only demo needs no external transport).",
-  "decision": "v1.0.0 declares email as the recommended default invite transport; the console delegates delivery to the applied application-notifications-email sibling when present, otherwise records the invite as a pending event on the notification centre for a later transport to pick up. The transport is elicited at apply time via the inviteTransport elicit (enum: email, in-app-only, custom), so the console does not hardcode the delivery path.",
+  "title": "Invite transport: elicited, vocabulary and default owned by the manifest elicit, delegated to the sibling resolved at apply time",
+  "context": "A users surface invite action needs a delivery transport. The shelf ships transport siblings under the application-notifications family; the manifest elicit `blueprint.json.elicits[id=invite-transport]` owns the option set (its `.options`) and the recommended default (its `.default`), and the console resolves the delegated sibling from the elicited value.",
+  "decision": "The transport is elicited at apply time via the manifest elicit `blueprint.json.elicits[id=invite-transport]`; the vocabulary and the default are owned by that elicit's `.options` and `.default` fields. The console delegates delivery to the sibling resolved from the elicited value (an applied `application-notifications-*` transport) when present, otherwise records the invite as a pending event on the notification centre for a later transport to pick up. The console does not hardcode the delivery path or restate the option set.",
   "consequences": "A project on the modal SaaS shape (email invite) gets a working invite path once application-notifications-email lands (currently reserved). A project that wants in-app-only invites picks that at apply. A future custom transport declares its own capability and the console delegates via the same elicit.",
   "alternativesConsidered": [
     {
@@ -16,5 +16,5 @@
     }
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/adrs/adr-2204-application-admin-console-audit-retention.json

@@ -2,19 +2,19 @@
   "adrId": "ADR-2204-application-admin-console-audit-retention",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
-  "title": "Audit-log retention window: elicited (default 90 days when auditLog is applied)",
+  "title": "Audit-log retention window: elicited, kind and default owned by the manifest elicit",
   "context": "The audit view reads the applied logging companions event stream. Retention windows are domain-specific (finance and healthcare regulations push retention to years; consumer SaaS often trims to 90 days for storage cost and privacy hygiene). The console does not own the retention decision; the applying project does.",
-  "decision": "v1.0.0 declares audit-log retention as an elicited parameter (auditRetentionDays elicit, kind:string default \"90\", when: auditLog is applied). The console renders the audit view with the elicited window; the applied logging companion is responsible for actually enforcing the retention at the write layer. The console suppresses the audit view when the auditLog capability is not applied.",
-  "consequences": "A projects audit view honours the elicited window; the write-side retention is the loggers job (the console does not delete rows from the log). A project on a heavily-regulated domain elicits a longer window at apply; a consumer SaaS defaults to 90 days.",
+  "decision": "Audit-log retention is an elicited parameter owned by the manifest elicit `blueprint.json.elicits[id=audit-retention-days]`; the elicit's `.kind`, `.default` and gating condition are the sole owner of those values. The console renders the audit view with the elicited window; the applied logging companion enforces the retention at the write layer. The console suppresses the audit view when the `auditLog` capability is not applied.",
+  "consequences": "A projects audit view honours the elicited window (its exact number lives on the manifest elicit); the write-side retention is the loggers job (the console does not delete rows from the log). A project on a heavily-regulated domain elicits a longer window at apply; a consumer SaaS accepts the manifest-owned default.",
   "alternativesConsidered": [
     {
-      "name": "Hard-code a 90-day retention",
-      "summary": "The console reads the last 90 days only.",
+      "name": "Hard-code a retention window",
+      "summary": "The console reads a fixed number of days.",
       "reasonNotChosen": "Refuses regulated-domain projects that need to render older entries in the surface; the retention question is authentically the projects, not the shelfs."
