rcf-lite 0.27.0 → 0.28.0

package/blueprints/application-spa/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-spa probes.
+//
+// The engine under probe is the sample-app fixture at
+// packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js. The
+// fixture stamps an x-fixture-request-id header on every response as
+// part of its own request pipeline (no probe-side monkey-patch), so
+// the identifier the probe records is the identifier the engine
+// itself issued. Probes call the fixture over real HTTP via node's
+// fetch, vary inputs, assert derived outputs, and record the
+// request-id, status, body excerpt, the varied input and the derived
+// output as evidence on every result row.
+// No account-bound branch: the engine is a local fixture, not a
+// third-party account, so no CI_HAS_* gate is invented. Every env
+// var this pack reads is declared on the fixture README.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-spa');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-spa');
+
+export const DEFAULT_PORT = 0;
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+// Empty results never pass: a synthesised row is emitted with an actionable detail and its
+// own evidence object recording the empty condition so the row is
+// not a naked verdict scalar.
+export function normaliseResults(results) {
+  if (!Array.isArray(results) || results.length === 0) {
+    return [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: 'no checks ran',
+      evidence: {
+        reason: 'empty-results',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: '',
+      },
+    }];
+  }
+  return results;
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'application-spa',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+// Starts the fixture on an ephemeral port (or PROBE_PORT when set)
+// and returns { server, port, baseUrl, close }. The close helper
+// rejects when the underlying close callback carries an error;
+// swallowing a teardown error would hide a boundary failure.
+export async function startFixture({ startServer, port } = {}) {
+  const resolvedPort = typeof port === 'number'
+    ? port
+    : Number(process.env.PROBE_PORT ?? DEFAULT_PORT);
+  const started = await startServer({ port: resolvedPort });
+  return {
+    server: started.server,
+    port: started.port,
+    baseUrl: `http://127.0.0.1:${started.port}`,
+    close: () => new Promise((res, rej) => started.server.close((err) => {
+      if (err) rej(err);
+      else res();
+    })),
+  };
+}
+
+// Reads a distinctive slice of a response body: the first N chars
+// so the report carries a body excerpt alongside the header id.
+export function bodyExcerpt(text, max = 240) {
+  if (text == null) return '';
+  const s = typeof text === 'string' ? text : String(text);
+  return s.length > max ? s.slice(0, max) + '...' : s;
+}
+
+// Records the positive-evidence shape on a probe result. Every row
+// carries route, status, the request id the fixture stamped, and a
+// body excerpt; the caller may extend the object with the varied
+// input and the derived output for that row.
+export function evidenceFromResponse({ route, response, bodyText, extraFields }) {
+  return {
+    route,
+    status: response.status,
+    xFixtureRequestId: response.headers.get('x-fixture-request-id') || null,
+    bodyExcerpt: bodyExcerpt(bodyText),
+    ...(extraFields ?? {}),
+  };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results: normaliseResults(results), extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict !== 'pass') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+      evidence: {
+        reason: 'probe-threw',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: err && err.stack ? String(err.stack).slice(0, 240) : '',
+      },
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Browser-observable properties are AMBER on the shelf by ruling.
+// A row that names such a property is recorded as notObservableHere
+// carrying an object with the AC id and a reason; the tally script
+// reads notObservableHere.ac to accept the row.
+export function notObservableHereResult({ ac, anchorAcId, detail, reason, evidence } = {}) {
+  // A notObservableHere row anchors nothing else: no anchorAcId,
+  // no anchorReqId - only notObservableHere.ac.
+  const acId = ac || anchorAcId;
+  return {
+    verdict: 'pass',
+    notObservableHere: {
+      ac: acId,
+      reason: reason || 'not observable on server-side probe pack; needs a browser-driven runner',
+    },
+    detail: detail || 'not observable on server-side probe pack',
+    evidence: {
+      reason: reason || 'not observable here; needs a browser-driven probe runner',
+      ...(evidence || {}),
+    },
+  };
+}
+
+// A row that keeps a real observation but records that the
+// observation only covers part of an AC uses conformanceOnly +
+// limitation carrying the AC id and the property not observed.
+export function conformanceOnlyResult({ anchorAcId, anchorReqId, verdict, detail, evidence, limitation }) {
+  return {
+    ...(anchorAcId ? { anchorAcId } : {}),
+    ...(anchorReqId ? { anchorReqId } : {}),
+    verdict: verdict || 'pass',
+    conformanceOnly: true,
+    limitation: limitation || 'browser-observable property not asserted from the server-side probe',
+    detail,
+    evidence,
+  };
+}

package/blueprints/application-spa/contributions/probes/route-inventory-published.mjs

