rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-009.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-account-settings-REQ-009",
+  "prdId": "PRD-001",
+  "title": "Custom-auth capability declarations bind the four provides-* booleans to the applied capability set",
+  "description": "When the applying project runs its own auth (no shipped security-auth-* blueprint) and answers the four custom-auth-provides-* boolean elicits, the account-settings shell binds each answer to the appliedCapabilities union with a runtime clause per token: when `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is `true` the union includes `principalDirectory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-credential-self-service]` is `true` the union includes `credentialSelfService` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-session-inventory]` is `true` the union includes `sessionInventory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-hosted-identity-ui]` is `true` the union includes `hostedIdentityUi` and `false` omits it. The sidecar the shell reads reflects the exact union the boolean answers produce.",
+  "deliveredBy": {
+    "tacId": "TAC-2602-application-account-settings-capability-discovery",
+    "field": "responsibilities.runElicitationPhase"
+  },
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "The four provides-* booleans produced capabilities in the applied union without a chained clause; requiring one runtime clause per token turns each boolean answer into a must-observable binding on the sidecar the shell reads.",
+  "tags": [
+    "blueprint:application-account-settings"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-account-settings/contributions/tacs/tac-2601-application-account-settings-shell.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-2601-application-account-settings-shell",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Account settings shell",
   "purpose": "Owns the rendered settings surface: the top-level tabs landmark, the surface-manifest read at load, the conditional rendering of every applied surface (profile always; security, sessions, notifications, theme conditional), the tabs interaction contract (ARIA APG), and the shared page layout every surface renders within. The shell is the base surface every AC in this blueprint anchors on.",
@@ -11,7 +11,11 @@
     "Render a single primary navigation landmark carrying an accessible name and rendering only applied surfaces (AC-25101-1, AC-25101-2).",
     "Render the profile surface unconditionally as the active tab on /account (AC-25102-1).",
     "Delegate the security, sessions, notification-preferences and theme surfaces to their respective TACs (TAC-2603, TAC-2604) or render inline for notifications and theme.",
-    "Route unauthenticated principals to the empty-error-states forbidden state (T-1) rather than inventing a bespoke denied UI."
+    "Route unauthenticated principals to the empty-error-states forbidden state rather than inventing a bespoke denied UI.",
+    "renderProfileSurface: mount the profile tab as the active tab on /account, always available (AC-25102-1).",
+    "renderPreferencesSurface: mount the notification-preferences tab when application-notifications-in-app is applied (AC-25107-1) and the theme tab when application-spa is applied honouring theme-persistence (AC-25108-1).",
+    "renderCorrelationId: write one request-scoped log line per rendered surface, carrying the correlation identifier the applied logging companion supplies.",
+    "renderThemeSurface: mount the theme tab when application-spa is applied, render the light/dark/system ARIA APG radiogroup, persist the choice per the elicited theme-persistence, and flip the data-theme attribute on the html element (REQ-006)."
