rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21102.json

@@ -13,13 +13,15 @@
       "id": "AC-21102-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given an authenticated admin AND an applied auth blueprint declaring principalDirectory, the users table lists every principal with data-user-id on each row, a role column (only when roleModel is applied; else suppressed), a last-active timestamp, and a status column; a principal without admin scope reaching /admin renders an access-denied state with a \"request access\" control routing to POST /api/request-access. Probed by application-admin-console pack check AC-21102-1."
+      "description": "Given an authenticated admin AND an applied auth blueprint declaring principalDirectory, the users table lists every principal with data-user-id on each row, a role column (only when roleModel is applied; else suppressed), a last-active timestamp, and a status column; a principal without admin scope reaching /admin renders an access-denied state with a \"request access\" control routing to POST /api/request-access. Probed by application-admin-console pack check AC-21102-1.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-21102-2",
       "testable": true,
       "scope": "runtime",
-      "description": "Each row exposes an invite control for a principal without an active session (data-action=\"invite\") and a deactivate control for an active principal (data-action=\"deactivate\"); the controls are keyboard-reachable buttons."
+      "description": "Each row exposes an invite control for a principal without an active session (data-action=\"invite\") and a deactivate control for an active principal (data-action=\"deactivate\"); the controls are keyboard-reachable buttons.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21103.json

@@ -2,7 +2,7 @@
   "usId": "application-admin-console-US-21103",
   "prdId": "PRD-001",
   "reqId": "application-admin-console-REQ-003",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Roles surface renders the permission matrix as an ARIA APG grid when roleModel is applied",
   "asA": "admin operator reviewing role permissions",
@@ -13,13 +13,19 @@
       "id": "AC-21103-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given the roles surface AND an applied auth blueprint declaring roleModel, the permission matrix renders as an ARIA APG grid: role=\"grid\" on the outer element, role=\"row\" on every rank (including the header rank), role=\"columnheader\" on every permission column header, role=\"rowheader\" on the leftmost cell of each role rank, role=\"gridcell\" on every inner cell, and each cell carries an aria-label announcing the exact permission string plus the allowed/denied state on focus (WCAG 4.1.3). Probed by pack check AC-21103-1."
+      "description": "Given the roles surface AND an applied auth blueprint declaring roleModel, the permission matrix renders as an ARIA APG grid: role=\"grid\" on the outer element, role=\"row\" on every rank (including the header rank), role=\"columnheader\" on every permission column header, role=\"rowheader\" on the leftmost cell of each role rank, role=\"gridcell\" on every inner cell, and each cell carries an aria-label announcing the exact permission string plus the allowed/denied state on focus (WCAG 4.1.3). Probed by pack check AC-21103-1. (WCAG 4.1.3 verified against https://www.w3.org/TR/WCAG22/#status-messages, 2026-09-10.)",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/grid/",
+        "verifiedOn": "2026-09-10"
+      }
     },
     {
       "id": "AC-21103-2",
       "testable": true,
       "scope": "runtime",
-      "description": "The baseline role set is Owner, Admin, Member, Viewer (ADR-2202); elicited additional roles rendered as extra rank rows, with the baseline four rendered first and additions after."
+      "description": "The baseline role set is Owner, Admin, Member, Viewer (ADR-2202); elicited additional roles rendered as extra rank rows, with the baseline four rendered first and additions after.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -30,5 +36,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21104.json

@@ -13,7 +13,18 @@
       "id": "AC-21104-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given an applied blueprint declaring tenancy, the shell renders an org switcher control (data-role=\"org-switcher\") on the console header; the users invite path renders an org selector. When tenancy is not applied, neither control is rendered nor reachable. Probed by pack check AC-21104-1."
+      "description": "Given an applied blueprint declaring tenancy, the shell renders an org switcher control (data-role=\"org-switcher\") on the console header; the users invite path renders an org selector. When tenancy is not applied, neither control is rendered nor reachable. Probed by pack check AC-21104-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21104-2",
+      "description": "When tenancy is NOT applied, the orgs route is suppressed (not linked in the shell navigation and returning 404 or the shared forbidden state on direct URL); the org switcher control is absent from the DOM on every route.",
+      "given": "a project without the tenancy capability applied",
+      "when": "the shell renders any route",
+      "then": "no orgs link is present in navigation, /admin/orgs is unreachable and no org-switcher control appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -24,5 +35,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21105.json