@@ -0,0 +1,185 @@
+// route-inventory-published probe for application-spa v1.5.11.
+//
+// Verifies AC-1101-1: the project maintains a declared route
+// inventory naming every route AND no navigable surface exists
+// outside it. To rule out fixture self-agreement the probe drives
+// two independent inputs it controls:
+//
+// Run A: routes = [/, /alpha, /beta]
+// Run B: routes = [/, /gamma, /delta, /epsilon]
+//
+// For each run the probe reads /__routes and /__mounted and
+// checks both endpoints reflect the injected input verbatim,
+// then crawls every declared path (expects 200) and every path
+// from the OTHER run's set that is NOT in the current set (expects
+// 404). If /__routes or /__mounted diverged from the injected
+// input, or if a path outside the input responded 200, the row
+// fails. The two runs together establish input-driven variation.
+//
+// anchorAcId: application-spa-AC-1101-1.
+
+import { startFixture, evidenceFromResponse, conformanceOnlyResult } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-spa-REQ-001';
+export const accountBound = false;
+
+const RUN_A_ROUTES = [
+ { path: '/', name: 'landing', state: 'populated', dataBearing: false },
+ { path: '/alpha', name: 'alpha', state: 'populated', dataBearing: true },
+ { path: '/beta', name: 'beta', state: 'populated', dataBearing: false },
+];
+const RUN_B_ROUTES = [
+ { path: '/', name: 'landing', state: 'populated', dataBearing: false },
+ { path: '/gamma', name: 'gamma', state: 'populated', dataBearing: true },
+ { path: '/delta', name: 'delta', state: 'populated', dataBearing: false },
+ { path: '/epsilon', name: 'epsilon', state: 'empty', dataBearing: true },
+];
+
+async function runOne(routeSet, otherSet) {
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js');
+ const fixture = await startFixture({ startServer: (opts) => startServer({ ...opts, routes: routeSet }), port: 0 });
+ try {
+ const declaredPaths = routeSet.map((r) => r.path);
+ const routesRes = await fetch(`${fixture.baseUrl}/__routes`);
+ const routesBody = await routesRes.text();
+ const routesJson = JSON.parse(routesBody);
+ const routesPaths = (routesJson.routes || []).map((r) => r.path);
+
+ const mountedRes = await fetch(`${fixture.baseUrl}/__mounted`);
+ const mountedBody = await mountedRes.text();
+ const mountedJson = JSON.parse(mountedBody);
+ const mountedPaths = mountedJson.paths || [];
+
+ const perPath = {};
+ for (const p of declaredPaths) {
+ const r = await fetch(`${fixture.baseUrl}${p}`);
+ const body = await r.text();
+ perPath[p] = { status: r.status, ok: r.status === 200 && /<main[^>]+data-route=/.test(body) };
+ }
+
+ // Paths NOT in the injected inventory must 404. We take them
+ // from the OTHER run's set (minus paths shared with this run).
+ const shared = new Set(declaredPaths);
+ const outsidePaths = otherSet.map((r) => r.path).filter((p) => !shared.has(p));
+ const perOutside = {};
+ for (const p of outsidePaths) {
+ const r = await fetch(`${fixture.baseUrl}${p}`);
+ await r.text();
+ perOutside[p] = { status: r.status, ok: r.status === 404 };
+ }
+
+ const routesMatchInput = declaredPaths.length === routesPaths.length && declaredPaths.every((p) => routesPaths.includes(p));
+ const mountedMatchInput = declaredPaths.length === mountedPaths.length && declaredPaths.every((p) => mountedPaths.includes(p));
+ const declaredAll200 = Object.values(perPath).every((v) => v.ok);
+ const outsideAll404 = Object.values(perOutside).every((v) => v.ok);
+ return {
+ routesRes,
+ routesBody,
+ mountedRes,
+ mountedBody,
+ declaredPaths,
+ routesPaths,
+ mountedPaths,
+ outsidePaths,
+ perPath,
+ perOutside,
+ routesMatchInput,
+ mountedMatchInput,
+ declaredAll200,
+ outsideAll404,
+ };
+ } finally {
+ await fixture.close();
+ }
+}
+
+export default async function runProbe() {
+ const results = [];
+ const runA = await runOne(RUN_A_ROUTES, RUN_B_ROUTES);
+ const runB = await runOne(RUN_B_ROUTES, RUN_A_ROUTES);
+
+ const bothMatchInput = runA.routesMatchInput && runA.mountedMatchInput && runB.routesMatchInput && runB.mountedMatchInput;
