rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-spa/contributions/tacs/tac-201-application-spa-app-shell.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-201-application-spa-app-shell",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "status": "approved",
   "name": "Application shell and navigation",
   "purpose": "Owns the persistent frame around every route: top navigation, optional side navigation, skip-link, landmark structure, and the outlet the router renders into.",
@@ -11,7 +11,8 @@
     "Expose ARIA landmarks (banner, navigation, main, contentinfo) and the skip-link as the first focusable element.",
     "Own keyboard behaviour for shell-level interaction: Tab traversal, arrow-key movement within menus, Escape closing overlays.",
     "Host the global surfaces that outlive routes: network-state banner (application-spa-REQ-014), toast region, and theme toggle.",
-    "Apply safe-area insets so shell chrome clears hardware cutouts (application-spa-REQ-003)."
+    "Apply safe-area insets so shell chrome clears hardware cutouts (application-spa-REQ-003).",
+    "Own the return-to state on the client-side router: on an unauthenticated visit to a protected route the originally requested path is captured, preserved across the sign-in flow (including a sign-out and re-authentication), and used as the post-sign-in landing (application-spa-REQ-009 deep-link and return-to behaviour)."
   ],
   "internalStructure": "A shell layout component wrapping the router outlet; navigation data is declarative (the route inventory from application-spa-REQ-001), not hand-wired per link.",
   "interfaces": [
@@ -41,5 +42,5 @@
   ],
   "tradeoffs": "A single persistent shell trades a little initial bundle weight for consistent navigation, one focus-management seam, and one place to verify landmarks.",
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-202-application-spa-theme-system.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-202-application-spa-theme-system",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Theme system and design tokens",
   "purpose": "Realises the semantic token layer (colour, spacing, radius, typography, elevation, motion) in both themes and owns theme selection, persistence-data-sqlite, and application.",

package/blueprints/application-spa/contributions/tacs/tac-203-application-spa-component-library.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-203-application-spa-component-library",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Component library",
   "purpose": "The single source of interactive and presentational primitives listed in application-spa-REQ-006; application screens compose these, they do not restyle them.",

package/blueprints/application-spa/contributions/tacs/tac-204-application-spa-client-data-layer.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-204-application-spa-client-data-layer",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Client data layer",
   "purpose": "Owns server-state caching, request lifecycle, invalidation, optimistic updates, and offline queueing; the seam between the UI and the wire.",

package/blueprints/application-spa/contributions/tacs/tac-205-application-spa-forms-engine.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-205-application-spa-forms-engine",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Forms and validation engine",
   "purpose": "Shared machinery for field state, validation timing, error binding, and submit orchestration per application-spa-REQ-007.",

package/blueprints/application-spa/contributions/tacs/tac-206-application-spa-telemetry.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-206-application-spa-telemetry",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Telemetry and error reporting",
   "purpose": "Emits journey checkpoint events, error-boundary reports, and performance marks per application-spa-REQ-016 under the naming scheme in ADR-209-application-spa-telemetry-naming.",

package/blueprints/application-spa/contributions/tacs/tac-207-application-spa-token-adherence-probe.json

@@ -2,10 +2,10 @@
   "tacId": "TAC-207-application-spa-token-adherence-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Token adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). Watchpost run4 demonstrated that declaring the discipline does not compel the shipped surface: build cycles ran green while raw hex values sat in component stylesheets. This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit when the discipline is violated, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit on any raw palette literal outside the token-realisation file or any missing light/dark counterpart, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1129-1, AC-1129-4).",
     "Read the design tokens source at a configured path (default `assets/tokens/design-tokens.json` per ADR-202) and enumerate the semantic token key sets for both themes (AC-1129-2).",

package/blueprints/application-spa/contributions/tacs/tac-208-application-spa-icon-adherence-probe.json

