rcf-lite 0.27.0 → 0.28.1

package/blueprints/application-spa/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-spa",
-  "version": "1.5.6",
+  "version": "1.5.11",
   "category": "application",
   "contributions": [
     {
@@ -415,5 +415,6 @@
       "role": "errorHandling",
       "reason": "The browser-facing error boundary constructs the internal record from a client-side exception and hands it to the applied transport writer; an error-handling companion supplies the boundary and the record factory the SPA composes on."
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T16:04:17Z"
 }

package/blueprints/application-spa/contributions/adrs/adr-202-application-spa-theming.json

@@ -5,7 +5,7 @@
   "version": "1.1.1",
   "status": "accepted",
   "title": "Semantic design tokens as CSS custom properties with a root-level theme switch",
-  "context": "Dark and light parity is a ratified requirement (application-spa-REQ-005). Parity is only checkable when every colour decision routes through a named token that exists in both palettes. How theming is realised is a whole-project decision: two theming mechanisms cannot coexist without drift. Watchpost run4 demonstrated that declaring the discipline is not the same as compelling it: raw palette values can sit in component stylesheets across passing build cycles. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
+  "context": "Dark and light parity is a shipped requirement (application-spa-REQ-005). Parity is only checkable when every colour decision routes through a named token that exists in both palettes. How theming is realised is a whole-project decision: two theming mechanisms cannot coexist without drift. A declared discipline is not the same as a compelled one: raw palette values can sit in component stylesheets across passing build cycles. The token-adherence gate enforces token parity so a violation refuses ship at gate time.",
   "decision": "The token layer in assets/tokens/design-tokens.json is the single source of colour, spacing, radius, typography, elevation, and motion values. Tokens are realised as CSS custom properties on the document root (assets/tokens/theme.css); the active theme is a data-theme attribute swap. Components consume semantic tokens only; raw palette values in component styles are a defect.",
   "consequences": "Theme parity and contrast become data checks over one JSON file. Re-skinning is a token edit. The indirection cost is one layer of naming; the working agent extends tokens by adding pairs, never by inlining values. The v1.1 token-adherence probe (TAC-207-application-spa-token-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the built stylesheet output for raw colour literals outside the token-realisation file and diffs the light and dark token key sets, and exits non-zero on any violation. When the probe is wired as a delivery-ci-workflows gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
   "alternativesConsidered": [

package/blueprints/application-spa/contributions/adrs/adr-206-application-spa-iconography.json

@@ -5,7 +5,7 @@
   "version": "1.1.1",
   "status": "accepted",
   "title": "One icon set behind semantic aliases",
-  "context": "application-spa-REQ-011 requires a single icon set. Which construction (stroke width, grid) and how components reference icons needs one recorded answer inside the SPA. Watchpost run4 demonstrated that recording the discipline is not the same as compelling it: a build cycle passed while eight surfaces shipped zero icons. v1.1 pairs the decision with a runtime-observable enforcement handle so the ship gate refuses on violation, not the operator's later reading of the ADR.",
+  "context": "application-spa-REQ-011 requires a single icon set. Which construction (stroke width, grid) and how components reference icons needs one recorded answer inside the SPA. A recorded discipline is not the same as a compelled one: raw inline SVG can sit outside the registry across passing build cycles. The icon-adherence gate enforces registry use so a violation refuses ship at gate time.",
   "decision": "The project selects exactly one icon set (consistent stroke and grid across all glyphs) and components reference icons only through semantic aliases (icon.close, icon.danger, icon.search, and peers) declared in one registry. Bespoke per-component artwork requires extending the registry, not inlining SVG.",
   "consequences": "Swapping icon sets is a registry edit. Decorative versus meaningful icon semantics get one enforcement point for the application-spa-REQ-019 naming rules. The v1.1 icon-adherence probe (TAC-208-application-spa-icon-adherence-probe) is the runtime-observable handle the ship gate exercises: the probe scans the component source for inline SVG outside the registry and for icon references naming aliases the registry does not declare, and exits non-zero on any violation. When the probe is wired as a delivery-ci-workflows gate (TAC-701), a violation refuses ship through the ordinary gate-failure path.",
   "createdAt": "2026-08-19T09:00:00Z",

