rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-007.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "application-admin-console-REQ-007",
+  "prdId": "PRD-001",
+  "title": "Every invite-transport option delivers or records the invite with a defined outcome",
+  "description": "The users surface honours the elicited invite-transport with a runtime clause per option: `email` hands the invite to the applied email companion (an email sibling declaring an email transport) and records success only after the transport reports the message accepted, presenting a delivery-failed refusal with a retryable control when the transport rejects or times out; `in-app-only` never touches the email transport and writes an invite record to the applied notification stream, marking the row with a data-invite-transport=in-app-only attribute so the recipient can see the invite in their own console; `custom` hands the invite payload to the project-supplied invite handler at surface time (a registered function on the applied capability sidecar) and records success only after the handler resolves, refusing the invite when no handler is registered. Every branch writes an audit record naming the transport, the invitee, and the outcome (accepted, failed, or refused).",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.deliverInvite"
+  },
+  "category": "functional",
+  "domain": "user-management",
+  "priority": "must",
+  "rationale": "The elicit offers three transports but the shipped requirements described the invite button only. A project that selected `in-app-only` or `custom` inherited no runtime behaviour and no failure-path assertion; the console shipped an invite control that silently misdelivered. Requiring a clause per option turns the elicit into a chain-linked commitment the audit record proves.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:07-invite-transport"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-008.json

@@ -0,0 +1,22 @@
+{
+  "reqId": "application-admin-console-REQ-008",
+  "prdId": "PRD-001",
+  "title": "The tenancy shape (per-user, per-org, both) determines directory membership and org-scoped invite behaviour",
+  "description": "When the tenancy capability is applied, the users surface, the org switcher and the invite path honour the elicited tenancy-shape with a runtime clause per option: `per-user` renders each principal in exactly one org (the directory row carries a single data-org-id and the org switcher only lists the principal's own org), and an org-scoped invite adds the invitee to exactly that org; `per-org` renders every principal in every org they can reach (the directory row carries a data-org-membership=* attribute and the org switcher lists every org the principal can enter), and an org-scoped invite adds the invitee to the currently switched org without touching the other orgs the principal already belongs to; `both` permits either shape per principal (the directory row carries data-org-scope=single or data-org-scope=many) and the invite path prompts for the org set when the invited principal is `many`. Every branch refuses a cross-org action (invite, deactivate) that the shape does not allow with a named error announcing the shape and the refused action.",
+  "deliveredBy": {
+    "tacId": "TAC-2201-application-admin-console-shell",
+    "field": "responsibilities.tenancyShapeGate"
+  },
+  "category": "functional",
+  "domain": "tenancy",
+  "priority": "must",
+  "rationale": "The tenancy-shape elicit offers three shapes but no requirement bound directory membership or invite scope to any of them. A project that chose `per-org` inherited a directory that behaved as `per-user` because no downstream link asked after the shape; the org switcher silently misrendered. Requiring a per-option clause turns the shape into a chain-linked behaviour the datatable's data attributes prove.",
+  "tags": [
+    "blueprint:application-admin-console",
+    "category:08-tenancy-shape"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-009.json

@@ -0,0 +1,21 @@
+{
+  "reqId": "application-admin-console-REQ-009",
+  "prdId": "PRD-001",
+  "title": "Custom-auth capability declarations bind the four provides-* booleans to the applied capability set",
+  "description": "When the applying project runs its own auth (no shipped security-auth-* blueprint) and answers the four custom-auth-provides-* boolean elicits, the console binds each answer to the appliedCapabilities union with a runtime clause per token: when `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is `true` the union includes `principalDirectory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-role-model]` is `true` the union includes `roleModel` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-tenancy]` is `true` the union includes `tenancy` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-audit-log]` is `true` the union includes `auditLog` and `false` omits it. The sidecar the shell reads reflects the exact union the boolean answers produce.",
+  "deliveredBy": {
+    "tacId": "TAC-2202-application-admin-console-capability-discovery",
+    "field": "responsibilities.runElicitationPhase"
+  },
+  "category": "functional",
+  "domain": "application",
+  "priority": "must",
+  "rationale": "The four provides-* booleans produced capabilities in the applied union without a chained clause. Requiring one runtime clause per token turns each boolean answer into a must-observable binding on the sidecar the shell reads.",
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-014.json

