rcf-lite 0.27.0 → 0.28.0

package/blueprints/application-account-settings/contributions/probes/sessions-surface-shape.mjs

@@ -0,0 +1,70 @@
+// application-account-settings probe: sessions surface renders under
+// sessionInventory with data-session-id rows and required columns
+// (AC-25105-1). Varies input: with vs without sessionInventory.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-account-settings-AC-25105-1';
+export const accountBound = false;
+
+const FIRST_EIGHT = 'When sessionInventory is in the applied capability set,';
+
+export default async function runProbe() {
+  const results = [];
+  const withCap = await startFixture({ env: { ACCOUNT_SETTINGS_CAPS: 'principalDirectory,sessionInventory' } });
+  try {
+    const r = await fixtureFetch(withCap.url, '/account/sessions');
+    const surface = /<div data-surface="sessions"/.test(r.body);
+    const rowIds = [...new Set([...r.body.matchAll(/data-session-id="([^"]+)"/g)].map((m) => m[1]))];
+    const deviceCells = (r.body.match(/data-column="device"/g) || []).length;
+    const lastActiveCells = (r.body.match(/data-column="lastActive"/g) || []).length;
+    const pass = r.status === 200 && !!r.requestId
+      && surface
+      && rowIds.length > 0
+      && deviceCells === rowIds.length
+      && lastActiveCells === rowIds.length;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-account-settings-AC-25105-1: per-row terminate control wired to a session-termination API and its activation cycle (the AC clauses beyond the DOM shape) are not present in this fixture and not observed by this Node HTTP probe; the sessions-surface row + device + lastActive walk under sessionInventory is a partial observation of AC-25105-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `${FIRST_EIGHT} GET /account/sessions returned 200 with data-surface="sessions" rendered; derived rows=${rowIds.length}, [data-column="device"] cells=${deviceCells}, [data-column="lastActive"] cells=${lastActiveCells} equal to row count (terminate control per row); x-fixture-request-id=${r.requestId}`
+        : `${FIRST_EIGHT} evidence gap: status=${r.status} rid=${r.requestId} surface=${surface} rows=${rowIds.length} device=${deviceCells} lastActive=${lastActiveCells}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<div data-surface="sessions"[^]{0,240}/) || [''])[0]),
+        derived: { rowCount: rowIds.length, deviceCells, lastActiveCells },
+      },
+    });
+  } finally {
+    await withCap.kill();
+  }
+
+  const noCap = await startFixture({ env: { ACCOUNT_SETTINGS_CAPS: 'principalDirectory' } });
+  try {
+    const r = await fixtureFetch(noCap.url, '/account/sessions');
+    const surface = /<div data-surface="sessions"/.test(r.body);
+    const rowCount = (r.body.match(/data-session-id="[^"]+"/g) || []).length;
+    const pass = r.status === 200 && !!r.requestId && !surface && rowCount === 0;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-account-settings-AC-25105-1: per-row terminate control wired to a session-termination API (the positive-branch contract the AC also carries) is not present in this fixture and not observed by this Node HTTP probe; the sessions-absence walk when sessionInventory is not applied is a partial observation of AC-25105-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `${FIRST_EIGHT} absence branch: with sessionInventory not applied, AC-25105-1's stated "Absent when sessionInventory is not applied" clause is observed - no data-surface="sessions" subtree and no data-session-id rows render; x-fixture-request-id=${r.requestId}`
+        : `${FIRST_EIGHT} absence gap: status=${r.status} rid=${r.requestId} surface=${surface} rows=${rowCount}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt(r.body.slice(0, 240)),
+        derived: { surface, rowCount },
+      },
+    });
+  } finally {
+    await noCap.kill();
+  }
+  return { results };
+}

package/blueprints/application-account-settings/contributions/probes/shell-tablist-per-capability.mjs

@@ -0,0 +1,60 @@
+// application-account-settings probe: tabs shell renders one
+// role="tab" per applied capability plus the always-on profile tab
+// (AC-25101-1).
+//
+// Varied inputs: three caps configurations produce three different
+// derived tab counts. The probe asserts the derived tab count on the
+// rendered nav matches the sum of the always-on tab + the enabled
+// capability tabs.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-account-settings-AC-25101-1';
+export const accountBound = false;
+
+const FIRST_EIGHT = 'Given an authenticated principal AND an applied auth';
+
+function countTabs(body) {
+  return (body.match(/<a role="tab"[^>]*>/g) || []).length;
+}
+
+async function tabsFor(fixture, caps, apps) {
+  const q = new URLSearchParams({ caps: caps.join(','), apps: apps.join(',') });
+  const r = await fixtureFetch(fixture.url, `/account?${q.toString()}`);
+  return { r, count: countTabs(r.body) };
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const configs = [
+      { name: 'profile-only', caps: ['principalDirectory'], apps: [], expected: 1 },
+      { name: 'profile+sessions', caps: ['principalDirectory', 'sessionInventory'], apps: [], expected: 2 },
+      { name: 'profile+security+sessions+notifications+theme', caps: ['principalDirectory', 'credentialSelfService', 'sessionInventory'], apps: ['application-notifications-in-app', 'application-spa'], expected: 5 },
+    ];
+    for (const cfg of configs) {
+      const { r, count } = await tabsFor(fixture, cfg.caps, cfg.apps);
+      const tablistPresent = /<nav[^>]*role="tablist"/.test(r.body);
+      const pass = r.status === 200 && !!r.requestId && count === cfg.expected && tablistPresent;
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: 'application-account-settings-AC-25101-1: capability-to-tab-label mapping (each tab labels the correct capability against a shipped tab-label registry) is not verified by this Node HTTP probe; the derived tab-count walk across three caps configurations is a partial observation of AC-25101-1',
+        verdict: pass ? 'warn' : 'fail',
+        detail: pass
+          ? `${FIRST_EIGHT} blueprint declaring principalDirectory, GET /account?caps=${cfg.caps.join(',')}&apps=${cfg.apps.join(',')} (${cfg.name}) returned 200 with role="tablist" nav and derived tab count=${count} matching expected=${cfg.expected} (always-on profile plus one tab per applied capability); x-fixture-request-id=${r.requestId}`
+          : `${FIRST_EIGHT} blueprint gap for ${cfg.name}: status=${r.status} rid=${r.requestId} tabs=${count} expected=${cfg.expected} tablist=${tablistPresent}`,
+        evidence: {
+          requestId: r.requestId,
+          responseStatus: r.status,
+          bodyExcerpt: excerpt((r.body.match(/<nav[^>]*role="tablist"[^]{0,240}/) || [''])[0]),
+          derived: { config: cfg.name, capsInput: cfg.caps, appsInput: cfg.apps, tabCount: count, expected: cfg.expected, tablistPresent },
+        },
+      });
+    }
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-account-settings/contributions/probes/theme-radiogroup.mjs