   ],
   "internalStructure": "One shell module that mounts the surface, reads the applied capabilities sidecar, and renders the tabs landmark, the page-layout scaffolding, and the tabpanel-level containers for each conditional surface. The framework is not prescribed; the shell interfaces are what the project realises against React, Vue, Svelte or vanilla DOM.",
   "interfaces": [
@@ -35,7 +39,7 @@
     }
   ],
   "tradeoffs": "The shell reads the sidecar file the apply verb writes; a runtime probe against manifest.blueprints[] would be more dynamic but ties the shell to the deploy-target having filesystem read access, which not every deploy target grants. The sidecar contract is deterministic and cacheable.",
-  "notes": "Composes on application-empty-error-states (T-1) for the forbidden and empty-list states rather than inventing bespoke denied UI. Known mechanism-reach gap: the shell contract cannot prove keyboard focus does not escape the tabs region in every framework rendering; project-side smoke tests supplement the pack. See README Known mechanism-reach gaps.",
+  "notes": "Composes on application-empty-error-states for the forbidden and empty-list states rather than inventing bespoke denied UI. Known mechanism-reach gap: the shell contract cannot prove keyboard focus does not escape the tabs region in every framework rendering; project-side smoke tests supplement the pack. See README Known mechanism-reach gaps.",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/tacs/tac-2602-application-account-settings-capability-discovery.json

@@ -2,13 +2,13 @@
   "tacId": "TAC-2602-application-account-settings-capability-discovery",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Account settings capability discovery",
   "purpose": "The apply-time reader that translates the applied blueprint set and any custom-auth elicits into an appliedCapabilities[] array, and enforces the requiresAppliedCapabilities gate.",
   "responsibilities": [
     "Read the union of capabilities[] declarations across applied blueprints (AC-25101-1, AC-25107-1, AC-25108-1).",
-    "Add capabilities the operator asserted through the four custom-auth-provides-* elicits (AC-25101-1).",
+    "runElicitationPhase: Run the elicitation phase gated on the discovered capability set; each `custom-auth-provides-*` boolean binds its `providesCapability` token onto the applied union when true, omits it when false (REQ-009).",
     "Refuse at apply when no applied blueprint declares principalDirectory and --allow-no-auth-yet is not passed (AC-25109-1).",
     "Write the sidecar file capturing appliedCapabilities, appliedElicitations, allowNoAuthYet and any scaffolding note (AC-25109-2)."
   ],
@@ -24,5 +24,5 @@
   "tradeoffs": "The sidecar path is stable and versioned; a schema minor bump on rcf-schemas can promote appliedCapabilities[] onto the applied-record shape directly, at which point the helper reads the manifest record instead. Kept file-scoped for v1.",
   "notes": "Known mechanism-reach gap: a project that declares a capability outside the section 6a vocabulary passes the loader shape check but the shell records no surface for it. Documented in README.",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/tacs/tac-2604-application-account-settings-session-store.json

@@ -2,15 +2,16 @@
   "tacId": "TAC-2604-application-account-settings-session-store",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Session store contract",
   "purpose": "The sessions surface bridge between the applied blueprints session-inventory source and the terminate-write flow.",
   "responsibilities": [
-    "Read the active-session inventory from the applied provider (an auth blueprint declaring sessionInventory, or observability-logging 1.2.0+ as the logging-projection provider) (AC-25105-1, AC-25106-1).",
+    "Read the active-session inventory from the applied provider (an auth blueprint declaring sessionInventory, owned by security-auth-clerk TAC-1003-security-auth-clerk-session-verifier field interfaces.sessionInventory) (AC-25105-1, AC-25106-1).",
     "Render one row per session enumerated by data-session-id with device and last-active columns and a terminate action (AC-25105-1).",
     "Open an ARIA APG dialog-modal on terminate with focus-trap, aria-labelledby to the heading and focus-return to the neighbouring row on close (AC-25105-2).",
-    "Announce the terminate-success via <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> (AC-25105-2)."
+    "Announce the terminate-success via <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> (AC-25105-2).",
+    "reauthWindowGate: honour the option chosen from `blueprint.json.elicits[id=reauth-window].options` by comparing the current session lastActive from the applied auth providers sessionInventory against the elapsed threshold and refusing the high-value action with REAUTH_REQUIRED or REAUTH_STALE or REAUTH_WINDOW_UNKNOWN accordingly (AC-25111-1 through AC-25111-5)."
   ],
   "internalStructure": "One sessions-surface module with a read-inventory helper and a terminate-write helper. The read-inventory helper dispatches to the applied providers session-inventory API; the terminate-write helper dispatches to the same providers terminate API. The framework is not prescribed.",
   "interfaces": [
@@ -22,7 +23,12 @@
     {
       "name": "sessionRecord",
       "kind": "shape",
-      "description": "{ sessionId, deviceLabel, lastActive (ISO-8601), currentSession (boolean) }. The current session cannot be terminated by itself (the operator signs out from the shell instead); the pack asserts the surface renders every session, the terminate control is present on every non-current row, and the current row (data-current-session=\"true\") does not carry the terminate action."
