rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2117.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2117",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-013",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "One request id from edge to every hop",
   "asA": "support engineer holding a single id from a bug report",
@@ -11,39 +11,43 @@
   "acceptanceCriteria": [
     {
       "id": "AC-2117-1",
-      "description": "A request arriving with a valid X-Request-Id keeps it: the same value appears in the response header and in every request-scoped log line.",
-      "given": "a request carrying X-Request-Id",
+      "description": "A request arriving with a valid value in the request-id header owned on TAC-301-application-api-rest-request-pipeline.responsibilities[0] keeps it: the same value appears in the response header and in every request-scoped log line.",
+      "given": "a request carrying the request-id header owned on TAC-301-application-api-rest-request-pipeline.responsibilities[0]",
       "when": "the response and logs are inspected",
       "then": "the inbound value is echoed in the response and present on every request-scoped log line",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2117-2",
-      "description": "A request arriving without X-Request-Id is assigned one at the edge before any other middleware runs, and the assigned value is echoed in the response.",
-      "given": "a request with no X-Request-Id",
+      "description": "A request arriving without the request-id header owned on TAC-301-application-api-rest-request-pipeline.responsibilities[0] is assigned one at the edge before any other middleware runs, and the assigned value is echoed in the response.",
+      "given": "a request with no value in the request-id header owned on TAC-301-application-api-rest-request-pipeline.responsibilities[0]",
       "when": "the response is inspected",
       "then": "a generated id in the documented format is present in the response header",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2117-3",
-      "description": "An inbound X-Request-Id failing the documented format or length constraints is replaced with a generated id rather than propagated, so hostile header values never flow into logs and downstream systems.",
-      "given": "a request with an oversized or malformed X-Request-Id",
+      "description": "An inbound value in the request-id header owned on TAC-301-application-api-rest-request-pipeline.responsibilities[0] failing the documented format or length constraints is replaced with a generated id rather than propagated, so hostile header values never flow into logs and downstream systems. Applying agent sets: the documented format and length constraints on the request-id header owned on TAC-301-application-api-rest-request-pipeline.responsibilities[0].",
+      "given": "a request with an oversized or malformed value in the request-id header owned on TAC-301-application-api-rest-request-pipeline.responsibilities[0]",
       "when": "the response and logs are inspected",
       "then": "a fresh generated id is used and the malformed inbound value is not propagated",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2117-4",
       "description": "Every downstream call made on behalf of a request carries the request id onward in its headers or protocol equivalent.",
       "given": "a handler calling a downstream HTTP dependency",
       "when": "the outbound request is captured",
-      "then": "it carries the same X-Request-Id value",
+      "then": "it carries the same value in the request-id header owned on TAC-301-application-api-rest-request-pipeline.responsibilities[0]",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2117-5",
@@ -52,7 +56,8 @@
       "when": "the response is inspected",
       "then": "the header and the envelope's instance field both carry the request id",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -60,5 +65,5 @@
     "TAC-305-application-api-rest-observability"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2118.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2118",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-014",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Forward-only migrations with named reverts and a live schema-version report",
   "asA": "platform operator deploying schema changes",
@@ -16,7 +16,8 @@
       "when": "migration is attempted",
       "then": "the tool refuses with an error naming the ordering violation",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2118-2",
@@ -25,16 +26,18 @@
       "when": "it is applied and its named revert executed",
       "then": "the schema returns to its prior state",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2118-3",
-      "description": "The deploy order between migrations and application rollout is stated in the project documentation, including which schema versions each application version tolerates.",
+      "description": "The deploy order between migrations and application rollout is stated in the project documentation, including which schema versions each application version tolerates. Applying agent sets: the location of the deploy documentation, the stated migration-versus-rollout order, and the tolerated schema-version window per application version.",
       "given": "the project's deploy documentation",
       "when": "the migration-versus-rollout order is looked up",
       "then": "the order and the tolerated schema-version window are stated",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2118-4",
@@ -43,7 +46,8 @@
       "when": "/v1/_meta is fetched",
       "then": "the response conforms to the declared meta schema carrying schema version and application version",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2118-5",
@@ -52,21 +56,27 @@
       "when": "/v1/_meta and the migration tool's recorded version are compared",