     }
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/adrs/adr-2214-application-admin-console-consume-zero-trust-gate.json

@@ -5,8 +5,8 @@
   "version": "1.1.0",
   "status": "accepted",
   "title": "Admin-console reads zeroTrustGate at apply-time and switches sign-in surface (scope global, adminConsoleSignInSurface)",
-  "context": "application-admin-console v1.0.0 shipped with principalDirectory as the sole hard requirement; the sign-in surface was local per whatever security-auth-* was applied. Round-6 T-4 introduces edge-cloudflare-access with the zeroTrustGate capability; a composed deployment needs the admin-console to flip its sign-in surface deterministically so the Access-gated deployment stops rendering the local login form.",
-  "decision": "application-admin-console v1.1.0 reads appliedCapabilities via readAppliedCapabilities at apply-time (the T-5 visual-round mechanism). When zeroTrustGate is present the sign-in surface renders access-gated (no local form, principal reads from request.auth); when absent the surface falls back to whatever security-auth-* is applied. Q4 default per spec 5.4.1: zeroTrustGate is CONSUMED OPTIONALLY; principalDirectory remains the sole hard requirement (making Access-gate hard is a v2.0 change). The adminConsoleSignInSurface topic scope is global on this blueprint at v1.1.0; the topic string is adminConsoleSignInSurface (camelCase, one concept per topic).",
+  "context": "application-admin-console v1.0.0 shipped with principalDirectory as the sole hard requirement; the sign-in surface was local per whatever security-auth-* was applied. round-6 introduces edge-cloudflare-access with the zeroTrustGate capability; a composed deployment needs the admin-console to flip its sign-in surface deterministically so the Access-gated deployment stops rendering the local login form.",
+  "decision": "application-admin-console v1.1.0 reads appliedCapabilities via readAppliedCapabilities at apply-time (the visual-round mechanism). When zeroTrustGate is present the sign-in surface renders access-gated (no local form, principal reads from request.auth); when absent the surface falls back to whatever security-auth-* is applied. Q4 default per spec 5.4.1: zeroTrustGate is CONSUMED OPTIONALLY; principalDirectory remains the sole hard requirement (making Access-gate hard is a v2.0 change). The adminConsoleSignInSurface topic scope is global on this blueprint at v1.1.0; the topic string is adminConsoleSignInSurface (camelCase, one concept per topic).",
   "consequences": "The v1.1.0 admin-console remains backward-compatible with every v1.0.0 deployment. An Access-gated deployment automatically stops rendering the local login form (the shipped pack check AC-21815-1 catches a stray local-login region under zeroTrustGate). The fallback branch (local-login surface) ships in v1.1.0 unchanged; a v2.0.0 that makes Access-gate hard would remove the fallback branch (breaking-change). Standards trace clause: Cloudflare round 6 spec section 5.4 (admin-console v1.1.0 delta).",
   "alternativesConsidered": [
     {
@@ -17,7 +17,7 @@
     {
       "name": "Ship two admin-console blueprints (local-only and access-gated)",
       "summary": "Split the surface across two slugs so the operator picks at apply.",
-      "reasonNotChosen": "Doubles the shelf surface area and duplicates every other contribution. The applied-capability read is the shipped mechanism for exactly this composition (T-5 visual-round)."
+      "reasonNotChosen": "Doubles the shelf surface area and duplicates every other contribution. The applied-capability read is the shipped mechanism for exactly this composition (visual-round)."
