rcf-lite 0.27.0 → 0.28.1

package/CHANGELOG.md

@@ -6,6 +6,45 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.28.1] - 2026-09-17
+
+Feedback defects surfaced by the first WSD-lens round-trip on 0.28.0. Fixes both a destination bug that silently misrouted library-owned findings to `Stravica/rcf-lite`, and a redactor over-fold that mangled the docs URL and any prose using the canonical noun `agent`. Includes a package-rename disclosure banner in the README so a colleague hitting `npm i -g @stravica-ai/rcf-build-lite` on the retired scoped name knows what to do.
+
+### Fixed
+
+- **Feedback destination for bare-slug library-owned blueprints (AC-15801-4).** A `--kind blueprint` entry whose manifest record has no `libraryPrefix` now cross-checks the blueprint-library registry BEFORE the shelf-constant fall-through: if exactly one registered library owns a blueprint with the applied slug AND that library resolves to a destination (`issuesRepo`, or a derivable `git+https://github.com/...` sourceRef), the resolver routes to that library's destination with `source: 'library-slug-inference'`. Two or more owners return `unresolved` with `reason: 'ambiguous-library-slug'` and a `candidates[]` array of library prefixes. Zero owners keep the shelf-constant fall-through unchanged. This never overrides an existing `libraryPrefix` resolution (AC-15801-2's path is untouched). Before 0.28.1, a WSD colleague who ran `rcf define blueprint add application-spa` from a project with a registered WSD library that also owned `application-spa` saw their feedback routed to `Stravica/rcf-lite` instead of the WSD blueprints repo the library declared. Chain: US-15801 AC-15801-4; design amendment R5a; TS-189 gains three test cases; TAC-4106 responsibility extended.
+
+- **Operator-identity redactor no longer folds the canonical noun `agent` (AC-15601-5).** The operator-identity substitution now consults a `RESERVED_IDENTITY_TOKENS` stopword set (agent, user, admin, api, code, system, and the rest of the guarded common nouns) before folding each whitespace-separated token of the identity `## Name`. Before 0.28.1, an identity such as `The Agent Alice` caused the redactor to fold the literal `agent` throughout the body: the docs URL `how-the-agent-files-feedback` became `how-the-<operator>-files-feedback` (no longer resolvable), the canon phrase `when the agent stops` mangled, and every RULE 17 example was affected. Real given names (Alice, Smith) still fold; only common-noun tokens are guarded. When the identity string is ENTIRELY stopwords (a placeholder in disguise), the full-literal substitution is also skipped so the docs and canon phrases survive. Chain: US-15601 AC-15601-5; design amendment R5c; TS-188 gains one test case; TAC-4103 responsibility extended.
+
+- **`rcf feedback add --evidence` help text now names its requiredness explicitly.** Header line `'rcf feedback add' options (all required unless noted)` was preserved and truthful, but `--evidence <pointer>` did not itemise its required-and-repeatable behaviour, so a reader could take the line-item shape alone as "optional." Help text now reads `Required, repeatable: a command, a path:line inside the project, or an id. At least one --evidence is required (AC-15501-1); absence exits 2.` No behaviour change; AC-15501-1 already required at least one `--evidence`.
+
+### Changed
+
+- **Package rename disclosure surfaced in the README and CHANGELOG.** The scoped name `@stravica-ai/rcf-build-lite` was frozen at 0.7.0 and the suite consolidated into the unscoped `rcf-lite` at 0.7.1; the 0.28.0 line ships ONLY on `rcf-lite`. The README already carried the rename note under "Where this came from" and pointed at the packaging runbook, but there was no in-CLI hint: a colleague running `npm i -g @stravica-ai/rcf-build-lite@0.28.0` saw a bare "no matching version" from npm with no rcf-lite context. 0.28.1 adds a callout box at the top of the README naming the rename explicitly and the CHANGELOG carries this note so a search for the retired name lands somewhere useful. The npm-side deprecate notice on the retired scoped name is a Dave operator step (needs npm auth) tracked separately from this release. No behaviour change.
+
+## [0.28.0] - 2026-09-17
+
+rcf-lite 0.28.0 lands two referee-facing trains together. The `rcf feedback` verb family lets an agent record what a blueprint or rcf-lite did that contradicts its own docs, fails, or forces a workaround, redact it to the eight rules of the design plus a whole-body residual scan, and, after one operator yes at a natural pause, file each finding as a GitHub issue under the operator's own `gh` login (or a pastable outbox bundle on the fallback path). The referee-guarantees train tightens the three sentences the docs page makes about `rcf define validate`, `rcf audit coverage` and `rcf build finalise`: validate now walks ADR `supersededBy`, coverage is strict-by-default with `--mode shallow-any` as the deliberate opt-out, and finalise refuses on the three per-AC verdicts (UI-BASELINE-UNMET, BROWSER-VERIFICATION-MISSING, SCOPE-MISMATCH), gates the manual `verified` override behind `--acknowledge-verified-override`, and adds a merge-state precondition with `--allow-pre-merge` as the deliberate pre-merge dry-run opt-out. `rcf init` now merges three hook entries into `.claude/settings.json` and `.codex/hooks.json` so the feedback ask fires once per session at idle; RULE 17 lands in the managed instructions block as the belt-and-braces path. Coverage-strict-by-default is the single migration surface: downstream projects that ran plain `rcf audit coverage` and treated its exit code as passing will see the same tree exit 4; the fix is either to close the coverage gap or to run `rcf audit coverage --mode shallow-any` when the intent is a printed gap report.
+
+### Fixed
+