       "then": "they are equal, and change together when the next migration applies",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2118-6",
-      "description": "The /v1/_meta endpoint declares an auth class like any other endpoint (service or admin by default), and startup readiness (AC-2108-4) gates on migrations being current.",
+      "description": "The /v1/_meta endpoint declares an auth class like any other endpoint (service or admin by default), and startup readiness (AC-2108-4) gates on migrations being current. Applying agent sets: the auth class declared on the /_meta endpoint (service or admin) and the migrations-current gate condition.",
       "given": "the generated spec and a booting instance behind on migrations",
       "when": "the _meta declaration and the startup probe are inspected",
       "then": "_meta carries its declared auth class, and the startup probe withholds 200 until migrations are current",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-306-application-api-rest-operability"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2119.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2119",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-015",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Spec-derived contract conformance across request, error, and auth axes",
   "asA": "API consumer trusting the published contract",
@@ -16,7 +16,12 @@
       "when": "a valid request is executed against it",
       "then": "the response validates against the declared schema for the returned status",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-2119-2",
@@ -25,7 +30,8 @@
       "when": "a request violating the input schema is executed",
       "then": "the response is the documented 4xx carrying the problem-details envelope",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2119-3",
@@ -34,7 +40,8 @@
       "when": "an under-privileged request is executed",
       "then": "the rejection matches the declared class semantics",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2119-4",
@@ -43,16 +50,22 @@
       "when": "the conformance run executes",
       "then": "the new operation is exercised on all three axes or the run fails naming it",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-2119-5",
-      "description": "The conformance run is part of the standard verification pipeline and its per-operation results are reported, so contract conformance is visible at every build, not sampled occasionally.",
+      "description": "The conformance run is part of the standard verification pipeline and its per-operation results are reported, so contract conformance is visible at every build, not sampled occasionally. Applying agent sets: the verification-pipeline definition (the pipeline file, workflow, or configuration) that runs the conformance check, and the per-operation reporting sink the pipeline writes results into.",
       "given": "the project's verification pipeline",
       "when": "it runs",
       "then": "the conformance results appear per operation and a conformance failure fails the pipeline",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2120.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2120",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-016",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Security baselines: clean logs, redacted PII, TLS enforced, explicit CORS",
   "asA": "security reviewer signing off the service",
@@ -16,16 +16,18 @@
       "when": "all log output is scanned for the known secret values",
       "then": "none appears in any line",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2120-2",
-      "description": "The PII-redaction policy is stated in project documentation, naming the field classes it covers and the redaction form, and log and error output conform to it.",
+      "description": "The PII-redaction policy is stated in project documentation, naming the field classes it covers and the redaction form, and log and error output conform to it. Applying agent sets: the PII-redaction policy document naming the field classes covered and the redaction form.",
       "given": "the stated policy and traffic carrying PII fields",
       "when": "logs and error responses are inspected",
       "then": "every covered field class appears only in its declared redacted form",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2120-3",
@@ -34,7 +36,8 @@
       "when": "a plain HTTP request is attempted",
       "then": "it is refused or redirected to TLS and no cleartext business response is served",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2120-4",
@@ -43,16 +46,18 @@
       "when": "the response headers are inspected",
       "then": "no Access-Control-Allow-Origin permits the undeclared origin, and no credentialed endpoint ever serves a wildcard",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2120-5",
-      "description": "Per-endpoint CORS overrides are declared configuration: an endpoint allowing specific origins lists them, the declaration is auditable alongside the endpoint, and behaviour matches it.",
+      "description": "Per-endpoint CORS overrides are declared configuration: an endpoint allowing specific origins lists them, the declaration is auditable alongside the endpoint, and behaviour matches it. Applying agent sets: the per-endpoint CORS override list (endpoints and their allowed origins).",
       "given": "an endpoint with a declared CORS override",
       "when": "cross-origin requests from declared and undeclared origins arrive",
       "then": "declared origins succeed per the declaration and undeclared origins are refused",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2120-6",
@@ -61,7 +66,8 @@
       "when": "every error body is scanned",
       "then": "no stack trace, query text, filesystem path, or internal hostname appears",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -69,5 +75,5 @@
     "TAC-305-application-api-rest-observability"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-charts/CHANGELOG.md