     }
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-001.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The application ships an admin-console shell with navigation across the applied capability set and no dead links",
   "description": "The application realises an admin-console surface whose navigation, on load, reads the applied blueprints capability declarations (via source read-back on manifest.blueprints[]) and renders links only for the surfaces the applied capabilities enable. A surface whose gating capability is not applied is neither linked nor reachable from the shell. The shell is the base surface REQ-002 to REQ-006 elaborate on.",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.renderShell"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-002.json

@@ -2,7 +2,11 @@
   "reqId": "application-admin-console-REQ-002",
   "prdId": "PRD-001",
   "title": "Users surface conditional on principalDirectory, with directory, invite, deactivate, last-active columns",
-  "description": "When an applied blueprint declares the principalDirectory capability, the console renders a users route: a directory table listing every principal identified by data-user-id, an invite control per row for a principal without an active session, a deactivate control per row for an active principal, and last-active plus status columns. A principal without admin scope reaching /admin renders an access-denied state (REQ-006) with a request-access control routed to a notification. The users table is a datatable (T-1 consumer) with the same ARIA APG contract.",
+  "description": "When an applied blueprint declares the principalDirectory capability, the console renders a users route: a directory table listing every principal identified by data-user-id, an invite control per row for a principal without an active session, a deactivate control per row for an active principal, and last-active plus status columns. A principal without admin scope reaching /admin renders an access-denied state (REQ-006) with a request-access control routed to a notification. The users table is a datatable (consumer) with the same ARIA APG contract.",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.delegateUsersSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Roles surface conditional on roleModel, with Owner + Admin + Member + Viewer baseline and permission matrix",
   "description": "When an applied blueprint declares the roleModel capability, the console renders a roles route: the Owner + Admin + Member + Viewer baseline (elicited additions per ADR-2202), and a permission matrix as an ARIA APG grid (rows = roles, columns = permissions, cells = allowed/denied). Each cell announces the exact permission string as it takes focus (WCAG 4.1.3). The matrix suppresses when roleModel is not applied.",
+  "deliveredBy": {
+    "tacId": "TAC-2203-application-admin-console-permission-matrix",
+    "field": "interfaces.renderMatrix"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Orgs surface conditional on tenancy, with switcher and org-scoped invites",
   "description": "When an applied blueprint declares the tenancy capability, the console renders an orgs route: an org switcher control on the shell and an org-scoped invite path from the users surface. The tenancy capability today has no shelf provider (reserved for a future application-tenancy-orgs blueprint per spec section 11); the surface is suppressed until that provider ships.",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.delegateOrgsSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-005.json

@@ -2,7 +2,11 @@
   "reqId": "application-admin-console-REQ-005",
   "prdId": "PRD-001",
   "title": "Audit-log surface conditional on the auditLog capability (via the applied logging companion), reading the delivered event stream",
-  "description": "When the auditLog capability is applied (through the observability-logging companion or a future dedicated audit blueprint), the console renders an audit-log route: an audit table listing every entry identified by data-audit-id and carrying actor, target, before, after, timestamp, and correlationId columns; per-actor filter chrome and per-target filter chrome; retention window per ADR-2204. Consumes application-datatable (T-1) for the table shell.",
+  "description": "When the auditLog capability is applied (through the observability-logging companion or a future dedicated audit blueprint), the console renders an audit-log route: an audit table listing every entry identified by data-audit-id and carrying actor, target, before, after, timestamp, and correlationId columns; per-actor filter chrome and per-target filter chrome; retention window per ADR-2204. Consumes application-datatable for the table shell. The retention window is the elicited `audit-retention-days` value (a number of days, default 90): the applied logging companion enforces retention at the write layer against that day-count so entries older than the window are not emitted, and the audit view uses the same day-count when computing the earliest-visible timestamp for the filter chrome. A project sets the value at apply time; a value below 1 is refused at apply.",
+  "deliveredBy": {
+    "tacId": "TAC-2204-application-admin-console-audit-view",