@@ -0,0 +1,126 @@
+// application-account-settings probe: theme surface renders as a
+// radiogroup with three options when application-spa is applied, and
+// the server-scoped theme-persistence variant persists a written
+// theme across a subsequent GET (AC-25108-1).
+//
+// AC-25108-1 has TWO observable halves from a Node HTTP probe:
+//   (a) the server-scoped-persistence half - when the applied
+//       theme-persistence store is 'server-scoped', a POST /api/theme
+//       write is reflected on the next GET /account/theme's initial
+//       html data-theme attribute (server-rendered, no browser JS
+//       involved); DELETE /api/theme clears the record and the next
+//       GET returns to the default; and
+//   (b) the DOM-shape half - the radiogroup markup, three named
+//       radios and the data-persist reflection of the elicit input.
+// The interaction half of AC-25108-1 - the user selecting a radio,
+// the client-side script flipping the html data-theme attribute and
+// writing spa-local-storage - is browser-driven and is NOT observed
+// here; that row de-claims via conformanceOnly with a limitation
+// naming the browser-only clause. (A dedicated browser-driven pack
+// check owns the interaction observation.)
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorAcId = 'application-account-settings-AC-25108-1';
+export const accountBound = false;
+
+const FIRST_EIGHT_SPA = 'When application-spa is in the applied-blueprint set, GET';
+
+export default async function runProbe() {
+  const results = [];
+
+  // Row 1: DOM shape (radiogroup, three radios, data-persist reflect).
+  const withSpa = await startFixture({ env: { ACCOUNT_SETTINGS_APPS: 'application-spa' } });
+  try {
+    const persist = 'spa-local-storage';
+    const r = await fixtureFetch(withSpa.url, `/account/theme?theme-persistence=${encodeURIComponent(persist)}`);
+    const radiogroup = /<div data-surface="theme"[^>]*role="radiogroup"[^>]*aria-label="Theme"[^>]*data-persist="([^"]+)"/.exec(r.body);
+    const derivedPersist = radiogroup ? radiogroup[1] : null;
+    const options = [...r.body.matchAll(/<input type="radio" name="theme" value="([^"]+)"[^>]*>/g)].map((m) => m[1]);
+    const optSet = new Set(options);
+    const hasAll = ['light', 'dark', 'system'].every((v) => optSet.has(v));
+    const shapePass = r.status === 200 && !!r.requestId
+      && !!radiogroup && derivedPersist === persist
+      && options.length === 3 && hasAll;
+    // Conformance-only: the DOM shape is a partial observation of
+    // AC-25108-1. Null anchor per rule 11; the limitation names the
+    // AC and the interaction clause NOT observed here.
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      verdict: shapePass ? 'warn' : 'fail',
+      limitation: 'application-account-settings-AC-25108-1: interaction half (user selecting a radio, client script flipping html data-theme, spa-local-storage write) is browser-driven and not observed from a Node HTTP probe',
+      detail: shapePass
+        ? `${FIRST_EIGHT_SPA} /account/theme's server-rendered shell is a radiogroup with role="radiogroup", aria-label="Theme", data-persist="${derivedPersist}" (reflects the theme-persistence elicit input=${persist}), and three radios ${JSON.stringify(options)} matching light/dark/system; conformance-only observation of the DOM-shape half of AC-25108-1`
+        : `${FIRST_EIGHT_SPA} /account/theme conformance-shape gap: status=${r.status} rid=${r.requestId} radiogroup=${!!radiogroup} derivedPersist=${derivedPersist} options=${JSON.stringify(options)}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<div data-surface="theme"[^]{0,260}/) || [''])[0]),
+        derived: { persistInput: persist, derivedPersist, options, dataSurfacePresent: !!radiogroup, hasAllRadios: hasAll },
+      },
+    });
+
+    // Row 2: server-scoped persistence half of AC-25108-1. Observable
+    // server-side: POST /api/theme?theme=X writes; GET reflects on
+    // data-theme; DELETE clears; a further GET drops back to default.
+    const principalId = 'probe-theme-' + randomUUID();
+    const persistServer = 'server-scoped';
+    const chosenTheme = 'dark';
+    const before = await fixtureFetch(withSpa.url, `/account/theme?theme-persistence=${persistServer}&principal-id=${principalId}`);
+    const beforeMatch = before.body.match(/<html[^>]*data-theme="([^"]+)"/);
+    const beforeTheme = beforeMatch ? beforeMatch[1] : null;
+    const write = await fixtureFetch(withSpa.url, `/api/theme?theme=${chosenTheme}&theme-persistence=${persistServer}&principal-id=${principalId}`, { method: 'POST' });
+    const writeBody = (() => { try { return JSON.parse(write.body || '{}'); } catch (e) { return {}; } })();
+    const after = await fixtureFetch(withSpa.url, `/account/theme?theme-persistence=${persistServer}&principal-id=${principalId}`);
+    const afterHtmlTheme = (after.body.match(/<html[^>]*data-theme="([^"]+)"/) || [null, null])[1];
+    const afterDataServerScoped = (after.body.match(/data-server-scoped-theme="([^"]*)"/) || [null, null])[1];
+    const afterDarkChecked = /<input type="radio" name="theme" value="dark"[^>]*checked/.test(after.body);
+    const clear = await fixtureFetch(withSpa.url, `/api/theme?theme-persistence=${persistServer}&principal-id=${principalId}`, { method: 'DELETE' });
+    const cleared = await fixtureFetch(withSpa.url, `/account/theme?theme-persistence=${persistServer}&principal-id=${principalId}`);
+    const clearedHtmlTheme = (cleared.body.match(/<html[^>]*data-theme="([^"]+)"/) || [null, null])[1];
+    const clearedDataServerScoped = (cleared.body.match(/data-server-scoped-theme="([^"]*)"/) || [null, null])[1];
+    const serverScopedPass = before.status === 200 && write.status === 200 && writeBody.ok === true
+      && after.status === 200 && afterHtmlTheme === chosenTheme && afterDataServerScoped === chosenTheme && afterDarkChecked
+      && clear.status === 200 && cleared.status === 200 && clearedHtmlTheme === 'light' && (!clearedDataServerScoped || clearedDataServerScoped.length === 0);
+    results.push({
+      anchorAcId,
+      verdict: serverScopedPass ? 'pass' : 'fail',
+      detail: serverScopedPass
+        ? `${FIRST_EIGHT_SPA} /account/theme with theme-persistence=server-scoped: for a fresh principalId, initial GET rendered html data-theme=${beforeTheme}; POST /api/theme?theme=${chosenTheme} wrote the record; a subsequent GET rendered html data-theme=${afterHtmlTheme} with data-server-scoped-theme=${afterDataServerScoped} and the dark radio checked; DELETE /api/theme cleared; a final GET fell back to html data-theme=${clearedHtmlTheme}. Server-scoped persistence observed across requests; x-fixture-request-id (final)=${cleared.requestId}`
+        : `${FIRST_EIGHT_SPA} /account/theme with theme-persistence=server-scoped (gap): before=${beforeTheme} write=${write.status}/${writeBody.ok} afterHtmlTheme=${afterHtmlTheme} afterServerScoped=${afterDataServerScoped} afterDarkChecked=${afterDarkChecked} clear=${clear.status} clearedHtmlTheme=${clearedHtmlTheme}`,
+      evidence: {
+        requestId: cleared.requestId,
+        responseStatus: cleared.status,
+        bodyExcerpt: excerpt((after.body.match(/<html[^]{0,320}/) || [''])[0]),
+        derived: {
+          principalId,
+          beforeTheme,
+          writtenTheme: chosenTheme,
+          afterHtmlTheme,
+          afterDataServerScoped,
+          afterDarkChecked,
+          clearedHtmlTheme,
+        },
+      },
+    });
+
+    // Row 3: interaction half is browser-only. notObservableHere
+    // anchored to AC-25108-1 with verdict warn (never pass). The
+    // aggregate() rule lifts any warn row to a warn aggregate, so this
+    // row makes the probe amber-on-the-shelf honestly without letting
+    // the interaction clause pass unobserved.
+    results.push({
+      anchorAcId,
+      notObservableAcId: anchorAcId,
+      notObservableHere: true,
+      verdict: 'warn',
+      reason: 'AC-25108-1 requires observing a principal selecting a theme radio, the html element data-theme attribute flipping to the chosen value in response to that user input event, and (for the spa-local-storage store) the client-side localStorage write. Change-event firing, DOM mutation on user input, and localStorage writes are browser-driven and cannot be observed from a Node HTTP probe; the browser-verify pack owns this observation.',
+      detail: `${FIRST_EIGHT_SPA} /account/theme's interaction half - user selection firing a change event, the client script flipping html data-theme on that event, and the spa-local-storage write - is browser-driven and observed by the browser-verify pack, not by this Node probe; anchored as notObservableHere for AC-25108-1 so the row does not falsely claim positive evidence`,
+    });
+  } finally {
+    await withSpa.kill();
+  }
+  return { results };
+}