+ const bothDeclared200 = runA.declaredAll200 && runB.declaredAll200;
+ const bothOutside404 = runA.outsideAll404 && runB.outsideAll404;
+ const pass = bothMatchInput && bothDeclared200 && bothOutside404;
+
+ results.push({
+ anchorAcId: 'application-spa-AC-1101-1',
+ anchorReqId: 'application-spa-REQ-001',
+ verdict: pass ? 'pass' : 'fail',
+ detail: `The project maintains a declared route inventory naming every route; no navigable surface exists outside it - runA(${runA.declaredPaths.join(',')}) routes=${runA.routesMatchInput} mounted=${runA.mountedMatchInput} declared200=${runA.declaredAll200} outside404=${runA.outsideAll404}; runB(${runB.declaredPaths.join(',')}) routes=${runB.routesMatchInput} mounted=${runB.mountedMatchInput} declared200=${runB.declaredAll200} outside404=${runB.outsideAll404}`,
+ evidence: evidenceFromResponse({
+ route: '/__routes (runA)',
+ response: runA.routesRes,
+ bodyText: runA.routesBody,
+ extraFields: {
+ input: {
+ runARoutes: RUN_A_ROUTES.map((r) => r.path),
+ runBRoutes: RUN_B_ROUTES.map((r) => r.path),
+ },
+ derived: {
+ runA: {
+ routesPaths: runA.routesPaths,
+ mountedPaths: runA.mountedPaths,
+ routesMatchInput: runA.routesMatchInput,
+ mountedMatchInput: runA.mountedMatchInput,
+ perPath: runA.perPath,
+ outsidePaths: runA.outsidePaths,
+ perOutside: runA.perOutside,
+ },
+ runB: {
+ routesPaths: runB.routesPaths,
+ mountedPaths: runB.mountedPaths,
+ routesMatchInput: runB.routesMatchInput,
+ mountedMatchInput: runB.mountedMatchInput,
+ perPath: runB.perPath,
+ outsidePaths: runB.outsidePaths,
+ perOutside: runB.perOutside,
+ },
+ },
+ altBodyExcerpt: runB.routesBody.slice(0, 240),
+ },
+ }),
+ });
+
+ // Second row: shell <meta name="route-inventory"> agrees with
+ // /__routes and /__mounted under run A. This observation covers
+ // only a same-run agreement slice of AC-1101-1 (route-inventory
+ // completeness across the app) and is emitted as conformanceOnly
+ // anchored on AC-1101-1 with a limitation naming the property the
+ // slice does not observe. The first row already carries the full
+ // positive AC-1101-1 observation across two injected sets.
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js');
+ const fixture = await startFixture({ startServer: (opts) => startServer({ ...opts, routes: RUN_A_ROUTES }), port: 0 });
+ let shellRes; let shellBody; let shellPaths = []; let shellAgreesJson = false; let shellAgreesMounted = false;
+ try {
+ shellRes = await fetch(`${fixture.baseUrl}/`);
+ shellBody = await shellRes.text();
+ const metaMatch = shellBody.match(/<meta name="route-inventory" content="([^"]+)"/);
+ shellPaths = metaMatch ? metaMatch[1].split(',') : [];
+ const declaredSet = new Set(RUN_A_ROUTES.map((r) => r.path));
+ shellAgreesJson = shellPaths.length === RUN_A_ROUTES.length && shellPaths.every((p) => declaredSet.has(p));
+ shellAgreesMounted = shellPaths.every((p) => runA.mountedPaths.includes(p));
+ } finally {
+ await fixture.close();
+ }
+ const agreeAll = shellAgreesJson && shellAgreesMounted;
+ results.push(conformanceOnlyResult({
+ anchorAcId: 'application-spa-AC-1101-1',
+ anchorReqId: 'application-spa-REQ-001',
+ verdict: agreeAll ? 'pass' : 'fail',
+ detail: `The project maintains a declared route inventory naming every route - same-run agreement slice: shell <meta name="route-inventory"> ${shellPaths.join(',')} agrees with /__routes JSON: ${shellAgreesJson} and /__mounted: ${shellAgreesMounted}`,
+ evidence: evidenceFromResponse({
+ route: '/',
+ response: shellRes,
+ bodyText: shellBody,
+ extraFields: {
+ input: { shellMetaPaths: shellPaths, injectedRoutes: RUN_A_ROUTES.map((r) => r.path) },
+ derived: { shellAgreesJson, shellAgreesMounted, agreeAll },
+ },
+ }),
+ limitation: 'application-spa-AC-1101-1: this row observes only same-run agreement between the shell meta, /__routes and /__mounted for one injected set; the AC also requires that no navigable surface exists outside the declared inventory, which the first AC-1101-1 row observes by injecting two independent route sets and confirming outsiders return 404',
+ }));
+
+ return { results };
+}