@@ -2,11 +2,15 @@
   "reqId": "application-admin-console-REQ-014",
   "prdId": "PRD-001",
   "title": "Consume zeroTrustGate optionally when applied alongside a zeroTrustGate provider",
-  "description": "application-admin-console v1.1.0 reads the appliedCapabilities set at apply-time via the shipped readAppliedCapabilities() helper (the T-5 visual-round mechanism). When zeroTrustGate is present alongside the sole hard requirement principalDirectory, the admin-console renders the Access-gated sign-in surface (no local login form; principal reads from request.auth via [data-role=principal-read]). When zeroTrustGate is absent the admin-console falls back to the local security-auth-* sign-in surface unchanged from v1.0.0. Q4 default per spec section 5.4.1: consumption is OPTIONAL; requiresAppliedCapabilities.capabilities[] remains [principalDirectory] (making Access-gate hard is a v2.0 change).",
+  "description": "application-admin-console v1.1.0 reads the appliedCapabilities set at apply-time via the shipped readAppliedCapabilities() helper (the visual-round mechanism). When zeroTrustGate is present alongside the sole hard requirement principalDirectory, the admin-console renders the Access-gated sign-in surface (no local login form; principal reads from request.auth via [data-role=principal-read]). When zeroTrustGate is absent the admin-console falls back to the local security-auth-* sign-in surface unchanged from v1.0.0. Q4 default per spec section 5.4.1: consumption is OPTIONAL; requiresAppliedCapabilities.capabilities[] remains [principalDirectory] (making Access-gate hard is a v2.0 change).",
+  "deliveredBy": {
+    "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+    "field": "responsibilities.renderAccessGatedSurface"
+  },
   "category": "functional",
   "domain": "application",
   "priority": "must",
-  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4.1) alongside edge-cloudflare-access v1.0.0. Round-4 T-4 capability-minor pattern: the admin-console minor rides the edge-cloudflare-access PR.",
+  "rationale": "Ratified in the Cloudflare round 6 spec (2026-09-06 section 5.4.1) alongside edge-cloudflare-access v1.0.0. round-4 capability-minor pattern: the admin-console minor rides the edge-cloudflare-access PR.",
   "tags": [
     "blueprint:application-admin-console"
   ],

package/blueprints/application-admin-console/contributions/tacs/tac-2201-application-admin-console-shell.json

@@ -2,15 +2,17 @@
   "tacId": "TAC-2201-application-admin-console-shell",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Admin-console shell",
   "purpose": "Owns the rendered admin-console surface: the top-level nav landmark, the surface-manifest read at load, the conditional rendering of every applied surface (users, roles, orgs, audit), the access-denied and request-access states, and the shared page layout every surface renders within. The shell is the base surface every AC in this blueprint anchors on.",
   "responsibilities": [
-    "Read the applied capability sidecar (rcf/blueprints/application-admin-console.applied.json) at load and configure the surface set (AC-21101-1, AC-21107-1).",
-    "Render a single primary navigation landmark carrying an accessible name and rendering only applied surfaces (AC-21101-1, AC-21101-2).",
-    "Render the access-denied state for a non-admin principal reaching any admin route with a keyboard-reachable request-access control announcing its state (AC-21106-1).",
-    "Delegate the users, roles, orgs and audit surfaces to their respective TACs (TAC-2201 through TAC-2204)."
+    "renderShell: assemble the shell landmark from the applied capability set and render the surface set (AC-21101-1, AC-21101-2, AC-21107-1).",
+    "delegateUsersSurface: mount the users route when principalDirectory is applied and render access-denied for a non-admin principal (AC-21102-1, AC-21102-2, AC-21106-1).",
+    "delegateOrgsSurface: mount the org switcher and org-scoped invite path when tenancy is applied (AC-21104-1, AC-21111-1 through AC-21111-5).",
+    "renderAccessDenied: render the access-denied state under WCAG 2.4.6 and 3.3.4 with a keyboard-reachable request-access control announcing its state (AC-21106-1).",
+    "deliverInvite: dispatch an invite through the elicited invite-transport (email, in-app-only or custom), refusing on missing transport handler and writing exactly one audit-stream row per invite (AC-21110-1, AC-21110-2, AC-21110-3, AC-21110-4, AC-21110-5).",
+    "tenancyShapeGate: enforce per-user, per-org or both tenancy shape on directory rows, switcher entries and org-scoped actions, refusing cross-shape actions with TENANCY_SHAPE_REFUSAL (AC-21111-1 through AC-21111-5)."
   ],
   "internalStructure": "One shell module that mounts the surface, reads the applied capabilities sidecar, and renders the nav landmark, the page-layout scaffolding, and the route-level containers for each conditional surface. The framework is not prescribed; the shell interfaces are what the project realises against React, Vue, Svelte or vanilla DOM.",
   "interfaces": [
@@ -22,7 +24,7 @@
     {
       "name": "capabilitiesSidecar",
       "kind": "shape",
-      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
+      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, skippedSources: Array<{ sourceId, reason }>, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
     }
   ],
   "dependencies": [
@@ -36,5 +38,5 @@
   "tradeoffs": "The shell reads the sidecar file the apply verb writes; a runtime probe against manifest.blueprints[] would be more dynamic but ties the shell to the deploy-target having filesystem read access, which not every deploy target grants. The sidecar contract is deterministic and cacheable.",
   "notes": "Known mechanism-reach gap: the shell contract cannot prove keyboard focus does not escape the surface in every frameworks rendering; project-side smoke tests supplement the pack. See README `Known mechanism-reach gaps`.",
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/tacs/tac-2202-application-admin-console-capability-discovery.json

