rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-admin-console/contributions/probes/permission-matrix-grid.mjs

@@ -0,0 +1,67 @@
+// application-admin-console probe: permission matrix ARIA APG grid
+// (AC-21103-1). Row detail opens on the first eight words of the
+// shipped AC it anchors (rule 10).
+//
+// AC-21103-1 requires: given the roles surface AND an applied auth
+// blueprint declaring roleModel, the permission matrix renders as an
+// ARIA APG grid: role="grid" on the outer element, role="row" on
+// every rank (including the header rank), role="columnheader" on
+// every permission column header, role="rowheader" on the leftmost
+// cell of each role rank, role="gridcell" on every inner cell, and
+// each cell carries an aria-label announcing the exact permission
+// string plus the allowed/denied state on focus.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-admin-console-AC-21103-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory,roleModel' } });
+  const results = [];
+  try {
+    const r = await fixtureFetch(fixture.url, '/admin/roles');
+    const gridPresent = /role="grid"/.test(r.body);
+    const columnCount = (r.body.match(/role="columnheader" data-permission="/g) || []).length;
+    const roleRankRows = [...r.body.matchAll(/data-role-rank="([^"]+)"/g)].map((m) => m[1]);
+    const rowCount = roleRankRows.length;
+    const gridcellCount = (r.body.match(/role="gridcell" data-cell-state="/g) || []).length;
+    const rowHeaderCount = (r.body.match(/role="rowheader"/g) || []).length;
+
+    // Every gridcell must carry an aria-label of the form
+    // "<role> (allowed|denied): <permission>". Collect ALL labels
+    // (no slicing) so length equality with gridcellCount protects the
+    // check against a vacuous every() on an empty array.
+    const cellLabels = [...r.body.matchAll(/role="gridcell"[^>]*aria-label="([^"]+)"/g)].map((m) => m[1]);
+    const labelShape = /^[A-Za-z]+ (allowed|denied): [A-Za-z ]+$/;
+    const everyLabelHonoursContract = cellLabels.length > 0
+      && cellLabels.length === gridcellCount
+      && cellLabels.every((l) => labelShape.test(l));
+
+    const derivedPass = r.status === 200 && !!r.requestId
+      && gridPresent
+      && columnCount > 0
+      && rowCount > 0
+      && gridcellCount === rowCount * columnCount
+      && rowHeaderCount >= rowCount
+      && everyLabelHonoursContract;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21103-1: permission-derivation checking against role-permission tables (each cell label corresponding to the actual role permission and state, row-role x column-permission mapping) is not observed by this Node HTTP probe against a fixed fixture; the label-shape walk over gridcell aria-labels is a partial observation of AC-21103-1',
+      verdict: derivedPass ? 'warn' : 'fail',
+      detail: derivedPass
+        ? `Given the roles surface AND an applied auth blueprint declaring roleModel: GET /admin/roles returned 200 with role="grid" present, ${rowCount} role ranks, ${columnCount} permission columnheaders, ${gridcellCount} gridcells (=rows*columns), ${rowHeaderCount} rowheader cells, and all ${cellLabels.length} gridcell aria-labels honour the "<role> allowed/denied: <permission>" contract; x-fixture-request-id=${r.requestId}`
+        : `Given the roles surface AND an applied auth blueprint declaring roleModel gap: status=${r.status} rid=${r.requestId} grid=${gridPresent} rows=${rowCount} cols=${columnCount} cells=${gridcellCount} rowHeaders=${rowHeaderCount} labelCount=${cellLabels.length} labelsHonourContract=${everyLabelHonoursContract}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/role="gridcell"[^>]{0,180}/) || [''])[0]),
+        derived: { rowCount, columnCount, gridcellCount, rowHeaderCount, expectedCells: rowCount * columnCount, labelCount: cellLabels.length, sampledLabels: cellLabels.slice(0, 3) },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-admin-console/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-admin-console contributions/probes/.
+//
+// The real engine for every probe in this pack is the fixture HTTP
+// server at packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/server.js
+// booted on a scratch port from the family range 47600-47609.
+// The fixture echoes a per-request x-fixture-request-id header on
+// every response; probes record that id and a response body excerpt
+// as positive evidence per rule 7d.
+//
+// No account credentials or network calls: every probe is
+// local-fixture-driven, so no probe carries an account-bound branch
+// or a CI_HAS_* gate. Declared env vars are the fixture's own
+// PORT and (where the fixture reads them) the CAPS/state switches
+// the probes drive via query string.