+    "field": "interfaces.renderAuditView"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Access-denied and request-access states per WCAG 2.2 AA",
   "description": "A principal without admin scope reaching an admin route renders an access-denied state under WCAG 2.4.6 Headings and Labels and 3.3.4 Error Prevention: a heading naming the denied action, an explanation of why access was refused, and a request-access control routed to a POST /api/request-access endpoint the applied notification blueprint delivers on. The request-access control is keyboard-reachable and announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3).",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.renderAccessDenied"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "application-admin-console-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Every invite-transport option delivers or records the invite with a defined outcome",
+  "description": "The users surface honours the elicited invite-transport with a runtime clause per option: `email` hands the invite to the applied email companion (an email sibling declaring an email transport) and records success only after the transport reports the message accepted, presenting a delivery-failed refusal with a retryable control when the transport rejects or times out; `in-app-only` never touches the email transport and writes an invite record to the applied notification stream, marking the row with a data-invite-transport=in-app-only attribute so the recipient can see the invite in their own console; `custom` hands the invite payload to the project-supplied invite handler at surface time (a registered function on the applied capability sidecar) and records success only after the handler resolves, refusing the invite when no handler is registered. Every branch writes an audit record naming the transport, the invitee, and the outcome (accepted, failed, or refused).",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.deliverInvite"
+  },
+  "category": "functional",
+  "domain": "user-management",
+  "priority": "must",
+  "rationale": "The elicit offers three transports but the shipped requirements described the invite button only. A project that selected `in-app-only` or `custom` inherited no runtime behaviour and no failure-path assertion; the console shipped an invite control that silently misdelivered. Requiring a clause per option turns the elicit into a chain-linked commitment the audit record proves.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:07-invite-transport"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-008.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "application-admin-console-REQ-008",
+  "prdId": "PRD-001",
+  "title": "The tenancy shape (per-user, per-org, both) determines directory membership and org-scoped invite behaviour",
+  "description": "When the tenancy capability is applied, the users surface, the org switcher and the invite path honour the elicited tenancy-shape with a runtime clause per option: `per-user` renders each principal in exactly one org (the directory row carries a single data-org-id and the org switcher only lists the principal's own org), and an org-scoped invite adds the invitee to exactly that org; `per-org` renders every principal in every org they can reach (the directory row carries a data-org-membership=* attribute and the org switcher lists every org the principal can enter), and an org-scoped invite adds the invitee to the currently switched org without touching the other orgs the principal already belongs to; `both` permits either shape per principal (the directory row carries data-org-scope=single or data-org-scope=many) and the invite path prompts for the org set when the invited principal is `many`. Every branch refuses a cross-org action (invite, deactivate) that the shape does not allow with a named error announcing the shape and the refused action.",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.tenancyShapeGate"
+  },
+  "category": "functional",
+  "domain": "tenancy",
+  "priority": "must",
+  "rationale": "The tenancy-shape elicit offers three shapes but no requirement bound directory membership or invite scope to any of them. A project that chose `per-org` inherited a directory that behaved as `per-user` because no downstream link asked after the shape; the org switcher silently misrendered. Requiring a per-option clause turns the shape into a chain-linked behaviour the datatable's data attributes prove.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:08-tenancy-shape"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-009.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-admin-console-REQ-009",
+  "prdId": "PRD-001",
+  "title": "Custom-auth capability declarations bind the four provides-* booleans to the applied capability set",
+  "description": "When the applying project runs its own auth (no shipped security-auth-* blueprint) and answers the four custom-auth-provides-* boolean elicits, the console binds each answer to the appliedCapabilities union with a runtime clause per token: when `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is `true` the union includes `principalDirectory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-role-model]` is `true` the union includes `roleModel` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-tenancy]` is `true` the union includes `tenancy` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-audit-log]` is `true` the union includes `auditLog` and `false` omits it. The sidecar the shell reads reflects the exact union the boolean answers produce.",