package/blueprints/application-spa/contributions/probes/designed-empty-state.mjs

@@ -0,0 +1,72 @@
+// designed-empty-state probe for application-spa v1.5.11.
+//
+// Verifies AC-1117-1: every data-bearing route renders a designed
+// loading, empty, error and success state (not a generic frame).
+// The probe drives every data-bearing route through each of the
+// four state values via ?state= and asserts the state-specific
+// region markers.
+//
+// anchorAcId: application-spa-AC-1117-1.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-spa-REQ-010';
+export const accountBound = false;
+
+const STATES = ['loading', 'empty', 'error', 'success'];
+
+function stateMarkers(state) {
+  if (state === 'loading') return { attr: /data-route-state="loading"/, region: /aria-busy="true"/ };
+  if (state === 'empty') return { attr: /data-route-state="empty"/, region: /data-empty-state=/ };
+  if (state === 'error') return { attr: /data-route-state="error"/, region: /data-state="error"/ };
+  return { attr: /data-route-state="success"/, region: /data-state="success"/ };
+}
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    const routesRes = await fetch(`${fixture.baseUrl}/__routes`);
+    const routesJson = JSON.parse(await routesRes.text());
+    const dataBearing = (routesJson.routes || []).filter((r) => r.dataBearing);
+
+    const matrix = {};
+    let allPass = true;
+    let lastRes = null, lastBody = null, lastRoute = null;
+    for (const r of dataBearing) {
+      matrix[r.path] = {};
+      for (const state of STATES) {
+        const res = await fetch(`${fixture.baseUrl}${r.path}?state=${state}`);
+        const body = await res.text();
+        lastRes = res; lastBody = body; lastRoute = `${r.path}?state=${state}`;
+        const markers = stateMarkers(state);
+        const attrOk = markers.attr.test(body);
+        const regionOk = markers.region.test(body);
+        const pass = res.status === 200 && attrOk && regionOk;
+        matrix[r.path][state] = { status: res.status, attrOk, regionOk, pass };
+        if (!pass) allPass = false;
+      }
+    }
+    const overallPass = allPass && dataBearing.length > 0;
+    results.push({
+      anchorAcId: 'application-spa-AC-1117-1',
+      anchorReqId: 'application-spa-REQ-010',
+      verdict: overallPass ? 'pass' : 'fail',
+      detail: `Every data-bearing route renders designed loading, empty, error, - drove ${dataBearing.length} data-bearing routes through 4 states each (${dataBearing.length * 4} observations); all state markers present: ${allPass}`,
+      evidence: evidenceFromResponse({
+        route: lastRoute || '/reports?state=empty',
+        response: lastRes,
+        bodyText: lastBody,
+        extraFields: {
+          input: { dataBearingPaths: dataBearing.map((r) => r.path), states: STATES },
+          derived: { matrix, allPass },
+        },
+      }),
+    });
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-spa/contributions/probes/probe-utils.mjs

