rcf-lite 0.27.0 → 0.28.1

package/blueprints/application-datatable/contributions/probes/sort-adapter-round-trip.mjs

@@ -0,0 +1,60 @@
+// sort-adapter-round-trip probe for application-datatable v1.0.9.
+//
+// AC-17101-1 has two halves: the API sort response ordering
+// (server-observable) and the browser DOM re-render after clicking
+// the header (browser-only). This probe records ONE conformanceOnly
+// row carrying the API observation with a limitation naming the
+// browser half - no separate notObservableHere row (a same-AC positive
+// plus amber pair would duplicate the anchor).
+//
+// anchorAcId: application-datatable-AC-17101-1.
+
+import { startFixture, evidenceFromResponse, conformanceOnlyResult } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-datatable-REQ-002';
+export const accountBound = false;
+
+function idsOf(payload) { return (payload.rows || []).map((r) => r.id); }
+function valuesOf(payload, key) { return (payload.rows || []).map((r) => r[key]); }
+
+export default async function runProbe() {
+ const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-datatable/server.js');
+ const fixture = await startFixture({ startServer, port: 0 });
+ try {
+ const results = [];
+ const unsorted = await fetch(`${fixture.baseUrl}/api/rows?pageSize=100`);
+ const unsortedBody = await unsorted.text();
+ const unsortedIds = idsOf(JSON.parse(unsortedBody));
+
+ const sortField = 'score';
+ const sortedRes = await fetch(`${fixture.baseUrl}/api/rows?sort=${sortField}&pageSize=100`);
+ const sortedBody = await sortedRes.text();
+ const sortedParsed = JSON.parse(sortedBody);
+ const sortedIds = idsOf(sortedParsed);
+ const sortedValues = valuesOf(sortedParsed, sortField);
+ const comparator = [...sortedValues].sort((a, b) => a - b);
+ const comparatorMatches = comparator.every((v, i) => v === sortedValues[i]);
+ const echoed = sortedParsed.sort === sortField;
+ const changed = JSON.stringify(unsortedIds) !== JSON.stringify(sortedIds);
+ const pass = unsorted.status === 200 && sortedRes.status === 200 && echoed && changed && comparatorMatches;
+ results.push(conformanceOnlyResult({
+ anchorAcId: 'application-datatable-AC-17101-1',
+ anchorReqId: 'application-datatable-REQ-002',
+ verdict: pass ? 'pass' : 'fail',
+ detail: `Given a rendered datatable route with a sortable - sort=${sortField}: order changed vs unsorted AND matches a JS-side ascending comparator over the returned ${sortField} values (server-observable half)`,
+ evidence: evidenceFromResponse({
+ route: `/api/rows?sort=${sortField}&pageSize=100`,
+ response: sortedRes,
+ bodyText: sortedBody,
+ extraFields: {
+ input: { sort: sortField },
+ derived: { unsortedIds, sortedIds, sortedValues, changed, echoedSort: echoed, comparatorMatches },
+ },
+ }),
+ limitation: 'application-datatable-AC-17101-1: clicking the column-header sort control and comparing rendered DOM row order is browser-only',
+ }));
+ return { results };
+ } finally {
+ await fixture.close();
+ }
+}

package/blueprints/application-datatable/contributions/requirements/application-datatable-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "application-datatable-REQ-006",
   "prdId": "PRD-001",
   "title": "Column visibility, reorder and resize each expose a keyboard-reachable alternative to any drag pointer path",
-  "description": "Column visibility toggles are keyboard-reachable controls (checkboxes or menu items) that hide or show columns; column reorder exposes a non-drag path (paired move-left / move-right controls or a menu ordering); column resize exposes a keyboard-alternative to any pointer drag, per WCAG 2.5.7 Dragging Movements. A drag-only reorder or resize is refused at author-side review.",
+  "description": "Column visibility toggles are keyboard-reachable controls (checkboxes or menu items) that hide or show columns; column reorder exposes a non-drag path (paired move-left / move-right controls or a menu ordering); column resize exposes a keyboard-alternative to any pointer drag, per WCAG 2.5.7 Dragging Movements. A drag-only reorder or resize is refused at the author-side check.",
   "category": "functional",
   "domain": "application",
   "priority": "must",

package/blueprints/application-datatable/docs/topics.md

@@ -7,7 +7,7 @@ The blueprint claims no new global topics at v1.0.0. The datatable shell is a ge
 ## Deliberately unclaimed topics
 
 - `dataGridEngine` (the chosen data-table library). Reserved for the applying project as an elicited choice, not a global topic; a second datatable-shaped blueprint that composes with a specific engine would either supersede this blueprint or share the shell TAC.
-- `columnRegistry` (a shared column vocabulary across surfaces). No blueprint claims it today; a future admin-console blueprint (visual round) may elicit column reuse without minting a global topic.
+- `columnRegistry` (a shared column vocabulary across surfaces). No blueprint claims it today; a future admin-console blueprint may elicit column reuse without minting a global topic.
 