package/blueprints/application-spa/contributions/probes/run-designed-empty-state.mjs

@@ -0,0 +1,5 @@
+import runProbe from './designed-empty-state.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-spa-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js' };
+runShim('designed-empty-state', engine, runProbe);

package/blueprints/application-spa/contributions/probes/run-route-inventory-published.mjs

@@ -0,0 +1,5 @@
+import runProbe from './route-inventory-published.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-spa-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js' };
+runShim('route-inventory-published', engine, runProbe);

package/blueprints/application-spa/contributions/probes/run-shell-nav-present.mjs

@@ -0,0 +1,5 @@
+import runProbe from './shell-nav-present.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-spa-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js' };
+runShim('shell-nav-present', engine, runProbe);

package/blueprints/application-spa/contributions/probes/shell-nav-present.mjs

@@ -0,0 +1,69 @@
+// shell-nav-present probe for application-spa v1.5.11.
+//
+// Verifies AC-1102-1: navigation renders on every route (not only
+// the shell root). The probe crawls every declared inventory path,
+// GETs each, and asserts the primary <nav> block appears in every
+// rendered page with one link per inventory entry.
+//
+// anchorAcId: application-spa-AC-1102-1.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-spa-REQ-002';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    const routesRes = await fetch(`${fixture.baseUrl}/__routes`);
+    const routesJson = JSON.parse(await routesRes.text());
+    const inventory = routesJson.routes || [];
+    const inventoryNames = inventory.map((r) => r.name);
+
+    const perRoute = {};
+    let allPerRoutePass = true;
+    let firstFailBody = '';
+    let lastRoute = null;
+    let lastBody = null;
+    let lastRes = null;
+
+    for (const r of inventory) {
+      const shellRes = await fetch(`${fixture.baseUrl}${r.path}`);
+      const body = await shellRes.text();
+      lastRes = shellRes; lastBody = body; lastRoute = r.path;
+      const navMatch = body.match(/<nav[^>]+aria-label="Primary"[^>]+data-region="primary-nav"[^>]*>([\s\S]*?)<\/nav>/);
+      const hasNav = !!navMatch;
+      const linksInNav = hasNav
+        ? Array.from(navMatch[1].matchAll(/data-route-name="([^"]+)"/g)).map((m) => m[1])
+        : [];
+      const linksParity = linksInNav.length === inventoryNames.length
+        && inventoryNames.every((n) => linksInNav.includes(n));
+      const routePass = shellRes.status === 200 && hasNav && linksParity;
+      perRoute[r.path] = { status: shellRes.status, hasNav, linksInNav, routePass };
+      if (!routePass) { allPerRoutePass = false; if (!firstFailBody) firstFailBody = body.slice(0, 240); }
+    }
+    const pass = allPerRoutePass && inventory.length > 0;
+
+    results.push({
+      anchorAcId: 'application-spa-AC-1102-1',
+      anchorReqId: 'application-spa-REQ-002',
+      verdict: pass ? 'pass' : 'fail',
+      detail: `Top navigation renders on every route from the - primary <nav aria-label="Primary"> renders on all ${Object.keys(perRoute).length} routes; every route carries links [${inventoryNames.join(',')}]`,
+      evidence: evidenceFromResponse({
+        route: lastRoute || '/',
+        response: lastRes,
+        bodyText: lastBody,
+        extraFields: {
+          input: { inventoryPaths: inventory.map((r) => r.path), inventoryNames },
+          derived: { perRoute, allRoutesRenderNav: allPerRoutePass, firstFailBody },
+        },
+      }),
+    });
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-spa/contributions/tacs/tac-207-application-spa-token-adherence-probe.json