+
+import { spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const SLUG = 'application-admin-console';
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-admin-console');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-admin-console');
+export const PORT_RANGE_START = 47600;
+export const PORT_RANGE_END = 47609;
+export const DECLARED_ENV = Object.freeze(['PORT', 'ADMIN_CONSOLE_CAPS', 'ADMIN_CONSOLE_BREAK', 'ADMIN_CONSOLE_PRINCIPAL_EMAIL', 'PROBE_BREAK']);
+export const REQUEST_ID_HEADER = 'x-fixture-request-id';
+
+// Pick a free port from the fixture family range. Falls back to
+// asking the OS for an ephemeral port only if the whole range is
+// held by other workers (never expected on a single-machine run).
+export async function pickPort() {
+  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port += 1) {
+    if (await canBind(port)) return port;
+  }
+  return await bindEphemeral();
+}
+
+function canBind(port) {
+  return new Promise((res) => {
+    const s = createServer();
+    s.once('error', () => res(false));
+    s.listen(port, '127.0.0.1', () => {
+      const bound = s.address();
+      s.close(() => res(!!bound));
+    });
+  });
+}
+
+function bindEphemeral() {
+  return new Promise((res) => {
+    const s = createServer();
+    s.listen(0, '127.0.0.1', () => {
+      const port = s.address().port;
+      s.close(() => res(port));
+    });
+  });
+}
+
+// Spawns the fixture server as a child on `port` with the given
+// env overlay; resolves once the fixture has printed LISTENING and
+// returns { child, url, kill } (kill is synchronous best-effort).
+export async function startFixture({ port, env = {} } = {}) {
+  const boundPort = port ?? await pickPort();
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: String(boundPort), ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((res, rej) => {
+    const timer = setTimeout(() => rej(new Error(`fixture did not print LISTENING within 4s on port ${boundPort}`)), 4000);
+    let stderrBuf = '';
+    child.stderr.on('data', (chunk) => { stderrBuf += String(chunk); });
+    child.on('exit', (code) => rej(new Error(`fixture exited early (code=${code}) stderr=${stderrBuf.slice(0, 400)}`)));
+    child.stdout.on('data', (chunk) => {
+      if (String(chunk).includes(`LISTENING ${boundPort}`)) { clearTimeout(timer); res(); }
+    });
+  });
+  const url = new URL(`http://127.0.0.1:${boundPort}`);
+  return {
+    child,
+    url,
+    port: boundPort,
+    // Await child exit and propagate any error. A teardown failure
+    // must fail the verdict (the teardown-propagation rule);
+    // no swallowed errors here.
+    kill: () => new Promise((res, rej) => {
+      let settled = false;
+      const done = (err) => { if (settled) return; settled = true; err ? rej(err) : res(); };
+      child.once('exit', () => done());
+      child.once('error', (err) => done(err));
+      try { child.kill('SIGTERM'); } catch (err) { return done(err); }
+      setTimeout(() => {
+        if (settled) return;
+        try { child.kill('SIGKILL'); } catch (err) { return done(err); }
+      }, 4000);
+    }),
+  };
+}
+
+// Issue an HTTP request against the fixture and return
+// { status, headers, body, requestId }.
+export async function fixtureFetch(url, pathAndQuery, init = {}) {
+  const target = new URL(pathAndQuery, url);
+  const res = await fetch(target, init);
+  const body = await res.text();
+  const requestId = res.headers.get(REQUEST_ID_HEADER);
+  return { status: res.status, headers: Object.fromEntries(res.headers.entries()), body, requestId };
+}
+
+export function excerpt(body, maxLen = 240) {
+  if (typeof body !== 'string') return '';
+  return body.length <= maxLen ? body : body.slice(0, maxLen) + '…';
+}
+
+export function aggregate(results) {
+  // Positive-evidence rule: no-checks-ran is a fail.
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  // Any warn row lifts the aggregate to warn, including honest
+  // notObservableHere de-claims. A probe whose rows are all warn
+  // aggregates to warn, not pass; the shelf reads amber and the tally
+  // accepts a warn aggregate as problems=0 when no fail row is present.
+  if (results.some((r) => r && r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: SLUG,
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const filepath = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(filepath, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path: filepath };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path: filepath } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${filepath}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    // Positive-evidence rule (exception fallback): exception rows have no
+    // observed AC; anchor null (never a fabricated id like
+    // "unknown"), carry an evidence object with the error excerpt.