 ## Shelf id band and suffix block
 

package/blueprints/application-empty-error-states/CHANGELOG.md

@@ -1,5 +1,35 @@
 # application-empty-error-states CHANGELOG
 
+## 1.2.7 - 2026-09-12
+
+- Register cleanup on branch-added prose: fixture server comment above the offline-buffer store now names the single-organisation fixture principal explicitly; empty-list-and-no-search notObservableHere limitation now says "subsequent navigation" for the browser-only clause beyond the DOM shape and the query echo, so the register-token grep on the added lines is clean. No probe or fixture behaviour change; blueprint contributions unchanged.
+
+## 1.2.6 - 2026-09-12
+
+- Positive-evidence row shape tightened in the anatomy helper: a positive row now requires a non-empty engine-returned `requestId` AND (a non-empty `bodyExcerpt` OR a non-empty `derived` object); a `{derived:{}}` alone or a `requestId` alone no longer counts, with two new negative-case tests covering the empty-derived and id-only patterns. No probe or fixture behaviour change on the empty-error-states family (positive AC-22102-1 and AC-22103-1 rows on forbidden-and-server-error already carry both request-id and non-empty derived; the existing `leak-id` and `stack-trace` breaks stay in the shipped negative-variant map).
+
+## 1.2.5 - 2026-09-12
+
+- Rule-7d shape fix on the de-claimed conformance rows across not-found (AC-22101-1), permission-denied + offline (AC-22104-1, AC-22105-1), empty-list + no-search (AC-22106-1, AC-22107-1) and error-boundary (AC-22108-1): each row now carries `anchorAcId: null` and names the anchored AC in the `limitation` field per the shipped shape (a `conformanceOnly:true` row must not simultaneously claim an anchor). Confidentiality upgrade on forbidden-and-server-error (AC-22102-1 and AC-22103-1): the probe now MINTS varied sensitive input per run (a token, a resource id, an email, a bare NAME=value env pair, a backtrace-frame line, a source path) and INJECTS them into the request that triggers the 403 / 500 via query and headers, then asserts none of the injected tokens appears in the rendered surface; the sensitive-value matcher for AC-22103-1 now catches bare NAME=value forms (in addition to `process.env.NAME`), and the probe verifies the matcher positively catches a bare NAME= on a canary string. Both rows are re-anchored to positive-evidence (`verdict: 'pass'`) against the shipped ACs. Fixture README env-var manifest now declares `PROBE_BREAK` (the fixture reads it as an alternate to `EMPTY_ERROR_STATES_BREAK` / `?break=`) and the probe-utils `DECLARED_ENV` list mirrors the addition. Anatomy shape check tightened to reject an anchored `conformanceOnly` row (a positive evidence field no longer bypasses the null-anchor + limitation contract); a new negative-case test constructs an anchored `conformanceOnly` row and asserts the shape helper throws.
+
+## 1.2.4 - 2026-09-11
+
+- Shared `aggregate()` no longer promotes warn rows to pass: any row with verdict warn (including honest de-claim rows) lifts the aggregate to warn; a probe whose rows are all warn aggregates to warn, not pass. Shared teardown propagates a SIGKILL failure through the returned kill() promise instead of swallowing it. Overclaiming rows across not-found (AC-22101-1), forbidden + server-error (AC-22102-1, AC-22103-1), permission-denied (AC-22104-1), offline buffer (AC-22105-1), empty-list + no-search (AC-22106-1, AC-22107-1) and error-boundary (AC-22108-1) are de-claimed to `conformanceOnly:true` with `verdict:'warn'` and a `limitation` field naming the anchored AC and the varied-input or browser-only clause that lives outside the Node HTTP probe. The server-observable halves (403/500 status, region roles, recovery controls, buffer lifecycle) still drive the row-observation and flip verdict to fail under the shipped fixture break switches. Anatomy test extended with a negative-variant assertion that the shipped break switches drive the affected probe aggregates to fail.
+
+## 1.2.3 - 2026-09-11
+
+- Buffer lifecycle for AC-22105-1 is now observed server-side. Fixture ships three new endpoints keyed by `x-principal-id` header (or `?principal-id=` query): `POST /probe/offline/state` flips online/offline, `POST /probe/offline/buffer` enqueues with an idempotency-per-token contract (duplicate token returns `deduped:true` and count stays), `POST /probe/offline/reconnect` drains the buffer and returns the flushed count; `GET` variants return current state. The `/probe/offline` HTML surface now renders `data-buffer-state`, `data-buffer-count`, `data-flushed-count` and a banner reflecting the current transport state. permission-denied-and-offline probe drives a fresh principalId through the full lifecycle (flip offline, enqueue distinct tokens, verify count grew, POST duplicate token and verify dedupe, reconnect and verify drain+delivered) instead of de-claiming as `notObservableHere`. Anatomy test extended to enumerate the shipped AC/REQ id set from `contributions/user-stories/*.json` and refuse any row whose anchor is not in it, and to accept the conformance-only row shape.
+
+## 1.2.2 - 2026-09-11
+
+- forbidden-and-server-error probes now compare positive state-copy tokens rendered in the response HTML against the AC-22102-1 (forbidden) and AC-22103-1 (server-error) contracts, replacing the fixture-specific data-leak marker key that did not observe the state copy. permission-denied-and-offline offline row de-claimed to notObservableHere for AC-22105-1 (buffer lifecycle intercepted-write, buffered, reconnect, flushed sequence is client-driven and only observable in a browser). error-boundary-alert reanchored to AC-22108-1 active crash state; the standby-absence row that lacked a positive anchor is removed. Positive-anchor-on-absence broken-variant rows removed. Rule 10 applied to every row detail. Anatomy test extended to accept notObservableHere row shape. Register cleanup.
+
+
+## 1.2.1 - 2026-09-11
+
+- Added a criterion-e probe pack (`contributions/probes/`) covering 5 properties the fixture engine at `packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/server.js` answers: `not-found-and-recovery`, `forbidden-and-server-error`, `permission-denied-and-offline`, `empty-list-and-no-search`, `error-boundary-alert`. Every response now carries an `x-fixture-request-id` header; probes record the id, the HTTP status and a body excerpt as positive evidence per rule 7d. Fixture README declares every env var the pack reads. Anatomy test at `packages/rcf-lite/test/blueprint/application-empty-error-states-anatomy.test.js` pins the new pack files and asserts each result carries one of the four 7d evidence shapes.
+
+
 ## 1.2.0 (2026-09-10)
 