@@ -2,10 +2,10 @@
   "tacId": "TAC-208-application-spa-icon-adherence-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Icon adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). Watchpost run4 shipped zero icons across eight surfaces while the build cycle ran green; declaring the discipline is not the same as compelling it. This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit when a component sidesteps the alias registry, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit on any inline SVG outside the registry or any icon reference naming an alias the registry does not declare, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1130-1, AC-1130-4).",
     "Read the icon alias registry at a configured path (default `assets/icons/aliases.json` or the project-declared equivalent per ADR-206) and enumerate the declared alias names (AC-1130-2).",
@@ -50,7 +50,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "Scanning source for inline SVG accepts that a project may sometimes ship a genuinely single-use bespoke glyph; the discipline says such a glyph joins the registry rather than living inline, and the probe surfaces the choice at the ship gate rather than at design review. The alias-reference scanner needs a project-declared reference-shape pattern (JSX prop, function call, or template literal); the probe ships a small pattern library and the project selects the shape it uses. The cost is one line of configuration; the buy is a runtime-observable enforcement that closes the mechanism-reach gap watchpost run4 caught.",
+  "tradeoffs": "Scanning source for inline SVG accepts that a project may sometimes ship a genuinely single-use bespoke glyph; the discipline says such a glyph joins the registry rather than living inline, and the probe surfaces the choice at the ship gate rather than at the design gate. The alias-reference scanner needs a project-declared reference-shape pattern (JSX prop, function call, or template literal); the probe ships a small pattern library and the project selects the shape it uses. The cost is one line of configuration; the buy is a runtime-observable enforcement that closes the mechanism-reach gap this probe cures.",
   "createdAt": "2026-08-24T00:00:00Z",
   "updatedAt": "2026-08-24T00:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-209-application-spa-csp-styled-adherence-probe.json

@@ -2,17 +2,17 @@
   "tacId": "TAC-209-application-spa-csp-styled-adherence-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "status": "approved",
   "name": "Styled-under-shipped-CSP adherence probe",
-  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). Watchpost run4 demonstrated the mechanism-reach gap this probe cures: FBS-011 declared a strict CSP (style-src 'self', no unsafe-inline), FBS-013/015 rendered inline <style> blocks, every existing UI-bearing gate passed (28 styled screenshots, browser-verify green), and yet every production page rendered unstyled at deploy because the harness bypassed the production security-header path. This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1131-5, AC-1131-6).",
     "Accept configuration naming (i) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration), (ii) the enumerated set of UI-bearing routes to probe, and (iii) the stylesheet URL every rendered document is expected to link (AC-1131-3, AC-1131-4).",
     "For every enumerated route: navigate a real headless browser to the served URL, capture the response `content-security-policy` header, capture the response body, read the browser's final URL after any redirect chain resolves, run getComputedStyle on document.body, and record the results (AC-1131-1, AC-1131-2, AC-1131-3).",
     "Refuse the run when any captured CSP declares 'unsafe-inline' or 'unsafe-eval' on style-src, when style-src is absent, or when style-src is served as a wildcard (AC-1131-1).",
     "Refuse the run when any captured response body contains a `<style` substring (case-insensitive), including <style> injected by templating helpers (AC-1131-2).",
-    "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, watchpost run4 partial-acceptance gap w-2026-08-24-003).",
+    "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, `pathMismatch`).",
     "Refuse the run when the computed body backgroundColor for any route is the browser default (`rgba(0, 0, 0, 0)` / `transparent`) or when the computed body fontFamily resolves to an empty value; both indicate the shipped stylesheet did NOT reach the runtime surface under the production headers (AC-1131-3).",
     "Issue a same-origin GET against the linked stylesheet URL through the same server instance and refuse when the response is not 200 with content-type `text/css` (AC-1131-4).",
     "Write a JSON report at a stable relative path (`reports/csp-styled-adherence.json` under the configured report directory, matching the delivery-ci-workflows per-gate report shape of TAC-702) naming: every route probed, the CSP header captured, whether an inline <style> was detected, the computed background and fontFamily values, the stylesheet GET verdict, and an ok / fail verdict (AC-1131-5).",
@@ -55,7 +55,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a real browser and a running server for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the mechanism-reach gap at watchpost run4 proved was missing: build cycles ran green and shipped an unstyled surface because no gate exercised the production header path with a real browser. Driving the shipped construction (not a bespoke harness) is the load-bearing choice; refusing app.inject() satisfaction is deliberate. The requirement that verification runs THROUGH the shipped headers is what makes the AC bite; a probe that stamps its own headers would recreate the class defect it exists to refuse. The v1.0.1 landed-path refusal cures a second gap the same class defect exposed: Playwright's `page.goto` follows redirects by default and returns the FINAL response, so a session-broken authenticated route silently 302'ing to a styled /login left every downstream styled-body assertion validating the login page instead of the requested surface (watchpost partial-acceptance w-2026-08-24-003 / AC-1601-14). Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes the gap without coupling the probe to session-lane internals.",
+  "tradeoffs": "The probe requires a real browser and a running server for every delivery-ci-workflows invocation. That cost buys runtime-observable enforcement of the production header path: driving the shipped construction (not a bespoke harness) is the load-bearing choice, and refusing app.inject() satisfaction is deliberate because a probe that stamps its own headers cannot refuse a CSP defect. The landed-path refusal is necessary because Playwright's `page.goto` follows redirects by default and returns the FINAL response, so without a final-path check a session-broken authenticated route that silently 302's to a styled /login would leave every downstream styled-body assertion validating the login page instead of the requested surface. Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes that gap without coupling the probe to session-lane internals.",
   "createdAt": "2026-08-24T10:30:00Z",
   "updatedAt": "2026-08-31T11:15:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-210-application-spa-external-dependency-provisioning-probe.json