@@ -5,7 +5,7 @@
   "version": "1.0.1",
   "status": "approved",
   "name": "Token adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). Watchpost run4 demonstrated that declaring the discipline does not compel the shipped surface: build cycles ran green while raw hex values sat in component stylesheets. This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit when the discipline is violated, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit on any raw palette literal outside the token-realisation file or any missing light/dark counterpart, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1129-1, AC-1129-4).",
     "Read the design tokens source at a configured path (default `assets/tokens/design-tokens.json` per ADR-202) and enumerate the semantic token key sets for both themes (AC-1129-2).",

package/blueprints/application-spa/contributions/tacs/tac-208-application-spa-icon-adherence-probe.json

@@ -5,7 +5,7 @@
   "version": "1.0.1",
   "status": "approved",
   "name": "Icon adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). Watchpost run4 shipped zero icons across eight surfaces while the build cycle ran green; declaring the discipline is not the same as compelling it. This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit when a component sidesteps the alias registry, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit on any inline SVG outside the registry or any icon reference naming an alias the registry does not declare, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1130-1, AC-1130-4).",
     "Read the icon alias registry at a configured path (default `assets/icons/aliases.json` or the project-declared equivalent per ADR-206) and enumerate the declared alias names (AC-1130-2).",
@@ -50,7 +50,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "Scanning source for inline SVG accepts that a project may sometimes ship a genuinely single-use bespoke glyph; the discipline says such a glyph joins the registry rather than living inline, and the probe surfaces the choice at the ship gate rather than at design review. The alias-reference scanner needs a project-declared reference-shape pattern (JSX prop, function call, or template literal); the probe ships a small pattern library and the project selects the shape it uses. The cost is one line of configuration; the buy is a runtime-observable enforcement that closes the mechanism-reach gap watchpost run4 caught.",
+  "tradeoffs": "Scanning source for inline SVG accepts that a project may sometimes ship a genuinely single-use bespoke glyph; the discipline says such a glyph joins the registry rather than living inline, and the probe surfaces the choice at the ship gate rather than at the design gate. The alias-reference scanner needs a project-declared reference-shape pattern (JSX prop, function call, or template literal); the probe ships a small pattern library and the project selects the shape it uses. The cost is one line of configuration; the buy is a runtime-observable enforcement that closes the mechanism-reach gap this probe cures.",
   "createdAt": "2026-08-24T00:00:00Z",
   "updatedAt": "2026-08-24T00:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-209-application-spa-csp-styled-adherence-probe.json