@@ -2,17 +2,17 @@
   "tacId": "TAC-2202-application-admin-console-capability-discovery",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Capability discovery",
   "purpose": "Owns the apply-time reader that inspects every applied blueprints source blueprint.json for its capabilities[] declaration and composes the union as appliedCapabilities. Owns the write side that persists the discovered union plus elicit answers into rcf/blueprints/application-admin-console.applied.json. Runs at apply time (packages/rcf-lite/src/blueprint/capabilities.js); the shell reads the sidecar the runtime writes.",
   "responsibilities": [
     "Enumerate manifest.blueprints[] and read each applied blueprints source blueprint.json to extract its capabilities[] (AC-21107-1).",
     "Compose the union of applied capabilities as a sorted string array (deterministic sidecar output).",
-    "Run the elicitation phase gated on the discovered capabilities: an elicit whose when.requiresCapability list has no overlap with the union does not prompt (AC-21109-2).",
-    "Write the sidecar file with appliedCapabilities[], appliedElicitations{}, allowNoAuthYet? and notes? (AC-21107-1)."
+    "runElicitationPhase: Run the elicitation phase gated on the discovered capability set; each `custom-auth-provides-*` boolean binds its `providesCapability` token onto the applied union when true, omits it when false, per REQ-009 (AC-21109-2).",
+    "Write the sidecar file whose shape is owned by `TAC-2201.interfaces.capabilitiesSidecar` (AC-21107-1)."
   ],
-  "internalStructure": "Two helpers: discoverAppliedCapabilities(applied, projectRoot) reads and unions; writeSidecar({slug, version, appliedAt, appliedCapabilities, appliedElicitations, allowNoAuthYet?, notes?}) writes the file. Both live in packages/rcf-lite/src/blueprint/capabilities.js.",
+  "internalStructure": "Two helpers: discoverAppliedCapabilities(applied, projectRoot) reads and unions; writeSidecar(record) writes the file, where `record` matches the shape owned by `TAC-2201.interfaces.capabilitiesSidecar`. Both live in packages/rcf-lite/src/blueprint/capabilities.js.",
   "interfaces": [
     {
       "name": "discoverAppliedCapabilities",
@@ -40,5 +40,5 @@
   "tradeoffs": "Source read-back rather than a schema-carried appliedCapabilities field on the applied record: the rcf-schemas 0.6.0 appliedBlueprintRecord is closed under additionalProperties:false, so a new field cannot land without a schema minor bump. The sidecar decouples the mechanism from the schema release cycle. A future rcf-schemas minor may add appliedCapabilities directly on the applied record and this TAC would move the write there; the sidecar would remain a supported read path for backward compatibility.",
   "notes": "Reads the applied recordss source string. When the source is a library-qualified ref (wsd:auth-oauth2), the source blueprint is not on this local tree and the reader returns an empty capabilities list; the applied record is skipped from the union.",
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
-}
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2204-application-admin-console-audit-view.json