@@ -2,10 +2,10 @@
   "tacId": "TAC-210-application-spa-external-dependency-provisioning-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "External-service-dependency provisioning adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the deployment-gate class defect the watchpost first-production review caught (w-2026-08-24-005, w-2026-08-24-006): the only login path (magic-link email) shipped inert because RESEND_API_KEY was a placeholder, the gap was filed as a 'quirk' in status.md rather than blocked at sign-off, and a real key existed in the estate all along. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md quirk line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for external-service-dependency provisioning discipline. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1132-5, AC-1132-6).",
     "Accept configuration naming (i) the path of the application's external-service-dependency manifest, (ii) how to boot the target server for handshake evidence (a Node module or command that starts the same server instance the production entry point starts, with the same route registration and middleware stack), (iii) the path of the ratified-deferrals store the deferral records live in, and (iv) the report directory (AC-1132-1, AC-1132-3, AC-1132-4).",
@@ -64,7 +64,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a running server booted through the production construction and network reach to real external providers for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: the build cycle ran green, sign-off said DEPLOYED, and the only login path was inert on a placeholder credential. Requiring a manifest is a deliberate load-bearing choice: without the manifest, the enumeration set of runtime-reached externals is invisible to the gate. Requiring the ratified-deferrals store to be a persistent machine-readable artefact (not a README note) is the choice that refuses the 'quirk-in-status.md' pattern the class defect exposed. Extending the detector's ruleset in rcf-lite (rather than per-project) is deliberate: one authoritative catalogue of placeholder shapes serves every downstream project.",
+  "tradeoffs": "The probe requires a running server booted through the production construction and network reach to real external providers for every delivery-ci-workflows invocation. Requiring a manifest is a deliberate load-bearing choice: without the manifest, the enumeration set of runtime-reached externals is invisible to the gate. Requiring the ratified-deferrals store to be a persistent machine-readable artefact (not a README note) makes deferrals durable and machine-checkable rather than prose the gate cannot inspect. Extending the detector's ruleset in rcf-lite (rather than per-project) is deliberate: one authoritative catalogue of placeholder shapes serves every downstream project.",
   "createdAt": "2026-08-24T13:00:00Z",
   "updatedAt": "2026-08-24T13:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-211-application-spa-core-flow-e2e-probe.json

@@ -2,10 +2,10 @@
   "tacId": "TAC-211-application-spa-core-flow-e2e-probe",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Core-flow end-to-end adherence probe",
-  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. Watchpost first production (w-2026-08-24-005) demonstrated the deployment-gate class defect this probe cures: the app was signed off as DEPLOYED, admin access was reachable only via ssh-minted tokens because magic-link email never worked in production, and the authentication core flow was never proven end-to-end in the shipped runtime. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1133-5, AC-1133-6).",
     "Accept configuration naming (i) the path of the application's core-flow manifest, (ii) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration, the same production security-header stack, and the same middleware), (iii) how to reach real external-service providers (the deferrals-permission is the same shape as TAC-210 accepts for its 'deferred' entries), and (iv) the report directory (AC-1133-1, AC-1133-2, AC-1133-4).",
@@ -64,7 +64,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a real browser, the shipped server construction, and network reach to real external providers for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: sign-off said DEPLOYED, admin login was only reachable via a manually minted token, and no gate demanded the auth flow work end-to-end in the shipped runtime. Requiring an auth-flow-enumeration hard invariant is deliberate: authentication is the flow the class-defect instance exposed, and its enumeration cannot be optional when application-spa-REQ-009 surfaces are present. Refusing to accept a 'documented workaround' as sign-off is the choice that refuses the 'quirk-in-status.md' pattern; the aggregate 'deployed-with-defects' vocabulary is what the probe emits to name the distinction between 'shipped and accepted' and 'shipped with a broken core flow'.",
+  "tradeoffs": "The probe requires a real browser, the shipped server construction, and network reach to real external providers for every delivery-ci-workflows invocation. Requiring an auth-flow-enumeration hard invariant is deliberate: authentication cannot be optional when application-spa-REQ-009 surfaces are present, because a manifest that omits it would silently permit a shipped surface with no proven login path. Refusing to accept a 'documented workaround' as passing is what forces broken or skipped flows into the aggregate; the 'ok' | 'deployed-with-defects' vocabulary is what the probe emits to name the distinction between 'every core flow proved' and 'shipped with a broken or unproven core flow'.",
   "createdAt": "2026-08-24T13:00:00Z",
   "updatedAt": "2026-08-24T13:00:00Z"
 }