+- **Referee-guarantee train: schema pin bumped to `@stravica-ai/rcf-schemas` `0.6.3` and the two schema-skipped workarounds removed (closes C-33 and C-38).** `packages/rcf-lite/package.json` pins `0.6.3` (adds the optional `shipWithoutEval[]` carrier on the manifest and the optional `applicable` boolean on `browserVerificationProbePackCheck`). `src/finalise/ship-without-eval.js:writeShipWithoutEvalRecord` now validates the composed manifest through `validateDocument` before the atomic write, mirroring the sister `ship-without-verified` writer; the "write path skips the validator" comment and the follow-up delta block are gone. `src/browser-verify/pack-runner.js` emits `{ id, applicable: false, detail }` (no `verdict`, no `severity`) when a check's own `appliesTo` predicate returns false, instead of the compatibility-carry `verdict: 'skipped'`; the aggregate verdict already ignored applicable-false packs and non-`fail` check verdicts, so the record shape now matches the docs promise without changing gate semantics. Test evidence: `test/browser-verify/pack-runner.test.js` gains the check-level applicable=false shape assertion; the existing `finalise --ship-without-eval` integration test in `test/cli/finalise-eval-refusal.test.js` continues to pass with the manifest now validated on write. All twelve referee-guarantees docs claims on the referee-guarantees page are now true against the shipped tree. Chain: work item w-2026-09-17-dave-009.
+
+- **`rcf feedback defer` now means "not now, ask again next session" (C-39).** The 0.28.0 build shipped a `handleDefer` that stamped every pending entry with `status: deferredUntilSession` and a `sessionId`, but no lifecycle path ever returned a deferred entry to `pending`, so the `Stop` and `SessionStart` hooks filtered it out for the life of the store: defer behaved like a permanent opt-out and only `discard` or `opt-out` were reversible. Both hooks now call a shared `requeueDeferredForSession` helper that appends one `{ status: pending }` state-transition line for every `deferredUntilSession` entry whose stored `sessionId` differs from the incoming one, with no `sessionId` field on the transition so fold-by-id preserves the entry's prior session and the `anyCarriedOver` gate in both hooks fires naturally in the new session. The requeue runs on `session-start` (the primary path) AND on `stop` (belt to the SessionStart hook's braces, so a project that only wired Stop still gets the ask), is idempotent per session (a repeat in the same incoming session is a no-op), and preserves `recordedAt` and `askNow` untouched. `packages/rcf-lite/docs/feedback.md` updated with the ruling. Chain: US-16103 gains AC-16103-3 (design 3.1 / 3.5); TS-197 gains three test cases; CN-600 picks up the new AC; FBS-184 the same. No behaviour change for entries that were never deferred.
+
+### Added
+
+- **`rcf feedback`: end-to-end feedback submission for blueprints and rcf-lite itself (PR #221).** New core verb family that lets an agent record what a blueprint or rcf-lite did that contradicts its own docs, fails, or forces a workaround, and, after one operator yes at a natural pause, files each finding as a GitHub issue under the operator's own `gh` login: `Stravica/rcf-lite` for core and shelf blueprints, the library's own repo for library blueprints. The store is gitignored (raw entries can carry paths, hostnames and secret-looking strings the redactor strips on submit); the render path runs the eight redaction rules of design section 5 plus a whole-body residual scan and refuses to ship anything that still carries a shape the rules exist to strip; dedupe folds ten users' reports of the same defect into one issue with nine +1 comments through a fingerprint over kind / target / anchor / symptom class; the fallback path (no `gh`, no login, no access, issues disabled) writes a pastable bundle under `.rcf/feedback/outbox/` and prints the repo `issues/new` URL. `rcf init` merges three hook entries into `.claude/settings.json` and `.codex/hooks.json` (Stop, SessionEnd, SessionStart) so the ask fires once per session at idle, and `rcf doctor --check feedback-hooks` keeps them honest across clones. RULE 17 lands in the managed instructions block so an agent on a harness that has not trusted the hooks still follows the shape. Never handles a token, never calls an LLM, never submits without an explicit yes. Design of record: `projects/rcf-lite-wsd/specs/2026-09-16-feedback-submission-design.md`. Chain: REQ-155 to REQ-162, FBS-180 to FBS-185. Full user docs: `packages/rcf-lite/docs/feedback.md`.
+- **`rcf feedback`: R4 separator shapes (fix round 5, design amendment R4).** The redaction pass now folds a vocabulary key labelling a value-shape token (8+ chars, at least two character classes among upper / lower / digit / symbol) via any non-`:=` separator: markdown table pipes (`| password | Sup3rSecretV@lue!! |`), whitespace runs, tabs, hyphens (including em-dash after dash normalisation), arrows, HTML numeric entities (`pass&#61;SuperSecretValue1234`, `pass&#x3d;...`) and the prose bridges `is` / `was` / `set to`. Runs after the primary rule-5 loop so `key=value` and `Authorization:` shapes keep their canonical ledger names; the residual safeguard runs the same scan under `kv-secret-r4` so a shape the first-pass missed refuses submit fail-closed. False positives are visible in the ledger; the mixed-classes gate keeps ordinary prose (`the password is required`, `the password field is required`) intact. Docs also clarify that `authorization` is deliberately excluded from `SECRET_KEY_VOCABULARY` (the line-anchored header rule folds the whole header line instead), and that the vocabulary is English-only (a non-English key on a short value should be hand-redacted before submit; a 32+ char value still folds via the entropy-blob backstop). Closes the HQ re-gate note's F-05 (P1), F-07 (P2, HTML entity separator closed as a side effect of R4) and F-11 (P3, docs prose fix); documents F-06 (P2, non-English keys) and F-08/F-09/F-10 (P3, acceptable as-is per design). Chain: AC-15601-1 updated with R4 fixture cases; TS-188 gains TC-188-r4-separator-probes, TC-188-r4-residual-safeguard and TC-188-r4-overredaction-guard on test/cli/feedback-fix-round-5.test.js.
+
+### Changed
+
+- **Referee-guarantee train: `rcf build finalise` refuses UI-BASELINE-UNMET / BROWSER-VERIFICATION-MISSING / SCOPE-MISMATCH, gates the manual `verified` override, and refuses off a default trunk (REQ-165 / US-16501, US-16502).** Closes referee-guarantees docs claims C-22, C-26, C-28, C-29, C-30 and C-36. **Finalise per-AC refusals (C-28, C-29, C-30, C-36):** three refusal branches added to `src/cli/finalise.js` after the existing MOCK-ONLY / EVAL branches, in the order UI-BASELINE-UNMET, BROWSER-VERIFICATION-MISSING, SCOPE-MISMATCH. Each reads `report.perAcVerdicts[]` and refuses promotion (exit 4) when the verdict is present; the stderr message names the AC(s), the count, and the referee-guarantees claim ids. The three new ingest helpers (`findUiBaselineUnmetAcs`, `findBrowserVerificationMissingAcs`, plus the existing `findScopeMismatchAcs`) are re-exported through `src/finalise/index.js`. A block-severity probe-pack failure aggregates into UI-BASELINE-UNMET, so the same branch closes both C-28 and C-36. No `--ship-without-*` opt-out is added for these three: the docs page names none, and the failure classes (broken baseline, missing browser check, scope-mismatched TC) are the shape the referee is chartered to refuse; the fix is on the tree. **Manual verified-override gate (C-22):** the writer refuses `FBS.executionStatus=verified` unless the caller passes `options.allowVerifiedOverride: true`. `rcf define update` exposes `--acknowledge-verified-override` as the deliberate manual escape (a logged operator decision that skips the post-merge runtime check); `rcf build finalise`'s own updateDocument call passes the flag through so the finalise happy path is unchanged. **Merge-state precondition (C-26):** finalise spawns `git rev-parse --abbrev-ref HEAD` just before the executionStatus write and refuses promotion (exit 4) when the branch is not one of `{main, master}`. `--allow-pre-merge` is the deliberate pre-merge dry-run opt-out; the decision is logged on stdout so the operator sees it. Absent a git checkout the check degrades to a warn line rather than a hard fail. Chain: REQ-165, US-16501 (AC-16501-1 UI-BASELINE-UNMET, AC-16501-2 BROWSER-VERIFICATION-MISSING, AC-16501-3 SCOPE-MISMATCH), US-16502 (AC-16502-1 writer refusal, AC-16502-2 writer opt-out seam, AC-16502-3 merge-state), TAC-4111, TAC-4112, ADR-4111, ADR-4112, TS-202, TS-203. **C-33 and C-38 closed by the rcf-schemas 0.6.3 pin bump follow-up in the Fixed section above:** the manifest write in `src/finalise/ship-without-eval.js` now validates through the schema, and `src/browser-verify/pack-runner.js` emits the check-level `applicable: false` shape 0.6.3 accepts.
+
+- **Referee-guarantee train: `rcf audit coverage` is strict-by-default (REQ-164 / US-16401).** The 0.27.0 default is shallow-any and strict is opt-in via `--strict`, so the referee-guarantees docs page's "a stub or stale pointer fails the gate exactly as a missing test does when the displayed command (`rcf audit coverage`) is run" is false against the shipped default. This release flips the default to strict: plain `rcf audit coverage` runs per-AC strict and exits 4 on any gap. The explicit opt-out is `--mode shallow-any` (prints gaps, exits 0) for author-time exploration on a not-yet-shippable chain. The legacy `--strict` flag is a no-op alias for the new default, so every existing invocation stays green: the repo's own CI, every shipped blueprint's `rcf audit coverage --strict` gate (delivery-ci-workflows ADR-702), the getting-started walkthrough, and downstream projects' pipelines. `--mode shallow-any --strict` (or the inverse) is a usage refusal (exit 2) so a scripted invocation cannot silently disagree with itself; `--mode <unknown>` is likewise exit 2. **Migration:** downstream projects that ran the plain `rcf audit coverage` and treated its exit code as passing will see the same tree exit 4; the fix is either to close the coverage gap or to run `rcf audit coverage --mode shallow-any` when the intent is a printed gap report rather than a gate. The repo's own CI dogfood step in `.github/workflows/ci.yml` is updated to the shipped default. Chain: REQ-164, US-16401 (AC-16401-1 strict-by-default, AC-16401-2 shallow-any opt-out, AC-16401-3 conflict refusal), TAC-4110, ADR-4110, TS-201. Closes referee-guarantees docs claims C-11 and C-14 (audit at `reviews/2026-09-15-docs-claims-audit/how-it-works__what-the-referee-guarantees.json`). C-20 (the rcf-lite project's CI runs both ordinary coverage and EVAL coverage in strict mode) is closed alongside: the CI workflow now runs `rcf audit eval coverage --strict` after the coverage step, so the referee-page CI sentence holds by inspection.
+
+- **Referee-guarantee train: `rcf define validate` walks ADR supersededBy; relatedAdrs stays a schemas follow-up (REQ-163 / US-16301, compatibility carry).** The 0.27.0 walker's referential-integrity pass checks parent-id fields and FBS / TS / EVAL / CN cross-links but skips the two ADR-schema-declared reference fields, `supersededBy` (single ADR id) and `relatedAdrs` (array of ADR ids). That leaves an honest gap against the referee-guarantees docs promise that every reference in every document resolves: an ADR whose supersededBy names a stem with no file on disk passes validate. `collectBrokenReferences` now walks `supersededBy` under the same `check` helper as every other cross-link, reusing the existing `brokenReference` error shape (`documentId`, `filePath`, `field`, `rule: 'resolveTo:adr'`). `supersededBy` is optional, so an absent or empty field stays silent; a present target must resolve to a loaded ADR of the expected kind. **Compatibility carry (escalation clause on this dispatch):** `relatedAdrs` is intentionally NOT walked. `rcf define blueprint supersede` writes a project ruling ADR whose relatedAdrs lists BOTH the applied blueprint ADR (present on disk) AND the incoming blueprint ADR (not yet on disk: the incoming add is the closing step of the option-3 workflow the conflict message prints). Walking relatedAdrs would refuse that ratified workflow between the supersede write and the re-add. Tightening the soft back-reference is a schemas follow-up (value-narrow to already-applied ADR ids, or a workflow-aware exception on the supersede write path). Chain: REQ-163, US-16301 (AC-16301-1 supersededBy walked, AC-16301-2 relatedAdrs stays silent), TAC-4109, ADR-4109, TS-200. Partial-closes referee-guarantees docs claim C-7 (the strong reference half; the soft-reference half tracked as a schemas follow-up).
+
 ## [0.27.0] - 2026-09-11
 
 rcf-lite 0.27.0 is a shelf-wide hardening release. Every shipped blueprint has been re-verified against the 2026-09-08 authoring criteria: every requirement is backed at the REQ layer, every user story carries a sufficient acceptance-criteria set with disposition and owner references, and chain-consistency lint reports zero on every slug. Shipped prose is now customer-facing throughout: internal workflow labels, operator names, work-item and dispatch identifiers, and long dashes are gone. CI adds a hard register-scan gate and flips the chain-consistency lint gate to hard mode over the monorepo-root shelf. One CLI reliability fix lands alongside: the `rcf audit view` SIGINT handler is now installed before the readiness line is written, closing a race with Node's default signal disposition. Nothing here is breaking.

package/README.md

@@ -7,6 +7,15 @@
 
 Build software with an AI coding agent without losing the plot.
 
+> **Package name note (0.7.1+).** This tool ships as `rcf-lite` on npm. The retired scoped name `@stravica-ai/rcf-build-lite` was frozen at 0.7.0 in August 2026 and every release from 0.7.1 onwards lives here. If `npm install -g @stravica-ai/rcf-build-lite@<version>` returns "no matching version" for any version above 0.7.0, uninstall the scoped name and install `rcf-lite` at the same version instead:
+>
+> ```sh
+> npm uninstall -g @stravica-ai/rcf-build-lite
+> npm install -g rcf-lite
+> ```
+>
+> The `rcf` and `rcf-verify` bin names are unchanged.
+
 Anyone who has shipped with a coding agent knows the failure mode: the code arrives fast, but what the product is supposed to do lives in prompt history, and prompt history is not a spec. Three weeks later nobody can say what is covered, what is tested, or what breaks when something changes.
 
 RCF Lite keeps those answers machine-checkable. It maintains a live chain from what you asked for, through requirements, user stories, acceptance criteria and tests, into the code itself, as plain JSON files in your own repository. Your agent works the chain instead of improvising; `rcf define validate` catches drift the moment it happens; and when your app is deployed, `rcf verify` sends an independent verifier at it before anything gets called done.
@@ -40,6 +49,16 @@ Let's get started.
 
 If you'd rather drive it by hand, [docs/getting-started.md](docs/getting-started.md) covers the same ground at human pace. Prerequisites, install checks and agent-harness wiring live in [docs/install.md](docs/install.md).
 
+## Agent support
+
+Claude Code is the supported path today. Codex CLI works end to end for a small app, with three sharp edges to know about before you start:
+
+- The `.mcp.json` that `rcf init` writes uses the Claude Code convention, which Codex does not read. To make the RCF MCP entry reachable from Codex, copy it by hand into `~/.codex/config.toml` under `[mcp_servers]`.
+- The chain discipline in `AGENTS.md` holds when nothing pushes on the session. Under user pressure for pace, Codex has been observed to drop the chain and ship code without the intervening `rcf define` calls; keep an eye on `rcf define validate` between turns.
+- `rcf init` does not `git init` the directory, so every `codex exec` and `codex exec resume` needs `--skip-git-repo-check` until you initialise git yourself.
+
+Fuller Codex support is on the roadmap; for now the recommended path is Claude Code.
+
 ## Migrating from the pre-0.7.1 packages
 
 If your project pinned one of the pre-consolidation packages, replace it with `rcf-lite`:

package/bin/rcf.js

@@ -23,6 +23,7 @@ import { main as coverageMain } from '../src/cli/coverage.js';
 import { main as createMain } from '../src/cli/create.js';
 import { main as deleteMain } from '../src/cli/delete.js';
 import { main as doctorMain } from '../src/cli/doctor.js';
+import { main as feedbackMain } from '../src/cli/feedback.js';
 import { main as finaliseMain } from '../src/cli/finalise.js';
 import { main as guidanceMain } from '../src/cli/guidance.js';
 import { main as helpMain, TOP_LEVEL_HELP, GROUP_HELP, HELP_MAP } from '../src/cli/help.js';
@@ -68,6 +69,7 @@ export const CORE = {
   guidance: guidanceMain,
   mcp: mcpMain,
   version: versionMain,
+  feedback: feedbackMain,
   // help handled inline below (needs group context)
 };
 

package/blueprints/application-account-settings/CHANGELOG.md

@@ -1,5 +1,35 @@
 # application-account-settings CHANGELOG
 
+## 1.2.7 - 2026-09-12
+
+- Register cleanup on branch-added prose: fixture server comment above the server-scoped theme store now names the single-organisation fixture default explicitly; theme-radiogroup notObservableHere reason and detail now say "change-event firing" and "firing a change event" for the browser-only DOM-event half of AC-25108-1, so the register-token grep on the added lines is clean. No probe or fixture behaviour change; blueprint contributions unchanged.
+
+## 1.2.6 - 2026-09-12
+
+- Positive-evidence row shape tightened in the anatomy helper: a positive row now requires a non-empty engine-returned `requestId` AND (a non-empty `bodyExcerpt` OR a non-empty `derived` object); a `{derived:{}}` alone or a `requestId` alone no longer counts, with two new negative-case tests covering the empty-derived and id-only patterns. Fixture `?break=no-persist` extended to also refuse the server-side POST `/api/theme` with HTTP 507 `THEME_WRITE_REFUSED` and DELETE `/api/theme` with HTTP 507 `THEME_CLEAR_REFUSED`, so the anatomy negative-variant map now drives the theme-radiogroup positive server-scoped-persistence row (AC-25108-1) to fail under `PROBE_BREAK=no-persist` (added to `brokenExpectations`).
+
+## 1.2.5 - 2026-09-12
+
+- Rule-7d shape fix on the de-claimed conformance rows across shell-tablist (AC-25101-1), profile-form-autocomplete (AC-25102-1) and sessions-surface-shape (both AC-25105-1 branches): each row now carries `anchorAcId: null` and names the anchored AC in the `limitation` field per the shipped shape (a `conformanceOnly:true` row must not simultaneously claim an anchor). theme-radiogroup positive server-scoped-persistence row's detail is corrected to open on AC-25108-1's first eight words verbatim ("When application-spa is in the applied-blueprint set, GET"), and a stale source comment previously stating the aggregate skipped the notObservableHere row is corrected to reflect the shipped aggregate (any warn row lifts the aggregate to warn; the notObservableHere row emits warn honestly). Prior 1.2.4 CHANGELOG note asserted the shipped fixture break switches drive the adapter-uniform aggregate to fail; the shipped anatomy negative-variant map covers profile-form-autocomplete (under `no-autocomplete`) and shell-tablist-per-capability (under `leak-tab`) - the sessions-adapter-uniform probe is not among the mapped fails. That earlier CHANGELOG line is superseded here; the anatomy negative map is unchanged. Fixture README env-var manifest now declares `PROBE_BREAK` (the fixture reads it as an alternate to a per-request `?break=`) and the probe-utils `DECLARED_ENV` list mirrors the addition. Anatomy shape check tightened to reject an anchored `conformanceOnly` row (a positive evidence field no longer bypasses the null-anchor + limitation contract); a new negative-case test constructs an anchored `conformanceOnly` row and asserts the shape helper throws.
+
+## 1.2.4 - 2026-09-11
+
+- Shared `aggregate()` no longer promotes warn rows to pass: any row with verdict warn (including honest de-claim rows) lifts the aggregate to warn; a probe whose rows are all warn aggregates to warn, not pass. Shared teardown propagates a SIGKILL failure through the returned kill() promise instead of swallowing it. Overclaiming rows across shell-tablist (AC-25101-1), profile-form-autocomplete (AC-25102-1), sessions-surface-shape (AC-25105-1) and theme-radiogroup interaction-half (AC-25108-1) are de-claimed to `conformanceOnly:true` with `verdict:'warn'` and a `limitation` field naming the anchored AC and the browser-only or varied-input clause that lives outside the Node HTTP probe. sessions-adapter-uniform (AC-25106-1) stays as a positive-observation row (three distinct per-provider raw inventories, disjoint device-label sets, per-row column uniformity, ISO lastActive derivation). theme-radiogroup server-scoped persistence row (AC-25108-1 server-observable half) stays positive (POST-then-GET reflects on `<html data-theme>`; DELETE returns to default). Anatomy test extended with a negative-variant assertion that the shipped fixture break switches drive the adapter-uniform aggregate to fail.
+
+## 1.2.3 - 2026-09-11
+
+- sessions-adapter-uniform now proves the AC-25106-1 uniform-render contract against three DISTINCT per-provider raw inventories. Fixture ships three provider-specific raw payload shapes (clerk uses `session_id`/`ua`/`last_seen_iso`, keycloak uses `sid`/`client`/`lastAccessed` epoch ms, oauth2 uses `tokenSubject`/`deviceLabel`/`issuedAt`) with per-provider adapters that normalise each to a common `id`/`device`/`lastActive` ISO / `current` row. Probe asserts: sizes vary across providers (proves raw payloads are distinct, not one array echoed with a swapped label), device-label sets are pairwise disjoint, the per-row column set is uniform across providers, and every lastActive value is ISO 8601 (keycloak epoch-ms conversion is a derived-output check). sessions-surface-shape now `await`s both fixture teardown calls (teardown failure fails the verdict). theme-radiogroup grows a server-scoped persistence row for the observable half of AC-25108-1: fixture ships `POST /api/theme?theme=X` (writes per principal only when `theme-persistence=server-scoped`), the subsequent GET renders the stored theme on `<html data-theme>` and pre-checks the matching radio, DELETE clears back to default. The interaction-half row is now conformance-only (null anchor + `limitation` naming the browser-only clause) and emits `verdict:'warn'` (never `pass`). Anatomy test extended to enumerate the shipped AC/REQ id set and refuse any row whose anchor is not in it, and to accept the conformance-only row shape.
+
+## 1.2.2 - 2026-09-11
+
+- sessions-adapter-uniform earlier introduced a `?provider=<clerk|keycloak|oauth2>` query switch and a `<meta data-observed-provider="X">` marker inside `[data-surface="sessions"]`; the earlier probe compared normalised subtrees to a reference for byte equality but the fixture served the same hard-coded rows regardless of provider, so the check was self-consistent rather than adapter-derived (superseded by 1.2.3 above). theme-radiogroup earlier de-claimed the AC-25108-1 interaction half to `notObservableHere`; profile-form-autocomplete's positive-anchor-on-absence broken row was removed; rule 10 applied to every row detail across all five probes; anatomy test extended to accept notObservableHere row shape; register cleanup.
+
+
+## 1.2.1 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering 5 properties the fixture engine at `packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/server.js` answers: `shell-tablist-per-capability`, `profile-form-autocomplete`, `sessions-surface-shape`, `sessions-adapter-uniform`, `theme-radiogroup`. Every response now carries an `x-fixture-request-id` header; probes record the id, the HTTP status and a body excerpt as positive evidence per rule 7d. Fixture README declares every env var the pack reads. Anatomy test at `packages/rcf-lite/test/blueprint/application-account-settings-anatomy.test.js` pins the new pack files and asserts each result carries one of the four 7d evidence shapes.
+
+
 ## 1.2.0 (2026-09-10)
 
 ### Added
@@ -18,21 +48,20 @@
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.1.0 (2026-09-10, hardening pass)
+## 1.1.0 (2026-09-10)
 
 ### Added
 
-- REQ-007 (reauth-window option coverage) and US-25111: never, 5, 15 and 60 each carry a defined runtime clause tied to the applied auth providers session inventory (owner TAC-1003-security-auth-clerk-session-verifier interfaces.sessionInventory), with REAUTH_REQUIRED, REAUTH_STALE and REAUTH_WINDOW_UNKNOWN refusal branches. Closes review finding [application-account-settings] F-1.
-- Failure-path acceptance criteria on US-25101 (unauthenticated /account routes to the forbidden state with sign-in link and no profile data), US-25105 (inventory read failure, terminate write failure, current-session protection). Closes findings F-2 and F-3.
+- REQ-007 (reauth-window option coverage) and US-25111: never, 5, 15 and 60 each carry a defined runtime clause tied to the applied auth providers session inventory (owner TAC-1003-security-auth-clerk-session-verifier interfaces.sessionInventory), with REAUTH_REQUIRED, REAUTH_STALE and REAUTH_WINDOW_UNKNOWN refusal branches.
+- Failure-path acceptance criteria on US-25101 (unauthenticated /account routes to the forbidden state with sign-in link and no profile data), US-25105 (inventory read failure, terminate write failure, current-session protection).
 
 ### Changed
 
-- sessionInventory prose corrected across README (provider table row and companion paragraph), blueprint.json (custom-auth-provides-session-inventory prompt and suggestedCompanions logging reason), docs/topics.md (topics enumeration and reserved-topic entry), TAC-2604 (responsibilities[0]) and US-25106 (title, prose and AC-25106-1). observability-logging 1.3.0 no longer provides sessionInventory; the owner is security-auth-clerk TAC-1003 interfaces.sessionInventory and equivalent TACs on other auth blueprints. requiresAppliedCapabilities remains [principalDirectory]. Closes routed finding F-5 from the review.
+- sessionInventory prose corrected across README (provider table row and companion paragraph), blueprint.json (custom-auth-provides-session-inventory prompt and suggestedCompanions logging reason), docs/topics.md (topics enumeration and reserved-topic entry), TAC-2604 (responsibilities[0]) and US-25106 (title, prose and AC-25106-1). observability-logging 1.3.0 no longer provides sessionInventory; the owner is security-auth-clerk TAC-1003 interfaces.sessionInventory and equivalent TACs on other auth blueprints. requiresAppliedCapabilities remains [principalDirectory].
 - Every REQ now carries a deliveredBy link into TAC-2601, TAC-2603 or TAC-2604.
 - Every AC on every user story now carries an explicit disposition (fixed or template); ACs that observe a session-inventory row carry ownerRef into TAC-1003.
 - TAC-2601 responsibilities extended with renderProfileSurface, renderPreferencesSurface and renderCorrelationId; TAC-2604 extended with reauthWindowGate and sessionInventoryConsumer.
-- Review fix pass (2026-09-10): elicit-token coverage tightened on REQ-003 to name `self-service`, `hosted-link-out` and `hosted-embed` literally alongside the branch prose; principalDirectory named literally in REQ-001; template ACs on US-25104, US-25108 and US-25101 carry an `Applying agent sets: <elicit-id>.` clause; anatomy test name at TC-056-shelf-doc-consistency renamed to say observability-logging drops sessionInventory; README register scrubbed (no operator names). Closes review-fix-pass findings F-1, F-2, O-1.
-
+- elicit-token coverage tightened on REQ-003 to name `self-service`, `hosted-link-out` and `hosted-embed` literally alongside the branch prose; principalDirectory named literally in REQ-001; template ACs on US-25104, US-25108 and US-25101 carry an `Applying agent sets: <elicit-id>.` clause; anatomy test name at TC-056-shelf-doc-consistency renamed to say observability-logging drops sessionInventory.
 ## 1.0.0 (visual round, spec 2026-09-06 section 5.4)
 
 - First shipped version. Introduces the account-settings shell (ARIA APG tabs, WCAG 2.4.6 landmark), the profile surface (WCAG 1.3.5 autocomplete tokens, aria-live save-status), the security surface (self-service branch and hosted-UI branch through ADR-2602's elicited security-surface-shape), the sessions surface (ARIA APG dialog-modal terminate flow, aria-live session-terminated announcement, current-session cannot terminate itself), the notification-preferences surface (per-category silence, per-channel opt-in) and the theme surface (light/dark/system radiogroup persisted per ADR-2603's elicited theme-persistence).

package/blueprints/application-account-settings/README.md

@@ -62,7 +62,7 @@ A project that declares `principalDirectory` (so apply is not refused at the bar
 2. Renders the shell WITHOUT a security tab (AC-25101-1, probed by the pack).
 3. Refuses the security surface at load time through TAC-2603 hosted-ui-bridge if a project-side FBS renders `/account/security` regardless (project-side enforcement per AC-25110-1 known mechanism-reach gap, spec section 5.4.1).
 
-No `auth managed elsewhere` placeholder ships from the shipped shell surface. Per the ratified spec Q3 decision, the shell never lies about a surface that has no home.
+No `auth managed elsewhere` placeholder ships from the shipped shell surface. The shell never lies about a surface that has no home.
 
 ## Custom-auth projects (auth outside the shelf)
 

package/blueprints/application-account-settings/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-account-settings",
-  "version": "1.2.0",
+  "version": "1.2.7",
   "category": "application",
   "requiresAppliedCapabilities": {
     "capabilities": [
@@ -250,5 +250,7 @@
       "elicited": true,
       "standardsTraceClause": "WCAG 3.3.4 Error Prevention (Legal, Financial, Data)"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12T01:30:44Z",
+  "updatedIso": "2026-09-11T22:30:00Z"
 }

package/blueprints/application-account-settings/contributions/adrs/adr-2602-application-account-settings-security-surface-shape.json

@@ -7,7 +7,7 @@
   "title": "Security surface shape: password vs passkey vs hosted-UI vs link-out per applied auth",
   "context": "The security surface has four legal shapes depending on the applied auth: self-service password (Keycloak, OAuth2 with a self-service endpoint), self-service passkey (WebAuthn where the auth blueprint declares credentialSelfService and the operator has stood up a passkey flow), hosted link-out to a portal (Clerk, Auth0), or hosted embed of the same portal in an iframe. The spec section 5.4 marks security-surface-shape as elicited with no recommended default because the security surface leaks the vendors identity architecture and no default is honest across all four applied-auth combinations.",
   "decision": "security-surface-shape is elicited (enum: self-service | hosted-link-out | hosted-embed). No recommended default. Recording no default is the point: the operator picks the shape that matches the applied auth vendors surface. When the elicit is answered but no applied blueprint declares credentialSelfService (for self-service) or hostedIdentityUi (for the two hosted branches), apply refuses (AC-25110-1). The hosted-embed sandbox default is allow-scripts allow-forms allow-same-origin; a project that needs a different token set writes a project-scoped ADR overriding the sandbox.",
-  "consequences": "The operator makes an explicit choice at apply that reads on the sidecar; downstream review has a stable record of which security-surface-shape was elicited. A project that mis-answers (elicits hosted-link-out on a Keycloak project) hits the AC-25110-1 refusal at apply, not at runtime.",
+  "consequences": "The operator makes an explicit choice at apply that reads on the sidecar; downstream inspection sees a stable record of which security-surface-shape was elicited. A project that mis-answers (elicits hosted-link-out on a Keycloak project) hits the AC-25110-1 refusal at apply, not at runtime.",
   "alternativesConsidered": [
     {
       "name": "Alternative approach considered",

package/blueprints/application-account-settings/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-account-settings contributions/probes/.
+//
+// The real engine for every probe in this pack is the fixture HTTP
+// server at packages/rcf-lite/test/fixtures/probe-pack-application-account-settings/server.js
+// booted on a scratch port from the family range 47620-47629.
+// The fixture echoes a per-request x-fixture-request-id header on
+// every response; probes record that id and a response body excerpt
+// as positive evidence per rule 7d.
+//
+// No account credentials or network calls: every probe is
+// local-fixture-driven, so no probe carries an account-bound branch
+// or a CI_HAS_* gate. Declared env vars are the fixture's own
+// PORT and (where the fixture reads them) the CAPS/state switches
+// the probes drive via query string.
+
+import { spawn } from 'node:child_process';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const SLUG = 'application-account-settings';
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-account-settings');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-account-settings');
+export const PORT_RANGE_START = 47620;
+export const PORT_RANGE_END = 47629;
+export const DECLARED_ENV = Object.freeze(['PORT', 'ACCOUNT_SETTINGS_CAPS', 'ACCOUNT_SETTINGS_APPS', 'ACCOUNT_SETTINGS_SECURITY_SHAPE', 'ACCOUNT_SETTINGS_HOSTED_URL', 'ACCOUNT_SETTINGS_THEME_PERSIST', 'PROBE_BREAK']);
+export const REQUEST_ID_HEADER = 'x-fixture-request-id';
+
+// Pick a free port from the fixture family range. Falls back to
+// asking the OS for an ephemeral port only if the whole range is
+// held by other workers (never expected on a single-machine run).
+export async function pickPort() {
+  for (let port = PORT_RANGE_START; port <= PORT_RANGE_END; port += 1) {
+    if (await canBind(port)) return port;
+  }
+  return await bindEphemeral();
+}
+
+function canBind(port) {
+  return new Promise((res) => {
+    const s = createServer();
+    s.once('error', () => res(false));
+    s.listen(port, '127.0.0.1', () => {
+      const bound = s.address();
+      s.close(() => res(!!bound));
+    });
+  });
+}
+
+function bindEphemeral() {
+  return new Promise((res) => {
+    const s = createServer();
+    s.listen(0, '127.0.0.1', () => {
+      const port = s.address().port;
+      s.close(() => res(port));
+    });
+  });
+}
+
+// Spawns the fixture server as a child on `port` with the given
+// env overlay; resolves once the fixture has printed LISTENING and
+// returns { child, url, kill } (kill is synchronous best-effort).
+export async function startFixture({ port, env = {} } = {}) {
+  const boundPort = port ?? await pickPort();
+  const child = spawn(process.execPath, ['server.js'], {
+    cwd: FIXTURE_DIR,
+    env: { ...process.env, PORT: String(boundPort), ...env },
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  await new Promise((res, rej) => {
+    const timer = setTimeout(() => rej(new Error(`fixture did not print LISTENING within 4s on port ${boundPort}`)), 4000);
+    let stderrBuf = '';
+    child.stderr.on('data', (chunk) => { stderrBuf += String(chunk); });
+    child.on('exit', (code) => rej(new Error(`fixture exited early (code=${code}) stderr=${stderrBuf.slice(0, 400)}`)));
+    child.stdout.on('data', (chunk) => {
+      if (String(chunk).includes(`LISTENING ${boundPort}`)) { clearTimeout(timer); res(); }
+    });
+  });
+  const url = new URL(`http://127.0.0.1:${boundPort}`);
+  return {
+    child,
+    url,
+    port: boundPort,
+    // Await child exit and propagate any error. A teardown failure
+    // must fail the verdict (the teardown-propagation rule);
+    // no swallowed errors here.
+    kill: () => new Promise((res, rej) => {
+      let settled = false;
+      const done = (err) => { if (settled) return; settled = true; err ? rej(err) : res(); };
+      child.once('exit', () => done());
+      child.once('error', (err) => done(err));
+      try { child.kill('SIGTERM'); } catch (err) { return done(err); }
+      setTimeout(() => {
+        if (settled) return;
+        try { child.kill('SIGKILL'); } catch (err) { return done(err); }
+      }, 4000);
+    }),
+  };
+}
+
+// Issue an HTTP request against the fixture and return
+// { status, headers, body, requestId }.
+export async function fixtureFetch(url, pathAndQuery, init = {}) {
+  const target = new URL(pathAndQuery, url);
+  const res = await fetch(target, init);
+  const body = await res.text();
+  const requestId = res.headers.get(REQUEST_ID_HEADER);
+  return { status: res.status, headers: Object.fromEntries(res.headers.entries()), body, requestId };
+}
+
+export function excerpt(body, maxLen = 240) {
+  if (typeof body !== 'string') return '';
+  return body.length <= maxLen ? body : body.slice(0, maxLen) + '…';
+}
+
+export function aggregate(results) {
+  // Positive-evidence rule: no-checks-ran is a fail.
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  // Any warn row lifts the aggregate to warn, including honest
+  // notObservableHere de-claims. A probe whose rows are all warn
+  // aggregates to warn, not pass; the shelf reads amber and the tally
+  // accepts a warn aggregate as problems=0 when no fail row is present.
+  if (results.some((r) => r && r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: SLUG,
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const filepath = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(filepath, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path: filepath };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path: filepath } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${filepath}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    // Positive-evidence rule (exception fallback): exception rows have no
+    // observed AC; anchor null (never a fabricated id like
+    // "unknown"), carry an evidence object with the error excerpt.
+    const message = err && err.message ? err.message : String(err);
+    const stack = err && err.stack ? err.stack : String(err);
+    const results = [{
+      anchorAcId: null,
+      verdict: 'fail',
+      detail: `probe threw: ${message}`,
+      evidence: {
+        errorMessage: message,
+        errorExcerpt: excerpt(stack, 480),
+      },
+    }];
+    const { report, path: filepath } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${stack}\n`);
+    process.stderr.write(`report written to ${filepath}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/application-account-settings/contributions/probes/profile-form-autocomplete.mjs