+      "description": "Shape owned by `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` (or the equivalent session-inventory TAC on the applied auth blueprint). The consumer reads that shape without restating it; the pack asserts the surface renders every session, the terminate control is present on every non-current row, and the current row (data-current-session=\"true\") does not carry the terminate action."
+    },
+    {
+      "name": "sessionInventoryConsumer",
+      "kind": "consumer",
+      "description": "Consumer contract on top of the applied auth providers sessionInventory (owner TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory or the equivalent TAC on another auth blueprint). Reads list()/revoke()/revokeAllExceptCurrent() and never restates the row shape."
     }
   ],
   "dependencies": [
@@ -33,8 +39,8 @@
       "description": "The sessions surface reads the applied capability set to gate on sessionInventory."
     }
   ],
-  "tradeoffs": "Re-authenticate before terminate is elicited (reauth-window ADR-2604) with a default of true. A project that ships a short-lived session token can set reauth-window=never; ADR-2604 records the choice and its risk.",
+  "tradeoffs": "Re-authenticate before high-value changes is elicited by the manifest elicit `blueprint.json.elicits[id=reauth-window]`; the default value is owned by that elicit's `.default` field, per ADR-2604. A project that ships a short-lived session token may pick the disable option that elicit exposes; ADR-2604 records the choice and its risk.",
   "notes": "Known mechanism-reach gap: the read-inventory adapter contract cannot prove the applied provider actually returns a device label the operator will recognise (User-Agent parsing varies); the pack asserts the DOM shape.",
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25101.json

@@ -13,13 +13,29 @@
       "id": "AC-25101-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given an authenticated principal AND an applied auth blueprint declaring principalDirectory, GET /account renders the shell as an ARIA APG tabs region [role=\"tablist\"] with one [role=\"tab\"] per applied capability plus the always-on profile tab; a tab whose capability is not in the applied set does NOT render (no disabled shell). Probed by pack check AC-25101-1."
+      "description": "Given an authenticated principal AND an applied auth blueprint declaring principalDirectory, GET /account renders the shell as an ARIA APG tabs region [role=\"tablist\"] with one [role=\"tab\"] per applied capability plus the always-on profile tab; a tab whose capability is not in the applied set does NOT render (no disabled shell). Probed by pack check AC-25101-1.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/tabs/",
+        "verifiedOn": "2026-09-10"
+      }
     },
     {
       "id": "AC-25101-2",
       "testable": true,
       "scope": "runtime",
-      "description": "The shell landmark is <nav data-role=\"account-settings-nav\" aria-label=\"Account settings\"> with a single accessible name; heading order follows h1 (page) then h2 (active tab) per WCAG 2.4.6."
+      "description": "The shell landmark is <nav data-role=\"account-settings-nav\" aria-label=\"Account settings\"> with a single accessible name; heading order follows h1 (page) then h2 (active tab) per WCAG 2.4.6.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25101-3",
+      "description": "When an unauthenticated principal requests /account, the shell routes to the shared forbidden state (application-empty-error-states), presents a sign-in link and renders no profile data.",
+      "given": "a request for /account without a valid principal on any applied auth blueprint",
+      "when": "the shell resolves the route",
+      "then": "the forbidden state renders with a sign-in link, no profile form is written to the DOM and no principal identifiers appear in the response body",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -30,5 +46,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25102.json

@@ -13,7 +13,32 @@
       "id": "AC-25102-1",
       "testable": true,
       "scope": "runtime",
-      "description": "GET /account/profile renders a <form data-surface=\"profile\"> with inputs carrying autocomplete tokens \"name\" on the full-name field, \"email\" on the email field, \"bday\" on the birthday field and \"country\" on the country field; save-success renders <div role=\"status\" aria-live=\"polite\">Profile saved</div>; save-failure per field carries aria-invalid=\"true\" and aria-describedby pointing to a rendered error message. Probed by pack check AC-25102-1."