@@ -5,7 +5,7 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Audit view",
-  "purpose": "Owns the audit-log surface: consumes the application-datatable shell (T-1) for filter chrome, pagination, four state regions and the row enumeration contract. Renders every audit entry with actor / target / before / after / timestamp / correlationId columns; the correlation id is the join key with the applied logging companion.",
+  "purpose": "Owns the audit-log surface: consumes the application-datatable shell for filter chrome, pagination, four state regions and the row enumeration contract. Renders every audit entry with actor / target / before / after / timestamp / correlationId columns; the correlation id is the join key with the applied logging companion.",
   "responsibilities": [
     "Render every audit entry inside the datatable shell (AC-21105-1, AC-21105-2).",
     "Enumerate every row by data-audit-id and expose every column via data-column (AC-21105-1).",

package/blueprints/application-admin-console/contributions/tacs/tac-2214-application-admin-console-access-gated-signin-surface.json

@@ -2,17 +2,17 @@
   "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "status": "approved",
   "name": "Access-gated sign-in surface with principal-read-from-request contract",
   "purpose": "Names the sign-in surface shape the admin-console renders when zeroTrustGate is in the applied capability set. The Access-gated shape carries [data-surface=access-gated], no local form, and a [data-role=principal-read] element rendering the principal email read from request.auth. The fallback shape (zeroTrustGate absent) carries [data-surface=local-login] with the security-auth-* local login form. The two are mutually exclusive on any /admin/sign-in render.",
   "responsibilities": [
-    "Render the Access-gated surface with [data-surface=access-gated] when zeroTrustGate is in appliedCapabilities (AC-21815-1).",
+    "renderAccessGatedSurface: render the Access-gated surface with [data-surface=access-gated] when zeroTrustGate is in appliedCapabilities, wiring the principal read from request.auth (AC-21815-1).",
     "Render the local-login surface with [data-surface=local-login] when zeroTrustGate is absent (AC-21816-1).",
     "Read the principal email from request.auth and render it in [data-role=principal-read] on the gated branch.",
     "Never render both surfaces on the same request; ensure the two are mutually exclusive per applied set."
   ],
-  "internalStructure": "Applied-capability-driven surface pick in the sign-in route. The applied-sidecar (rcf/blueprints/application-admin-console.applied.json) records the appliedCapabilities set; the shipped readAppliedCapabilities() helper reads it at apply-time (T-5 visual-round mechanism). No new elicits on the admin-console side: the sign-in seam is deterministic once the applied set is known.",
+  "internalStructure": "Applied-capability-driven surface pick in the sign-in route. The applied-sidecar (rcf/blueprints/application-admin-console.applied.json) records the appliedCapabilities set; the shipped readAppliedCapabilities() helper reads it at apply-time (visual-round mechanism). No new elicits on the admin-console side: the sign-in seam is deterministic once the applied set is known.",
   "interfaces": [
     {
       "name": "GET /admin/sign-in",
@@ -22,11 +22,11 @@
   ],
   "dependencies": [
     {
-      "name": "T-4 edge-cloudflare-access v1.0.0 (zeroTrustGate provider)",
+      "name": "edge-cloudflare-access v1.0.0 (zeroTrustGate provider)",
       "kind": "blueprint",
       "description": "Applied alongside admin-console v1.1.0 to compose the Access-gated sign-in surface."
     }
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21101.json

@@ -13,13 +13,15 @@
       "id": "AC-21101-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at deploy time) and, for each of principalDirectory, roleModel, tenancy, auditLog, renders a nav item ONLY when the capability is present in appliedCapabilities[]. A nav item that would route to a non-applied surface is neither rendered nor keyboard-reachable."
+      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at deploy time) and, for each of principalDirectory, roleModel, tenancy, auditLog, renders a nav item ONLY when the capability is present in appliedCapabilities[]. A nav item that would route to a non-applied surface is neither rendered nor keyboard-reachable.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-21101-2",
       "testable": true,
       "scope": "runtime",
-      "description": "The shell has a single primary nav landmark (role=\"navigation\" or a nav element) with an accessible name naming the console."
+      "description": "The shell has a single primary nav landmark (role=\"navigation\" or a nav element) with an accessible name naming the console.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21102.json