@@ -13,13 +13,25 @@
       "id": "AC-21105-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a role change AND the auditLog capability applied (via observability-logging or a dedicated audit blueprint), an audit-log entry writes with actor, target, before, after, timestamp, and correlationId from the logging companion; the entry surfaces on the audit view table where every row is enumerable by data-audit-id and every cell exposes its column via a data-column attribute. Probed by pack check AC-21105-1."
+      "description": "Given a role change AND the auditLog capability applied (via observability-logging or a dedicated audit blueprint), an audit-log entry writes with actor, target, before, after, timestamp, and correlationId from the logging companion; the entry surfaces on the audit view table where every row is enumerable by data-audit-id and every cell exposes its column via a data-column attribute. Probed by pack check AC-21105-1.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-21105-2",
       "testable": true,
       "scope": "runtime",
-      "description": "The audit view consumes the application-datatable shell (TAC-2204 depends on TAC-1801-application-datatable-shell), so filter chrome, pagination and the four state regions inherit from the datatable contract."
+      "description": "The audit view consumes the application-datatable shell (TAC-2204 depends on TAC-1801-application-datatable-shell), so filter chrome, pagination and the four state regions inherit from the datatable contract.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21105-3",
+      "description": "The audit view honours the elicited `audit-retention-days` day-count: entries whose timestamp is older than (now - days) do not appear in the table and the earliest filter chrome date-boundary uses the same day-count. A day-count below 1 refuses at apply with AUDIT_RETENTION_OUT_OF_RANGE naming the value. Applying agent sets: audit-retention-days.",
+      "given": "auditLog applied with audit-retention-days elicited to N days and audit entries spanning older-than-N and newer-than-N timestamps",
+      "when": "the audit view renders",
+      "then": "the DOM lists only entries within the last N days and the earliest filter-chrome date-boundary matches (now - N days); apply refuses with AUDIT_RETENTION_OUT_OF_RANGE for a value below 1",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -30,5 +42,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21106.json

@@ -13,7 +13,40 @@
       "id": "AC-21106-1",
       "testable": true,
       "scope": "runtime",
-      "description": "A non-admin principal reaching /admin renders a role=\"region\" with an accessible name naming the denied action (WCAG 2.4.6), a paragraph explaining why access was refused (WCAG 3.3.4), and a request-access control (data-action=\"request-access\") routed to POST /api/request-access. The control announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3)."
+      "description": "A non-admin principal reaching /admin renders a role=\"region\" with an accessible name naming the denied action (WCAG 2.4.6), a paragraph explaining why access was refused (WCAG 3.3.4), and a request-access control (data-action=\"request-access\") routed to POST /api/request-access. The control announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3). (WCAG 3.3.4 verified against https://www.w3.org/TR/WCAG22/#error-suggestion and WCAG 4.1.3 verified against https://www.w3.org/TR/WCAG22/#status-messages, 2026-09-10.)",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#headings-and-labels",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-21106-2",
+      "description": "When the request-access POST returns a non-2xx response or times out, the access-denied state announces the failure through the polite live region, the request-access control returns to an idle state (data-state=idle) and remains keyboard-reachable for a retry; no submitted-success announcement is emitted. Vendor citation on the WCAG live-region announcement path.",
+      "given": "the access-denied state rendered and the applied notification blueprint returns a non-2xx or times out",
+      "when": "the principal activates the request-access control",
+      "then": "the live region announces a failure message, the control returns to data-state=idle with keyboard focus preserved and no data-state=submitted transition fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#status-messages",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-21106-3",
+      "description": "The access-denied heading names the denied action, the explanation names the missing capability (principalDirectory when the console runs without any applied auth), and the request-access control exposes accName that matches the visible label per WCAG 2.5.3.",
+      "given": "a principal without admin scope reaches /admin",
+      "when": "the access-denied state renders",
+      "then": "the heading text names the action, the explanation text names the missing capability and the request-access control accessible name matches its visible label",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#label-in-name",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [
@@ -23,5 +56,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21107.json