+      "description": "GET /account/profile renders a <form data-surface=\"profile\"> with inputs carrying autocomplete tokens \"name\" on the full-name field, \"email\" on the email field, \"bday\" on the birthday field and \"country\" on the country field; save-success renders <div role=\"status\" aria-live=\"polite\">Profile saved</div>; save-failure per field carries aria-invalid=\"true\" and aria-describedby pointing to a rendered error message. Probed by pack check AC-25102-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25102-2",
+      "description": "A profile save that returns a non-2xx or times out surfaces an assertive error toast, preserves the entered values in the DOM (data-form-state=unsaved) and never marks the fields as saved.",
+      "given": "a profile save that returns a non-2xx or times out",
+      "when": "the principal submits",
+      "then": "an assertive error toast appears, data-form-state=unsaved renders and no data-form-state=saved is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25102-3",
+      "description": "Every identifier input carries an appropriate WCAG 1.3.5 autocomplete token (email as email, given-name as given-name, family-name as family-name); a break that removes any of these fails the pack.",
+      "given": "the profile form rendered",
+      "when": "the DOM is inspected",
+      "then": "every identifier input has an autocomplete attribute per WCAG 1.3.5",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#identify-input-purpose",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [
@@ -23,5 +48,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25103.json

@@ -13,7 +13,18 @@
       "id": "AC-25103-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When credentialSelfService is in the applied capability set, GET /account/security renders <div data-surface=\"security\" data-branch=\"self-service\"> containing a [data-role=\"change-password\"] form and a [data-role=\"mfa-management\"] region. Absent from render when credentialSelfService is not applied. Probed by pack check AC-25105-1 (unified security check)."
+      "description": "When credentialSelfService is in the applied capability set, GET /account/security renders <div data-surface=\"security\" data-branch=\"self-service\"> containing a [data-role=\"change-password\"] form and a [data-role=\"mfa-management\"] region. Absent from render when credentialSelfService is not applied. Probed by pack check AC-25105-1 (unified security check).",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25103-2",
+      "description": "The self-service credential-change surface never accepts a new password without a fresh reauthentication when the elicited reauth-window says so (REQ-007); a submit without a passing reauth refuses with REAUTH_REQUIRED.",
+      "given": "credentialSelfService applied with reauth-window > 0 and the current session past the elapsed threshold",
+      "when": "the principal submits a new password",
+      "then": "the submit refuses with REAUTH_REQUIRED and no credential change occurs",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -23,5 +34,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25104.json

@@ -13,7 +13,28 @@
       "id": "AC-25104-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When hostedIdentityUi is in the applied capability set AND the operator elicited security-surface-shape=hosted-link-out, GET /account/security renders <a data-role=\"hosted-link-out\" href=\"{hosted-identity-url}\" rel=\"noopener\"> with an accessible label carrying the destination provider name; when security-surface-shape=hosted-embed, renders <iframe data-role=\"hosted-embed\" title=\"Account security\" src=\"{hosted-identity-url}\" sandbox=\"allow-scripts allow-forms allow-same-origin\">. Probed by pack check AC-25105-1."