@@ -0,0 +1,177 @@
+// Shared helpers for application-spa probes.
+//
+// The engine under probe is the sample-app fixture at
+// packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js. The
+// fixture stamps an x-fixture-request-id header on every response as
+// part of its own request pipeline (no probe-side monkey-patch), so
+// the identifier the probe records is the identifier the engine
+// itself issued. Probes call the fixture over real HTTP via node's
+// fetch, vary inputs, assert derived outputs, and record the
+// request-id, status, body excerpt, the varied input and the derived
+// output as evidence on every result row.
+// No account-bound branch: the engine is a local fixture, not a
+// third-party account, so no CI_HAS_* gate is invented. Every env
+// var this pack reads is declared on the fixture README.
+
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-application-spa');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/application-spa');
+
+export const DEFAULT_PORT = 0;
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+
+// Empty results never pass: a synthesised row is emitted with an actionable detail and its
+// own evidence object recording the empty condition so the row is
+// not a naked verdict scalar.
+export function normaliseResults(results) {
+  if (!Array.isArray(results) || results.length === 0) {
+    return [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: 'no checks ran',
+      evidence: {
+        reason: 'empty-results',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: '',
+      },
+    }];
+  }
+  return results;
+}
+
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const report = {
+    slug: 'application-spa',
+    probeName,
+    runAt: new Date().toISOString(),
+    engine,
+    results,
+    aggregateVerdict: aggregate(results),
+    ...(extra ?? {}),
+  };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+
+// Starts the fixture on an ephemeral port (or PROBE_PORT when set)
+// and returns { server, port, baseUrl, close }. The close helper
+// rejects when the underlying close callback carries an error;
+// swallowing a teardown error would hide a boundary failure.
+export async function startFixture({ startServer, port } = {}) {
+  const resolvedPort = typeof port === 'number'
+    ? port
+    : Number(process.env.PROBE_PORT ?? DEFAULT_PORT);
+  const started = await startServer({ port: resolvedPort });
+  return {
+    server: started.server,
+    port: started.port,
+    baseUrl: `http://127.0.0.1:${started.port}`,
+    close: () => new Promise((res, rej) => started.server.close((err) => {
+      if (err) rej(err);
+      else res();
+    })),
+  };
+}
+
+// Reads a distinctive slice of a response body: the first N chars
+// so the report carries a body excerpt alongside the header id.
+export function bodyExcerpt(text, max = 240) {
+  if (text == null) return '';
+  const s = typeof text === 'string' ? text : String(text);
+  return s.length > max ? s.slice(0, max) + '...' : s;
+}
+
+// Records the positive-evidence shape on a probe result. Every row
+// carries route, status, the request id the fixture stamped, and a
+// body excerpt; the caller may extend the object with the varied
+// input and the derived output for that row.
+export function evidenceFromResponse({ route, response, bodyText, extraFields }) {
+  return {
+    route,
+    status: response.status,
+    xFixtureRequestId: response.headers.get('x-fixture-request-id') || null,
+    bodyExcerpt: bodyExcerpt(bodyText),
+    ...(extraFields ?? {}),
+  };
+}
+
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results: normaliseResults(results), extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict !== 'pass') process.exitCode = 1;
+  } catch (err) {
+    const results = [{
+      anchorReqId: 'unknown',
+      verdict: 'fail',
+      detail: `probe threw: ${err && err.message ? err.message : String(err)}`,
+      evidence: {
+        reason: 'probe-threw',
+        route: 'n/a',
+        status: 0,
+        xFixtureRequestId: null,
+        bodyExcerpt: err && err.stack ? String(err.stack).slice(0, 240) : '',
+      },
+    }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err && err.stack ? err.stack : String(err)}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+
+// Browser-observable properties are AMBER on the shelf by ruling.
+// A row that names such a property is recorded as notObservableHere
+// carrying an object with the AC id and a reason; the tally script
+// reads notObservableHere.ac to accept the row.
+export function notObservableHereResult({ ac, anchorAcId, detail, reason, evidence } = {}) {
+  // A notObservableHere row anchors nothing else: no anchorAcId,
+  // no anchorReqId - only notObservableHere.ac.
+  const acId = ac || anchorAcId;
+  return {
+    verdict: 'pass',
+    notObservableHere: {
+      ac: acId,
+      reason: reason || 'not observable on server-side probe pack; needs a browser-driven runner',
+    },
+    detail: detail || 'not observable on server-side probe pack',
+    evidence: {
+      reason: reason || 'not observable here; needs a browser-driven probe runner',
+      ...(evidence || {}),
+    },
+  };
+}
+
+// A row that keeps a real observation but records that the
+// observation only covers part of an AC uses conformanceOnly +
+// limitation carrying the AC id and the property not observed.
+export function conformanceOnlyResult({ anchorAcId, anchorReqId, verdict, detail, evidence, limitation }) {
+  return {
+    ...(anchorAcId ? { anchorAcId } : {}),
+    ...(anchorReqId ? { anchorReqId } : {}),
+    verdict: verdict || 'pass',
+    conformanceOnly: true,
+    limitation: limitation || 'browser-observable property not asserted from the server-side probe',
+    detail,
+    evidence,
+  };
+}

package/blueprints/application-spa/contributions/probes/route-inventory-published.mjs