@@ -2,7 +2,7 @@
   "usId": "application-admin-console-US-21107",
   "prdId": "PRD-001",
   "reqId": "application-admin-console-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Console shell surfaces are self-configured from the applied capability sidecar at deploy time, not from client-side inference",
   "asA": "admin operator opening the console the same way in every deploy environment",
@@ -13,7 +13,26 @@
       "id": "AC-21107-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at build time) as a build asset served under a stable path (e.g. /admin/caps.json); the shell never runs a runtime probe against manifest.blueprints[] over the network. The sidecar payload keys are appliedCapabilities[], appliedElicitations{} and allowNoAuthYet? per the mechanism spec."
+      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at build time) as a build asset served under a stable path (e.g. /admin/caps.json); the shell never runs a runtime probe against manifest.blueprints[] over the network. The sidecar payload shape is owned by TAC-2201.interfaces.capabilitiesSidecar.",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2201-application-admin-console-shell",
+        "field": "interfaces.capabilitiesSidecar"
+      }
+    },
+    {
+      "id": "AC-21107-2",
+      "description": "When manifest.blueprints[] carries a library-qualified source that cannot be read locally (a library-qualified source unavailable at read time), the entry is skipped in the union; the sidecar (shape owned by TAC-2201.interfaces.capabilitiesSidecar) records the skipped entry and the shell navigation gates as though that source had contributed no capabilities (no surface renders that would have required a capability from the missing source).",
+      "given": "a project whose manifest.blueprints[] names a library-qualified source unavailable locally",
+      "when": "apply runs and the sidecar is written",
+      "then": "the sidecar entry names the skipped source id per TAC-2201.interfaces.capabilitiesSidecar and the shell navigation renders only surfaces whose gating capabilities were provided by successfully read sources",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2201-application-admin-console-shell",
+        "field": "interfaces.capabilitiesSidecar"
+      }
     }
   ],
   "tacIds": [
@@ -23,5 +42,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21108.json

@@ -13,7 +13,8 @@
       "id": "AC-21108-1",
       "testable": true,
       "scope": "library",
-      "description": "blueprint.json does not declare providesRoles (per spec 5.5.3); the loader is happy (providesRoles is optional). A future admin-console-shaped blueprint composes via capabilities[] and the crossBlueprintOwnership conflict on the same slug family, not via providesRoles[]."
+      "description": "blueprint.json does not declare providesRoles (per spec 5.5.3); the loader is happy (providesRoles is optional). A future admin-console-shaped blueprint composes via capabilities[] and the crossBlueprintOwnership conflict on the same slug family, not via providesRoles[].",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -23,5 +24,6 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "description": "Note (blueprint-authoring section 7a single-AC legality clause): this static check has no documented runtime or apply-time failure path; the assertion is either true or false statically and requires no failure branch."
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21109.json

@@ -13,13 +13,15 @@
       "id": "AC-21109-1",
       "testable": true,
       "scope": "runtime",
-      "description": "rcf define blueprint add ./blueprints/application-admin-console on a project with no applied blueprint declaring principalDirectory (and without --allow-no-auth-yet) exits 3; the stderr message begins with \"application-admin-console requires at least one applied security-auth-*\", lists the currently-applied blueprints on the project, and prints the \"Suggested next steps\" block including the four shelf auth slugs. No contribution files are written; the sidecar is not created."
+      "description": "rcf define blueprint add ./blueprints/application-admin-console on a project with no applied blueprint declaring principalDirectory (and without --allow-no-auth-yet) exits 3; the stderr message begins with \"application-admin-console requires at least one applied security-auth-*\", lists the currently-applied blueprints on the project, and prints the \"Suggested next steps\" block including the four shelf auth slugs. No contribution files are written; the sidecar is not created.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-21109-2",
       "testable": true,
       "scope": "runtime",
-      "description": "With --allow-no-auth-yet passed, the apply proceeds and writes rcf/blueprints/application-admin-console.applied.json with allowNoAuthYet:true and a notes string naming the \"no auth yet\" state; a later rcf define validate reads the sidecar and flags the ungated surfaces."
+      "description": "With --allow-no-auth-yet passed, the apply proceeds and writes rcf/blueprints/application-admin-console.applied.json with allowNoAuthYet:true and a notes string naming the \"no auth yet\" state; a later rcf define validate reads the sidecar and flags the ungated surfaces.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21110.json