package/blueprints/application-admin-console/CHANGELOG.md

@@ -1,5 +1,31 @@
 # application-admin-console CHANGELOG
 
+## 1.3.6 - 2026-09-12
+
+- Positive-evidence row shape tightened in the anatomy helper: a positive row now requires a non-empty engine-returned `requestId` AND (a non-empty `bodyExcerpt` OR a non-empty `derived` object); a `{derived:{}}` alone or a `requestId` alone no longer counts, with two new negative-case tests covering the empty-derived and id-only patterns. Anatomy negative-variant map extended with `{brk:"local-login-form", probes:["sign-in-access-gated-surface"]}` so the shipped `?break=local-login-form` fixture switch drives the positive AC-21816-1 local-login row to fail (the break drops the `[data-role="local-login-form"]` region on the sign-in surface). No probe or fixture behaviour change on the admin-console family beyond the anatomy shape helper and the negative-variant coverage.
+
+## 1.3.5 - 2026-09-12
+
+- Rule-7d shape fix on every de-claimed conformance row across users-directory (four AC-21102-1 / AC-21102-2 rows), permission-matrix (AC-21103-1), org-switcher (AC-21104-1), audit-log (AC-21105-1) and sign-in-access-gated (AC-21815-2): each row now carries `anchorAcId: null` and names the anchored AC in the `limitation` field per the shipped shape (a `conformanceOnly:true` row must not simultaneously claim an anchor). Positive-observation rows on AC-21815-1, AC-21816-1 and the org-switcher AC-21104-2 no-tenancy branch stay anchored. Fixture README env-var manifest now declares `PROBE_BREAK` (the fixture reads it as an alternate to `ADMIN_CONSOLE_BREAK` / `?break=`) and the probe-utils `DECLARED_ENV` list mirrors the addition. Anatomy shape check tightened to reject an anchored `conformanceOnly` row (a positive evidence field no longer bypasses the null-anchor + limitation contract); a new negative-case test constructs an anchored `conformanceOnly` row and asserts the shape helper throws.
+
+## 1.3.4 - 2026-09-11
+
+- Shared `aggregate()` no longer promotes warn rows to pass: any row with verdict warn (including honest de-claim rows) lifts the aggregate to warn; a probe whose rows are all warn aggregates to warn, not pass. Shared teardown propagates a SIGKILL failure through the returned kill() promise instead of swallowing it. Overclaiming rows across users-directory (AC-21102-1, AC-21102-2), permission-matrix (AC-21103-1), org-switcher (AC-21104-1), audit-log (AC-21105-1) and sign-in-access-gated (AC-21815-2) are de-claimed to `conformanceOnly:true` with `verdict:'warn'` and a `limitation` field naming the anchored AC and the varied-input or browser-only clause that lives outside the Node HTTP probe. Positive-observation rows kept on AC-21815-1 (Access-gated Authorization-bearing surface), AC-21816-1 (local-login fallback) and the org-switcher no-tenancy 404 branch. Anatomy test extended with a negative-variant assertion that the shipped fixture break switches drive the affected probe aggregates to fail.
+
+## 1.3.3 - 2026-09-11
+
+- sign-in-access-gated-surface fixture now returns HTTP 403 with the `[data-surface="access-denied"]` region (and no `[data-role="principal-read"]` element) when `zeroTrustGate` is applied AND no Authorization header is present, wiring the previously-dead `renderSignInAccessDenied` branch to observe AC-21815-2's refusal contract server-side. The probe's AC-21815-2 row is now a positive-evidence row (HTTP 403 + access-denied surface + absence of principal-read) rather than a `notObservableHere` de-claim. Consumers that expected the previous 200-with-default-principal shape (`edge-cloudflare-access` TC-117, TC-118, TC-119 and its admin-console-gate-surface probe) send an Authorization header on the gated caps path; the local-login branch (no `zeroTrustGate`) is unchanged. Anatomy test extended to enumerate the shipped AC/REQ id set and refuse any row whose anchor is not in it, and to accept the conformance-only row shape.
+
+## 1.3.2 - 2026-09-11
+
+- users-directory-surface split into per-AC rows: AC-21102-1 anchors the directory listing observation; AC-21102-2 anchors the invite and deactivate controls (previously conflated on one row). org-switcher-surface fixture now returns HTTP 404 on the no-tenancy path so the probe can observe the AC-21104-2 refusal status (previously the fixture returned 200 with not-found HTML, contradicting the AC). audit-log-surface probe now drives a real write-then-read cycle: POST /api/members/:id/role writes an audit entry and GET /admin/audit reads it back, observing AC-21105-1 rather than a hard-coded table. sign-in-access-gated-surface probe now varies an Authorization principal and observes the derived email on the principal-read element; the local-fallback row is anchored under AC-21816-1. permission-matrix-grid vacuous `.every()` over an empty label array replaced with a check that asserts at least one label exists and every cell carries one per AC-21103-1. Positive-anchor-on-absence broken-variant rows removed. Rule 10 applied to every row detail. Anatomy test extended to accept notObservableHere row shape. Register cleanup.
+
+
+## 1.3.1 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering 5 properties the fixture engine at `packages/rcf-lite/test/fixtures/probe-pack-application-admin-console/server.js` answers: `users-directory-surface`, `permission-matrix-grid`, `org-switcher-surface`, `audit-log-surface`, `sign-in-access-gated-surface`. Every response now carries an `x-fixture-request-id` header; probes record the id, the HTTP status and a body excerpt as positive evidence per rule 7d. Fixture README declares every env var the pack reads. Anatomy test at `packages/rcf-lite/test/blueprint/application-admin-console-anatomy.test.js` pins the new pack files and asserts each result carries one of the four 7d evidence shapes.
+
+
 ## 1.3.0 (2026-09-10)
 
 ### Added
@@ -20,13 +46,13 @@
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.2.0 (2026-09-10, hardening pass)
+## 1.2.0 (2026-09-10)
 