@@ -0,0 +1,185 @@
+// route-inventory-published probe for application-spa v1.5.11.
+//
+// Verifies AC-1101-1: the project maintains a declared route
+// inventory naming every route AND no navigable surface exists
+// outside it. To rule out fixture self-agreement the probe drives
+// two independent inputs it controls:
+//
+// Run A: routes = [/, /alpha, /beta]
+// Run B: routes = [/, /gamma, /delta, /epsilon]
+//
+// For each run the probe reads /__routes and /__mounted and
+// checks both endpoints reflect the injected input verbatim,
+// then crawls every declared path (expects 200) and every path
+// from the OTHER run's set that is NOT in the current set (expects
+// 404). If /__routes or /__mounted diverged from the injected
+// input, or if a path outside the input responded 200, the row
+// fails. The two runs together establish input-driven variation.
+//
+// anchorAcId: application-spa-AC-1101-1.
+
+import { startFixture, evidenceFromResponse, conformanceOnlyResult } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-spa-REQ-001';
+export const accountBound = false;
+
+const RUN_A_ROUTES = [
+ { path: '/', name: 'landing', state: 'populated', dataBearing: false },
+ { path: '/alpha', name: 'alpha', state: 'populated', dataBearing: true },
+ { path: '/beta', name: 'beta', state: 'populated', dataBearing: false },
+];
+const RUN_B_ROUTES = [
+ { path: '/', name: 'landing', state: 'populated', dataBearing: false },
+ { path: '/gamma', name: 'gamma', state: 'populated', dataBearing: true },
+ { path: '/delta', name: 'delta', state: 'populated', dataBearing: false },
+ { path: '/epsilon', name: 'epsilon', state: 'empty', dataBearing: true },
+];
+
+async function runOne(routeSet, otherSet) {
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js');
+ const fixture = await startFixture({ startServer: (opts) => startServer({ ...opts, routes: routeSet }), port: 0 });
+ try {
+ const declaredPaths = routeSet.map((r) => r.path);
+ const routesRes = await fetch(`${fixture.baseUrl}/__routes`);
+ const routesBody = await routesRes.text();
+ const routesJson = JSON.parse(routesBody);
+ const routesPaths = (routesJson.routes || []).map((r) => r.path);
+
+ const mountedRes = await fetch(`${fixture.baseUrl}/__mounted`);
+ const mountedBody = await mountedRes.text();
+ const mountedJson = JSON.parse(mountedBody);
+ const mountedPaths = mountedJson.paths || [];
+
+ const perPath = {};
+ for (const p of declaredPaths) {
+ const r = await fetch(`${fixture.baseUrl}${p}`);
+ const body = await r.text();
+ perPath[p] = { status: r.status, ok: r.status === 200 && /<main[^>]+data-route=/.test(body) };
+ }
+
+ // Paths NOT in the injected inventory must 404. We take them
+ // from the OTHER run's set (minus paths shared with this run).
+ const shared = new Set(declaredPaths);
+ const outsidePaths = otherSet.map((r) => r.path).filter((p) => !shared.has(p));
+ const perOutside = {};
+ for (const p of outsidePaths) {
+ const r = await fetch(`${fixture.baseUrl}${p}`);
+ await r.text();
+ perOutside[p] = { status: r.status, ok: r.status === 404 };
+ }
+
+ const routesMatchInput = declaredPaths.length === routesPaths.length && declaredPaths.every((p) => routesPaths.includes(p));
+ const mountedMatchInput = declaredPaths.length === mountedPaths.length && declaredPaths.every((p) => mountedPaths.includes(p));
+ const declaredAll200 = Object.values(perPath).every((v) => v.ok);
+ const outsideAll404 = Object.values(perOutside).every((v) => v.ok);
+ return {
+ routesRes,
+ routesBody,
+ mountedRes,
+ mountedBody,
+ declaredPaths,
+ routesPaths,
+ mountedPaths,
+ outsidePaths,
+ perPath,
+ perOutside,
+ routesMatchInput,
+ mountedMatchInput,
+ declaredAll200,
+ outsideAll404,
+ };
+ } finally {
+ await fixture.close();
+ }
+}
+
+export default async function runProbe() {
+ const results = [];
+ const runA = await runOne(RUN_A_ROUTES, RUN_B_ROUTES);
+ const runB = await runOne(RUN_B_ROUTES, RUN_A_ROUTES);
+
+ const bothMatchInput = runA.routesMatchInput && runA.mountedMatchInput && runB.routesMatchInput && runB.mountedMatchInput;