@@ -0,0 +1,68 @@
+{
+  "usId": "application-admin-console-US-21110",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The invite path honours the elicited invite-transport for every option and records the outcome",
+  "asA": "shelf consumer applying application-admin-console with an invite-transport chosen at elicit time",
+  "iWant": "the users surface to deliver invites through the elicited transport with a defined success and a defined refusal per option",
+  "soThat": "the invite control I click never silently misdelivers and every outcome shows up in the audit stream",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21110-1",
+      "description": "When invite-transport is `email` and the applied email companion accepts the invite payload, the invite row records data-invite-outcome=accepted and the audit stream carries a row naming transport=email, the invitee and outcome=accepted. Applying agent sets: the email companion binding name, the from address and the invite template id.",
+      "given": "invite-transport=email applied and the email companion returns accepted",
+      "when": "an admin clicks invite for a pending principal",
+      "then": "the invite row exposes data-invite-outcome=accepted and the audit stream row names transport=email, invitee and outcome=accepted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-21110-2",
+      "description": "When invite-transport is `email` and the applied email companion rejects the payload (a non-2xx response or a timeout), the invite row shows data-invite-outcome=failed with a retry control, no audit record marks the invite accepted, and the console announces the failure through the notifications live region.",
+      "given": "invite-transport=email applied and the companion returns a non-2xx or times out",
+      "when": "an admin clicks invite",
+      "then": "the invite row carries data-invite-outcome=failed, a data-action=retry-invite control is keyboard-reachable, the audit stream row records outcome=failed and no outcome=accepted row is emitted for this invitee",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21110-3",
+      "description": "When invite-transport is `in-app-only`, the invite path never invokes the email companion; the invite writes a notification with data-invite-transport=in-app-only to the applied notification stream, and the users row records data-invite-outcome=recorded.",
+      "given": "invite-transport=in-app-only applied",
+      "when": "an admin clicks invite for a pending principal",
+      "then": "no email transport is called, the notifications stream carries a row with data-invite-transport=in-app-only, and the users row carries data-invite-outcome=recorded",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21110-4",
+      "description": "When invite-transport is `custom` and a project-supplied invite handler is registered on the applied capability sidecar, the invite payload is handed to the handler and success is recorded only after the handler resolves; when no handler is registered the invite refuses at apply-time with INVITE_HANDLER_MISSING naming the sidecar key. Applying agent sets: the handler function name and the sidecar key it registers under.",
+      "given": "invite-transport=custom applied",
+      "when": "an admin clicks invite",
+      "then": "the handler is called with { invitee, orgId?, correlationId } and the row records data-invite-outcome=accepted only after the handler resolves; a missing handler refuses at apply with INVITE_HANDLER_MISSING",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-21110-5",
+      "description": "Every transport branch writes exactly one audit-stream row per invite, naming transport, invitee identifier and outcome (accepted, failed or refused). No transport branch writes zero rows or more than one row for a single invite click.",
+      "given": "any invite-transport applied",
+      "when": "an admin clicks invite once for a principal",
+      "then": "the audit stream carries exactly one row for this invite naming transport, invitee and outcome",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21111.json

@@ -0,0 +1,76 @@
+{
+  "usId": "application-admin-console-US-21111",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-008",
+  "version": "1.0.1",
+  "status": "approved",
+  "title": "The users surface, the org switcher and the invite path honour the elicited tenancy shape",
+  "asA": "shelf consumer applying application-admin-console with the tenancy capability applied and a tenancy-shape chosen",
+  "iWant": "the directory, the switcher and org-scoped invites to obey the per-user, per-org or both shape",
+  "soThat": "the org boundaries the platform enforces are the boundaries the console renders and refuses across",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21111-1",
+      "description": "When tenancy-shape is `per-user`, every directory row carries exactly one data-org-id and the org switcher renders exactly one org for the current principal; a per-org action from the switcher list beyond the principal's org is refused with TENANCY_SHAPE_REFUSAL naming the shape.",
+      "given": "tenancy applied with tenancy-shape=per-user",
+      "when": "the users route and the org switcher render",
+      "then": "each users row carries exactly one data-org-id, the switcher lists exactly one org, and a switch to another org refuses with TENANCY_SHAPE_REFUSAL",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21111-2",
+      "description": "When tenancy-shape is `per-org`, every directory row carries the per-org membership attribute owned by `REQ-008.description`, and the switcher renders every org the current principal can reach; an org-scoped invite adds the invitee to the currently switched org without touching the other orgs the principal already belongs to.",
+      "given": "tenancy applied with tenancy-shape=per-org",
+      "when": "the users route renders and an admin invites into the currently switched org",
+      "then": "each users row carries the per-org membership attribute defined by `REQ-008.description`, the switcher enumerates every reachable org, and the invite POST records the invitee against exactly the switched org (verified in the audit stream)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "reqId": "application-admin-console-REQ-008",
+        "field": "description"
+      }
+    },
+    {
+      "id": "AC-21111-3",
+      "description": "When tenancy-shape is `both`, each directory row carries data-org-scope=single or data-org-scope=many and an org-scoped invite for a `many` principal presents an org-picker for the invitee's target orgs; a `single` principal cannot be invited into more than one org.",
+      "given": "tenancy applied with tenancy-shape=both",
+      "when": "the users route renders and an admin invites",
+      "then": "rows carry data-org-scope=single or data-org-scope=many, a `many` invitee shows an org-picker, and a `single` invitee cannot be given multiple orgs (the picker refuses)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21111-4",
+      "description": "A cross-org action (deactivate, role-change) the elicited shape does not allow refuses at the console with TENANCY_SHAPE_REFUSAL naming the shape and the refused action; the underlying principal directory API is not called.",
+      "given": "any tenancy-shape applied and an admin attempts an action outside the shape",
+      "when": "the admin submits the action",
+      "then": "the console refuses with TENANCY_SHAPE_REFUSAL naming the shape and the action, and no request reaches the principal directory",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21111-5",
+      "description": "The rendered directory always agrees with the applied shape: a users row rendered with the per-org membership attribute (owned by `REQ-008.description`) under tenancy-shape=per-user refuses to render (data-error=SHAPE_MISMATCH is written to the console log and the row is suppressed) rather than presenting the wrong shape.",
+      "given": "tenancy applied and a mismatched row surfaces from the principal directory",
+      "when": "the users route renders",
+      "then": "the row is suppressed and data-error=SHAPE_MISMATCH is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "reqId": "application-admin-console-REQ-008",
+        "field": "description"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21112.json