 ### Added
 
-- REQ-007 (invite-transport option coverage) and US-21110: every invite-transport option (email, in-app-only, custom) now carries a runtime clause and a story binding accepted, failed and recorded outcomes with a per-invite audit record. Closes review finding [application-admin-console] F-1.
-- REQ-008 (tenancy-shape option coverage) and US-21111: the elicited tenancy-shape (per-user, per-org, both) now determines directory membership, org switcher entries, invite scope and cross-shape refusal (TENANCY_SHAPE_REFUSAL). Closes review finding [application-admin-console] F-2.
-- Failure-path acceptance criteria on US-21106 (request-access POST failure) and US-21107 (empty union entry for a library-qualified source unavailable locally) closing findings F-3 and F-4; failure-path AC on US-21815 for a gated request with no request.auth closing finding F-5.
+- REQ-007 (invite-transport option coverage) and US-21110: every invite-transport option (email, in-app-only, custom) now carries a runtime clause and a story binding accepted, failed and recorded outcomes with a per-invite audit record.
+- REQ-008 (tenancy-shape option coverage) and US-21111: the elicited tenancy-shape (per-user, per-org, both) now determines directory membership, org switcher entries, invite scope and cross-shape refusal (TENANCY_SHAPE_REFUSAL).
+- Failure-path acceptance criteria on US-21106 (request-access POST failure) and US-21107 (empty union entry for a library-qualified source unavailable locally); failure-path AC on US-21815 for a gated request with no request.auth.
 - Vendor citations on the WCAG 2.4.6 / 3.3.4 / 4.1.3 fixed acceptance criteria and on the ARIA APG grid pattern criteria (verified 2026-09-10).
 
 ### Changed
@@ -34,7 +60,7 @@
 - Every REQ now carries a deliveredBy link into TAC-2201, TAC-2203, TAC-2204 or TAC-2214.
 - Every AC on every user story now carries an explicit disposition (fixed or template); template ACs state the values the applying agent sets.
 - TAC-2201 responsibilities now include deliverInvite (per invite-transport branch), tenancyShapeGate (per tenancy shape), delegateUsersSurface, delegateOrgsSurface, renderAccessDenied and renderShell so the deliveredBy fields resolve.
-- Review fix pass (2026-09-10): REQ-005 extended with an audit-retention-days runtime clause naming the string elicit and its refusal branch; US-21105 gained a template AC (AC-21105-3) carrying `Applying agent sets: audit-retention-days.`; README and ADR-2201 register scrubbed (no operator names). Closes review-fix-pass finding F-3 for the audit-retention-days string elicit.
+- REQ-005 extended with an audit-retention-days runtime clause naming the string elicit and its refusal branch; US-21105 gained a template AC (AC-21105-3) carrying `Applying agent sets: audit-retention-days.`.
 
 ## 1.1.0 (2026-09-07)
 
@@ -50,7 +76,7 @@
 
 ## 1.0.0 (visual round, spec 2026-09-04)
 
-- First ratified version of the shelf's admin-console blueprint. Six REQs (console shell with no dead links, conditional users, conditional roles with Owner + Admin + Member + Viewer baseline, conditional orgs, conditional audit-log, access-denied plus request-access), nine USs 21101-21109 binding 16 runtime-observable ACs, four TACs 2201-2204 (shell, capability discovery, permission matrix, audit view consuming datatable), four ADRs 2201-2204 (capability vocabulary, baseline roles, invite transport, audit retention). No new global topics.
+- Initial shipped version of the shelf's admin-console blueprint. Six REQs (console shell with no dead links, conditional users, conditional roles with Owner + Admin + Member + Viewer baseline, conditional orgs, conditional audit-log, access-denied plus request-access), nine USs 21101-21109 binding 16 runtime-observable ACs, four TACs 2201-2204 (shell, capability discovery, permission matrix, audit view consuming datatable), four ADRs 2201-2204 (capability vocabulary, baseline roles, invite transport, audit retention). No new global topics.
 - Introduces the capability-declaration mechanism: `capabilities[]` on identity blueprints (v1.1.0 minor bumps on magic-link, clerk, oauth2, keycloak land in the same PR per spec Q2 default), `requiresAppliedCapabilities` and `elicits[]` on consumer blueprints, apply-time discovery via source read-back on `manifest.blueprints[]`, exit-3 refusal with the spec 5.5.1 verbatim message on bare-SPA applies, and a `--allow-no-auth-yet` operator override.
 - Persists per-project apply-time state in a sidecar `rcf/blueprints/application-admin-console.applied.json` (the applied-blueprint-record schema in rcf-schemas 0.6.0 is closed under additionalProperties:false; the source-manifest read-back precedent from the core-companions train applies here). The sidecar carries `appliedCapabilities`, `appliedElicitations`, `allowNoAuthYet?` and `notes?`.
 - Ships `probe-packs/application-admin-console.pack.mjs`: four capability-gated browser-verify checks anchored to AC-21102-1 (users), AC-21103-1 (permission matrix), AC-21104-1 (org switcher), AC-21105-1 (audit-log surface). Each check reads the applied capability sidecar and records `applicable: false` where its required capability is absent (residual cure). Fifth shipped consumer of the earlier release probe-pack runner extension.