 ### Added
@@ -18,11 +48,11 @@
 
 - Register: neutral wording in shipped prose (no capability change).
 
-## 1.1.0 (2026-09-10, hardening pass)
+## 1.1.0 (2026-09-10)
 
 ### Added
 
-- Failure-path acceptance criteria on US-22102 (failed request-access POST, no per-resource detail), US-22103 (retry failure, no stack trace leak), US-22105 (ordered flush with stable tokens, per-write failure with retry counter and banner, idempotency of retried operations), US-22106 (no-recovery notice for a state without configured recovery), US-22107 (query verbatim rendering, failed clear-filters reload), US-22108 (role=alert, hard-refresh recommendation after 3 recovery retries), US-22101 (gone vs never-existed distinction gated on the applied data provider), US-22104 (class-only naming, no per-resource detail). Closes review findings F-1, F-2 and F-3.
+- Failure-path acceptance criteria on US-22102 (failed request-access POST, no per-resource detail), US-22103 (retry failure, no stack trace leak), US-22105 (ordered flush with stable tokens, per-write failure with retry counter and banner, idempotency of retried operations), US-22106 (no-recovery notice for a state without configured recovery), US-22107 (query verbatim rendering, failed clear-filters reload), US-22108 (role=alert, hard-refresh recommendation after 3 recovery retries), US-22101 (gone vs never-existed distinction gated on the applied data provider), US-22104 (class-only naming, no per-resource detail).
 - Vendor citations on the WCAG status-messages criteria and the ARIA APG alert-pattern criteria (verified 2026-09-10).
 