@@ -13,13 +13,15 @@
       "id": "AC-21102-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given an authenticated admin AND an applied auth blueprint declaring principalDirectory, the users table lists every principal with data-user-id on each row, a role column (only when roleModel is applied; else suppressed), a last-active timestamp, and a status column; a principal without admin scope reaching /admin renders an access-denied state with a \"request access\" control routing to POST /api/request-access. Probed by application-admin-console pack check AC-21102-1."
+      "description": "Given an authenticated admin AND an applied auth blueprint declaring principalDirectory, the users table lists every principal with data-user-id on each row, a role column (only when roleModel is applied; else suppressed), a last-active timestamp, and a status column; a principal without admin scope reaching /admin renders an access-denied state with a \"request access\" control routing to POST /api/request-access. Probed by application-admin-console pack check AC-21102-1.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-21102-2",
       "testable": true,
       "scope": "runtime",
-      "description": "Each row exposes an invite control for a principal without an active session (data-action=\"invite\") and a deactivate control for an active principal (data-action=\"deactivate\"); the controls are keyboard-reachable buttons."
+      "description": "Each row exposes an invite control for a principal without an active session (data-action=\"invite\") and a deactivate control for an active principal (data-action=\"deactivate\"); the controls are keyboard-reachable buttons.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21103.json

@@ -2,7 +2,7 @@
   "usId": "application-admin-console-US-21103",
   "prdId": "PRD-001",
   "reqId": "application-admin-console-REQ-003",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Roles surface renders the permission matrix as an ARIA APG grid when roleModel is applied",
   "asA": "admin operator reviewing role permissions",
@@ -13,13 +13,19 @@
       "id": "AC-21103-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given the roles surface AND an applied auth blueprint declaring roleModel, the permission matrix renders as an ARIA APG grid: role=\"grid\" on the outer element, role=\"row\" on every rank (including the header rank), role=\"columnheader\" on every permission column header, role=\"rowheader\" on the leftmost cell of each role rank, role=\"gridcell\" on every inner cell, and each cell carries an aria-label announcing the exact permission string plus the allowed/denied state on focus (WCAG 4.1.3). Probed by pack check AC-21103-1."
+      "description": "Given the roles surface AND an applied auth blueprint declaring roleModel, the permission matrix renders as an ARIA APG grid: role=\"grid\" on the outer element, role=\"row\" on every rank (including the header rank), role=\"columnheader\" on every permission column header, role=\"rowheader\" on the leftmost cell of each role rank, role=\"gridcell\" on every inner cell, and each cell carries an aria-label announcing the exact permission string plus the allowed/denied state on focus (WCAG 4.1.3). Probed by pack check AC-21103-1. (WCAG 4.1.3 verified against https://www.w3.org/TR/WCAG22/#status-messages, 2026-09-10.)",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/WAI/ARIA/apg/patterns/grid/",
+        "verifiedOn": "2026-09-10"
+      }
     },
     {
       "id": "AC-21103-2",
       "testable": true,
       "scope": "runtime",
-      "description": "The baseline role set is Owner, Admin, Member, Viewer (ADR-2202); elicited additional roles rendered as extra rank rows, with the baseline four rendered first and additions after."
+      "description": "The baseline role set is Owner, Admin, Member, Viewer (ADR-2202); elicited additional roles rendered as extra rank rows, with the baseline four rendered first and additions after.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -30,5 +36,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21104.json

@@ -13,7 +13,18 @@
       "id": "AC-21104-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given an applied blueprint declaring tenancy, the shell renders an org switcher control (data-role=\"org-switcher\") on the console header; the users invite path renders an org selector. When tenancy is not applied, neither control is rendered nor reachable. Probed by pack check AC-21104-1."
+      "description": "Given an applied blueprint declaring tenancy, the shell renders an org switcher control (data-role=\"org-switcher\") on the console header; the users invite path renders an org selector. When tenancy is not applied, neither control is rendered nor reachable. Probed by pack check AC-21104-1.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21104-2",
+      "description": "When tenancy is NOT applied, the orgs route is suppressed (not linked in the shell navigation and returning 404 or the shared forbidden state on direct URL); the org switcher control is absent from the DOM on every route.",
+      "given": "a project without the tenancy capability applied",
+      "when": "the shell renders any route",
+      "then": "no orgs link is present in navigation, /admin/orgs is unreachable and no org-switcher control appears",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -24,5 +35,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21105.json