package/blueprints/application-admin-console/README.md

@@ -26,7 +26,7 @@ Refuses with exit 3 and the spec 5.5.1 verbatim message on a project with no app
 | Applied capability | Surface | Rendered by |
 |---|---|---|
 | `principalDirectory` | Users directory (`/admin/users`) | Any applied auth blueprint (magic-link, clerk, oauth2, keycloak). |
-| `roleModel` | Permission matrix (`/admin/roles`) | Clerk, OAuth2, Keycloak. Magic-link does NOT declare it, so a bare-magic-link project gets NO roles surface (per the ratified spec section 5.5 worked example). |
+| `roleModel` | Permission matrix (`/admin/roles`) | Clerk, OAuth2, Keycloak. Magic-link does NOT declare it, so a bare-magic-link project gets NO roles surface (per the shipped spec section 5.5 worked example). |
 | `tenancy` | Org switcher (`/admin/orgs`), org-scoped invites | Reserved for a future `application-tenancy-orgs` blueprint (spec section 11). No shelf provider today. |
 | `auditLog` | Audit-log surface (`/admin/audit`) | Via the applied `observability-logging` companion (implicit), or a future dedicated audit-log blueprint. |
 | (none) | Access-denied + request-access | Always renders for a non-admin principal reaching `/admin/*`. |

package/blueprints/application-admin-console/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-admin-console",
-  "version": "1.3.0",
+  "version": "1.3.6",
   "category": "application",
   "requiresAppliedCapabilities": {
     "capabilities": [
@@ -285,5 +285,7 @@
   ],
   "optionalCapabilities": [
     "zeroTrustGate"
-  ]
+  ],
+  "updatedAt": "2026-09-12T00:45:12Z",
+  "updatedIso": "2026-09-11T22:30:00Z"
 }

package/blueprints/application-admin-console/contributions/adrs/adr-2201-application-admin-console-capability-vocabulary.json

@@ -7,7 +7,7 @@
   "title": "Capability vocabulary: principalDirectory, roleModel, tenancy, auditLog as the v1 capability set",
   "context": "Admin-console surfaces are conditional on what the applied identity blueprint provides. The vocabulary must be small (four strings today), extensible (the section 6a table is chunk-zero, so a future capability lands with a docs edit and no code change), and grounded in industry practice (SaaS UI research, IAM literature). The ratified 2026-09-04 shelf decision 5 lands the initial four capabilities as principalDirectory, roleModel, tenancy and auditLog.",
   "decision": "v1.0.0 declares four capability strings the applied identity blueprints can declare in their capabilities[] field: principalDirectory (identifies principals for a users surface); roleModel (declares operator-visible role labels for a permission matrix); tenancy (declares an organisation abstraction the console can switch across); auditLog (emits an event stream the audit view can read). The vocabulary lives in packages/rcf-lite/docs/blueprint-authoring.md section 6a as a table extending the roles registry; the loader validates capability SHAPE (lower camelCase on ^[a-z][a-zA-Z0-9]*$), not the vocabulary. A future capability lands by adding a table row and adopting it on an identity blueprints minor bump.",
-  "consequences": "The console renders only surfaces the applied capabilities enable, so a bare magic-link project gets a users surface but no roles surface (per the ratified spec section 5.5 worked example). A future dedicated audit-log blueprint declaring auditLog directly (rather than through observability-logging) composes cleanly. A new capability lands additively.",
+  "consequences": "The console renders only surfaces the applied capabilities enable, so a bare magic-link project gets a users surface but no roles surface (per the shipped spec section 5.5 worked example). A future dedicated audit-log blueprint declaring auditLog directly (rather than through observability-logging) composes cleanly. A new capability lands additively.",
   "alternativesConsidered": [
     {
       "name": "Encode the vocabulary in code as an enum",

package/blueprints/application-admin-console/contributions/probes/audit-log-surface.mjs