+  "deliveredBy": {
+    "tacId": "TAC-2202-application-admin-console-capability-discovery",
+    "field": "responsibilities.runElicitationPhase"
+  },
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "The four provides-* booleans produced capabilities in the applied union without a chained clause. Requiring one runtime clause per token turns each boolean answer into a must-observable binding on the sidecar the shell reads.",
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-014.json

@@ -2,11 +2,15 @@
   "reqId": "application-admin-console-REQ-014",
   "prdId": "PRD-001",
   "title": "Consume zeroTrustGate optionally when applied alongside a zeroTrustGate provider",
-  "description": "application-admin-console v1.1.0 reads the appliedCapabilities set at apply-time via the shipped readAppliedCapabilities() helper (the T-5 visual-round mechanism). When zeroTrustGate is present alongside the sole hard requirement principalDirectory, the admin-console renders the Access-gated sign-in surface (no local login form; principal reads from request.auth via [data-role=principal-read]). When zeroTrustGate is absent the admin-console falls back to the local security-auth-* sign-in surface unchanged from v1.0.0. Q4 default per spec section 5.4.1: consumption is OPTIONAL; requiresAppliedCapabilities.capabilities[] remains [principalDirectory] (making Access-gate hard is a v2.0 change).",
+  "description": "application-admin-console v1.1.0 reads the appliedCapabilities set at apply-time via the shipped readAppliedCapabilities() helper (the visual-round mechanism). When zeroTrustGate is present alongside the sole hard requirement principalDirectory, the admin-console renders the Access-gated sign-in surface (no local login form; principal reads from request.auth via [data-role=principal-read]). When zeroTrustGate is absent the admin-console falls back to the local security-auth-* sign-in surface unchanged from v1.0.0. Q4 default per spec section 5.4.1: consumption is OPTIONAL; requiresAppliedCapabilities.capabilities[] remains [principalDirectory] (making Access-gate hard is a v2.0 change).",
+  "deliveredBy": {
+    "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+    "field": "responsibilities.renderAccessGatedSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
-  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4.1) alongside edge-cloudflare-access v1.0.0. Round-4 T-4 capability-minor pattern: the admin-console minor rides the edge-cloudflare-access PR.",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4.1) alongside edge-cloudflare-access v1.0.0. round-4 capability-minor pattern: the admin-console minor rides the edge-cloudflare-access PR.",
   "tags": [
     "blueprint:application-admin-console"
   ],

package/blueprints/application-admin-console/contributions/tacs/tac-2201-application-admin-console-shell.json

@@ -2,15 +2,17 @@
   "tacId": "TAC-2201-application-admin-console-shell",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Admin-console shell",
   "purpose": "Owns the rendered admin-console surface: the top-level nav landmark, the surface-manifest read at load, the conditional rendering of every applied surface (users, roles, orgs, audit), the access-denied and request-access states, and the shared page layout every surface renders within. The shell is the base surface every AC in this blueprint anchors on.",
   "responsibilities": [
-    "Read the applied capability sidecar (rcf/blueprints/application-admin-console.applied.json) at load and configure the surface set (AC-21101-1, AC-21107-1).",
-    "Render a single primary navigation landmark carrying an accessible name and rendering only applied surfaces (AC-21101-1, AC-21101-2).",
-    "Render the access-denied state for a non-admin principal reaching any admin route with a keyboard-reachable request-access control announcing its state (AC-21106-1).",
-    "Delegate the users, roles, orgs and audit surfaces to their respective TACs (TAC-2201 through TAC-2204)."
+    "renderShell: assemble the shell landmark from the applied capability set and render the surface set (AC-21101-1, AC-21101-2, AC-21107-1).",
+    "delegateUsersSurface: mount the users route when principalDirectory is applied and render access-denied for a non-admin principal (AC-21102-1, AC-21102-2, AC-21106-1).",
+    "delegateOrgsSurface: mount the org switcher and org-scoped invite path when tenancy is applied (AC-21104-1, AC-21111-1 through AC-21111-5).",
+    "renderAccessDenied: render the access-denied state under WCAG 2.4.6 and 3.3.4 with a keyboard-reachable request-access control announcing its state (AC-21106-1).",
+    "deliverInvite: dispatch an invite through the elicited invite-transport (email, in-app-only or custom), refusing on missing transport handler and writing exactly one audit-stream row per invite (AC-21110-1, AC-21110-2, AC-21110-3, AC-21110-4, AC-21110-5).",
+    "tenancyShapeGate: enforce per-user, per-org or both tenancy shape on directory rows, switcher entries and org-scoped actions, refusing cross-shape actions with TENANCY_SHAPE_REFUSAL (AC-21111-1 through AC-21111-5)."