@@ -0,0 +1,77 @@
+{
+  "usId": "application-admin-console-US-21112",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-009",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Custom-auth provides-* boolean elicits each bind one applied-capabilities token on the sidecar",
+  "asA": "operator applying the admin-console on a project running its own auth (no shipped security-auth-* blueprint)",
+  "iWant": "each of the four custom-auth-provides-* boolean elicits to bind its capability token onto the sidecar's appliedCapabilities union with a per-token clause (true adds; false omits)",
+  "soThat": "the shell reads the exact capability union the elicited answers produce and no downstream surface guesses at what a custom auth has declared",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21112-1",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is answered `true`, the sidecar written by the elicitation phase records `principalDirectory` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `principalDirectory` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-principal-directory`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-principal-directory` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `principalDirectory` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2202-application-admin-console-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    },
+    {
+      "id": "AC-21112-2",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-role-model]` is answered `true`, the sidecar written by the elicitation phase records `roleModel` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `roleModel` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-role-model`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-role-model` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `roleModel` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2202-application-admin-console-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    },
+    {
+      "id": "AC-21112-3",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-tenancy]` is answered `true`, the sidecar written by the elicitation phase records `tenancy` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `tenancy` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-tenancy`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-tenancy` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `tenancy` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2202-application-admin-console-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    },
+    {
+      "id": "AC-21112-4",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-audit-log]` is answered `true`, the sidecar written by the elicitation phase records `auditLog` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `auditLog` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-audit-log`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-audit-log` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `auditLog` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2202-application-admin-console-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21815.json

@@ -16,12 +16,31 @@
       "when": "the pack drives GET /admin/sign-in",
       "then": "the DOM carries [data-surface=access-gated], no [data-surface=local-login], and a [data-role=principal-read] with the request.auth email",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+        "field": "interfaces.GET /admin/sign-in"
+      }
+    },
+    {
+      "id": "AC-21815-2",
+      "description": "When zeroTrustGate is applied but the incoming request lacks request.auth (the JWT validator upstream did not populate it), GET /admin/sign-in refuses with a 403 access-denied surface: no [data-role=principal-read] element is rendered, no principal email is echoed, and no protected data is served. The refusal reason is logged with the correlation id and the applied capability set.",
+      "given": "zeroTrustGate applied and a request arrives at /admin/sign-in with request.auth undefined",
+      "when": "the route renders",
+      "then": "the response status is 403, the DOM carries the access-denied surface, no [data-role=principal-read] element is present and no protected data is included",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+        "field": "interfaces.GET /admin/sign-in"
+      }
     }
   ],
   "tacIds": [
     "TAC-2214-application-admin-console-access-gated-signin-surface"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21816.json