+      "description": "When hostedIdentityUi is in the applied capability set AND the operator elicited security-surface-shape=hosted-link-out, GET /account/security renders <a data-role=\"hosted-link-out\" href=\"{hosted-identity-url}\" rel=\"noopener\"> with an accessible label carrying the destination provider name; when security-surface-shape=hosted-embed, renders <iframe data-role=\"hosted-embed\" title=\"Account security\" src=\"{hosted-identity-url}\" sandbox=\"allow-scripts allow-forms allow-same-origin\">. Probed by pack check AC-25105-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25104-2",
+      "description": "When security-surface-shape is hosted-link-out, the surface renders an <a> element carrying data-role=hosted-link-out and href={hosted-identity-url}; a missing hosted-identity-url elicit answer refuses at apply with HOSTED_URL_MISSING. Applying agent sets: hosted-identity-url.",
+      "given": "hostedIdentityUi applied with security-surface-shape=hosted-link-out and hosted-identity-url set",
+      "when": "the security route renders",
+      "then": "the DOM carries an <a data-role=\"hosted-link-out\" href={hosted-identity-url}> element; missing URL refuses at apply",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-25104-3",
+      "description": "When security-surface-shape is hosted-embed, the surface renders an <iframe data-role=\"hosted-embed\" title=\"Account security\" src={hosted-identity-url}> element; the iframe carries a defined title for screen readers. Applying agent sets: hosted-identity-url.",
+      "given": "hostedIdentityUi applied with security-surface-shape=hosted-embed",
+      "when": "the security route renders",
+      "then": "the DOM carries the described iframe with a non-empty title",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -23,5 +44,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25105.json

@@ -13,13 +13,61 @@
       "id": "AC-25105-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When sessionInventory is in the applied capability set, GET /account/sessions renders <div data-surface=\"sessions\"> containing a table whose rows are enumerated by data-session-id, each row carrying [data-column=\"device\"], [data-column=\"lastActive\"] and a [data-action=\"terminate\"] control. Absent when sessionInventory is not applied. Probed by pack check AC-25106-1."
+      "description": "When sessionInventory is in the applied capability set, GET /account/sessions renders <div data-surface=\"sessions\"> containing a table whose rows are enumerated by data-session-id, each row carrying [data-column=\"device\"], [data-column=\"lastActive\"] and a [data-action=\"terminate\"] control. Absent when sessionInventory is not applied. Probed by pack check AC-25106-1.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-25105-2",
       "testable": true,
       "scope": "runtime",
-      "description": "Clicking [data-action=\"terminate\"] opens <div role=\"dialog\" aria-modal=\"true\" data-role=\"terminate-confirm\" aria-labelledby=\"terminate-confirm-heading\"> with the row focus-trapped inside the dialog; on confirm the row is removed and <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> is announced; focus returns to the neighbouring row on close."
+      "description": "Clicking [data-action=\"terminate\"] opens <div role=\"dialog\" aria-modal=\"true\" data-role=\"terminate-confirm\" aria-labelledby=\"terminate-confirm-heading\"> with the row focus-trapped inside the dialog; on confirm the row is removed and <div role=\"status\" aria-live=\"polite\" data-role=\"session-terminated-announce\">Session ended</div> is announced; focus returns to the neighbouring row on close.",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/dialog-modal/",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-25105-3",
+      "description": "When the read of the session inventory fails (a non-2xx from the applied provider or a timeout), the sessions surface renders an error state naming the failure and no row is rendered as if terminated; a retry control is keyboard-reachable.",
+      "given": "the applied provider returns a non-2xx or times out on sessionInventory.list()",
+      "when": "the /account/sessions route renders",
+      "then": "the surface shows an inventory-read-failed banner, no data-session-id rows appear as terminated, and a retry control is keyboard-reachable",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-25105-4",
+      "description": "When the terminate-write fails on a session (a non-2xx from revoke() or a timeout), the row remains in the DOM with data-terminate-outcome=failed, the polite live region announces the failure, and no data-role=session-terminated-announce fires.",
+      "given": "a principal invokes terminate on a session row and the provider rejects revoke()",
+      "when": "the terminate write resolves",
+      "then": "the row remains with data-terminate-outcome=failed, the polite live region announces the failure and no session-terminated-announce is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-25105-5",
+      "description": "The current session row carries data-current-session=true and its terminate control refuses (data-action=terminate is absent or renders disabled with an aria-describedby explanation) so a principal cannot accidentally terminate their own session from within the surface.",