   ],
   "internalStructure": "One shell module that mounts the surface, reads the applied capabilities sidecar, and renders the nav landmark, the page-layout scaffolding, and the route-level containers for each conditional surface. The framework is not prescribed; the shell interfaces are what the project realises against React, Vue, Svelte or vanilla DOM.",
   "interfaces": [
@@ -22,7 +24,7 @@
     {
       "name": "capabilitiesSidecar",
       "kind": "shape",
-      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
+      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, skippedSources: Array<{ sourceId, reason }>, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
     }
   ],
   "dependencies": [
@@ -36,5 +38,5 @@
   "tradeoffs": "The shell reads the sidecar file the apply verb writes; a runtime probe against manifest.blueprints[] would be more dynamic but ties the shell to the deploy-target having filesystem read access, which not every deploy target grants. The sidecar contract is deterministic and cacheable.",
   "notes": "Known mechanism-reach gap: the shell contract cannot prove keyboard focus does not escape the surface in every frameworks rendering; project-side smoke tests supplement the pack. See README `Known mechanism-reach gaps`.",
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/tacs/tac-2202-application-admin-console-capability-discovery.json

@@ -2,17 +2,17 @@
   "tacId": "TAC-2202-application-admin-console-capability-discovery",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Capability discovery",
   "purpose": "Owns the apply-time reader that inspects every applied blueprints source blueprint.json for its capabilities[] declaration and composes the union as appliedCapabilities. Owns the write side that persists the discovered union plus elicit answers into rcf/blueprints/application-admin-console.applied.json. Runs at apply time (packages/rcf-lite/src/blueprint/capabilities.js); the shell reads the sidecar the runtime writes.",
   "responsibilities": [
     "Enumerate manifest.blueprints[] and read each applied blueprints source blueprint.json to extract its capabilities[] (AC-21107-1).",
     "Compose the union of applied capabilities as a sorted string array (deterministic sidecar output).",
-    "Run the elicitation phase gated on the discovered capabilities: an elicit whose when.requiresCapability list has no overlap with the union does not prompt (AC-21109-2).",
-    "Write the sidecar file with appliedCapabilities[], appliedElicitations{}, allowNoAuthYet? and notes? (AC-21107-1)."
+    "runElicitationPhase: Run the elicitation phase gated on the discovered capability set; each `custom-auth-provides-*` boolean binds its `providesCapability` token onto the applied union when true, omits it when false, per REQ-009 (AC-21109-2).",
+    "Write the sidecar file whose shape is owned by `TAC-2201.interfaces.capabilitiesSidecar` (AC-21107-1)."
   ],
-  "internalStructure": "Two helpers: discoverAppliedCapabilities(applied, projectRoot) reads and unions; writeSidecar({slug, version, appliedAt, appliedCapabilities, appliedElicitations, allowNoAuthYet?, notes?}) writes the file. Both live in packages/rcf-lite/src/blueprint/capabilities.js.",
+  "internalStructure": "Two helpers: discoverAppliedCapabilities(applied, projectRoot) reads and unions; writeSidecar(record) writes the file, where `record` matches the shape owned by `TAC-2201.interfaces.capabilitiesSidecar`. Both live in packages/rcf-lite/src/blueprint/capabilities.js.",
   "interfaces": [
     {
       "name": "discoverAppliedCapabilities",
@@ -40,5 +40,5 @@
   "tradeoffs": "Source read-back rather than a schema-carried appliedCapabilities field on the applied record: the rcf-schemas 0.6.0 appliedBlueprintRecord is closed under additionalProperties:false, so a new field cannot land without a schema minor bump. The sidecar decouples the mechanism from the schema release cycle. A future rcf-schemas minor may add appliedCapabilities directly on the applied record and this TAC would move the write there; the sidecar would remain a supported read path for backward compatibility.",
   "notes": "Reads the applied recordss source string. When the source is a library-qualified ref (wsd:auth-oauth2), the source blueprint is not on this local tree and the reader returns an empty capabilities list; the applied record is skipped from the union.",
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2204-application-admin-console-audit-view.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Audit view",