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1101.json

@@ -2,7 +2,7 @@
   "usId": "application-spa-US-1101",
   "prdId": "PRD-001",
   "reqId": "application-spa-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Declared routes, canonical URLs, breadcrumbs, and not-found surfaces",
   "asA": "user sharing and revisiting links",
@@ -11,12 +11,17 @@
   "acceptanceCriteria": [
     {
       "id": "AC-1101-1",
-      "description": "The project maintains a declared route inventory naming every route; no navigable surface exists outside it.",
+      "description": "The project maintains a declared route inventory naming every route; no navigable surface exists outside it. Applying agent sets: the source location of the declared route inventory (a manifest, module export, or route table) and the enumeration of every reachable navigation target the inventory compares against.",
       "given": "the application source tree",
       "when": "the route inventory is compared against reachable navigation targets",
       "then": "every reachable target appears in the inventory and every inventory entry is reachable",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-201-application-spa-app-shell",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "template"
     },
     {
       "id": "AC-1101-2",
@@ -25,7 +30,8 @@
       "when": "a non-canonical variant of that URL is visited",
       "then": "the application redirects or rewrites to the canonical shape",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1101-3",
@@ -34,7 +40,8 @@
       "when": "the route renders",
       "then": "a breadcrumb trail shows the ancestry and each crumb navigates to its level",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1101-4",
@@ -43,7 +50,12 @@
       "when": "a path outside the route inventory is visited",
       "then": "the 404 surface renders with shell navigation present, not a blank page or silent redirect",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-201-application-spa-app-shell",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-1101-5",
@@ -52,7 +64,8 @@
       "when": "its canonical URL is visited",
       "then": "the 410 surface renders naming the resource as removed",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1101-6",
@@ -61,7 +74,8 @@
       "when": "the URL is opened in a fresh browser session",
       "then": "the route renders its arrival state without client-side navigation first",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1102.json

@@ -2,7 +2,7 @@
   "usId": "application-spa-US-1102",
   "prdId": "PRD-001",
   "reqId": "application-spa-REQ-002",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Navigation shell with visible structure and active states",
   "asA": "user moving between areas of the application",
@@ -11,12 +11,17 @@
   "acceptanceCriteria": [
     {
       "id": "AC-1102-1",
-      "description": "Top navigation renders on every route from the route inventory; sections the signed-in user cannot access are absent, not disabled.",
+      "description": "Top navigation renders on every route from the route inventory; sections the signed-in user cannot access are absent, not disabled. Applying agent sets: the top-navigation section inventory (per applied route inventory).",
       "given": "any declared route",
       "when": "the route renders",
       "then": "the top navigation is present and reflects the route inventory for the current user",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-201-application-spa-app-shell",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "template"
     },
     {
       "id": "AC-1102-2",
@@ -25,16 +30,18 @@
       "when": "the route renders",
       "then": "that section's item is visually active and exposes aria-current",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1102-3",
-      "description": "Side navigation, where the project declares secondary structure, collapses below 1024 into an accessible disclosure pattern rather than disappearing.",
+      "description": "Side navigation, where the project declares secondary structure, collapses below 1024 into an accessible disclosure pattern rather than disappearing. Applying agent sets: whether the project ships secondary navigation, the toggle control that reveals it below the collapse breakpoint (default 1024), the accessible name and expanded/collapsed state text on the toggle.",
       "given": "a project with declared secondary navigation",
       "when": "the viewport is below 1024",
       "then": "secondary navigation is reachable via a toggle with an accessible name and state",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-1102-4",
@@ -43,7 +50,8 @@
       "when": "their rendered shells are compared",
       "then": "navigation structure and behaviour are identical except for active states",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1102-5",
@@ -52,12 +60,13 @@
       "when": "it is inspected or middle-clicked",
       "then": "it exposes an href and opens correctly in a new tab",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-201-application-spa-app-shell"
   ],
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1103.json