@@ -5,14 +5,14 @@
   "version": "1.0.2",
   "status": "approved",
   "name": "Styled-under-shipped-CSP adherence probe",
-  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). Watchpost run4 demonstrated the mechanism-reach gap this probe cures: FBS-011 declared a strict CSP (style-src 'self', no unsafe-inline), FBS-013/015 rendered inline <style> blocks, every existing UI-bearing gate passed (28 styled screenshots, browser-verify green), and yet every production page rendered unstyled at deploy because the harness bypassed the production security-header path. This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1131-5, AC-1131-6).",
     "Accept configuration naming (i) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration), (ii) the enumerated set of UI-bearing routes to probe, and (iii) the stylesheet URL every rendered document is expected to link (AC-1131-3, AC-1131-4).",
     "For every enumerated route: navigate a real headless browser to the served URL, capture the response `content-security-policy` header, capture the response body, read the browser's final URL after any redirect chain resolves, run getComputedStyle on document.body, and record the results (AC-1131-1, AC-1131-2, AC-1131-3).",
     "Refuse the run when any captured CSP declares 'unsafe-inline' or 'unsafe-eval' on style-src, when style-src is absent, or when style-src is served as a wildcard (AC-1131-1).",
     "Refuse the run when any captured response body contains a `<style` substring (case-insensitive), including <style> injected by templating helpers (AC-1131-2).",
-    "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, the watchpost run4 partial-acceptance class defect).",
+    "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, `pathMismatch`).",
     "Refuse the run when the computed body backgroundColor for any route is the browser default (`rgba(0, 0, 0, 0)` / `transparent`) or when the computed body fontFamily resolves to an empty value; both indicate the shipped stylesheet did NOT reach the runtime surface under the production headers (AC-1131-3).",
     "Issue a same-origin GET against the linked stylesheet URL through the same server instance and refuse when the response is not 200 with content-type `text/css` (AC-1131-4).",
     "Write a JSON report at a stable relative path (`reports/csp-styled-adherence.json` under the configured report directory, matching the delivery-ci-workflows per-gate report shape of TAC-702) naming: every route probed, the CSP header captured, whether an inline <style> was detected, the computed background and fontFamily values, the stylesheet GET verdict, and an ok / fail verdict (AC-1131-5).",
@@ -55,7 +55,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a real browser and a running server for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the mechanism-reach gap at watchpost run4 proved was missing: build cycles ran green and shipped an unstyled surface because no gate exercised the production header path with a real browser. Driving the shipped construction (not a bespoke harness) is the load-bearing choice; refusing app.inject() satisfaction is deliberate. The requirement that verification runs THROUGH the shipped headers is what makes the AC bite; a probe that stamps its own headers would recreate the class defect it exists to refuse. The v1.0.1 landed-path refusal cures a second gap the same class defect exposed: Playwright's `page.goto` follows redirects by default and returns the FINAL response, so a session-broken authenticated route silently 302'ing to a styled /login left every downstream styled-body assertion validating the login page instead of the requested surface (the watchpost partial-acceptance class defect). Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes the gap without coupling the probe to session-lane internals.",
+  "tradeoffs": "The probe requires a real browser and a running server for every delivery-ci-workflows invocation. That cost buys runtime-observable enforcement of the production header path: driving the shipped construction (not a bespoke harness) is the load-bearing choice, and refusing app.inject() satisfaction is deliberate because a probe that stamps its own headers cannot refuse a CSP defect. The landed-path refusal is necessary because Playwright's `page.goto` follows redirects by default and returns the FINAL response, so without a final-path check a session-broken authenticated route that silently 302's to a styled /login would leave every downstream styled-body assertion validating the login page instead of the requested surface. Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes that gap without coupling the probe to session-lane internals.",
   "createdAt": "2026-08-24T10:30:00Z",
   "updatedAt": "2026-08-31T11:15:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-210-application-spa-external-dependency-provisioning-probe.json