@@ -13,13 +13,25 @@
       "id": "AC-21105-1",
       "testable": true,
       "scope": "runtime",
-      "description": "Given a role change AND the auditLog capability applied (via observability-logging or a dedicated audit blueprint), an audit-log entry writes with actor, target, before, after, timestamp, and correlationId from the logging companion; the entry surfaces on the audit view table where every row is enumerable by data-audit-id and every cell exposes its column via a data-column attribute. Probed by pack check AC-21105-1."
+      "description": "Given a role change AND the auditLog capability applied (via observability-logging or a dedicated audit blueprint), an audit-log entry writes with actor, target, before, after, timestamp, and correlationId from the logging companion; the entry surfaces on the audit view table where every row is enumerable by data-audit-id and every cell exposes its column via a data-column attribute. Probed by pack check AC-21105-1.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-21105-2",
       "testable": true,
       "scope": "runtime",
-      "description": "The audit view consumes the application-datatable shell (TAC-2204 depends on TAC-1801-application-datatable-shell), so filter chrome, pagination and the four state regions inherit from the datatable contract."
+      "description": "The audit view consumes the application-datatable shell (TAC-2204 depends on TAC-1801-application-datatable-shell), so filter chrome, pagination and the four state regions inherit from the datatable contract.",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21105-3",
+      "description": "The audit view honours the elicited `audit-retention-days` day-count: entries whose timestamp is older than (now - days) do not appear in the table and the earliest filter chrome date-boundary uses the same day-count. A day-count below 1 refuses at apply with AUDIT_RETENTION_OUT_OF_RANGE naming the value. Applying agent sets: audit-retention-days.",
+      "given": "auditLog applied with audit-retention-days elicited to N days and audit entries spanning older-than-N and newer-than-N timestamps",
+      "when": "the audit view renders",
+      "then": "the DOM lists only entries within the last N days and the earliest filter-chrome date-boundary matches (now - N days); apply refuses with AUDIT_RETENTION_OUT_OF_RANGE for a value below 1",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
@@ -30,5 +42,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21106.json

@@ -13,7 +13,40 @@
       "id": "AC-21106-1",
       "testable": true,
       "scope": "runtime",
-      "description": "A non-admin principal reaching /admin renders a role=\"region\" with an accessible name naming the denied action (WCAG 2.4.6), a paragraph explaining why access was refused (WCAG 3.3.4), and a request-access control (data-action=\"request-access\") routed to POST /api/request-access. The control announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3)."
+      "description": "A non-admin principal reaching /admin renders a role=\"region\" with an accessible name naming the denied action (WCAG 2.4.6), a paragraph explaining why access was refused (WCAG 3.3.4), and a request-access control (data-action=\"request-access\") routed to POST /api/request-access. The control announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3). (WCAG 3.3.4 verified against https://www.w3.org/TR/WCAG22/#error-suggestion and WCAG 4.1.3 verified against https://www.w3.org/TR/WCAG22/#status-messages, 2026-09-10.)",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#headings-and-labels",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-21106-2",
+      "description": "When the request-access POST returns a non-2xx response or times out, the access-denied state announces the failure through the polite live region, the request-access control returns to an idle state (data-state=idle) and remains keyboard-reachable for a retry; no submitted-success announcement is emitted. Vendor citation on the WCAG live-region announcement path.",
+      "given": "the access-denied state rendered and the applied notification blueprint returns a non-2xx or times out",
+      "when": "the principal activates the request-access control",
+      "then": "the live region announces a failure message, the control returns to data-state=idle with keyboard focus preserved and no data-state=submitted transition fires",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#status-messages",
+        "verifiedOn": "2026-09-10"
+      }
+    },
+    {
+      "id": "AC-21106-3",
+      "description": "The access-denied heading names the denied action, the explanation names the missing capability (principalDirectory when the console runs without any applied auth), and the request-access control exposes accName that matches the visible label per WCAG 2.5.3.",
+      "given": "a principal without admin scope reaches /admin",
+      "when": "the access-denied state renders",
+      "then": "the heading text names the action, the explanation text names the missing capability and the request-access control accessible name matches its visible label",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://www.w3.org/TR/WCAG22/#label-in-name",
+        "verifiedOn": "2026-09-10"
+      }
     }
   ],
   "tacIds": [
@@ -23,5 +56,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21107.json