+ const bothDeclared200 = runA.declaredAll200 && runB.declaredAll200;
+ const bothOutside404 = runA.outsideAll404 && runB.outsideAll404;
+ const pass = bothMatchInput && bothDeclared200 && bothOutside404;
+
+ results.push({
+ anchorAcId: 'application-spa-AC-1101-1',
+ anchorReqId: 'application-spa-REQ-001',
+ verdict: pass ? 'pass' : 'fail',
+ detail: `The project maintains a declared route inventory naming every route; no navigable surface exists outside it - runA(${runA.declaredPaths.join(',')}) routes=${runA.routesMatchInput} mounted=${runA.mountedMatchInput} declared200=${runA.declaredAll200} outside404=${runA.outsideAll404}; runB(${runB.declaredPaths.join(',')}) routes=${runB.routesMatchInput} mounted=${runB.mountedMatchInput} declared200=${runB.declaredAll200} outside404=${runB.outsideAll404}`,
+ evidence: evidenceFromResponse({
+ route: '/__routes (runA)',
+ response: runA.routesRes,
+ bodyText: runA.routesBody,
+ extraFields: {
+ input: {
+ runARoutes: RUN_A_ROUTES.map((r) => r.path),
+ runBRoutes: RUN_B_ROUTES.map((r) => r.path),
+ },
+ derived: {
+ runA: {
+ routesPaths: runA.routesPaths,
+ mountedPaths: runA.mountedPaths,
+ routesMatchInput: runA.routesMatchInput,
+ mountedMatchInput: runA.mountedMatchInput,
+ perPath: runA.perPath,
+ outsidePaths: runA.outsidePaths,
+ perOutside: runA.perOutside,
+ },
+ runB: {
+ routesPaths: runB.routesPaths,
+ mountedPaths: runB.mountedPaths,
+ routesMatchInput: runB.routesMatchInput,
+ mountedMatchInput: runB.mountedMatchInput,
+ perPath: runB.perPath,
+ outsidePaths: runB.outsidePaths,
+ perOutside: runB.perOutside,
+ },
+ },
+ altBodyExcerpt: runB.routesBody.slice(0, 240),
+ },
+ }),
+ });
+
+ // Second row: shell <meta name="route-inventory"> agrees with
+ // /__routes and /__mounted under run A. This observation covers
+ // only a same-run agreement slice of AC-1101-1 (route-inventory
+ // completeness across the app) and is emitted as conformanceOnly
+ // anchored on AC-1101-1 with a limitation naming the property the
+ // slice does not observe. The first row already carries the full
+ // positive AC-1101-1 observation across two injected sets.
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js');
+ const fixture = await startFixture({ startServer: (opts) => startServer({ ...opts, routes: RUN_A_ROUTES }), port: 0 });
+ let shellRes; let shellBody; let shellPaths = []; let shellAgreesJson = false; let shellAgreesMounted = false;
+ try {
+ shellRes = await fetch(`${fixture.baseUrl}/`);
+ shellBody = await shellRes.text();
+ const metaMatch = shellBody.match(/<meta name="route-inventory" content="([^"]+)"/);
+ shellPaths = metaMatch ? metaMatch[1].split(',') : [];
+ const declaredSet = new Set(RUN_A_ROUTES.map((r) => r.path));
+ shellAgreesJson = shellPaths.length === RUN_A_ROUTES.length && shellPaths.every((p) => declaredSet.has(p));
+ shellAgreesMounted = shellPaths.every((p) => runA.mountedPaths.includes(p));
+ } finally {
+ await fixture.close();
+ }
+ const agreeAll = shellAgreesJson && shellAgreesMounted;
+ results.push(conformanceOnlyResult({
+ anchorAcId: 'application-spa-AC-1101-1',
+ anchorReqId: 'application-spa-REQ-001',
+ verdict: agreeAll ? 'pass' : 'fail',
+ detail: `The project maintains a declared route inventory naming every route - same-run agreement slice: shell <meta name="route-inventory"> ${shellPaths.join(',')} agrees with /__routes JSON: ${shellAgreesJson} and /__mounted: ${shellAgreesMounted}`,
+ evidence: evidenceFromResponse({
+ route: '/',
+ response: shellRes,
+ bodyText: shellBody,
+ extraFields: {
+ input: { shellMetaPaths: shellPaths, injectedRoutes: RUN_A_ROUTES.map((r) => r.path) },
+ derived: { shellAgreesJson, shellAgreesMounted, agreeAll },
+ },
+ }),
+ limitation: 'application-spa-AC-1101-1: this row observes only same-run agreement between the shell meta, /__routes and /__mounted for one injected set; the AC also requires that no navigable surface exists outside the declared inventory, which the first AC-1101-1 row observes by injecting two independent route sets and confirming outsiders return 404',
+ }));
+
+ return { results };
+}