@@ -5,7 +5,7 @@
   "version": "1.0.1",
   "status": "approved",
   "name": "External-service-dependency provisioning adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the deployment-gate class defect the watchpost first-production review caught: the only login path (magic-link email) shipped inert because RESEND_API_KEY was a placeholder, the gap was filed as a 'quirk' in status.md rather than blocked at sign-off, and a real key existed in the estate all along. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md quirk line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for external-service-dependency provisioning discipline. This TAC is the project-realised probe that (a) refuses any placeholder-shape value in a credential field named on the application's external-service-dependency manifest, (b) requires captured live-handshake evidence for every dependency at status 'verified', (c) requires an operator-ratified persistent deferral record for every dependency at status 'deferred' (a README note, a status.md line, or a code comment does NOT satisfy), and (d) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1132-5, AC-1132-6).",
     "Accept configuration naming (i) the path of the application's external-service-dependency manifest, (ii) how to boot the target server for handshake evidence (a Node module or command that starts the same server instance the production entry point starts, with the same route registration and middleware stack), (iii) the path of the ratified-deferrals store the deferral records live in, and (iv) the report directory (AC-1132-1, AC-1132-3, AC-1132-4).",
@@ -64,7 +64,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a running server booted through the production construction and network reach to real external providers for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: the build cycle ran green, sign-off said DEPLOYED, and the only login path was inert on a placeholder credential. Requiring a manifest is a deliberate load-bearing choice: without the manifest, the enumeration set of runtime-reached externals is invisible to the gate. Requiring the ratified-deferrals store to be a persistent machine-readable artefact (not a README note) is the choice that refuses the 'quirk-in-status.md' pattern the class defect exposed. Extending the detector's ruleset in rcf-lite (rather than per-project) is deliberate: one authoritative catalogue of placeholder shapes serves every downstream project.",
+  "tradeoffs": "The probe requires a running server booted through the production construction and network reach to real external providers for every delivery-ci-workflows invocation. Requiring a manifest is a deliberate load-bearing choice: without the manifest, the enumeration set of runtime-reached externals is invisible to the gate. Requiring the ratified-deferrals store to be a persistent machine-readable artefact (not a README note) makes deferrals durable and machine-checkable rather than prose the gate cannot inspect. Extending the detector's ruleset in rcf-lite (rather than per-project) is deliberate: one authoritative catalogue of placeholder shapes serves every downstream project.",
   "createdAt": "2026-08-24T13:00:00Z",
   "updatedAt": "2026-08-24T13:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-211-application-spa-core-flow-e2e-probe.json

@@ -5,7 +5,7 @@
   "version": "1.0.1",
   "status": "approved",
   "name": "Core-flow end-to-end adherence probe",
-  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. Watchpost first production demonstrated the deployment-gate class defect this probe cures: the app was signed off as DEPLOYED, admin access was reachable only via ssh-minted tokens because magic-link email never worked in production, and the authentication core flow was never proven end-to-end in the shipped runtime. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-008 (journey completeness) at ship. This TAC is the project-realised probe that (a) enumerates the app's core flows from a stable manifest and refuses when authentication is absent from the manifest while application-spa-REQ-009 surfaces are present, (b) drives a real browser through every enumerated flow against the shipped runtime and real external-service providers, (c) captures per-flow evidence sufficient to reconstruct the run, (d) refuses on any skipped, timed-out, absent, or failed flow (a documented workaround does NOT satisfy), and (e) writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single '.js' or '.mjs' file) invocable as 'node <path>' with no shell glue; the entry point path is stable and recorded on the aggregate report's 'runner.entryPoint' field when this probe is wired as a delivery-ci-workflows gate (AC-1133-5, AC-1133-6).",
     "Accept configuration naming (i) the path of the application's core-flow manifest, (ii) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration, the same production security-header stack, and the same middleware), (iii) how to reach real external-service providers (the deferrals-permission is the same shape as TAC-210 accepts for its 'deferred' entries), and (iv) the report directory (AC-1133-1, AC-1133-2, AC-1133-4).",
@@ -64,7 +64,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a real browser, the shipped server construction, and network reach to real external providers for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the watchpost first-production defect proved was missing: sign-off said DEPLOYED, admin login was only reachable via a manually minted token, and no gate demanded the auth flow work end-to-end in the shipped runtime. Requiring an auth-flow-enumeration hard invariant is deliberate: authentication is the flow the class-defect instance exposed, and its enumeration cannot be optional when application-spa-REQ-009 surfaces are present. Refusing to accept a 'documented workaround' as sign-off is the choice that refuses the 'quirk-in-status.md' pattern; the aggregate 'deployed-with-defects' vocabulary is what the probe emits to name the distinction between 'shipped and accepted' and 'shipped with a broken core flow'.",
+  "tradeoffs": "The probe requires a real browser, the shipped server construction, and network reach to real external providers for every delivery-ci-workflows invocation. Requiring an auth-flow-enumeration hard invariant is deliberate: authentication cannot be optional when application-spa-REQ-009 surfaces are present, because a manifest that omits it would silently permit a shipped surface with no proven login path. Refusing to accept a 'documented workaround' as passing is what forces broken or skipped flows into the aggregate; the 'ok' | 'deployed-with-defects' vocabulary is what the probe emits to name the distinction between 'every core flow proved' and 'shipped with a broken or unproven core flow'.",
   "createdAt": "2026-08-24T13:00:00Z",
   "updatedAt": "2026-08-24T13:00:00Z"
 }

package/blueprints/application-spa/contributions/user-stories/application-spa-us-1131.json