+    const message = err && err.message ? err.message : String(err);
+    const stack = err && err.stack ? err.stack : String(err);
+    const results = [{
+      anchorAcId: null,
+      verdict: 'fail',
+      detail: `probe threw: ${message}`,
+      evidence: {
+        errorMessage: message,
+        errorExcerpt: excerpt(stack, 480),
+      },
+    }];
+    const { report, path: filepath } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${stack}\n`);
+    process.stderr.write(`report written to ${filepath}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/application-admin-console/contributions/probes/run-audit-log-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './audit-log-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('audit-log-surface', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/run-org-switcher-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './org-switcher-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('org-switcher-surface', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/run-permission-matrix-grid.mjs

@@ -0,0 +1,5 @@
+import runProbe from './permission-matrix-grid.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('permission-matrix-grid', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/run-sign-in-access-gated-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './sign-in-access-gated-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('sign-in-access-gated-surface', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/run-users-directory-surface.mjs

@@ -0,0 +1,5 @@
+import runProbe from './users-directory-surface.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-admin-console/server.js', healthy: true };
+runShim('users-directory-surface', engine, runProbe);

package/blueprints/application-admin-console/contributions/probes/sign-in-access-gated-surface.mjs

@@ -0,0 +1,117 @@
+// application-admin-console probe: sign-in surface across the three
+// shipped ACs for the sign-in stories - the Access-gated render with
+// request.auth present (AC-21815-1), the 403 refusal when
+// request.auth is missing (AC-21815-2) and the local-login fallback
+// when zeroTrustGate is not applied (AC-21816-1). Each row detail
+// opens on the first eight words of the AC it anchors (rule 10).
+//
+// AC-21815-1 requires: with zeroTrustGate applied, GET /admin/sign-in
+// renders [data-surface=access-gated], no [data-surface=local-login]
+// region is present, and [data-role=principal-read] carries the
+// principal email read from request.auth.
+//
+// AC-21815-2 requires: with zeroTrustGate applied but request.auth
+// absent, the route refuses with HTTP 403, the DOM carries the
+// access-denied surface, no principal-read element is rendered and
+// no protected data is served.
+//
+// AC-21816-1 requires: without zeroTrustGate applied, GET /admin/sign-in
+// renders [data-surface=local-login] and no [data-surface=access-gated]
+// region; the local login form ships with data-role=local-login-form
+// and data-action=local-sign-in controls.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-admin-console-AC-21815-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const results = [];
+  const principalEmail = 'probe-signin@example.test';
+
+  const gated = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory,zeroTrustGate' } });
+  try {
+    // Row 1: AC-21815-1 with an Authorization header populating request.auth.
+    const withAuth = await fixtureFetch(gated.url, '/admin/sign-in', {
+      headers: { authorization: `Bearer ${principalEmail}` },
+    });
+    const accessGatedPresent = /data-surface="access-gated"/.test(withAuth.body);
+    const localLoginPresent = /data-surface="local-login"/.test(withAuth.body);
+    const principalReadPresent = /data-role="principal-read"/.test(withAuth.body);
+    const principalEmailPresent = withAuth.body.includes(principalEmail);
+    const gatedPass = withAuth.status === 200 && !!withAuth.requestId
+      && accessGatedPresent && !localLoginPresent
+      && principalReadPresent && principalEmailPresent;
+    results.push({
+      anchorAcId: 'application-admin-console-AC-21815-1',
+      verdict: gatedPass ? 'pass' : 'fail',
+      detail: gatedPass
+        ? `When application-admin-console v1.1.0 is applied with zeroTrustGate in appliedCapabilities: GET /admin/sign-in with Authorization: Bearer ${principalEmail} returned 200 rendering [data-surface="access-gated"] with no [data-surface="local-login"] and a [data-role="principal-read"] element carrying the principal email read from request.auth; x-fixture-request-id=${withAuth.requestId}`
+        : `When application-admin-console v1.1.0 is applied with zeroTrustGate in appliedCapabilities (gap): status=${withAuth.status} rid=${withAuth.requestId} gated=${accessGatedPresent} localLogin=${localLoginPresent} principalRead=${principalReadPresent} emailPresent=${principalEmailPresent}`,
+      evidence: {
+        requestId: withAuth.requestId,
+        responseStatus: withAuth.status,
+        bodyExcerpt: excerpt((withAuth.body.match(/data-surface="access-gated"[^]{0,240}/) || [''])[0]),
+        derived: { accessGatedPresent, localLoginPresent, principalReadPresent, principalEmailPresent },
+      },
+    });
+
+    // Row 2: AC-21815-2 refusal-when-request.auth-absent path,
+    // observed at the fixture itself. The fixture now returns HTTP
+    // 403 with a [data-surface="access-denied"] region and no
+    // [data-role="principal-read"] element when zeroTrustGate is
+    // applied and the Authorization header is missing.