@@ -0,0 +1,79 @@
+// application-admin-console probe: audit-log surface (AC-21105-1).
+//
+// AC-21105-1 requires: given a role change AND the auditLog capability
+// applied, an audit-log entry writes with actor, target, before, after,
+// timestamp and correlationId from the logging companion; the entry
+// surfaces on the audit view table where every row is enumerable by
+// data-audit-id and every cell exposes its column via a data-column
+// attribute.
+//
+// The probe drives a real role change: POST /api/members/:id/role,
+// then GET /admin/audit and assert the DOM row for the new audit id
+// carries the changed before/after values. Row detail opens on the
+// first eight words of AC-21105-1 (rule 10).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-admin-console-AC-21105-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory,auditLog' } });
+  const results = [];
+  try {
+    // Drive the role change and capture the emitted audit id.
+    const targetMemberId = 'u3';
+    const nextRole = 'Admin';
+    const postRes = await fixtureFetch(fixture.url, `/api/members/${targetMemberId}/role`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ role: nextRole, actor: 'probe@example.test' }),
+    });
+    let postBody = null;
+    try { postBody = JSON.parse(postRes.body); } catch { postBody = null; }
+    const newAuditId = postBody && typeof postBody.auditId === 'string' ? postBody.auditId : null;
+    const postBefore = postBody && typeof postBody.before === 'string' ? postBody.before : null;
+    const postAfter = postBody && typeof postBody.after === 'string' ? postBody.after : null;
+
+    // GET the audit view and assert the new audit row is present with
+    // the changed before/after and every required column carries a
+    // data-column attribute.
+    const r = await fixtureFetch(fixture.url, '/admin/audit');
+    const rowIds = [...new Set([...r.body.matchAll(/data-audit-id="([^"]+)"/g)].map((m) => m[1]))];
+    const requiredColumns = ['actor', 'target', 'before', 'after', 'timestamp', 'correlationId'];
+    const allColumnsPresent = requiredColumns.every((col) => new RegExp(`<th data-column="${col}">`).test(r.body));
+    const newRowRegex = newAuditId
+      ? new RegExp(`<tr data-audit-id="${newAuditId}">[^]*?</tr>`)
+      : null;
+    const newRow = newRowRegex ? (r.body.match(newRowRegex) || [null])[0] : null;
+    const rowHasBefore = !!newRow && !!postBefore && new RegExp(`<td data-column="before">${postBefore}</td>`).test(newRow);
+    const rowHasAfter = !!newRow && !!postAfter && new RegExp(`<td data-column="after">${postAfter}</td>`).test(newRow);
+    const rowHasCorrelation = !!newRow && /<td data-column="correlationId">corr-/.test(newRow);
+    const everyCellHasDataColumn = !!newRow && (newRow.match(/<td data-column="[^"]+">/g) || []).length === requiredColumns.length;
+
+    const pass = postRes.status === 200 && r.status === 200 && !!r.requestId
+      && !!newAuditId && rowIds.includes(newAuditId)
+      && allColumnsPresent
+      && rowHasBefore && rowHasAfter && rowHasCorrelation
+      && everyCellHasDataColumn;
+
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21105-1: actor / target / timestamp equality and companion-log source provenance (external correlation from the logging companion) are not verified against a shipped log adapter by this Node HTTP probe; the write-then-read cycle (POST role change, GET audit surfaces the new row with correlationId) is a partial observation of AC-21105-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `Given a role change AND the auditLog capability applied: POST /api/members/${targetMemberId}/role returned 200 with auditId=${newAuditId} before=${postBefore} after=${postAfter}; subsequent GET /admin/audit surfaced the new row with data-audit-id=${newAuditId}, before/after cells matching the round-trip and a correlationId cell present; all six required columns (actor/target/before/after/timestamp/correlationId) rendered; x-fixture-request-id=${r.requestId}`
+        : `Given a role change AND the auditLog capability applied round-trip gap: postStatus=${postRes.status} auditStatus=${r.status} rid=${r.requestId} newAuditId=${newAuditId} newRowFound=${rowIds.includes(String(newAuditId))} allCols=${allColumnsPresent} rowHasBefore=${rowHasBefore} rowHasAfter=${rowHasAfter} rowHasCorrelation=${rowHasCorrelation} everyCellHasDataColumn=${everyCellHasDataColumn}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt(newRow || (r.body.match(/<tr data-audit-id="[^"]+">[^]{0,200}/) || [''])[0]),
+        derived: { postStatus: postRes.status, newAuditId, postBefore, postAfter, rowCount: rowIds.length, allColumnsPresent, rowHasBefore, rowHasAfter, rowHasCorrelation, everyCellHasDataColumn },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-admin-console/contributions/probes/org-switcher-surface.mjs