@@ -2,7 +2,7 @@
   "usId": "application-admin-console-US-21107",
   "prdId": "PRD-001",
   "reqId": "application-admin-console-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Console shell surfaces are self-configured from the applied capability sidecar at deploy time, not from client-side inference",
   "asA": "admin operator opening the console the same way in every deploy environment",
@@ -13,7 +13,26 @@
       "id": "AC-21107-1",
       "testable": true,
       "scope": "runtime",
-      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at build time) as a build asset served under a stable path (e.g. /admin/caps.json); the shell never runs a runtime probe against manifest.blueprints[] over the network. The sidecar payload keys are appliedCapabilities[], appliedElicitations{} and allowNoAuthYet? per the mechanism spec."
+      "description": "The console shell reads rcf/blueprints/application-admin-console.applied.json (written by apply at build time) as a build asset served under a stable path (e.g. /admin/caps.json); the shell never runs a runtime probe against manifest.blueprints[] over the network. The sidecar payload shape is owned by TAC-2201.interfaces.capabilitiesSidecar.",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2201-application-admin-console-shell",
+        "field": "interfaces.capabilitiesSidecar"
+      }
+    },
+    {
+      "id": "AC-21107-2",
+      "description": "When manifest.blueprints[] carries a library-qualified source that cannot be read locally (a library-qualified source unavailable at read time), the entry is skipped in the union; the sidecar (shape owned by TAC-2201.interfaces.capabilitiesSidecar) records the skipped entry and the shell navigation gates as though that source had contributed no capabilities (no surface renders that would have required a capability from the missing source).",
+      "given": "a project whose manifest.blueprints[] names a library-qualified source unavailable locally",
+      "when": "apply runs and the sidecar is written",
+      "then": "the sidecar entry names the skipped source id per TAC-2201.interfaces.capabilitiesSidecar and the shell navigation renders only surfaces whose gating capabilities were provided by successfully read sources",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2201-application-admin-console-shell",
+        "field": "interfaces.capabilitiesSidecar"
+      }
     }
   ],
   "tacIds": [
@@ -23,5 +42,5 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21108.json

@@ -13,7 +13,8 @@
       "id": "AC-21108-1",
       "testable": true,
       "scope": "library",
-      "description": "blueprint.json does not declare providesRoles (per spec 5.5.3); the loader is happy (providesRoles is optional). A future admin-console-shaped blueprint composes via capabilities[] and the crossBlueprintOwnership conflict on the same slug family, not via providesRoles[]."
+      "description": "blueprint.json does not declare providesRoles (per spec 5.5.3); the loader is happy (providesRoles is optional). A future admin-console-shaped blueprint composes via capabilities[] and the crossBlueprintOwnership conflict on the same slug family, not via providesRoles[].",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -23,5 +24,6 @@
     "blueprint:application-admin-console"
   ],
   "createdAt": "2026-09-05T01:30:00Z",
-  "updatedAt": "2026-09-05T01:30:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "description": "Note (blueprint-authoring section 7a single-AC legality clause): this static check has no documented runtime or apply-time failure path; the assertion is either true or false statically and requires no failure branch."
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21109.json