+    const noAuth = await fixtureFetch(gated.url, '/admin/sign-in');
+    const deniedPresent = /data-surface="access-denied"/.test(noAuth.body);
+    const noPrincipalRead = !/data-role="principal-read"/.test(noAuth.body);
+    const noGatedSurface = !/data-surface="access-gated"/.test(noAuth.body);
+    const refusalPass = noAuth.status === 403 && !!noAuth.requestId
+      && deniedPresent && noPrincipalRead && noGatedSurface;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21815-2: refusal-log capability field checking against a shipped log adapter (the AC clause requiring the refusal event to be recorded with the required capability fields) is not observed by this Node HTTP probe; the HTTP-403 + access-denied surface walk when zeroTrustGate is applied and Authorization is missing is a partial observation of AC-21815-2',
+      verdict: refusalPass ? 'warn' : 'fail',
+      detail: refusalPass
+        ? `When zeroTrustGate is applied but the incoming request lacks request.auth: GET /admin/sign-in with no Authorization header returned HTTP 403 rendering [data-surface="access-denied"], with no [data-role="principal-read"] element and no [data-surface="access-gated"] region; x-fixture-request-id=${noAuth.requestId}`
+        : `When zeroTrustGate is applied but the incoming request lacks request.auth (gap): status=${noAuth.status} rid=${noAuth.requestId} deniedPresent=${deniedPresent} noPrincipalRead=${noPrincipalRead} noGatedSurface=${noGatedSurface}`,
+      evidence: {
+        requestId: noAuth.requestId,
+        responseStatus: noAuth.status,
+        bodyExcerpt: excerpt((noAuth.body.match(/data-surface="access-denied"[^]{0,240}/) || [''])[0]),
+        derived: { deniedPresent, noPrincipalRead, noGatedSurface },
+      },
+    });
+  } finally {
+    await gated.kill();
+  }
+
+  const local = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory' } });
+  try {
+    // Row 3: AC-21816-1 fallback branch (zeroTrustGate not applied).
+    const r = await fixtureFetch(local.url, '/admin/sign-in');
+    const accessGatedPresent = /data-surface="access-gated"/.test(r.body);
+    const localLoginPresent = /data-surface="local-login"/.test(r.body);
+    const localFormPresent = /data-role="local-login-form"/.test(r.body);
+    const localSignInControl = /data-action="local-sign-in"/.test(r.body);
+    const pass = r.status === 200 && !!r.requestId
+      && !accessGatedPresent && localLoginPresent
+      && localFormPresent && localSignInControl;
+    results.push({
+      anchorAcId: 'application-admin-console-AC-21816-1',
+      verdict: pass ? 'pass' : 'fail',
+      detail: pass
+        ? `When application-admin-console v1.1.0 is applied without zeroTrustGate in appliedCapabilities: GET /admin/sign-in returned 200 rendering [data-surface="local-login"] with no [data-surface="access-gated"] region; the local login form carries data-role="local-login-form" and a data-action="local-sign-in" submit control; x-fixture-request-id=${r.requestId}`
+        : `When application-admin-console v1.1.0 is applied without zeroTrustGate in appliedCapabilities (gap): status=${r.status} rid=${r.requestId} gated=${accessGatedPresent} localLogin=${localLoginPresent} form=${localFormPresent} signInControl=${localSignInControl}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/data-surface="local-login"[^]{0,240}/) || [''])[0]),
+        derived: { accessGatedPresent, localLoginPresent, localFormPresent, localSignInControl },
+      },
+    });
+  } finally {
+    await local.kill();
+  }
+  return { results };
+}

package/blueprints/application-admin-console/contributions/probes/users-directory-surface.mjs

@@ -0,0 +1,145 @@
+// application-admin-console probe: users directory surface.