+      "given": "the sessions inventory carries a row with currentSession=true",
+      "when": "the surface renders",
+      "then": "the current row carries data-current-session=true and its terminate control is disabled with an aria-describedby explanation",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
     }
   ],
   "tacIds": [
@@ -29,5 +77,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25106.json

@@ -4,16 +4,35 @@
   "reqId": "application-account-settings-REQ-004",
   "version": "1.0.0",
   "status": "approved",
-  "title": "Sessions surface hoists session inventory from an applied logging companion",
-  "asA": "authenticated principal on a project where the logger is the session store",
-  "iWant": "the sessions surface to read the applied logging companion inventory when sessionInventory arrives from observability-logging rather than from an auth blueprint",
-  "soThat": "the composition is the same regardless of which applied blueprint declared sessionInventory",
+  "title": "Sessions surface reads session inventory from the applied auth provider only",
+  "asA": "shelf consumer applying application-account-settings with an auth blueprint that declares sessionInventory",
+  "iWant": "the sessions surface to read the applied auth providers inventory verbatim, without restating the shape locally",
+  "soThat": "the shape of a session row is owned by the auth blueprint and never drifts on the account-settings side",
   "acceptanceCriteria": [
     {
       "id": "AC-25106-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The sessions surface reads sessionInventory from the union of applied capabilities across auth AND logging providers; the render contract of AC-25105-1 is identical whether the capability was supplied by an auth blueprint (security-auth-clerk 1.3.0, security-auth-keycloak 1.2.0, security-auth-oauth2 1.2.0) or by observability-logging 1.2.0."
+      "description": "The sessions surface reads sessionInventory from the applied auth provider (security-auth-clerk 1.3.0+, security-auth-keycloak 1.2.0+, security-auth-oauth2 1.2.0+); the render contract of AC-25105-1 is identical regardless of which auth blueprint supplied the capability. observability-logging 1.3.0 no longer provides sessionInventory and is not consulted on this surface.",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
+    },
+    {
+      "id": "AC-25106-2",
+      "description": "When two auth blueprints applied both declare sessionInventory, the sessions surface reads exactly one of them (the first in the applied source order) and never merges rows across providers; a divergent shape between providers refuses the render with SESSION_PROVIDER_CONFLICT.",
+      "given": "two applied auth blueprints both declaring sessionInventory",
+      "when": "the sessions route renders",
+      "then": "the surface reads the first providers inventory only, no cross-provider merge occurs and a divergent-shape observation refuses with SESSION_PROVIDER_CONFLICT",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
+        "field": "interfaces.sessionInventory"
+      }
     }
   ],
   "tacIds": [
@@ -23,5 +42,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25107.json

@@ -13,7 +13,18 @@
       "id": "AC-25107-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When application-notifications-in-app is in the applied-blueprint set, GET /account/notifications renders <div data-surface=\"notifications\"> with [data-role=\"category-silence\"] entries per category and [data-role=\"channel-opt-in\"] entries per channel; save-success and save-failure announcements follow the profile surface contract. Absent when notifications-in-app is not applied. Probed by pack check AC-25107-1."
+      "description": "When application-notifications-in-app is in the applied-blueprint set, GET /account/notifications renders <div data-surface=\"notifications\"> with [data-role=\"category-silence\"] entries per category and [data-role=\"channel-opt-in\"] entries per channel; save-success and save-failure announcements follow the profile surface contract. Absent when notifications-in-app is not applied. Probed by pack check AC-25107-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25107-2",
+      "description": "When application-notifications-in-app is not applied, the preferences tab is suppressed (not linked in the settings navigation and returning 404 on direct URL); no preferences form is written to the DOM.",
+      "given": "application-notifications-in-app not applied",
+      "when": "the settings shell renders",
+      "then": "no preferences link appears in navigation, /account/preferences is unreachable and no preferences form is in the DOM",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -23,5 +34,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25108.json

@@ -13,7 +13,32 @@
       "id": "AC-25108-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When application-spa is in the applied-blueprint set, GET /account/theme renders <div data-surface=\"theme\" role=\"radiogroup\" aria-label=\"Theme\"> containing three <input type=\"radio\" name=\"theme\" value=\"light|dark|system\"> options; selecting an option flips the data-theme attribute on the html element and persists per the theme-persistence elicit (spa-local-storage default, server-scoped, or none). Probed by pack check AC-25108-1."