@@ -1,12 +1,33 @@
 # application-charts CHANGELOG
 
-## 1.0.0 (visual round T-2, spec 2026-09-04)
+## 1.0.4 - 2026-09-10
+
+Findings closed: F-1, F-2, F-3, F-4, F-5, F-6, F-7. Template-AC fill-in clauses on AC-18105-1, AC-18105-2, AC-18106-1, AC-18106-2 and AC-18106-3 now enumerate the specific applying-project substitutions (applied light and dark backgrounds and any operator brand-token overrides on `blueprint.json:elicits[palette-overrides]`, the elicited palette-overrides string value, the elicited engine token, the elicited engine choice failing the text-alternative check) in place of the generic phrasing. TAC-1901-application-charts-render-shell patch-bumped to 1.0.3: responsibilities[6] fixes the `data-chart-engine` attribute referenced from AC-18106-2, and responsibilities[5] now owns the render-log refusal-record shape (one warning entry per refused chart declaration, keyed to the accessible-name and naming the engine and the missing text-alternative surface) referenced from AC-18106-3 and AC-18106-4 in place of the shape restatement on AC-18106-4. ADR-1902 fixes the palette fallback expectation. Register cleanup on README shipped prose (removed the dated visual-specification reference, neutralised the follow-up naming and aligned the AC-18106-2 marker gap to the TAC-1901 owner) and on the guide (rewrote the spec-reference section to neutral spec-provenance without the operator-repo path or the internal review convention).
+
+
+## 1.0.3 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.0.2 (application-core completion pass, 2026-09-09)
+
+- Adds top-level elicits[] block on blueprint.json declaring the two apply-time answers (chart-engine, palette-overrides); each option value backed by a must REQ description with a runtime clause per section 7c. REQ-001 gains the chart-engine token set (recharts, echarts, chart-js, d3-primitives, hand-authored-svg) and the canvas-only refusal clause.
+- Adds refusal-path ACs to US-18101 (per-form binder check, specialised-form CALLS MADE, empty-data-set labelled block), US-18102 (deuteranopia simulation check, direct-label rule vs legend-only, unique colour+pattern combination), US-18103 (cell-value match check, same-landmark rule, visually-hidden-vs-display:none), US-18104 (announced-string field order, series-by-series traversal, prefers-reduced-motion), US-18105 (dark-background contrast, undersupplied palette warning, runtime theme flip). Every story now at the 7a floor (4-5 ACs per story, 29 ACs total).
+- Review fix pass 2026-09-10: F-1 vendorCitation added to AC-18102-2 (WCAG 1.4.1 use-of-color) and AC-18105-3 (WCAG 1.4.11 non-text contrast) with verifiedOn 2026-09-09; F-3 Applying agent sets clause appended to AC-18101-4 naming the specialised chart form, the CALLS MADE entry text and the superseding REQ id; F-4 REQ-002 (priority must) extended to name the `palette-overrides` elicit contract with runtime clauses per option value (empty override resolves to accessible defaults with no warnings; a malformed override is refused at project-side review) and AC-18105-2 and AC-18105-4 now reference `blueprint.json:elicits[].palette-overrides` verbatim so the section-7c option coverage binds; F-5 chart-engine canonical option tokens (owned by the manifest as `recharts`, `echarts`, `chart-js`, `d3-primitives`, `hand-authored-svg`) now appear verbatim in AC-18106-1 and AC-18106-2 so a section-7c string-scan matches every option.
+
+## 1.0.1 (application-core hardening, 2026-09-09)
+
+- hardening pass: chain-consistency lint zero (pass1 + pass2 already clean at baseline); added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b.
+- Added AC-18106-3 and AC-18106-4 (mount refusal before any DOM attaches and the render-log warning contract with one entry per refused declaration and no duplication on compliant re-mount) covering the 2026-09-08 review finding F-1 on TAC-1901.responsibilities[5].
+
+
+## 1.0.0 (2026-09-04)
 
 - First ratified version of the shelf's charts blueprint. Four REQs (chart form set, non-colour distinction, text-alternative table, keyboard traversal), six USs binding runtime-observable ACs, two TACs (render shell, keyboard traversal), three ADRs (elicited chart engine with canvas-only refusal, accessible palette light and dark, reduced motion via application-spa tokens). No new global topics.
-- Ships `probe-packs/application-charts.pack.mjs`: three browser-verify checks anchored to AC-18102-1 (non-colour distinction), AC-18103-1 (text-alternative table with cell-per-value contract), AC-18104-1 (keyboard traversal contract with reduced-motion suppression). Every check carries a description field per spec section 9. Second blueprint on the shelf that ships a Playwright probe pack under the T-0 runner extension; first leaf blueprint the T-3 application-dashboard consumes.
+- Ships `probe-packs/application-charts.pack.mjs`: three browser-verify checks anchored to AC-18102-1 (non-colour distinction), AC-18103-1 (text-alternative table with cell-per-value contract), AC-18104-1 (keyboard traversal contract with reduced-motion suppression). Every check carries a description field per spec section 9. Second blueprint on the shelf that ships a Playwright probe pack under the runner extension; first leaf blueprint the application-dashboard consumes.
 - Ships a sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-charts/` (dependency-free Node HTTP server) so the pack can be probed at the shelf's own gate; the fixture is the golden the gate reviewer drives, with `?break=table`, `?break=pattern` and `?break=keyboard` query switches for the negative runs.
 - Suggests the `logging` and `errorHandling` companions with the ratified spec's reasons.
 
-### Patch note (2026-09-04, T-3 gate follow-up)
+### Patch note (2026-09-04, gate follow-up)
 
 - `probe-packs/application-charts.pack.mjs`: navigate with `new URL('', runtimeUrl).toString()` instead of `runtimeUrl + '/'` on the three goto call sites (AC-18102-1, AC-18103-1, AC-18104-1). The concat form stripped a reviewer-supplied `?break=<mode>` from a CLI `--url`; the URL-resolver form preserves the runtime URL verbatim so a reviewer pointing the CLI at `?break=<mode>` sees the negative run naturally. Version stays at 1.0.0; behaviour unchanged on the default apply-side runtime URL.

package/blueprints/application-charts/README.md

@@ -1,6 +1,6 @@
-# Charts blueprint (v1.0.0)
+# Charts blueprint (v1.0.4)
 
-Vendor-neutral chart-component contract for a rcf-lite application. Ships the accessibility, palette, text-alternative and keyboard-traversal discipline every chart on the shipped surface must meet. Ships a Playwright probe pack under `probe-packs/application-charts.pack.mjs` whose three checks are the runtime gate the delivery-ci-workflows runner drives (visual round spec 2026-09-04, section 5.2). No new global topics; suggests the `logging` and `errorHandling` companions. Leaf blueprint: application-dashboard (visual round T-3) consumes it; no other blueprint in this round does.
+Vendor-neutral chart-component contract for a rcf-lite application. Ships the accessibility, palette, text-alternative and keyboard-traversal discipline every chart on the shipped surface must meet. Ships a Playwright probe pack under `probe-packs/application-charts.pack.mjs` whose three checks are the runtime gate the delivery-ci-workflows runner drives (section 5.2 of the ratified visual specification). No new global topics; suggests the `logging` and `errorHandling` companions. Leaf blueprint: application-dashboard consumes it; no other blueprint on the shelf does.
 
 ## Apply
 
@@ -56,7 +56,7 @@ Every chart on the shipped surface mounts through the render shell (TAC-1901). E
 
 ## Known mechanism-reach gaps
 
-Every runtime-observable AC that is not bound to a pack check appears here individually per the T-1 gate discipline (`blueprint-authoring-checklist.md` section 6.g): categories are not enough. The pack has three checks; every other runtime-observable AC on this blueprint is a mechanism-reach gap named below.
+Every runtime-observable AC that is not bound to a pack check appears here individually per the gate discipline (`blueprint-authoring-checklist.md` section 6.g): categories are not enough. The pack has three checks; every other runtime-observable AC on this blueprint is a mechanism-reach gap named below.
 
 - **AC-18101-1 form-set membership**. the pack does not inspect a chart's declared form against the six-form set. A project-side review is the current mechanism. A v1.1 minor bump could add a fourth pack check reading the `data-chart-form` attribute the shell emits and asserting membership.
 - **AC-18101-2 shell-mount routing**. the pack does not inspect the mount seam; a chart bypass to the raw chart-library mount is caught at project-side review. A build-scan pre-check in a v1.1 minor bump can grep the applying project's source for engine-specific mount calls.
@@ -66,8 +66,8 @@ Every runtime-observable AC that is not bound to a pack check appears here indiv
 - **AC-18105-1 palette contrast**. the pack does not measure contrast ratios today. Palette contrast is a build-scan surface (colour tokens are inspectable from the applied palette module). A v1.1 minor bump can add a Node build-scan pre-check that reads the applied palette and checks the ratios against WCAG 1.4.3 and 1.4.11.
 - **AC-18105-2 palette override fallback**. the fallback behaviour is exercised by the applying project's own tests, not this blueprint's pack. The applying project owns the assertion.
 - **AC-18106-1 canvas-only refusal**. the refusal is documented in the README's engine-refusal rule; project-side review enforces it. A v1.1 minor bump could add a pack pre-check that reads the applied engine and refuses on a canvas-only engine with no `<table>` companion.
-- **AC-18106-2 engine-name marker**. the applying project ships a `data-chart-engine` attribute or an equivalent DOM marker. The pack does not assert this today; a v1.1 minor bump could read the marker and add it to the pack record for downstream tooling.
+- **AC-18106-2 engine-name marker**. the applying project ships the `data-chart-engine` attribute fixed on TAC-1901-application-charts-render-shell.responsibilities[6]. The pack does not assert this today; a v1.1 minor bump could read the marker and add it to the pack record for downstream tooling.
 
 ## Vision-deficiency emulation is a runner-seam gap
 
-The runner has no `emulateVisionDeficiency` seam on the pack browser today (`goto`, `snapshot`, `evaluate`, `click`, `type`, `press`, `screenshot` is the current API). AC-18102-1 is therefore proven at the DOM level: every series carries a non-colour cue AND a direct label. A future runner minor that adds `emulateVisionDeficiency` to the seam lets this pack add a deuteranopia render pass; that follow-up is named under CONCERNS in the T-2 dispatch report as the smallest runner change that would close the class.
+The runner has no `emulateVisionDeficiency` seam on the pack browser today (`goto`, `snapshot`, `evaluate`, `click`, `type`, `press`, `screenshot` is the current API). AC-18102-1 is therefore proven at the DOM level: every series carries a non-colour cue AND a direct label. A future runner minor that adds `emulateVisionDeficiency` to the seam lets this pack add a deuteranopia render pass; that follow-up covers the smallest runner change that would close the class.

package/blueprints/application-charts/blueprint.json

@@ -1,26 +1,120 @@
 {
   "slug": "application-charts",
-  "version": "1.0.0",
+  "version": "1.0.4",
   "category": "application",
   "suggestedCompanions": [
-    { "role": "logging", "reason": "Chart rendering telemetry (data-point activation, keyboard traversal) rides the same log surface as the rest of the client; a logging companion supplies the factory the client-side telemetry uses." },
-    { "role": "errorHandling", "reason": "A chart that fails to load surfaces a client-side error record; an error-handling companion supplies the boundary and the record factory." }
+    {
+      "role": "logging",
+      "reason": "Chart rendering telemetry (data-point activation, keyboard traversal) rides the same log surface as the rest of the client; a logging companion supplies the factory the client-side telemetry uses."
+    },
+    {
+      "role": "errorHandling",
+      "reason": "A chart that fails to load surfaces a client-side error record; an error-handling companion supplies the boundary and the record factory."
+    }
+  ],
+  "elicits": [
+    {
+      "id": "chart-engine",
+      "prompt": "Chart engine the applying project ships. One of recharts, echarts, chart-js, d3-primitives or hand-authored-svg. A canvas-only engine that offers no text-alternative surface is refused at project-side review (ADR-1901).",
+      "kind": "enum",
+      "options": [
+        "recharts",
+        "echarts",
+        "chart-js",
+        "d3-primitives",
+        "hand-authored-svg"
+      ],
+      "default": "recharts"
+    },
+    {
+      "id": "palette-overrides",
+      "prompt": "Optional brand-token overrides for the categorical palette, supplied through the shell palette accessor. Missing tokens fall back to the accessible-defaults palette (light and dark) at the same index and the render log records a warning (ADR-1902).",
+      "kind": "string",
+      "default": ""
+    }
   ],
   "contributions": [
-    { "id": "application-charts-REQ-001", "kind": "req", "path": "requirements/application-charts-req-001.json" },
-    { "id": "application-charts-REQ-002", "kind": "req", "path": "requirements/application-charts-req-002.json" },
-    { "id": "application-charts-REQ-003", "kind": "req", "path": "requirements/application-charts-req-003.json" },
-    { "id": "application-charts-REQ-004", "kind": "req", "path": "requirements/application-charts-req-004.json" },
-    { "id": "application-charts-US-18101", "kind": "us", "path": "user-stories/application-charts-us-18101.json" },
-    { "id": "application-charts-US-18102", "kind": "us", "path": "user-stories/application-charts-us-18102.json" },
-    { "id": "application-charts-US-18103", "kind": "us", "path": "user-stories/application-charts-us-18103.json" },
-    { "id": "application-charts-US-18104", "kind": "us", "path": "user-stories/application-charts-us-18104.json" },
-    { "id": "application-charts-US-18105", "kind": "us", "path": "user-stories/application-charts-us-18105.json" },
-    { "id": "application-charts-US-18106", "kind": "us", "path": "user-stories/application-charts-us-18106.json" },
-    { "id": "TAC-1901-application-charts-render-shell", "kind": "tac", "path": "tacs/tac-1901-application-charts-render-shell.json" },
-    { "id": "TAC-1902-application-charts-keyboard-traversal", "kind": "tac", "path": "tacs/tac-1902-application-charts-keyboard-traversal.json" },
-    { "id": "ADR-1901-application-charts-engine-choice", "kind": "adr", "path": "adrs/adr-1901-application-charts-engine-choice.json", "elicited": true, "standardsTraceClause": "WCAG 1.4.1 / WCAG 2.1.1" },
-    { "id": "ADR-1902-application-charts-accessible-palette", "kind": "adr", "path": "adrs/adr-1902-application-charts-accessible-palette.json", "recommendedDefault": true, "elicited": true, "standardsTraceClause": "WCAG 1.4.3 / WCAG 1.4.11" },
-    { "id": "ADR-1903-application-charts-motion", "kind": "adr", "path": "adrs/adr-1903-application-charts-motion.json", "recommendedDefault": true, "standardsTraceClause": "WCAG 2.3.3" }
+    {
+      "id": "application-charts-REQ-001",
+      "kind": "req",
+      "path": "requirements/application-charts-req-001.json"
+    },
+    {
+      "id": "application-charts-REQ-002",
+      "kind": "req",
+      "path": "requirements/application-charts-req-002.json"
+    },
+    {
+      "id": "application-charts-REQ-003",
+      "kind": "req",
+      "path": "requirements/application-charts-req-003.json"
+    },
+    {
+      "id": "application-charts-REQ-004",
+      "kind": "req",
+      "path": "requirements/application-charts-req-004.json"
+    },
+    {
+      "id": "application-charts-US-18101",
+      "kind": "us",
+      "path": "user-stories/application-charts-us-18101.json"
+    },
+    {
+      "id": "application-charts-US-18102",
+      "kind": "us",
+      "path": "user-stories/application-charts-us-18102.json"
+    },
+    {
+      "id": "application-charts-US-18103",
+      "kind": "us",
+      "path": "user-stories/application-charts-us-18103.json"
+    },
+    {
+      "id": "application-charts-US-18104",
+      "kind": "us",
+      "path": "user-stories/application-charts-us-18104.json"
+    },
+    {
+      "id": "application-charts-US-18105",
+      "kind": "us",
+      "path": "user-stories/application-charts-us-18105.json"
+    },
+    {
+      "id": "application-charts-US-18106",
+      "kind": "us",
+      "path": "user-stories/application-charts-us-18106.json"
+    },
+    {
+      "id": "TAC-1901-application-charts-render-shell",
+      "kind": "tac",
+      "path": "tacs/tac-1901-application-charts-render-shell.json"
+    },
+    {
+      "id": "TAC-1902-application-charts-keyboard-traversal",
+      "kind": "tac",
+      "path": "tacs/tac-1902-application-charts-keyboard-traversal.json"
+    },
+    {
+      "id": "ADR-1901-application-charts-engine-choice",
+      "kind": "adr",
+      "path": "adrs/adr-1901-application-charts-engine-choice.json",
+      "elicited": true,
+      "standardsTraceClause": "WCAG 1.4.1 / WCAG 2.1.1"
+    },
+    {
+      "id": "ADR-1902-application-charts-accessible-palette",
+      "kind": "adr",
+      "path": "adrs/adr-1902-application-charts-accessible-palette.json",
+      "recommendedDefault": true,
+      "elicited": true,
+      "standardsTraceClause": "WCAG 1.4.3 / WCAG 1.4.11"
+    },
+    {
+      "id": "ADR-1903-application-charts-motion",
+      "kind": "adr",
+      "path": "adrs/adr-1903-application-charts-motion.json",
+      "recommendedDefault": true,
+      "standardsTraceClause": "WCAG 2.3.3"
+    }
   ]
 }

package/blueprints/application-charts/contributions/adrs/adr-1901-application-charts-engine-choice.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-1901-application-charts-engine-choice",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Elicit the chart engine at apply, and refuse a canvas-only engine that offers no text-alternative surface",
   "context": "Chart engines have wildly different accessibility postures. Recharts and ECharts render to SVG with keyboard-focusable data points and a DOM the shell can read; Chart.js renders to canvas and needs a paired data-table to reach a screen reader; D3 primitives leave the accessibility contract to the author. A blueprint that hard-picks one engine locks the applying project into that engine's accessibility posture; a blueprint that leaves it wide open lets the project ship a canvas-only chart with no text-alternative path.",

package/blueprints/application-charts/contributions/adrs/adr-1902-application-charts-accessible-palette.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-1902-application-charts-accessible-palette",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Ship an accessible-defaults categorical palette (light and dark) with elicited operator overrides",
   "context": "Categorical palettes are the most common source of colour-blindness defects on chart libraries: many popular defaults (rainbow gradients, the classic ten-colour categorical from d3-scale v1) fail deuteranopia readability at the second and third series. Operators bring brand tokens they want to see on the shipped surface; the tension between brand palette and accessible palette is real.",

package/blueprints/application-charts/contributions/adrs/adr-1903-application-charts-motion.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-1903-application-charts-motion",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Honour prefers-reduced-motion via the application-spa motion tokens on every chart transition",
   "context": "Chart libraries default to animated entry and update transitions (bars grow from zero, lines sweep left-to-right). `prefers-reduced-motion: reduce` is the WCAG 2.3.3 signal the operator's platform preferences carry; failing to honour it is a common accessibility defect on chart libraries and a hard-to-diagnose vestibular trigger.",

package/blueprints/application-charts/contributions/requirements/application-charts-req-001.json

@@ -2,14 +2,21 @@
   "reqId": "application-charts-REQ-001",
   "prdId": "PRD-001",
   "title": "The application ships the small set of chart forms an operator SaaS actually shows",
-  "description": "The application realises the chart-form set the shelf's spec commits: bar, line, area, pie or donut, single-value with sparkline, and heatmap. Every rendered chart on the shipped surface picks one of these forms and honours the render-shell contract (TAC-1901). A form outside this set is refused at project-side review; a specialised form the applying project needs (a candlestick, a Sankey) supersedes this REQ with a project-authored REQ and is documented as a known deviation.",
+  "description": "The application realises the chart-form set the shelf's spec commits: bar, line, area, pie or donut, single-value with sparkline, and heatmap. Every rendered chart on the shipped surface picks one of these forms and honours the render-shell contract (TAC-1901). A form outside this set is refused at project-side review; a specialised form the applying project needs (a candlestick, a Sankey) supersedes this REQ with a project-authored REQ and is documented as a known deviation. The chart engine is elicited at apply (`recharts`, `echarts`, `chart-js`, `d3-primitives` or `hand-authored-svg` per ADR-1901); a canvas-only engine that offers no text-alternative surface is refused at project-side review and the refusal is documented on the blueprint README under the engine-refusal rule.",
   "category": "functional",
   "domain": "application",
   "priority": "must",
   "rationale": "The form set is where teams reach for a chart library and pick the wrong tool. Enumerating the forms in the contract closes the ambiguity at ship: every rendered chart on the surface names one of the six forms and inherits its rendering discipline, its accessibility affordances and its text-alternative shape from the shell.",
-  "tags": ["blueprint:application-charts", "category:01-form-set"],
-  "version": "1.0.0",
+  "tags": [
+    "blueprint:application-charts",
+    "category:01-form-set"
+  ],
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-04T21:00:00Z",
-  "updatedAt": "2026-09-04T21:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1901-application-charts-render-shell",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-charts/contributions/requirements/application-charts-req-002.json

@@ -2,14 +2,21 @@
   "reqId": "application-charts-REQ-002",
   "prdId": "PRD-001",
   "title": "Every chart series distinguishes on colour plus pattern plus direct label (non-colour distinction, WCAG 1.4.1)",
-  "description": "Every rendered chart with two or more series distinguishes the series through more than colour alone: colour is paired with a pattern (a dashed line, a hatched fill, a marker shape) and a direct label placed at the series (a legend entry alone does not satisfy the AC). A vision-deficiency simulation (deuteranopia is the shelf's default screen) still reads the series distinction. The blueprint's accessible palette (ADR-1902) is the colour default; the pattern and label rules apply regardless of palette.",
+  "description": "Every rendered chart with two or more series distinguishes the series through more than colour alone: colour is paired with a pattern (a dashed line, a hatched fill, a marker shape) and a direct label placed at the series (a legend entry alone does not satisfy the AC). A vision-deficiency simulation (deuteranopia is the shelf's default screen) still reads the series distinction. The blueprint's accessible palette (ADR-1902) is the colour default; the pattern and label rules apply regardless of palette. The elicited `palette-overrides` value on `blueprint.json:elicits[]` supplies operator-authored brand tokens keyed by series role or index; the render shell applies each supplied token verbatim, falls back to the accessible-defaults palette at the same series index for any missing token, and the render log records exactly one warning per unpaletted series naming the missing token (ADR-1902). An empty override string (the default) is legal and resolves to the accessible-defaults palette with no warnings; a malformed override (non-JSON, or a shape the shell cannot key by series role or index) is refused at project-side review and the refusal is recorded on the render log.",
   "category": "functional",
   "domain": "application",
   "priority": "must",
   "rationale": "Colour blindness is the most common visual disability and colour-only series distinction is the most common accessibility defect on chart libraries; the tri-cue (colour, pattern, label) is what WCAG 1.4.1 asks for and what a build-scan or runtime check can prove at the DOM level.",
-  "tags": ["blueprint:application-charts", "category:02-non-colour-distinction"],
-  "version": "1.0.0",
+  "tags": [
+    "blueprint:application-charts",
+    "category:02-non-colour-distinction"
+  ],
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-04T21:00:00Z",
-  "updatedAt": "2026-09-04T21:00:00Z"
+  "updatedAt": "2026-09-04T21:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-1901-application-charts-render-shell",
+    "field": "responsibilities"
+  }
 }