+//
+// De-claim first, observe second. This probe splits observation
+// across the two shipped ACs for the users-directory story: the
+// directory listing contract (AC-21102-1) and the per-row
+// invite/deactivate action controls (AC-21102-2). Each row detail
+// opens on the first eight words of the shipped AC it anchors (rule 10).
+//
+// AC-21102-1 requires: with principalDirectory applied AND admin
+// scope, the users table lists every principal by data-user-id with
+// a role column (only when roleModel is applied), a last-active
+// timestamp and a status column; a principal without admin scope
+// hitting /admin renders an access-denied state with a request-access
+// control routing to POST /api/request-access.
+//
+// AC-21102-2 requires: each row exposes an invite control for a
+// principal without an active session (data-action="invite") and a
+// deactivate control for an active principal (data-action="deactivate");
+// the controls are keyboard-reachable buttons.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-admin-console-AC-21102-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const withRole = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory,roleModel' } });
+  const results = [];
+  try {
+    const r = await fixtureFetch(withRole.url, '/admin/users');
+    const rowIds = [...r.body.matchAll(/data-user-id="([^"]+)"/g)].map((m) => m[1]);
+    const distinctRowIds = [...new Set(rowIds)];
+    const roleColumnPresent = /<th data-column="role">/.test(r.body);
+    const roleCellCount = (r.body.match(/<td data-column="role">/g) || []).length;
+    const statusColumnPresent = /<th data-column="status">/.test(r.body);
+    const lastActiveColumnPresent = /<th data-column="lastActive">/.test(r.body);
+    const inviteBtnCount = (r.body.match(/data-action="invite" data-user-id="/g) || []).length;
+    const deactivateBtnCount = (r.body.match(/data-action="deactivate" data-user-id="/g) || []).length;
+
+    // Row 1: AC-21102-1 directory-listing contract with roleModel applied.
+    const listingPass = r.status === 200 && !!r.requestId
+      && distinctRowIds.length > 0
+      && roleColumnPresent
+      && roleCellCount === distinctRowIds.length
+      && statusColumnPresent
+      && lastActiveColumnPresent;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21102-1: inventory-completeness reconciliation against the applied provider adapter (every principal in the provider inventory rendered with populated role, last-active and status values) is not observed by this Node HTTP probe against a fixed fixture; the directory-shell walk is a partial observation of AC-21102-1',
+      verdict: listingPass ? 'warn' : 'fail',
+      detail: listingPass
+        ? `Given an authenticated admin AND an applied auth blueprint declaring principalDirectory: GET /admin/users returned 200 with distinct data-user-id rows=${distinctRowIds.length}, role column present with cells=${roleCellCount} matching row count, status column present, lastActive column present; x-fixture-request-id=${r.requestId}`
+        : `Given an authenticated admin AND an applied auth blueprint listing gap: status=${r.status} rid=${r.requestId} rows=${distinctRowIds.length} roleColumn=${roleColumnPresent} roleCells=${roleCellCount} statusColumn=${statusColumnPresent} lastActiveColumn=${lastActiveColumnPresent}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<tr data-user-id="[^"]+">[^]{0,180}/) || [''])[0]),
+        derived: { rowCount: distinctRowIds.length, roleColumnPresent, roleCellCount, statusColumnPresent, lastActiveColumnPresent },
+      },
+    });
+
+    // Row 2: AC-21102-2 per-row invite/deactivate action controls.
+    // Every row must carry exactly one action (invite if pending, deactivate if active).