+      "description": "When application-spa is in the applied-blueprint set, GET /account/theme renders <div data-surface=\"theme\" role=\"radiogroup\" aria-label=\"Theme\"> containing three <input type=\"radio\" name=\"theme\" value=\"light|dark|system\"> options; selecting an option flips the data-theme attribute on the html element and persists per the theme-persistence elicit (spa-local-storage default, server-scoped, or none). Probed by pack check AC-25108-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25108-2",
+      "description": "The theme surface renders a radiogroup with exactly three options (light, dark, system) using role=\"radiogroup\" and role=\"radio\", each with an accessible name; a break that omits a radio fails the pack.",
+      "given": "application-spa applied and the theme route renders",
+      "when": "the DOM is inspected",
+      "then": "the theme control is a radiogroup with three radios named light, dark and system",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/radio/",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-25108-3",
+      "description": "When theme-persistence is spa-local-storage, the theme choice persists across principal loads via localStorage; when server-scoped, the choice persists via the applied server endpoint; when none, the choice resets to system on load. Applying agent sets: theme-persistence.",
+      "given": "each theme-persistence value applied in turn",
+      "when": "the principal picks a theme and reloads",
+      "then": "spa-local-storage persists via localStorage, server-scoped persists via the server endpoint, none resets to system",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -23,5 +48,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25109.json

@@ -13,13 +13,15 @@
       "id": "AC-25109-1",
       "testable": true,
       "scope": "runtime",
-      "description": "rcf define blueprint add ./blueprints/application-account-settings on a project with no applied blueprint declaring principalDirectory exits 3 and prints the [application-account-settings-bare-spa] refusal message quoting the required capability, the applied-blueprint list and the two suggested next steps."
+      "description": "rcf define blueprint add ./blueprints/application-account-settings on a project with no applied blueprint declaring principalDirectory exits 3 and prints the [application-account-settings-bare-spa] refusal message quoting the required capability, the applied-blueprint list and the two suggested next steps.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-25109-2",
       "testable": true,
       "scope": "runtime",
-      "description": "Passing --allow-no-auth-yet applies the blueprint and writes rcf/blueprints/application-account-settings.applied.json with allowNoAuthYet:true, empty appliedCapabilities and a scaffolding-pass note; rcf define validate flags the sidecar note on read-back."
+      "description": "Passing --allow-no-auth-yet applies the blueprint and writes rcf/blueprints/application-account-settings.applied.json with allowNoAuthYet:true, empty appliedCapabilities and a scaffolding-pass note; rcf define validate flags the sidecar note on read-back.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25110.json

@@ -13,7 +13,18 @@
       "id": "AC-25110-1",
       "testable": true,
       "scope": "runtime",
-      "description": "When no applied blueprint declares credentialSelfService OR hostedIdentityUi and the operator answers --answer security-surface-shape=self-service (or =hosted-link-out or =hosted-embed), apply exits 3 with the two-remedy message: (a) apply an auth blueprint that declares one of the two security capabilities, or (b) drop the security tab from scope by not answering security-surface-shape."