@@ -16,12 +16,31 @@
       "when": "the pack drives GET /admin/sign-in",
       "then": "the DOM carries [data-surface=local-login] and no [data-surface=access-gated]",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+        "field": "interfaces.GET /admin/sign-in"
+      }
+    },
+    {
+      "id": "AC-21816-2",
+      "description": "The local-login surface renders exactly the security-auth-* local form contract from v1.0.0: an id-labelled input for the credential, a submit control routed to the local sign-in POST and no [data-surface=access-gated] region on the same render.",
+      "given": "a project without zeroTrustGate applied",
+      "when": "GET /admin/sign-in renders",
+      "then": "the DOM carries an input, a submit control routed to the local sign-in POST and no [data-surface=access-gated] region",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+        "field": "interfaces.GET /admin/sign-in"
+      }
     }
   ],
   "tacIds": [
     "TAC-2214-application-admin-console-access-gated-signin-surface"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/guide/application-admin-console.md

@@ -20,7 +20,7 @@ You want an anonymous product (no principal directory, no roles). The blueprint
 
 ## Mechanism-reach gaps
 
-The blueprint's README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack; the shipped v1.0.0 pack anchors the four load-bearing surface checks. Combine with the T-1 datatable pack to reach the users and audit shells' state-region contract.
+The blueprint's README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack; the shipped v1.0.0 pack anchors the four load-bearing surface checks. Combine with the datatable pack to reach the users and audit shells' state-region contract.
 
 ## Promotion signals
 
@@ -28,9 +28,9 @@ The blueprint's README lists the runtime-observable ACs the pack does NOT bind d
 - The tenancy shape needs a real shelf provider: candidate for the `application-tenancy-orgs` blueprint (spec section 11).
 - A dedicated audit-log blueprint ships: candidate for the console to consume it directly via `capabilities: ["auditLog"]` rather than through the logging companion.
 
-## v1.1.0 minor: Access-gate consumption (Cloudflare round 6 T-4)
+## v1.1.0 minor: Access-gate consumption (Cloudflare round 6)
 
-Applying `edge-cloudflare-access` v1.0.0 alongside `application-admin-console` v1.1.0 flips the sign-in surface on `/admin/sign-in`. The admin-console reads `appliedCapabilities` at apply-time via the shipped `readAppliedCapabilities()` helper (the T-5 visual-round mechanism).
+Applying `edge-cloudflare-access` v1.0.0 alongside `application-admin-console` v1.1.0 flips the sign-in surface on `/admin/sign-in`. The admin-console reads `appliedCapabilities` at apply-time via the shipped `readAppliedCapabilities()` helper (the visual-round mechanism).
 
 - With `zeroTrustGate` in the applied set: the sign-in page renders `[data-surface=access-gated]` with no local login form. A `[data-role=principal-read]` element carries the principal email the `edge-cloudflare-access` JWT validator attached to `request.auth`. The shipped pack check `AC-21815-1` on `application-admin-console.pack.mjs` asserts the shape.
 - Without `zeroTrustGate`: the sign-in page renders `[data-surface=local-login]` with the local `security-auth-*` form unchanged from v1.0.0. Every v1.0.0 deployment continues to work; the minor is strictly additive.

package/blueprints/application-admin-console/probe-packs/application-admin-console.pack.mjs

@@ -6,7 +6,7 @@
 //   AC-21104-1 org switcher (fires when tenancy applied)
 //   AC-21105-1 audit-log surface (fires when auditLog applied)
 //
-// Every check drives the real Playwright browser the T-0 runner injects
+// Every check drives the real Playwright browser the runner injects
 // and reads its per-check applicability from the blueprint applied
 // sidecar (rcf/blueprints/application-admin-console.applied.json)
 // written by the apply verb: an absent capability records
@@ -181,7 +181,7 @@ export default {
       {
       id: 'AC-21815-1',
       severity: 'block',
-      description: 'Access-gated sign-in surface renders when zeroTrustGate is applied: [data-surface=access-gated] present, [data-surface=local-login] absent, and [data-role=principal-read] carries the principal email read from request.auth (T-4 admin-console v1.1.0 delta, Cloudflare round 6 spec 5.4.1)',
+      description: 'Access-gated sign-in surface renders when zeroTrustGate is applied: [data-surface=access-gated] present, [data-surface=local-login] absent, and [data-role=principal-read] carries the principal email read from request.auth (admin-console v1.1.0 delta, Cloudflare round 6 spec 5.4.1)',
       appliesTo: async ({ projectRoot }) => {
         const caps = await readAppliedCapabilities(projectRoot);
         return caps.includes('zeroTrustGate');