+    const perRowAction = distinctRowIds.every((id) => {
+      const inviteHere = new RegExp(`data-action="invite" data-user-id="${id}"`).test(r.body);
+      const deactivateHere = new RegExp(`data-action="deactivate" data-user-id="${id}"`).test(r.body);
+      return (inviteHere && !deactivateHere) || (!inviteHere && deactivateHere);
+    });
+    const actionButtonsAreButtons = /(<button[^>]*data-action="invite"|<button[^>]*data-action="deactivate")/.test(r.body);
+    const actionPass = r.status === 200 && !!r.requestId
+      && distinctRowIds.length > 0
+      && (inviteBtnCount + deactivateBtnCount) === distinctRowIds.length
+      && perRowAction
+      && actionButtonsAreButtons;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21102-2: state-to-action correlation (deactivate offered on active sessions, invite offered on pending) against varied per-principal states is not observed by this Node HTTP probe against a fixed fixture; the per-row action-control walk is a partial observation of AC-21102-2',
+      verdict: actionPass ? 'warn' : 'fail',
+      detail: actionPass
+        ? `Each row exposes an invite control for a principal without an active session and a deactivate control for an active principal; derived invite buttons=${inviteBtnCount}, deactivate buttons=${deactivateBtnCount}, total=${inviteBtnCount + deactivateBtnCount} matches row count ${distinctRowIds.length}, all rendered as keyboard-reachable <button> elements; x-fixture-request-id=${r.requestId}`
+        : `Each row exposes an invite control for a action gap: status=${r.status} rid=${r.requestId} invite=${inviteBtnCount} deactivate=${deactivateBtnCount} rows=${distinctRowIds.length} perRowAction=${perRowAction} buttonElements=${actionButtonsAreButtons}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<button[^>]*data-action="(?:invite|deactivate)"[^>]{0,180}/) || [''])[0]),
+        derived: { inviteBtnCount, deactivateBtnCount, rowCount: distinctRowIds.length, perRowAction, actionButtonsAreButtons },
+      },
+    });
+  } finally {
+    await withRole.kill();
+  }
+
+  const noRole = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory' } });
+  try {
+    // Row 3: AC-21102-1 role-column-suppression when roleModel is absent.
+    const r = await fixtureFetch(noRole.url, '/admin/users');
+    const rowIds = [...r.body.matchAll(/data-user-id="([^"]+)"/g)].map((m) => m[1]);
+    const distinctRowIds = [...new Set(rowIds)];
+    const roleColumnPresent = /<th data-column="role">/.test(r.body);
+    const suppressionPass = r.status === 200 && !!r.requestId
+      && distinctRowIds.length > 0
+      && !roleColumnPresent;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21102-1: the full directory-listing contract (every provider principal enumerated with populated status and last-active) is not observed by this Node HTTP probe against a fixed fixture; the role-column suppression walk (when roleModel is not applied) is a partial observation of AC-21102-1',
+      verdict: suppressionPass ? 'warn' : 'fail',
+      detail: suppressionPass
+        ? `Given an authenticated admin AND an applied auth blueprint on caps=principalDirectory only: GET /admin/users returned 200 with distinct rows=${distinctRowIds.length} unchanged and the role column suppressed as the AC requires when roleModel is not applied; x-fixture-request-id=${r.requestId}`
+        : `Given an authenticated admin AND an applied auth blueprint suppression gap: status=${r.status} rid=${r.requestId} rows=${distinctRowIds.length} roleColumn=${roleColumnPresent}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<thead>[^]{0,200}/) || [''])[0]),
+        derived: { rowCount: distinctRowIds.length, roleColumnPresent },
+      },
+    });
+
+    // Row 4: AC-21102-1 access-denied surface with request-access control.
+    const denied = await fixtureFetch(noRole.url, '/admin/users?asAdmin=false');
+    const hasDeniedRegion = /data-surface="denied"/.test(denied.body);
+    const hasRequestAccess = /data-action="request-access"/.test(denied.body);
+    const deniedPass = denied.status === 200 && !!denied.requestId && hasDeniedRegion && hasRequestAccess;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21102-1: request-access control activation and outcome against a routed API are browser-driven and not observed by this Node HTTP probe; the denied-surface walk on the not-authorised branch is a partial observation of AC-21102-1',
+      verdict: deniedPass ? 'warn' : 'fail',
+      detail: deniedPass
+        ? `Given an authenticated admin AND an applied auth blueprint (denied branch): GET /admin/users?asAdmin=false returned 200 with the [data-surface="denied"] region and a keyboard-reachable [data-action="request-access"] control routing to POST /api/request-access; x-fixture-request-id=${denied.requestId}`
+        : `Given an authenticated admin AND an applied auth blueprint denied-branch gap: status=${denied.status} rid=${denied.requestId} deniedRegion=${hasDeniedRegion} requestAccess=${hasRequestAccess}`,
+      evidence: {
+        requestId: denied.requestId,
+        responseStatus: denied.status,
+        bodyExcerpt: excerpt((denied.body.match(/data-surface="denied"[^]{0,220}/) || [''])[0]),
+        derived: { hasDeniedRegion, hasRequestAccess },
+      },
+    });
+  } finally {
+    await noRole.kill();
+  }
+  return { results };
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-001.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The application ships an admin-console shell with navigation across the applied capability set and no dead links",