@@ -0,0 +1,83 @@
+// application-admin-console probe: org switcher surface across the
+// two shipped ACs for the org-switcher story - the tenancy-applied
+// render contract (AC-21104-1) and the tenancy-absent suppression
+// contract (AC-21104-2). Each row detail opens on the first eight
+// words of the shipped AC it anchors (rule 10).
+//
+// AC-21104-1 requires: with tenancy applied, the shell renders
+// [data-role="org-switcher"] on the console header; when tenancy is
+// not applied, neither the control nor the org-scoped invite path is
+// rendered nor reachable.
+//
+// AC-21104-2 requires: when tenancy is NOT applied, the orgs route is
+// suppressed (not linked in the shell navigation and returning 404 or
+// the shared forbidden state on direct URL); the org switcher control
+// is absent from the DOM on every route.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-admin-console-AC-21104-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const results = [];
+  const withTenancy = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory,tenancy' } });
+  try {
+    // Row 1: AC-21104-1 tenancy-applied render.
+    const r = await fixtureFetch(withTenancy.url, '/admin/orgs');
+    const switcherCount = (r.body.match(/data-role="org-switcher"/g) || []).length;
+    const orgsLinkInNav = /<nav[^>]*data-role="primary-nav"[^]*?<a[^>]*href="\/admin\/orgs">Orgs<\/a>[^]*?<\/nav>/.test(r.body);
+    const pass = r.status === 200 && !!r.requestId && switcherCount >= 1 && orgsLinkInNav;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21104-1: the users invite-path organization selector for scoping the invite (the AC clause beyond the general header selector) is not present in this fixture and not observed by this Node HTTP probe; the general header org-selector walk is a partial observation of AC-21104-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `Given an applied blueprint declaring tenancy, the shell rendered [data-role="org-switcher"] count=${switcherCount} on the console header and the Orgs link is present in the primary navigation; GET /admin/orgs returned 200; x-fixture-request-id=${r.requestId}`
+        : `Given an applied blueprint declaring tenancy, the shell tenancy-on gap: status=${r.status} rid=${r.requestId} switcher=${switcherCount} orgsNavLink=${orgsLinkInNav}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/data-role="org-switcher"[^]{0,140}/) || [''])[0]),
+        derived: { switcherCount, orgsLinkInNav, capsIncludesTenancy: true },
+      },
+    });
+  } finally {
+    await withTenancy.kill();
+  }
+
+  const noTenancy = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory' } });
+  try {
+    // Row 2: AC-21104-2 tenancy-absent suppression.
+    // The AC mandates 404 or forbidden on direct URL AND no orgs link
+    // in nav AND no switcher control on any route.
+    const directOrgs = await fixtureFetch(noTenancy.url, '/admin/orgs');
+    const home = await fixtureFetch(noTenancy.url, '/admin');
+    const statusIsRefused = directOrgs.status === 404 || directOrgs.status === 403;
+    const orgsLinkInNav = /href="\/admin\/orgs">Orgs</.test(home.body);
+    const switcherOnHome = /data-role="org-switcher"/.test(home.body);
+    const switcherOnOrgs = /data-role="org-switcher"/.test(directOrgs.body);
+    const suppressionPass = !!directOrgs.requestId && !!home.requestId
+      && statusIsRefused
+      && !orgsLinkInNav
+      && !switcherOnHome
+      && !switcherOnOrgs;
+    results.push({
+      anchorAcId: 'application-admin-console-AC-21104-2',
+      verdict: suppressionPass ? 'pass' : 'fail',
+      detail: suppressionPass
+        ? `When tenancy is NOT applied, the orgs route was suppressed: GET /admin/orgs returned ${directOrgs.status} (404 or 403 as the AC requires); no /admin/orgs link in the shell nav; no [data-role="org-switcher"] on /admin or on the refused /admin/orgs response; x-fixture-request-id=${directOrgs.requestId}`
+        : `When tenancy is NOT applied, the orgs route suppression gap: orgs status=${directOrgs.status} orgsRid=${directOrgs.requestId} homeRid=${home.requestId} statusRefused=${statusIsRefused} orgsNavLink=${orgsLinkInNav} switcherOnHome=${switcherOnHome} switcherOnOrgs=${switcherOnOrgs}`,
+      evidence: {
+        requestId: directOrgs.requestId,
+        responseStatus: directOrgs.status,
+        bodyExcerpt: excerpt(directOrgs.body),
+        derived: { statusIsRefused, orgsLinkInNav, switcherOnHome, switcherOnOrgs, capsIncludesTenancy: false },
+      },
+    });
+  } finally {
+    await noTenancy.kill();
+  }
+  return { results };
+}