-  "purpose": "Owns the audit-log surface: consumes the application-datatable shell (T-1) for filter chrome, pagination, four state regions and the row enumeration contract. Renders every audit entry with actor / target / before / after / timestamp / correlationId columns; the correlation id is the join key with the applied logging companion.",
+  "purpose": "Owns the audit-log surface: consumes the application-datatable shell for filter chrome, pagination, four state regions and the row enumeration contract. Renders every audit entry with actor / target / before / after / timestamp / correlationId columns; the correlation id is the join key with the applied logging companion.",
   "responsibilities": [
     "Render every audit entry inside the datatable shell (AC-21105-1, AC-21105-2).",
     "Enumerate every row by data-audit-id and expose every column via data-column (AC-21105-1).",

package/blueprints/application-admin-console/contributions/tacs/tac-2214-application-admin-console-access-gated-signin-surface.json

@@ -2,17 +2,17 @@
   "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "status": "approved",
   "name": "Access-gated sign-in surface with principal-read-from-request contract",
   "purpose": "Names the sign-in surface shape the admin-console renders when zeroTrustGate is in the applied capability set. The Access-gated shape carries [data-surface=access-gated], no local form, and a [data-role=principal-read] element rendering the principal email read from request.auth. The fallback shape (zeroTrustGate absent) carries [data-surface=local-login] with the security-auth-* local login form. The two are mutually exclusive on any /admin/sign-in render.",
   "responsibilities": [
-    "Render the Access-gated surface with [data-surface=access-gated] when zeroTrustGate is in appliedCapabilities (AC-21815-1).",
+    "renderAccessGatedSurface: render the Access-gated surface with [data-surface=access-gated] when zeroTrustGate is in appliedCapabilities, wiring the principal read from request.auth (AC-21815-1).",
     "Render the local-login surface with [data-surface=local-login] when zeroTrustGate is absent (AC-21816-1).",
     "Read the principal email from request.auth and render it in [data-role=principal-read] on the gated branch.",
     "Never render both surfaces on the same request; ensure the two are mutually exclusive per applied set."
   ],
-  "internalStructure": "Applied-capability-driven surface pick in the sign-in route. The applied-sidecar (rcf/blueprints/application-admin-console.applied.json) records the appliedCapabilities set; the shipped readAppliedCapabilities() helper reads it at apply-time (T-5 visual-round mechanism). No new elicits on the admin-console side: the sign-in seam is deterministic once the applied set is known.",
+  "internalStructure": "Applied-capability-driven surface pick in the sign-in route. The applied-sidecar (rcf/blueprints/application-admin-console.applied.json) records the appliedCapabilities set; the shipped readAppliedCapabilities() helper reads it at apply-time (visual-round mechanism). No new elicits on the admin-console side: the sign-in seam is deterministic once the applied set is known.",
   "interfaces": [
     {
       "name": "GET /admin/sign-in",
@@ -22,11 +22,11 @@
   ],
   "dependencies": [
     {
-      "name": "T-4 edge-cloudflare-access v1.0.0 (zeroTrustGate provider)",
+      "name": "edge-cloudflare-access v1.0.0 (zeroTrustGate provider)",
       "kind": "blueprint",
       "description": "Applied alongside admin-console v1.1.0 to compose the Access-gated sign-in surface."
     }
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21101.json

@@ -13,13 +13,15 @@
       "id": "AC-21101-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at deploy time) and, for each of principalDirectory, roleModel, tenancy, auditLog, renders a nav item ONLY when the capability is present in appliedCapabilities[]. A nav item that would route to a non-applied surface is neither rendered nor keyboard-reachable."
+      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at deploy time) and, for each of principalDirectory, roleModel, tenancy, auditLog, renders a nav item ONLY when the capability is present in appliedCapabilities[]. A nav item that would route to a non-applied surface is neither rendered nor keyboard-reachable.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-21101-2",
       "testable": true,
       "scope": "runtime",
-      "description": "The shell has a single primary nav landmark (role=\"navigation\" or a nav element) with an accessible name naming the console."
+      "description": "The shell has a single primary nav landmark (role=\"navigation\" or a nav element) with an accessible name naming the console.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [