rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-account-settings/contributions/probes/profile-form-autocomplete.mjs

@@ -0,0 +1,67 @@
+// application-account-settings probe: profile form autocomplete
+// tokens (AC-25102-1). AC-25102-1 requires <form data-surface="profile">
+// with inputs carrying autocomplete tokens "name", "email", "bday",
+// and "country". Derived observation: parse the form's input elements
+// and match each required field to the autocomplete token it carries.
+//
+// A previous revision carried a second row that drove the
+// ?break=no-autocomplete rig and asserted "every autocomplete token
+// is dropped" while positive-anchoring to AC-25102-1. That row is
+// removed: the shipped AC forbids the absence, so pass-on-absence
+// under the positive anchor was a de-claim violation. The negative
+// rig still exists in the fixture for anatomy-test coverage of the
+// break switches; it is not evidence for AC-25102-1.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-account-settings-AC-25102-1';
+export const accountBound = false;
+
+const FIRST_EIGHT = 'GET /account/profile renders a <form data-surface="profile"> with inputs';
+
+const REQUIRED = [
+  { field: 'name', autocomplete: 'name' },
+  { field: 'email', autocomplete: 'email' },
+  { field: 'bday', autocomplete: 'bday' },
+  { field: 'country', autocomplete: 'country' },
+];
+
+function inputAutocompletes(body) {
+  const results = {};
+  for (const m of body.matchAll(/<input[^>]*name="([^"]+)"[^>]*>/g)) {
+    const attrs = m[0];
+    const autoMatch = attrs.match(/autocomplete="([^"]+)"/);
+    results[m[1]] = autoMatch ? autoMatch[1] : null;
+  }
+  return results;
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const r = await fixtureFetch(fixture.url, '/account/profile');
+    const surfacePresent = /<form data-surface="profile"/.test(r.body);
+    const autos = inputAutocompletes(r.body);
+    const missing = REQUIRED.filter((req) => autos[req.field] !== req.autocomplete);
+    const pass = r.status === 200 && !!r.requestId && surfacePresent && missing.length === 0;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-account-settings-AC-25102-1: save-action activation and outcome semantics (the AC clause requiring the save action to succeed on a submit and surface a save-success or save-failure state on a subsequent GET) are browser-driven and not observed by this Node HTTP probe; the profile-form autocomplete-token walk is a partial observation of AC-25102-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `${FIRST_EIGHT} carrying autocomplete tokens name/email/bday/country: the profile form renders and every required input carries the AC-25102-1 token verbatim; derived autocompletes=${JSON.stringify(autos)}; x-fixture-request-id=${r.requestId}`
+        : `${FIRST_EIGHT} autocomplete gap: status=${r.status} rid=${r.requestId} surface=${surfacePresent} autos=${JSON.stringify(autos)} missing=${JSON.stringify(missing)}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<form data-surface="profile"[^]{0,240}/) || [''])[0]),
+        derived: { autos, missing, surfacePresent },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-account-settings/contributions/probes/run-profile-form-autocomplete.mjs

@@ -0,0 +1,5 @@
+import runProbe from './profile-form-autocomplete.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('profile-form-autocomplete', engine, runProbe);

package/blueprints/application-account-settings/contributions/probes/run-sessions-adapter-uniform.mjs

@@ -0,0 +1,5 @@
+import runProbe from './sessions-adapter-uniform.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('sessions-adapter-uniform', engine, runProbe);

package/blueprints/application-account-settings/contributions/probes/run-sessions-surface-shape.mjs

@@ -0,0 +1,5 @@
+import runProbe from './sessions-surface-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('sessions-surface-shape', engine, runProbe);

package/blueprints/application-account-settings/contributions/probes/run-shell-tablist-per-capability.mjs

@@ -0,0 +1,5 @@
+import runProbe from './shell-tablist-per-capability.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('shell-tablist-per-capability', engine, runProbe);

package/blueprints/application-account-settings/contributions/probes/run-theme-radiogroup.mjs

@@ -0,0 +1,5 @@
+import runProbe from './theme-radiogroup.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('theme-radiogroup', engine, runProbe);

package/blueprints/application-account-settings/contributions/probes/sessions-adapter-uniform.mjs

@@ -0,0 +1,130 @@
+// application-account-settings probe: the sessions surface render
+// contract is identical regardless of which applied auth provider
+// supplied sessionInventory (AC-25106-1). The fixture ships three
+// distinct raw provider inventories (clerk, keycloak, oauth2) and
+// three provider-specific adapters that normalise each raw shape
+// into a common session row (device / lastActive ISO / current). The
+// probe drives each provider via ?provider= and asserts:
+//   - each provider yields a non-empty rendered inventory
+//   - the inventory sizes ACROSS providers differ (proves the raw
+//     payloads are distinct, not a constant echoed with a swapped
+//     label)
+//   - the observed device labels ACROSS providers are disjoint
+//     (further evidence the adapter reads distinct raw payloads)
+//   - the DOM COLUMN STRUCTURE is uniform (identical set of
+//     data-column tokens per row across providers), i.e. the adapter
+//     normalises to a common row shape
+//   - the last-active values normalise to valid ISO 8601 timestamps
+//     under every provider (Keycloak raw ships epoch ms; the adapter
+//     converts to ISO), a further derived-output check
+// Together those observations prove the AC-25106-1 uniform-render
+// contract without relying on byte-equality of the same hard-coded
+// rows.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-account-settings-AC-25106-1';
+export const accountBound = false;
+
+const FIRST_EIGHT = 'The sessions surface reads sessionInventory from the applied';
+
+function extractRows(body) {
+  const surfaceMatch = body.match(/<div data-surface="sessions"[^]*?<\/table>/);
+  if (!surfaceMatch) return { rows: [], columnsPerRow: [] };
+  const surface = surfaceMatch[0];
+  const rowMatches = [...surface.matchAll(/<tr data-session-id="([^"]+)"([^>]*)>([^]*?)<\/tr>/g)];
+  const rows = rowMatches.map((m) => {
+    const id = m[1];
+    const rowInner = m[3];
+    const deviceMatch = rowInner.match(/<td data-column="device">([^<]*)<\/td>/);
+    const lastActiveMatch = rowInner.match(/<td data-column="lastActive">([^<]*)<\/td>/);
+    const columns = [...rowInner.matchAll(/data-column="([^"]+)"/g)].map((c) => c[1]);
+    return {
+      id,
+      device: deviceMatch ? deviceMatch[1] : null,
+      lastActive: lastActiveMatch ? lastActiveMatch[1] : null,
+      columns,
+    };
+  });
+  const columnsPerRow = rows.map((r) => r.columns.slice().sort().join(','));
+  return { rows, columnsPerRow };
+}
+
+const ISO_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
+
+export default async function runProbe() {
+  const results = [];
+  const providers = ['clerk', 'keycloak', 'oauth2'];
+  const fixture = await startFixture({ env: { ACCOUNT_SETTINGS_CAPS: 'principalDirectory,sessionInventory' } });
+  try {
+    const observations = [];
+    for (const provider of providers) {
+      const r = await fixtureFetch(fixture.url, `/account/sessions?provider=${provider}`);
+      const observedMatch = r.body.match(/<meta data-observed-provider="([^"]+)">/);
+      const { rows, columnsPerRow } = extractRows(r.body);
+      observations.push({ provider, status: r.status, requestId: r.requestId, observedProvider: observedMatch ? observedMatch[1] : null, rows, columnsPerRow });
+    }
+    // Adapter-derived-inventory checks that would fail under a
+    // constant-echo fixture:
+    //   - Size varies across providers (raw payloads are distinct).
+    //   - Device-label sets are disjoint across providers (adapter
+    //     really reads each raw payload).
+    //   - Uniform column set per row across every provider.
+    //   - Every lastActive value is a valid ISO 8601 string.
+    const sizes = observations.map((o) => o.rows.length);
+    const distinctSizeCount = new Set(sizes).size;
+    const sizesVary = distinctSizeCount > 1 && sizes.every((n) => n > 0);
+    const allDevices = observations.map((o) => new Set(o.rows.map((r) => r.device)));
+    let disjointDevices = true;
+    for (let i = 0; i < allDevices.length; i += 1) {
+      for (let j = i + 1; j < allDevices.length; j += 1) {
+        for (const d of allDevices[i]) if (allDevices[j].has(d)) { disjointDevices = false; break; }
+        if (!disjointDevices) break;
+      }
+      if (!disjointDevices) break;
+    }
+    const columnSets = observations.flatMap((o) => o.columnsPerRow);
+    const uniqueColumnShapes = new Set(columnSets);
+    const uniformColumns = uniqueColumnShapes.size === 1 && columnSets.every((c) => c.length > 0);
+    const invalidIsoValues = observations.flatMap((o) => o.rows.map((r) => ({ provider: o.provider, id: r.id, lastActive: r.lastActive }))).filter((r) => !ISO_RE.test(r.lastActive || ''));
+    const isoUniform = invalidIsoValues.length === 0;
+    const observedLabelsHonoured = observations.every((o) => o.observedProvider === o.provider);
+    const overallPass = observations.every((o) => o.status === 200 && !!o.requestId)
+      && sizesVary && disjointDevices && uniformColumns && isoUniform && observedLabelsHonoured;
+
+    // One row per provider carrying the per-provider observation.
+    for (const obs of observations) {
+      const perProviderPass = obs.status === 200 && !!obs.requestId
+        && obs.observedProvider === obs.provider
+        && obs.rows.length > 0
+        && overallPass;
+      results.push({
+        anchorAcId,
+        verdict: perProviderPass ? 'pass' : 'fail',
+        detail: perProviderPass
+          ? `${FIRST_EIGHT} auth provider (varied via ?provider=${obs.provider}): the adapter for ${obs.provider} normalised its distinct raw inventory (${obs.rows.length} rows) into the common row shape; column set per row = ${obs.rows[0] ? obs.rows[0].columns.slice().sort().join(',') : '(none)'}, identical across all three providers; lastActive values are ISO 8601 across every provider; sizes across providers ${JSON.stringify(sizes)} confirm the raw inventories are distinct (not a constant echo); x-fixture-request-id=${obs.requestId}`
+          : `${FIRST_EIGHT} auth provider gap: provider=${obs.provider} status=${obs.status} rid=${obs.requestId} observedProvider=${obs.observedProvider} rows=${obs.rows.length} sizes=${JSON.stringify(sizes)} sizesVary=${sizesVary} disjointDevices=${disjointDevices} uniformColumns=${uniformColumns} isoUniform=${isoUniform} invalidIsoSample=${JSON.stringify(invalidIsoValues.slice(0, 3))}`,
+        evidence: {
+          requestId: obs.requestId,
+          responseStatus: obs.status,
+          bodyExcerpt: excerpt(JSON.stringify(obs.rows.slice(0, 3))),
+          derived: {
+            provider: obs.provider,
+            observedProvider: obs.observedProvider,
+            rowCount: obs.rows.length,
+            uniformColumnShape: obs.rows[0] ? obs.rows[0].columns.slice().sort().join(',') : null,
+            sizesAcrossProviders: sizes,
+            distinctSizeCount,
+            sizesVary,
+            disjointDevices,
+            uniformColumns,
+            isoUniform,
+          },
+        },
+      });
+    }
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-account-settings/contributions/probes/sessions-surface-shape.mjs

@@ -0,0 +1,70 @@
+// application-account-settings probe: sessions surface renders under
+// sessionInventory with data-session-id rows and required columns
+// (AC-25105-1). Varies input: with vs without sessionInventory.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-account-settings-AC-25105-1';
+export const accountBound = false;
+
+const FIRST_EIGHT = 'When sessionInventory is in the applied capability set,';
+
+export default async function runProbe() {
+  const results = [];
+  const withCap = await startFixture({ env: { ACCOUNT_SETTINGS_CAPS: 'principalDirectory,sessionInventory' } });
+  try {
+    const r = await fixtureFetch(withCap.url, '/account/sessions');
+    const surface = /<div data-surface="sessions"/.test(r.body);
+    const rowIds = [...new Set([...r.body.matchAll(/data-session-id="([^"]+)"/g)].map((m) => m[1]))];
+    const deviceCells = (r.body.match(/data-column="device"/g) || []).length;
+    const lastActiveCells = (r.body.match(/data-column="lastActive"/g) || []).length;
+    const pass = r.status === 200 && !!r.requestId
+      && surface
+      && rowIds.length > 0
+      && deviceCells === rowIds.length
+      && lastActiveCells === rowIds.length;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-account-settings-AC-25105-1: per-row terminate control wired to a session-termination API and its activation cycle (the AC clauses beyond the DOM shape) are not present in this fixture and not observed by this Node HTTP probe; the sessions-surface row + device + lastActive walk under sessionInventory is a partial observation of AC-25105-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `${FIRST_EIGHT} GET /account/sessions returned 200 with data-surface="sessions" rendered; derived rows=${rowIds.length}, [data-column="device"] cells=${deviceCells}, [data-column="lastActive"] cells=${lastActiveCells} equal to row count (terminate control per row); x-fixture-request-id=${r.requestId}`
+        : `${FIRST_EIGHT} evidence gap: status=${r.status} rid=${r.requestId} surface=${surface} rows=${rowIds.length} device=${deviceCells} lastActive=${lastActiveCells}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<div data-surface="sessions"[^]{0,240}/) || [''])[0]),
+        derived: { rowCount: rowIds.length, deviceCells, lastActiveCells },
+      },
+    });
+  } finally {
+    await withCap.kill();
+  }
+
+  const noCap = await startFixture({ env: { ACCOUNT_SETTINGS_CAPS: 'principalDirectory' } });
+  try {
+    const r = await fixtureFetch(noCap.url, '/account/sessions');
+    const surface = /<div data-surface="sessions"/.test(r.body);
+    const rowCount = (r.body.match(/data-session-id="[^"]+"/g) || []).length;
+    const pass = r.status === 200 && !!r.requestId && !surface && rowCount === 0;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-account-settings-AC-25105-1: per-row terminate control wired to a session-termination API (the positive-branch contract the AC also carries) is not present in this fixture and not observed by this Node HTTP probe; the sessions-absence walk when sessionInventory is not applied is a partial observation of AC-25105-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `${FIRST_EIGHT} absence branch: with sessionInventory not applied, AC-25105-1's stated "Absent when sessionInventory is not applied" clause is observed - no data-surface="sessions" subtree and no data-session-id rows render; x-fixture-request-id=${r.requestId}`
+        : `${FIRST_EIGHT} absence gap: status=${r.status} rid=${r.requestId} surface=${surface} rows=${rowCount}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt(r.body.slice(0, 240)),
+        derived: { surface, rowCount },
+      },
+    });
+  } finally {
+    await noCap.kill();
+  }
+  return { results };
+}

package/blueprints/application-account-settings/contributions/probes/shell-tablist-per-capability.mjs

@@ -0,0 +1,60 @@
+// application-account-settings probe: tabs shell renders one
+// role="tab" per applied capability plus the always-on profile tab
+// (AC-25101-1).
+//
+// Varied inputs: three caps configurations produce three different
+// derived tab counts. The probe asserts the derived tab count on the
+// rendered nav matches the sum of the always-on tab + the enabled
+// capability tabs.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-account-settings-AC-25101-1';
+export const accountBound = false;
+
+const FIRST_EIGHT = 'Given an authenticated principal AND an applied auth';
+
+function countTabs(body) {
+  return (body.match(/<a role="tab"[^>]*>/g) || []).length;
+}
+
+async function tabsFor(fixture, caps, apps) {
+  const q = new URLSearchParams({ caps: caps.join(','), apps: apps.join(',') });
+  const r = await fixtureFetch(fixture.url, `/account?${q.toString()}`);
+  return { r, count: countTabs(r.body) };
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const configs = [
+      { name: 'profile-only', caps: ['principalDirectory'], apps: [], expected: 1 },
+      { name: 'profile+sessions', caps: ['principalDirectory', 'sessionInventory'], apps: [], expected: 2 },
+      { name: 'profile+security+sessions+notifications+theme', caps: ['principalDirectory', 'credentialSelfService', 'sessionInventory'], apps: ['application-notifications-in-app', 'application-spa'], expected: 5 },
+    ];
+    for (const cfg of configs) {
+      const { r, count } = await tabsFor(fixture, cfg.caps, cfg.apps);
+      const tablistPresent = /<nav[^>]*role="tablist"/.test(r.body);
+      const pass = r.status === 200 && !!r.requestId && count === cfg.expected && tablistPresent;
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: 'application-account-settings-AC-25101-1: capability-to-tab-label mapping (each tab labels the correct capability against a shipped tab-label registry) is not verified by this Node HTTP probe; the derived tab-count walk across three caps configurations is a partial observation of AC-25101-1',
+        verdict: pass ? 'warn' : 'fail',
+        detail: pass
+          ? `${FIRST_EIGHT} blueprint declaring principalDirectory, GET /account?caps=${cfg.caps.join(',')}&apps=${cfg.apps.join(',')} (${cfg.name}) returned 200 with role="tablist" nav and derived tab count=${count} matching expected=${cfg.expected} (always-on profile plus one tab per applied capability); x-fixture-request-id=${r.requestId}`
+          : `${FIRST_EIGHT} blueprint gap for ${cfg.name}: status=${r.status} rid=${r.requestId} tabs=${count} expected=${cfg.expected} tablist=${tablistPresent}`,
+        evidence: {
+          requestId: r.requestId,
+          responseStatus: r.status,
+          bodyExcerpt: excerpt((r.body.match(/<nav[^>]*role="tablist"[^]{0,240}/) || [''])[0]),
+          derived: { config: cfg.name, capsInput: cfg.caps, appsInput: cfg.apps, tabCount: count, expected: cfg.expected, tablistPresent },
+        },
+      });
+    }
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-account-settings/contributions/probes/theme-radiogroup.mjs

@@ -0,0 +1,126 @@
+// application-account-settings probe: theme surface renders as a
+// radiogroup with three options when application-spa is applied, and
+// the server-scoped theme-persistence variant persists a written
+// theme across a subsequent GET (AC-25108-1).
+//
+// AC-25108-1 has TWO observable halves from a Node HTTP probe:
+//   (a) the server-scoped-persistence half - when the applied
+//       theme-persistence store is 'server-scoped', a POST /api/theme
+//       write is reflected on the next GET /account/theme's initial
+//       html data-theme attribute (server-rendered, no browser JS
+//       involved); DELETE /api/theme clears the record and the next
+//       GET returns to the default; and
+//   (b) the DOM-shape half - the radiogroup markup, three named
+//       radios and the data-persist reflection of the elicit input.
+// The interaction half of AC-25108-1 - the user selecting a radio,
+// the client-side script flipping the html data-theme attribute and
+// writing spa-local-storage - is browser-driven and is NOT observed
+// here; that row de-claims via conformanceOnly with a limitation
+// naming the browser-only clause. (A dedicated browser-driven pack
+// check owns the interaction observation.)
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorAcId = 'application-account-settings-AC-25108-1';
+export const accountBound = false;
+
+const FIRST_EIGHT_SPA = 'When application-spa is in the applied-blueprint set, GET';
+
+export default async function runProbe() {
+  const results = [];
+
+  // Row 1: DOM shape (radiogroup, three radios, data-persist reflect).
+  const withSpa = await startFixture({ env: { ACCOUNT_SETTINGS_APPS: 'application-spa' } });
+  try {
+    const persist = 'spa-local-storage';
+    const r = await fixtureFetch(withSpa.url, `/account/theme?theme-persistence=${encodeURIComponent(persist)}`);
+    const radiogroup = /<div data-surface="theme"[^>]*role="radiogroup"[^>]*aria-label="Theme"[^>]*data-persist="([^"]+)"/.exec(r.body);
+    const derivedPersist = radiogroup ? radiogroup[1] : null;
+    const options = [...r.body.matchAll(/<input type="radio" name="theme" value="([^"]+)"[^>]*>/g)].map((m) => m[1]);
+    const optSet = new Set(options);
+    const hasAll = ['light', 'dark', 'system'].every((v) => optSet.has(v));
+    const shapePass = r.status === 200 && !!r.requestId
+      && !!radiogroup && derivedPersist === persist
+      && options.length === 3 && hasAll;
+    // Conformance-only: the DOM shape is a partial observation of
+    // AC-25108-1. Null anchor per rule 11; the limitation names the
+    // AC and the interaction clause NOT observed here.
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      verdict: shapePass ? 'warn' : 'fail',
+      limitation: 'application-account-settings-AC-25108-1: interaction half (user selecting a radio, client script flipping html data-theme, spa-local-storage write) is browser-driven and not observed from a Node HTTP probe',
+      detail: shapePass
+        ? `${FIRST_EIGHT_SPA} /account/theme's server-rendered shell is a radiogroup with role="radiogroup", aria-label="Theme", data-persist="${derivedPersist}" (reflects the theme-persistence elicit input=${persist}), and three radios ${JSON.stringify(options)} matching light/dark/system; conformance-only observation of the DOM-shape half of AC-25108-1`
+        : `${FIRST_EIGHT_SPA} /account/theme conformance-shape gap: status=${r.status} rid=${r.requestId} radiogroup=${!!radiogroup} derivedPersist=${derivedPersist} options=${JSON.stringify(options)}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<div data-surface="theme"[^]{0,260}/) || [''])[0]),
+        derived: { persistInput: persist, derivedPersist, options, dataSurfacePresent: !!radiogroup, hasAllRadios: hasAll },
+      },
+    });
+
+    // Row 2: server-scoped persistence half of AC-25108-1. Observable
+    // server-side: POST /api/theme?theme=X writes; GET reflects on
+    // data-theme; DELETE clears; a further GET drops back to default.
+    const principalId = 'probe-theme-' + randomUUID();
+    const persistServer = 'server-scoped';
+    const chosenTheme = 'dark';
+    const before = await fixtureFetch(withSpa.url, `/account/theme?theme-persistence=${persistServer}&principal-id=${principalId}`);
+    const beforeMatch = before.body.match(/<html[^>]*data-theme="([^"]+)"/);
+    const beforeTheme = beforeMatch ? beforeMatch[1] : null;
+    const write = await fixtureFetch(withSpa.url, `/api/theme?theme=${chosenTheme}&theme-persistence=${persistServer}&principal-id=${principalId}`, { method: 'POST' });
+    const writeBody = (() => { try { return JSON.parse(write.body || '{}'); } catch (e) { return {}; } })();
+    const after = await fixtureFetch(withSpa.url, `/account/theme?theme-persistence=${persistServer}&principal-id=${principalId}`);
+    const afterHtmlTheme = (after.body.match(/<html[^>]*data-theme="([^"]+)"/) || [null, null])[1];
+    const afterDataServerScoped = (after.body.match(/data-server-scoped-theme="([^"]*)"/) || [null, null])[1];
+    const afterDarkChecked = /<input type="radio" name="theme" value="dark"[^>]*checked/.test(after.body);
+    const clear = await fixtureFetch(withSpa.url, `/api/theme?theme-persistence=${persistServer}&principal-id=${principalId}`, { method: 'DELETE' });
+    const cleared = await fixtureFetch(withSpa.url, `/account/theme?theme-persistence=${persistServer}&principal-id=${principalId}`);
+    const clearedHtmlTheme = (cleared.body.match(/<html[^>]*data-theme="([^"]+)"/) || [null, null])[1];
+    const clearedDataServerScoped = (cleared.body.match(/data-server-scoped-theme="([^"]*)"/) || [null, null])[1];
+    const serverScopedPass = before.status === 200 && write.status === 200 && writeBody.ok === true
+      && after.status === 200 && afterHtmlTheme === chosenTheme && afterDataServerScoped === chosenTheme && afterDarkChecked
+      && clear.status === 200 && cleared.status === 200 && clearedHtmlTheme === 'light' && (!clearedDataServerScoped || clearedDataServerScoped.length === 0);
+    results.push({
+      anchorAcId,
+      verdict: serverScopedPass ? 'pass' : 'fail',
+      detail: serverScopedPass
+        ? `${FIRST_EIGHT_SPA} /account/theme with theme-persistence=server-scoped: for a fresh principalId, initial GET rendered html data-theme=${beforeTheme}; POST /api/theme?theme=${chosenTheme} wrote the record; a subsequent GET rendered html data-theme=${afterHtmlTheme} with data-server-scoped-theme=${afterDataServerScoped} and the dark radio checked; DELETE /api/theme cleared; a final GET fell back to html data-theme=${clearedHtmlTheme}. Server-scoped persistence observed across requests; x-fixture-request-id (final)=${cleared.requestId}`
+        : `${FIRST_EIGHT_SPA} /account/theme with theme-persistence=server-scoped (gap): before=${beforeTheme} write=${write.status}/${writeBody.ok} afterHtmlTheme=${afterHtmlTheme} afterServerScoped=${afterDataServerScoped} afterDarkChecked=${afterDarkChecked} clear=${clear.status} clearedHtmlTheme=${clearedHtmlTheme}`,
+      evidence: {
+        requestId: cleared.requestId,
+        responseStatus: cleared.status,
+        bodyExcerpt: excerpt((after.body.match(/<html[^]{0,320}/) || [''])[0]),
+        derived: {
+          principalId,
+          beforeTheme,
+          writtenTheme: chosenTheme,
+          afterHtmlTheme,
+          afterDataServerScoped,
+          afterDarkChecked,
+          clearedHtmlTheme,
+        },
+      },
+    });
+
+    // Row 3: interaction half is browser-only. notObservableHere
+    // anchored to AC-25108-1 with verdict warn (never pass). The
+    // aggregate() rule lifts any warn row to a warn aggregate, so this
+    // row makes the probe amber-on-the-shelf honestly without letting
+    // the interaction clause pass unobserved.
+    results.push({
+      anchorAcId,
+      notObservableAcId: anchorAcId,
+      notObservableHere: true,
+      verdict: 'warn',
+      reason: 'AC-25108-1 requires observing a principal selecting a theme radio, the html element data-theme attribute flipping to the chosen value in response to that user input event, and (for the spa-local-storage store) the client-side localStorage write. Change-event firing, DOM mutation on user input, and localStorage writes are browser-driven and cannot be observed from a Node HTTP probe; the browser-verify pack owns this observation.',
+      detail: `${FIRST_EIGHT_SPA} /account/theme's interaction half - user selection firing a change event, the client script flipping html data-theme on that event, and the spa-local-storage write - is browser-driven and observed by the browser-verify pack, not by this Node probe; anchored as notObservableHere for AC-25108-1 so the row does not falsely claim positive evidence`,
+    });
+  } finally {
+    await withSpa.kill();
+  }
+  return { results };
+}

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-001.json

@@ -2,7 +2,11 @@
   "reqId": "application-account-settings-REQ-001",
   "prdId": "PRD-001",
   "title": "Settings shell with no dead links to unapplied capabilities and ARIA APG tabs",
-  "description": "The settings shell renders a single primary tabs region (ARIA APG tabs pattern) whose entries mirror the union of applied capabilities discovered via readAppliedCapabilities. A tab whose capability is not applied does NOT render (no dead link, no disabled shell). A principal without an authenticated session reaching /account routes to the access-denied state through application-empty-error-states (T-1) with a sign-in link; no bespoke access-denied UI is invented here. Landmark, headings, focus order per WCAG 2.4.6.",
+  "description": "The settings shell renders a single primary tabs region (ARIA APG tabs pattern) whose entries mirror the union of applied capabilities discovered via readAppliedCapabilities. The applied capability floor is principalDirectory: the shell reads the current authenticated principal (name, email, id) from the applied principalDirectory provider on first render and passes the identity to every child surface without re-reading it per tab switch. A tab whose capability is not applied does NOT render (no dead link, no disabled shell). A principal without an authenticated session reaching /account routes to the access-denied state through application-empty-error-states with a sign-in link; no bespoke access-denied UI is invented here. Landmark, headings, focus order per WCAG 2.4.6.",
+  "deliveredBy": {
+    "tacId": "TAC-2601-application-account-settings-shell",
+    "field": "responsibilities.renderShell"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Profile surface always available with autocomplete tokens per WCAG 1.3.5",
   "description": "The profile surface (/account/profile) is unconditional (any authenticated principal reaches it) and renders a form with WCAG 1.3.5 autocomplete tokens on every editable identifier (name, email, bday, country). Save success announces via aria-live polite (\"Profile saved\"). Save failure per field renders aria-invalid true with aria-describedby to the per-field error message and focus moves to the first invalid field (WCAG 3.3.1 Error Identification).",
+  "deliveredBy": {
+    "tacId": "TAC-2601-application-account-settings-shell",
+    "field": "responsibilities.renderProfileSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-003.json

@@ -2,7 +2,11 @@
   "reqId": "application-account-settings-REQ-003",
   "prdId": "PRD-001",
   "title": "Security surface conditional on credentialSelfService OR hostedIdentityUi",
-  "description": "The security surface (/account/security) renders when the applied capability set contains credentialSelfService (self-service branch: password change, MFA setup, session-based sign-out) or hostedIdentityUi (link-out or embed branch: rendering an operator-elicited href or handle). When NEITHER capability is applied, the security tab does not render and the surface refuses at apply with the two-remedy message (declare a capability, or drop the security tab from scope) per spec Q3.",
+  "description": "The security surface (/account/security) renders when the applied capability set contains credentialSelfService (self-service branch of the security-surface-shape elicit: password change, MFA setup, session-based sign-out) or hostedIdentityUi (hosted-link-out or hosted-embed branch of the security-surface-shape elicit: hosted-link-out surfaces an operator-elicited href through the hosted-identity-url handle; hosted-embed surfaces the same handle inside a same-origin iframe when the applied hosted-identity provider names an embed clause). When NEITHER capability is applied, the security tab does not render and the surface refuses at apply with the two-remedy message (declare a capability, or drop the security tab from scope) per spec Q3.",
+  "deliveredBy": {
+    "tacId": "TAC-2603-application-account-settings-hosted-ui-bridge",
+    "field": "interfaces.renderSecuritySurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-account-settings",
     "category:03-security"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Sessions surface conditional on sessionInventory",
   "description": "The sessions surface (/account/sessions) renders when sessionInventory is applied. Lists active sessions in a table enumerated by data-session-id with device label, last-active timestamp and terminate control. Terminate opens an ARIA APG dialog-modal (role=dialog, aria-modal=true, aria-labelledby to the heading, focus trap, focus returns to the row on close) confirming the action; on submit the row disappears from the table and a polite \"Session ended\" announcement fires (WCAG 4.1.3 Status Messages).",
+  "deliveredBy": {
+    "tacId": "TAC-2604-application-account-settings-session-store",
+    "field": "interfaces.sessionInventoryConsumer"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Notification preferences surface conditional on application-notifications-in-app applied",
   "description": "The notification-preferences surface (/account/notifications) renders when application-notifications-in-app is applied. Provides a per-category silence control and a per-channel opt-in (in-app, email, push where channels apply). The blueprint does NOT own the notification model; it delegates the model to the applied blueprint and renders the operator interface only. Save-success and save-failure announcements follow the profile surface contract.",
+  "deliveredBy": {
+    "tacId": "TAC-2601-application-account-settings-shell",
+    "field": "responsibilities.renderPreferencesSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Theme surface conditional on application-spa applied with theme-persistence elicit",
   "description": "The theme surface (/account/theme) renders when application-spa is applied. Renders a light/dark/system radiogroup (ARIA APG radiogroup, keyboard reachable) and persists the choice per the theme-persistence elicit (spa-local-storage default, server-scoped, or none). Choice takes effect immediately (data-theme attribute on the html element flips) and honours the users prefers-color-scheme when set to system.",
+  "deliveredBy": {
+    "tacId": "TAC-2601-application-account-settings-shell",
+    "field": "responsibilities.renderThemeSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:application-account-settings",
     "category:06-theme"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "application-account-settings-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Reauth window: never, 5, 15, 60 each carry a defined trigger for high-value changes",
+  "description": "The security and sessions surfaces honour the elicited reauth-window with a runtime clause per option, applied before a high-value change (credential change, session termination, MFA enrolment). `never` bypasses reauthentication for any interval since the last successful sign-in and permits the high-value action to proceed with only the standard confirmation dialog. `5`, `15` and `60` denote a minute-count: when more than that many minutes have elapsed since the principal's last successful sign-in (as recorded on the applied auth providers session inventory), the surface presents a reauth prompt before the high-value action; the action refuses with REAUTH_REQUIRED until the reauth prompt returns success, then proceeds. The comparison uses the last-active timestamp on the current session record from the applied provider (security-auth-clerk TAC-1003 sessionInventory or the equivalent TAC on another auth blueprint), never a local clock. The reauth prompt never accepts the current session's own credentials as sufficient for the reauth without a fresh challenge (a fresh password entry, a fresh MFA challenge or a fresh magic-link click).",
+  "deliveredBy": {
+    "tacId": "TAC-2604-application-account-settings-session-store",
+    "field": "responsibilities.reauthWindowGate"
+  },
+  "category": "functional",
+  "domain": "security",
+  "priority": "must",
+  "rationale": "The elicit offers four windows but no requirement described what each option does. A project that chose 15 inherited `never` behaviour silently because no chain link asked after the elapsed-minutes gate. Requiring a per-option clause turns the elicit into a chain-linked check the reauth prompts appearance proves.",
+  "tags": [
+    "blueprint:application-account-settings",
+    "category:07-reauth-window"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}