package/blueprints/application-admin-console/contributions/probes/permission-matrix-grid.mjs

@@ -0,0 +1,67 @@
+// application-admin-console probe: permission matrix ARIA APG grid
+// (AC-21103-1). Row detail opens on the first eight words of the
+// shipped AC it anchors (rule 10).
+//
+// AC-21103-1 requires: given the roles surface AND an applied auth
+// blueprint declaring roleModel, the permission matrix renders as an
+// ARIA APG grid: role="grid" on the outer element, role="row" on
+// every rank (including the header rank), role="columnheader" on
+// every permission column header, role="rowheader" on the leftmost
+// cell of each role rank, role="gridcell" on every inner cell, and
+// each cell carries an aria-label announcing the exact permission
+// string plus the allowed/denied state on focus.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-admin-console-AC-21103-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture({ env: { ADMIN_CONSOLE_CAPS: 'principalDirectory,roleModel' } });
+  const results = [];
+  try {
+    const r = await fixtureFetch(fixture.url, '/admin/roles');
+    const gridPresent = /role="grid"/.test(r.body);
+    const columnCount = (r.body.match(/role="columnheader" data-permission="/g) || []).length;
+    const roleRankRows = [...r.body.matchAll(/data-role-rank="([^"]+)"/g)].map((m) => m[1]);
+    const rowCount = roleRankRows.length;
+    const gridcellCount = (r.body.match(/role="gridcell" data-cell-state="/g) || []).length;
+    const rowHeaderCount = (r.body.match(/role="rowheader"/g) || []).length;
+
+    // Every gridcell must carry an aria-label of the form
+    // "<role> (allowed|denied): <permission>". Collect ALL labels
+    // (no slicing) so length equality with gridcellCount protects the
+    // check against a vacuous every() on an empty array.
+    const cellLabels = [...r.body.matchAll(/role="gridcell"[^>]*aria-label="([^"]+)"/g)].map((m) => m[1]);
+    const labelShape = /^[A-Za-z]+ (allowed|denied): [A-Za-z ]+$/;
+    const everyLabelHonoursContract = cellLabels.length > 0
+      && cellLabels.length === gridcellCount
+      && cellLabels.every((l) => labelShape.test(l));
+
+    const derivedPass = r.status === 200 && !!r.requestId
+      && gridPresent
+      && columnCount > 0
+      && rowCount > 0
+      && gridcellCount === rowCount * columnCount
+      && rowHeaderCount >= rowCount
+      && everyLabelHonoursContract;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-admin-console-AC-21103-1: permission-derivation checking against role-permission tables (each cell label corresponding to the actual role permission and state, row-role x column-permission mapping) is not observed by this Node HTTP probe against a fixed fixture; the label-shape walk over gridcell aria-labels is a partial observation of AC-21103-1',
+      verdict: derivedPass ? 'warn' : 'fail',
+      detail: derivedPass
+        ? `Given the roles surface AND an applied auth blueprint declaring roleModel: GET /admin/roles returned 200 with role="grid" present, ${rowCount} role ranks, ${columnCount} permission columnheaders, ${gridcellCount} gridcells (=rows*columns), ${rowHeaderCount} rowheader cells, and all ${cellLabels.length} gridcell aria-labels honour the "<role> allowed/denied: <permission>" contract; x-fixture-request-id=${r.requestId}`
+        : `Given the roles surface AND an applied auth blueprint declaring roleModel gap: status=${r.status} rid=${r.requestId} grid=${gridPresent} rows=${rowCount} cols=${columnCount} cells=${gridcellCount} rowHeaders=${rowHeaderCount} labelCount=${cellLabels.length} labelsHonourContract=${everyLabelHonoursContract}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/role="gridcell"[^>]{0,180}/) || [''])[0]),
+        derived: { rowCount, columnCount, gridcellCount, rowHeaderCount, expectedCells: rowCount * columnCount, labelCount: cellLabels.length, sampledLabels: cellLabels.slice(0, 3) },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}