@@ -31,7 +31,7 @@
     },
     {
       "id": "AC-1131-3",
-      "description": "Every UI-bearing route renders styled UNDER the shipped strict CSP, AND the probe proves it exercised the requested surface (not a page a redirect would land on). A browser-driven check drives the same server instance that stamps the production security headers, navigates each enumerated UI route, and asserts (a) the browser's final URL path equals the requested route path; a silent redirect (for example an authenticated route 302'ing to /login when the harness session is broken) is a hard refusal because a headless browser follows redirects by default and would otherwise validate the redirect target's styled state seven times over, and (b) the computed body background is NOT the browser default (rgba(0,0,0,0) / transparent) and the computed body font-family resolves to a non-empty value. Verification runs through the production header path; a harness that strips the security headers, injects nonces the CSP does not declare, or invokes the app via app.inject() rather than a real browser fetch does NOT satisfy the AC. Cures the class of harness where a broken session lane silently causes every route assertion to run against /login (styled) and pass (a partial-acceptance class defect a prior review caught). Applying agent sets: the enumerated list of UI-bearing routes to probe, the production boot command the probe invokes, and the strict-CSP header set the production runtime stamps on every response.",
+      "description": "Every UI-bearing route renders styled UNDER the shipped strict CSP, AND the probe proves it exercised the requested surface (not a page a redirect would land on). A browser-driven check drives the same server instance that stamps the production security headers, navigates each enumerated UI route, and asserts (a) the browser's final URL path equals the requested route path; a silent redirect (for example an authenticated route 302'ing to /login when the harness session is broken) is a hard refusal because a headless browser follows redirects by default and would otherwise validate the redirect target's styled state seven times over, and (b) the computed body background is NOT the browser default (rgba(0,0,0,0) / transparent) and the computed body font-family resolves to a non-empty value. Verification runs through the production header path; a harness that strips the security headers, injects nonces the CSP does not declare, or invokes the app via app.inject() rather than a real browser fetch does NOT satisfy the AC. Applying agent sets: the enumerated list of UI-bearing routes to probe, the production boot command the probe invokes, and the strict-CSP header set the production runtime stamps on every response.",
       "given": "a server booted through the project's production entry point with every UI-bearing route registered",
       "when": "a real browser navigates each enumerated route, its final URL is read, and getComputedStyle(document.body) is read",
       "then": "the final URL path equals the requested route (no silent redirect chain to another surface) AND the computed background is not the browser default AND the computed font-family resolves; on any route the check fails, the run refuses ship with a per-route diagnostic naming the requested and landed paths",

package/blueprints/application-spa/docs/topics.md

@@ -79,4 +79,4 @@ Suffix-family ids (ADR, TAC) are string-distinct once slug-suffixed. SPA numbers
 
 ## v1.0.0 US-1101 collision note (preserved)
 
-In run4 of the watchpost case study, a project-side `US-1101` derived mechanically from `REQ-011` (leading `11` + sequence `01`) collided with the application-spa blueprint's `application-spa-us-1101` at the AC-id-scoping bucket. The seat allocated the project story as `US-1181` and moved on. Lesson: keep contributions on the LOW end of the band and leave headroom at the HIGH end for project-side stories that mechanically derive to your numbers. v1.1 preserves this lesson: US-1129 and US-1130 remain at the low end.
+A project-side `US-1101` derived mechanically from `REQ-011` (leading `11` + sequence `01`) collides with the application-spa blueprint's `application-spa-us-1101` at the AC-id-scoping bucket; the project story is allocated as `US-1181` instead. Rule: keep contributions on the LOW end of the band and leave headroom at the HIGH end for project-side stories that mechanically derive to your numbers. v1.1 preserves this rule: US-1129 and US-1130 remain at the low end.