package/blueprints/application-spa/contributions/probes/run-designed-empty-state.mjs

@@ -0,0 +1,5 @@
+import runProbe from './designed-empty-state.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-spa-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js' };
+runShim('designed-empty-state', engine, runProbe);

package/blueprints/application-spa/contributions/probes/run-route-inventory-published.mjs

@@ -0,0 +1,5 @@
+import runProbe from './route-inventory-published.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-spa-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js' };
+runShim('route-inventory-published', engine, runProbe);

package/blueprints/application-spa/contributions/probes/run-shell-nav-present.mjs

@@ -0,0 +1,5 @@
+import runProbe from './shell-nav-present.mjs';
+import { runShim } from './probe-utils.mjs';
+
+const engine = { kind: 'application-spa-fixture', server: 'packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js' };
+runShim('shell-nav-present', engine, runProbe);

package/blueprints/application-spa/contributions/probes/shell-nav-present.mjs

@@ -0,0 +1,69 @@
+// shell-nav-present probe for application-spa v1.5.11.
+//
+// Verifies AC-1102-1: navigation renders on every route (not only
+// the shell root). The probe crawls every declared inventory path,
+// GETs each, and asserts the primary <nav> block appears in every
+// rendered page with one link per inventory entry.
+//
+// anchorAcId: application-spa-AC-1102-1.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-spa-REQ-002';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-spa/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    const routesRes = await fetch(`${fixture.baseUrl}/__routes`);
+    const routesJson = JSON.parse(await routesRes.text());
+    const inventory = routesJson.routes || [];
+    const inventoryNames = inventory.map((r) => r.name);
+
+    const perRoute = {};
+    let allPerRoutePass = true;
+    let firstFailBody = '';
+    let lastRoute = null;
+    let lastBody = null;
+    let lastRes = null;
+
+    for (const r of inventory) {
+      const shellRes = await fetch(`${fixture.baseUrl}${r.path}`);
+      const body = await shellRes.text();
+      lastRes = shellRes; lastBody = body; lastRoute = r.path;
+      const navMatch = body.match(/<nav[^>]+aria-label="Primary"[^>]+data-region="primary-nav"[^>]*>([\s\S]*?)<\/nav>/);
+      const hasNav = !!navMatch;
+      const linksInNav = hasNav
+        ? Array.from(navMatch[1].matchAll(/data-route-name="([^"]+)"/g)).map((m) => m[1])
+        : [];
+      const linksParity = linksInNav.length === inventoryNames.length
+        && inventoryNames.every((n) => linksInNav.includes(n));
+      const routePass = shellRes.status === 200 && hasNav && linksParity;
+      perRoute[r.path] = { status: shellRes.status, hasNav, linksInNav, routePass };
+      if (!routePass) { allPerRoutePass = false; if (!firstFailBody) firstFailBody = body.slice(0, 240); }
+    }
+    const pass = allPerRoutePass && inventory.length > 0;
+
+    results.push({
+      anchorAcId: 'application-spa-AC-1102-1',
+      anchorReqId: 'application-spa-REQ-002',
+      verdict: pass ? 'pass' : 'fail',
+      detail: `Top navigation renders on every route from the - primary <nav aria-label="Primary"> renders on all ${Object.keys(perRoute).length} routes; every route carries links [${inventoryNames.join(',')}]`,
+      evidence: evidenceFromResponse({
+        route: lastRoute || '/',
+        response: lastRes,
+        bodyText: lastBody,
+        extraFields: {
+          input: { inventoryPaths: inventory.map((r) => r.path), inventoryNames },
+          derived: { perRoute, allRoutesRenderNav: allPerRoutePass, firstFailBody },
+        },
+      }),
+    });
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}

package/blueprints/application-spa/contributions/tacs/tac-207-application-spa-token-adherence-probe.json