   "description": "The application realises an admin-console surface whose navigation, on load, reads the applied blueprints capability declarations (via source read-back on manifest.blueprints[]) and renders links only for the surfaces the applied capabilities enable. A surface whose gating capability is not applied is neither linked nor reachable from the shell. The shell is the base surface REQ-002 to REQ-006 elaborate on.",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.renderShell"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-002.json

@@ -2,7 +2,11 @@
   "reqId": "application-admin-console-REQ-002",
   "prdId": "PRD-001",
   "title": "Users surface conditional on principalDirectory, with directory, invite, deactivate, last-active columns",
-  "description": "When an applied blueprint declares the principalDirectory capability, the console renders a users route: a directory table listing every principal identified by data-user-id, an invite control per row for a principal without an active session, a deactivate control per row for an active principal, and last-active plus status columns. A principal without admin scope reaching /admin renders an access-denied state (REQ-006) with a request-access control routed to a notification. The users table is a datatable (T-1 consumer) with the same ARIA APG contract.",
+  "description": "When an applied blueprint declares the principalDirectory capability, the console renders a users route: a directory table listing every principal identified by data-user-id, an invite control per row for a principal without an active session, a deactivate control per row for an active principal, and last-active plus status columns. A principal without admin scope reaching /admin renders an access-denied state (REQ-006) with a request-access control routed to a notification. The users table is a datatable (consumer) with the same ARIA APG contract.",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.delegateUsersSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Roles surface conditional on roleModel, with Owner + Admin + Member + Viewer baseline and permission matrix",
   "description": "When an applied blueprint declares the roleModel capability, the console renders a roles route: the Owner + Admin + Member + Viewer baseline (elicited additions per ADR-2202), and a permission matrix as an ARIA APG grid (rows = roles, columns = permissions, cells = allowed/denied). Each cell announces the exact permission string as it takes focus (WCAG 4.1.3). The matrix suppresses when roleModel is not applied.",
+  "deliveredBy": {
+    "tacId": "TAC-2203-application-admin-console-permission-matrix",
+    "field": "interfaces.renderMatrix"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Orgs surface conditional on tenancy, with switcher and org-scoped invites",
   "description": "When an applied blueprint declares the tenancy capability, the console renders an orgs route: an org switcher control on the shell and an org-scoped invite path from the users surface. The tenancy capability today has no shelf provider (reserved for a future application-tenancy-orgs blueprint per spec section 11); the surface is suppressed until that provider ships.",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.delegateOrgsSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-005.json

@@ -2,7 +2,11 @@
   "reqId": "application-admin-console-REQ-005",
   "prdId": "PRD-001",
   "title": "Audit-log surface conditional on the auditLog capability (via the applied logging companion), reading the delivered event stream",
-  "description": "When the auditLog capability is applied (through the observability-logging companion or a future dedicated audit blueprint), the console renders an audit-log route: an audit table listing every entry identified by data-audit-id and carrying actor, target, before, after, timestamp, and correlationId columns; per-actor filter chrome and per-target filter chrome; retention window per ADR-2204. Consumes application-datatable (T-1) for the table shell.",
+  "description": "When the auditLog capability is applied (through the observability-logging companion or a future dedicated audit blueprint), the console renders an audit-log route: an audit table listing every entry identified by data-audit-id and carrying actor, target, before, after, timestamp, and correlationId columns; per-actor filter chrome and per-target filter chrome; retention window per ADR-2204. Consumes application-datatable for the table shell. The retention window is the elicited `audit-retention-days` value (a number of days, default 90): the applied logging companion enforces retention at the write layer against that day-count so entries older than the window are not emitted, and the audit view uses the same day-count when computing the earliest-visible timestamp for the filter chrome. A project sets the value at apply time; a value below 1 is refused at apply.",
+  "deliveredBy": {
+    "tacId": "TAC-2204-application-admin-console-audit-view",
+    "field": "interfaces.renderAuditView"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Access-denied and request-access states per WCAG 2.2 AA",
   "description": "A principal without admin scope reaching an admin route renders an access-denied state under WCAG 2.4.6 Headings and Labels and 3.3.4 Error Prevention: a heading naming the denied action, an explanation of why access was refused, and a request-access control routed to a POST /api/request-access endpoint the applied notification blueprint delivers on. The request-access control is keyboard-reachable and announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3).",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.renderAccessDenied"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",