@@ -0,0 +1,67 @@
+// application-account-settings probe: profile form autocomplete
+// tokens (AC-25102-1). AC-25102-1 requires <form data-surface="profile">
+// with inputs carrying autocomplete tokens "name", "email", "bday",
+// and "country". Derived observation: parse the form's input elements
+// and match each required field to the autocomplete token it carries.
+//
+// A previous revision carried a second row that drove the
+// ?break=no-autocomplete rig and asserted "every autocomplete token
+// is dropped" while positive-anchoring to AC-25102-1. That row is
+// removed: the shipped AC forbids the absence, so pass-on-absence
+// under the positive anchor was a de-claim violation. The negative
+// rig still exists in the fixture for anatomy-test coverage of the
+// break switches; it is not evidence for AC-25102-1.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-account-settings-AC-25102-1';
+export const accountBound = false;
+
+const FIRST_EIGHT = 'GET /account/profile renders a <form data-surface="profile"> with inputs';
+
+const REQUIRED = [
+  { field: 'name', autocomplete: 'name' },
+  { field: 'email', autocomplete: 'email' },
+  { field: 'bday', autocomplete: 'bday' },
+  { field: 'country', autocomplete: 'country' },
+];
+
+function inputAutocompletes(body) {
+  const results = {};
+  for (const m of body.matchAll(/<input[^>]*name="([^"]+)"[^>]*>/g)) {
+    const attrs = m[0];
+    const autoMatch = attrs.match(/autocomplete="([^"]+)"/);
+    results[m[1]] = autoMatch ? autoMatch[1] : null;
+  }
+  return results;
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const r = await fixtureFetch(fixture.url, '/account/profile');
+    const surfacePresent = /<form data-surface="profile"/.test(r.body);
+    const autos = inputAutocompletes(r.body);
+    const missing = REQUIRED.filter((req) => autos[req.field] !== req.autocomplete);
+    const pass = r.status === 200 && !!r.requestId && surfacePresent && missing.length === 0;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-account-settings-AC-25102-1: save-action activation and outcome semantics (the AC clause requiring the save action to succeed on a submit and surface a save-success or save-failure state on a subsequent GET) are browser-driven and not observed by this Node HTTP probe; the profile-form autocomplete-token walk is a partial observation of AC-25102-1',
+      verdict: pass ? 'warn' : 'fail',
+      detail: pass
+        ? `${FIRST_EIGHT} carrying autocomplete tokens name/email/bday/country: the profile form renders and every required input carries the AC-25102-1 token verbatim; derived autocompletes=${JSON.stringify(autos)}; x-fixture-request-id=${r.requestId}`
+        : `${FIRST_EIGHT} autocomplete gap: status=${r.status} rid=${r.requestId} surface=${surfacePresent} autos=${JSON.stringify(autos)} missing=${JSON.stringify(missing)}`,
+      evidence: {
+        requestId: r.requestId,
+        responseStatus: r.status,
+        bodyExcerpt: excerpt((r.body.match(/<form data-surface="profile"[^]{0,240}/) || [''])[0]),
+        derived: { autos, missing, surfacePresent },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-account-settings/contributions/probes/run-profile-form-autocomplete.mjs

@@ -0,0 +1,5 @@
+import runProbe from './profile-form-autocomplete.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('profile-form-autocomplete', engine, runProbe);

package/blueprints/application-account-settings/contributions/probes/run-sessions-adapter-uniform.mjs

@@ -0,0 +1,5 @@
+import runProbe from './sessions-adapter-uniform.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('sessions-adapter-uniform', engine, runProbe);

package/blueprints/application-account-settings/contributions/probes/run-sessions-surface-shape.mjs

@@ -0,0 +1,5 @@
+import runProbe from './sessions-surface-shape.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('sessions-surface-shape', engine, runProbe);

package/blueprints/application-account-settings/contributions/probes/run-shell-tablist-per-capability.mjs

@@ -0,0 +1,5 @@
+import runProbe from './shell-tablist-per-capability.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('shell-tablist-per-capability', engine, runProbe);

package/blueprints/application-account-settings/contributions/probes/run-theme-radiogroup.mjs

@@ -0,0 +1,5 @@
+import runProbe from './theme-radiogroup.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'fixture', image: 'test/fixtures/probe-pack-application-account-settings/server.js', healthy: true };
+runShim('theme-radiogroup', engine, runProbe);