@@ -13,13 +13,15 @@
       "id": "AC-21109-1",
       "testable": true,
       "scope": "runtime",
-      "description": "rcf define blueprint add ./blueprints/application-admin-console on a project with no applied blueprint declaring principalDirectory (and without --allow-no-auth-yet) exits 3; the stderr message begins with \"application-admin-console requires at least one applied security-auth-*\", lists the currently-applied blueprints on the project, and prints the \"Suggested next steps\" block including the four shelf auth slugs. No contribution files are written; the sidecar is not created."
+      "description": "rcf define blueprint add ./blueprints/application-admin-console on a project with no applied blueprint declaring principalDirectory (and without --allow-no-auth-yet) exits 3; the stderr message begins with \"application-admin-console requires at least one applied security-auth-*\", lists the currently-applied blueprints on the project, and prints the \"Suggested next steps\" block including the four shelf auth slugs. No contribution files are written; the sidecar is not created.",
+      "disposition": "fixed"
     },
     {
       "id": "AC-21109-2",
       "testable": true,
       "scope": "runtime",
-      "description": "With --allow-no-auth-yet passed, the apply proceeds and writes rcf/blueprints/application-admin-console.applied.json with allowNoAuthYet:true and a notes string naming the \"no auth yet\" state; a later rcf define validate reads the sidecar and flags the ungated surfaces."
+      "description": "With --allow-no-auth-yet passed, the apply proceeds and writes rcf/blueprints/application-admin-console.applied.json with allowNoAuthYet:true and a notes string naming the \"no auth yet\" state; a later rcf define validate reads the sidecar and flags the ungated surfaces.",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21110.json

@@ -0,0 +1,68 @@
+{
+  "usId": "application-admin-console-US-21110",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The invite path honours the elicited invite-transport for every option and records the outcome",
+  "asA": "shelf consumer applying application-admin-console with an invite-transport chosen at elicit time",
+  "iWant": "the users surface to deliver invites through the elicited transport with a defined success and a defined refusal per option",
+  "soThat": "the invite control I click never silently misdelivers and every outcome shows up in the audit stream",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21110-1",
+      "description": "When invite-transport is `email` and the applied email companion accepts the invite payload, the invite row records data-invite-outcome=accepted and the audit stream carries a row naming transport=email, the invitee and outcome=accepted. Applying agent sets: the email companion binding name, the from address and the invite template id.",
+      "given": "invite-transport=email applied and the email companion returns accepted",
+      "when": "an admin clicks invite for a pending principal",
+      "then": "the invite row exposes data-invite-outcome=accepted and the audit stream row names transport=email, invitee and outcome=accepted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-21110-2",
+      "description": "When invite-transport is `email` and the applied email companion rejects the payload (a non-2xx response or a timeout), the invite row shows data-invite-outcome=failed with a retry control, no audit record marks the invite accepted, and the console announces the failure through the notifications live region.",
+      "given": "invite-transport=email applied and the companion returns a non-2xx or times out",
+      "when": "an admin clicks invite",
+      "then": "the invite row carries data-invite-outcome=failed, a data-action=retry-invite control is keyboard-reachable, the audit stream row records outcome=failed and no outcome=accepted row is emitted for this invitee",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21110-3",
+      "description": "When invite-transport is `in-app-only`, the invite path never invokes the email companion; the invite writes a notification with data-invite-transport=in-app-only to the applied notification stream, and the users row records data-invite-outcome=recorded.",
+      "given": "invite-transport=in-app-only applied",
+      "when": "an admin clicks invite for a pending principal",
+      "then": "no email transport is called, the notifications stream carries a row with data-invite-transport=in-app-only, and the users row carries data-invite-outcome=recorded",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21110-4",
+      "description": "When invite-transport is `custom` and a project-supplied invite handler is registered on the applied capability sidecar, the invite payload is handed to the handler and success is recorded only after the handler resolves; when no handler is registered the invite refuses at apply-time with INVITE_HANDLER_MISSING naming the sidecar key. Applying agent sets: the handler function name and the sidecar key it registers under.",
+      "given": "invite-transport=custom applied",
+      "when": "an admin clicks invite",
+      "then": "the handler is called with { invitee, orgId?, correlationId } and the row records data-invite-outcome=accepted only after the handler resolves; a missing handler refuses at apply with INVITE_HANDLER_MISSING",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-21110-5",
+      "description": "Every transport branch writes exactly one audit-stream row per invite, naming transport, invitee identifier and outcome (accepted, failed or refused). No transport branch writes zero rows or more than one row for a single invite click.",
+      "given": "any invite-transport applied",
+      "when": "an admin clicks invite once for a principal",
+      "then": "the audit stream carries exactly one row for this invite naming transport, invitee and outcome",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}