@@ -2,7 +2,7 @@
   "usId": "application-spa-US-1103",
   "prdId": "PRD-001",
   "reqId": "application-spa-REQ-002",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Keyboard navigation, skip-link, and landmark roles",
   "asA": "keyboard-only user",
@@ -16,7 +16,8 @@
       "when": "Tab is pressed once from page load",
       "then": "the skip-link receives visible focus and activating it moves focus into main",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-2",
@@ -25,7 +26,8 @@
       "when": "the page is traversed with Tab and Shift-Tab",
       "then": "focus order matches visual order with no unreachable interactive element",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-3",
@@ -34,7 +36,8 @@
       "when": "arrow keys and Tab are pressed",
       "then": "arrows move within the menu and Tab moves focus out of it",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-4",
@@ -43,7 +46,8 @@
       "when": "Escape is pressed",
       "then": "the overlay closes and focus returns to its trigger",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-5",
@@ -52,7 +56,8 @@
       "when": "the accessibility tree is inspected",
       "then": "the four landmarks are present and main is unique",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1103-6",
@@ -61,7 +66,8 @@
       "when": "standard focus-movement keys are used",
       "then": "focus always has an exit path",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1104.json

@@ -2,7 +2,7 @@
   "usId": "application-spa-US-1104",
   "prdId": "PRD-001",
   "reqId": "application-spa-REQ-003",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Grid, spacing scale, container widths, and safe areas",
   "asA": "user on any device",
@@ -16,25 +16,28 @@
       "when": "spacing declarations are audited",
       "then": "every margin, padding, and gap value maps to a spacing token",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1104-2",
-      "description": "Container maximum widths match the declared per-breakpoint values in the viewport table (assets/viewports.md).",
+      "description": "Container maximum widths match the declared per-breakpoint values in the viewport table (assets/viewports.md). Applying agent sets: the per-breakpoint container maximum widths declared in the viewport table.",
       "given": "each baseline breakpoint",
       "when": "the main container is measured",
       "then": "its maximum width matches the declared value for that breakpoint",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-1104-3",
-      "description": "Page-level layout uses the declared grid; sections align to it rather than to per-section improvised offsets.",
+      "description": "Page-level layout uses the declared grid; sections align to it rather than to per-section improvised offsets. Applying agent sets: the declared page-level grid the applying project ratifies.",
       "given": "any declared route",
       "when": "section edges are compared against the grid",
       "then": "content aligns to grid columns and gutters",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-1104-4",
@@ -43,21 +46,23 @@
       "when": "shell and route content render",
       "then": "all content and controls clear the unsafe regions",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1104-5",
-      "description": "Vertical rhythm between stacked sections uses the scale's section-spacing tokens consistently across routes.",
+      "description": "Vertical rhythm between stacked sections uses the scale's section-spacing tokens consistently across routes. Applying agent sets: the section-spacing token pair the applying project ratifies for vertical rhythm.",
       "given": "any two routes with stacked sections",
       "when": "inter-section spacing is compared",
       "then": "the same structural relationships use the same spacing tokens",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-202-application-spa-theme-system"
   ],
   "createdAt": "2026-08-19T09:00:00Z",
-  "updatedAt": "2026-08-19T09:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1105.json

@@ -2,7 +2,7 @@
   "usId": "application-spa-US-1105",
   "prdId": "PRD-001",
   "reqId": "application-spa-REQ-004",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Reflow without horizontal overflow at every baseline breakpoint",
   "asA": "user on a small phone, a tablet, or a desktop",
@@ -16,7 +16,8 @@
       "when": "rendered at each baseline breakpoint",
       "then": "document scroll width does not exceed viewport width",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1105-2",
@@ -25,7 +26,8 @@
       "when": "rendered at 360",
       "then": "columns stack or reorganise; content is not proportionally shrunk",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1105-3",
@@ -34,7 +36,8 @@
       "when": "images load at each breakpoint",
       "then": "no layout shift from late image sizing and no container overflow",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1105-4",
@@ -43,7 +46,8 @@
       "when": "rendered below 768",
       "then": "the table is card-formatted or contained in its own scroll region",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1105-5",
@@ -52,7 +56,8 @@
       "when": "the viewport is resized across the baseline range",
       "then": "text wraps or scales without clipping or unintended truncation",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-1105-6",
@@ -61,7 +66,8 @@
       "when": "measured at 360",
       "then": "its target area is at least 24x24 CSS pixels",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "createdAt": "2026-08-19T09:00:00Z",