@@ -5,7 +5,7 @@
   "version": "1.0.1",
   "status": "approved",
   "name": "Token adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). Watchpost run4 demonstrated that declaring the discipline does not compel the shipped surface: build cycles ran green while raw hex values sat in component stylesheets. This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit when the discipline is violated, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the ADR-202 theming discipline. The blueprint declares that component styles consume semantic tokens only, that raw palette values are a defect, and that every light token has a declared dark counterpart (application-spa-REQ-005, US-1106). This TAC is the project-realised probe that inspects the built stylesheet output plus the design-tokens JSON, refuses at non-zero exit on any raw palette literal outside the token-realisation file or any missing light/dark counterpart, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1129-1, AC-1129-4).",
     "Read the design tokens source at a configured path (default `assets/tokens/design-tokens.json` per ADR-202) and enumerate the semantic token key sets for both themes (AC-1129-2).",

package/blueprints/application-spa/contributions/tacs/tac-208-application-spa-icon-adherence-probe.json

@@ -5,7 +5,7 @@
   "version": "1.0.1",
   "status": "approved",
   "name": "Icon adherence probe",
-  "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). Watchpost run4 shipped zero icons across eight surfaces while the build cycle ran green; declaring the discipline is not the same as compelling it. This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit when a component sidesteps the alias registry, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for the ADR-206 iconography discipline. The blueprint declares that components reference icons only through the semantic alias registry and that bespoke per-component artwork is an extension to the registry rather than inline SVG (application-spa-REQ-011, US-1118). This TAC is the project-realised probe that inspects the shipped component source (or built bundle), refuses at non-zero exit on any inline SVG outside the registry or any icon reference naming an alias the registry does not declare, and writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1130-1, AC-1130-4).",
     "Read the icon alias registry at a configured path (default `assets/icons/aliases.json` or the project-declared equivalent per ADR-206) and enumerate the declared alias names (AC-1130-2).",
@@ -50,7 +50,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "Scanning source for inline SVG accepts that a project may sometimes ship a genuinely single-use bespoke glyph; the discipline says such a glyph joins the registry rather than living inline, and the probe surfaces the choice at the ship gate rather than at design review. The alias-reference scanner needs a project-declared reference-shape pattern (JSX prop, function call, or template literal); the probe ships a small pattern library and the project selects the shape it uses. The cost is one line of configuration; the buy is a runtime-observable enforcement that closes the mechanism-reach gap watchpost run4 caught.",
+  "tradeoffs": "Scanning source for inline SVG accepts that a project may sometimes ship a genuinely single-use bespoke glyph; the discipline says such a glyph joins the registry rather than living inline, and the probe surfaces the choice at the ship gate rather than at the design gate. The alias-reference scanner needs a project-declared reference-shape pattern (JSX prop, function call, or template literal); the probe ships a small pattern library and the project selects the shape it uses. The cost is one line of configuration; the buy is a runtime-observable enforcement that closes the mechanism-reach gap this probe cures.",
   "createdAt": "2026-08-24T00:00:00Z",
   "updatedAt": "2026-08-24T00:00:00Z"
 }

package/blueprints/application-spa/contributions/tacs/tac-209-application-spa-csp-styled-adherence-probe.json

@@ -5,14 +5,14 @@
   "version": "1.0.2",
   "status": "approved",
   "name": "Styled-under-shipped-CSP adherence probe",
-  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). Watchpost run4 demonstrated the mechanism-reach gap this probe cures: FBS-011 declared a strict CSP (style-src 'self', no unsafe-inline), FBS-013/015 rendered inline <style> blocks, every existing UI-bearing gate passed (28 styled screenshots, browser-verify green), and yet every production page rendered unstyled at deploy because the harness bypassed the production security-header path. This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
+  "purpose": "The runtime-observable enforcement handle for application-spa-REQ-018 (SPA security baselines: CSP, sanitised dynamic HTML, hardened cookies, secret-free bundle). This TAC is the project-realised probe that (a) refuses any inline <style> block in the rendered HTML surface, (b) refuses a CSP that relaxes style-src to unsafe-inline, and (c) drives a real browser at the same server instance that stamps the production headers to prove the shipped stylesheet actually reaches the runtime surface. Writes a stable JSON report the delivery-ci-workflows aggregate report can name.",
   "responsibilities": [
     "Expose a Node entry point (a single `.js` or `.mjs` file) invocable as `node <path>` with no shell glue; the entry point path is stable and recorded on the aggregate report's `runner.entryPoint` field when this probe is wired as a delivery-ci-workflows gate (AC-1131-5, AC-1131-6).",
     "Accept configuration naming (i) how to boot the target server (a Node module or command that starts the same server instance the production entry point starts, with the same route registration), (ii) the enumerated set of UI-bearing routes to probe, and (iii) the stylesheet URL every rendered document is expected to link (AC-1131-3, AC-1131-4).",
     "For every enumerated route: navigate a real headless browser to the served URL, capture the response `content-security-policy` header, capture the response body, read the browser's final URL after any redirect chain resolves, run getComputedStyle on document.body, and record the results (AC-1131-1, AC-1131-2, AC-1131-3).",
     "Refuse the run when any captured CSP declares 'unsafe-inline' or 'unsafe-eval' on style-src, when style-src is absent, or when style-src is served as a wildcard (AC-1131-1).",
     "Refuse the run when any captured response body contains a `<style` substring (case-insensitive), including <style> injected by templating helpers (AC-1131-2).",
-    "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, the watchpost run4 partial-acceptance class defect).",
+    "Refuse the run when the browser's final URL path for any enumerated route does NOT equal the requested route path (a `pathMismatch` refusal class); a headless browser follows redirects by default, so a session-broken authenticated route silently 302'ing to a styled /login would otherwise cause every downstream styled-body assertion below to pass against the redirect target rather than the requested surface. The refusal names both the requested and the landed path (AC-1131-3, `pathMismatch`).",
     "Refuse the run when the computed body backgroundColor for any route is the browser default (`rgba(0, 0, 0, 0)` / `transparent`) or when the computed body fontFamily resolves to an empty value; both indicate the shipped stylesheet did NOT reach the runtime surface under the production headers (AC-1131-3).",
     "Issue a same-origin GET against the linked stylesheet URL through the same server instance and refuse when the response is not 200 with content-type `text/css` (AC-1131-4).",
     "Write a JSON report at a stable relative path (`reports/csp-styled-adherence.json` under the configured report directory, matching the delivery-ci-workflows per-gate report shape of TAC-702) naming: every route probed, the CSP header captured, whether an inline <style> was detected, the computed background and fontFamily values, the stylesheet GET verdict, and an ok / fail verdict (AC-1131-5).",
@@ -55,7 +55,7 @@
       "description": "When this probe is wired as a delivery-ci-workflows gate, the runner invokes it as a child process, captures the exit code, and delegates the per-gate report write to TAC-702 in the ordinary way. The probe writes its own detailed report; the gate report writer records the exit-code envelope."
     }
   ],
-  "tradeoffs": "The probe requires a real browser and a running server for every delivery-ci-workflows invocation. That cost buys the runtime-observable enforcement the mechanism-reach gap at watchpost run4 proved was missing: build cycles ran green and shipped an unstyled surface because no gate exercised the production header path with a real browser. Driving the shipped construction (not a bespoke harness) is the load-bearing choice; refusing app.inject() satisfaction is deliberate. The requirement that verification runs THROUGH the shipped headers is what makes the AC bite; a probe that stamps its own headers would recreate the class defect it exists to refuse. The v1.0.1 landed-path refusal cures a second gap the same class defect exposed: Playwright's `page.goto` follows redirects by default and returns the FINAL response, so a session-broken authenticated route silently 302'ing to a styled /login left every downstream styled-body assertion validating the login page instead of the requested surface (the watchpost partial-acceptance class defect). Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes the gap without coupling the probe to session-lane internals.",
+  "tradeoffs": "The probe requires a real browser and a running server for every delivery-ci-workflows invocation. That cost buys runtime-observable enforcement of the production header path: driving the shipped construction (not a bespoke harness) is the load-bearing choice, and refusing app.inject() satisfaction is deliberate because a probe that stamps its own headers cannot refuse a CSP defect. The landed-path refusal is necessary because Playwright's `page.goto` follows redirects by default and returns the FINAL response, so without a final-path check a session-broken authenticated route that silently 302's to a styled /login would leave every downstream styled-body assertion validating the login page instead of the requested surface. Comparing `new URL(page.url()).pathname` to the enumerated route path is the cheapest structural refusal that closes that gap without coupling the probe to session-lane internals.",
   "createdAt": "2026-08-24T10:30:00Z",
   "updatedAt": "2026-08-31T11:15:00Z"
 }