+      "description": "When no applied blueprint declares credentialSelfService OR hostedIdentityUi and the operator answers --answer security-surface-shape=self-service (or =hosted-link-out or =hosted-embed), apply exits 3 with the two-remedy message: (a) apply an auth blueprint that declares one of the two security capabilities, or (b) drop the security tab from scope by not answering security-surface-shape.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25110-2",
+      "description": "The refusal names both remedies: applying an auth blueprint that declares credentialSelfService or hostedIdentityUi, and re-answering security-surface-shape or leaving the elicit unanswered. The refusal message is stable and matches the packaged fixture.",
+      "given": "a project answering security-surface-shape without a supplying capability",
+      "when": "apply runs",
+      "then": "apply refuses naming both remedies and the refusal message matches the packaged fixture verbatim",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -23,5 +34,5 @@
     "blueprint:application-account-settings"
   ],
   "createdAt": "2026-09-06T20:55:46Z",
-  "updatedAt": "2026-09-06T20:55:46Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25111.json

@@ -0,0 +1,71 @@
+{
+  "usId": "application-account-settings-US-25111",
+  "prdId": "PRD-001",
+  "reqId": "application-account-settings-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Every reauth-window option gates the high-value change with a defined behaviour",
+  "asA": "principal on a project applying application-account-settings with reauth-window chosen",
+  "iWant": "the surface to prompt for reauthentication when the elicited window says so and to refuse the high-value change otherwise",
+  "soThat": "a compromised session cannot silently walk through a credential change or a session termination outside the policy the operator elicited",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-25111-1",
+      "description": "When reauth-window is `never`, a high-value action (credential change, MFA enrolment, session termination) proceeds after the standard confirmation dialog without an additional reauth prompt.",
+      "given": "reauth-window=never applied",
+      "when": "the principal confirms a high-value action",
+      "then": "the action proceeds after the standard confirmation dialog with no reauth prompt rendered",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25111-2",
+      "description": "When reauth-window is `5` and more than 5 minutes have elapsed since the current session's last-active timestamp from the applied auth providers session inventory, the high-value action refuses with REAUTH_REQUIRED and a reauth prompt renders; the action does not proceed until the reauth prompt returns success.",
+      "given": "reauth-window=5 applied and a session with lastActive older than 5 minutes",
+      "when": "the principal confirms a high-value action",
+      "then": "the action refuses with REAUTH_REQUIRED, a reauth prompt renders and the action proceeds only after the reauth prompt returns success",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+    },
+    {
+      "id": "AC-25111-3",
+      "description": "When reauth-window is `15`, the same behaviour applies with a 15-minute elapsed threshold; when reauth-window is `60`, the threshold is 60 minutes.",
+      "given": "reauth-window=15 or reauth-window=60 applied",
+      "when": "the principal confirms a high-value action after the elapsed threshold",
+      "then": "the action refuses with REAUTH_REQUIRED and a reauth prompt renders; below the threshold no reauth prompt renders",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+    },
+    {
+      "id": "AC-25111-4",
+      "description": "The reauth prompt never accepts the current session credentials as sufficient without a fresh challenge (a fresh password entry, a fresh MFA challenge or a fresh magic-link click); a reauth attempt that reuses only the current session token refuses with REAUTH_STALE.",
+      "given": "any reauth-window not `never` and an elapsed session",
+      "when": "the principal submits the current session token as the reauth",
+      "then": "the reauth refuses with REAUTH_STALE and a fresh challenge is presented",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-25111-5",
+      "description": "The elapsed-minutes comparison uses the current session's lastActive from the applied auth providers session inventory, never a client-side clock; when the inventory read fails the surface refuses the high-value action with REAUTH_WINDOW_UNKNOWN and offers a retry.",
+      "given": "any reauth-window not `never` and the session inventory read fails",
+      "when": "the principal confirms a high-value action",
+      "then": "the action refuses with REAUTH_WINDOW_UNKNOWN, a retry control renders keyboard-reachable and no client clock is used",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+    }
+  ],
+  "tacIds": [
+    "TAC-2604-application-account-settings-session-store"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}