 ### Changed
@@ -32,7 +62,7 @@
 
 ## 1.0.0 (visual round, spec 2026-09-06)
 
-- First ratified version of the shelf's empty-and-error-states blueprint. Five REQs (state catalogue with eight named states, recovery-action contract, announcement contract with role region and aria-live polite, least-privilege 5xx and 403 posture, offline state with write-buffer and reconnection semantics), eight USs 22101-22108 binding one runtime-observable AC per named state, three TACs 2301-2303 (state-machine, recovery-action router, offline write-buffer), three ADRs 2301-2303 (HTTP status contract per RFC 9110 as recommendedDefault, stack-trace visibility elicited with recommendedDefault true, offline strategy across write-buffer read-only-banner and refuse-writes elicited). No new global topics.
+- Initial shipped version of the shelf's empty-and-error-states blueprint. Five REQs (state catalogue with eight named states, recovery-action contract, announcement contract with role region and aria-live polite, least-privilege 5xx and 403 posture, offline state with write-buffer and reconnection semantics), eight USs 22101-22108 binding one runtime-observable AC per named state, three TACs 2301-2303 (state-machine, recovery-action router, offline write-buffer), three ADRs 2301-2303 (HTTP status contract per RFC 9110 as recommendedDefault, stack-trace visibility elicited with recommendedDefault true, offline strategy across write-buffer read-only-banner and refuse-writes elicited). No new global topics.
 - Ships `probe-packs/application-empty-error-states.pack.mjs`: eight surface-observable browser-verify checks anchored one per named state (`AC-22101-1` not-found, `AC-22102-1` forbidden, `AC-22103-1` server-error, `AC-22104-1` permission-denied, `AC-22105-1` offline, `AC-22106-1` empty-list, `AC-22107-1` no-search-results, `AC-22108-1` error-boundary). Every URL is composed by the `withUrl(runtimeUrl, path)` helper per the round 3 fix train; no bare string concatenation. The pack-level `appliesTo` predicate references BOTH `tacIds` (TAC-2301) AND `route` (the operator-configured error-shell path glob).
 - Ships a dependency-free sample-app fixture at `packages/rcf-lite/test/fixtures/probe-pack-application-empty-error-states/` with a Node HTTP server realising all eight states honestly under `/probe/<name>` and break switches (`?break=stack-trace`, `?break=leak-id`, `?break=no-recovery`, `?break=no-live-region`) driving the negative runs from a single boot. The fixture ships its own README naming PORT, every `?state=`, every `?break=`, the manual boot line and the two-line gate-reviewer boot.
 - Declares `suggestedCompanions` `logging` (every rendered error state writes one request-scoped log line with the correlation identifier) and `errorHandling` (the error-boundary state constructs an internal error record from the caught exception). Does NOT declare `providesRoles` (leaf blueprint per spec; loader refuses an empty `providesRoles` array when set, so the leaf-blueprint intent is expressed by omitting the field). Does NOT declare `capabilities` and does NOT declare `requiresAppliedCapabilities` (no auth required).

package/blueprints/application-empty-error-states/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-empty-error-states",
-  "version": "1.2.0",
+  "version": "1.2.7",
   "category": "application",
   "suggestedCompanions": [
     {
@@ -149,5 +149,7 @@
       ],
       "default": "write-buffer"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-12T01:30:44Z",
+  "updatedIso": "2026-09-11T22:30:00Z"
 }

package/blueprints/application-empty-error-states/contributions/probes/empty-list-and-no-search.mjs

@@ -0,0 +1,66 @@
+// application-empty-error-states probe: empty-list state
+// (AC-22106-1) and no-search-results state echoing the query
+// (AC-22107-1). Broken-variant row on empty-list?break=no-recovery
+// was removed under the positive-anchor cleanup (positive-anchor on
+// absence is void).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-empty-error-states-AC-22106-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const empty = await fixtureFetch(fixture.url, '/probe/empty-list');
+    const region = /data-surface="empty-list"[^>]*role="region"/.test(empty.body);
+    const visualWrapper = /data-visual="empty-list"/.test(empty.body);
+    const recoveryLink = /data-recovery="create"/.test(empty.body);
+    const emptyPass = empty.status === 200 && !!empty.requestId && region && visualWrapper && recoveryLink;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22106-1: assistive-tech accessible-name resolution on the create control (the AC clause beyond the DOM shape) is AT-driven and not observed by this Node HTTP probe; the empty-list region + visual + create-link walk is a partial observation of AC-22106-1',
+      verdict: emptyPass ? 'warn' : 'fail',
+      detail: emptyPass
+        ? `Given a listing endpoint returning an empty array, observed role="region", data-visual="empty-list" wrapper and keyboard-reachable [data-recovery="create"] link on the rendered surface; x-fixture-request-id=${empty.requestId}`
+        : `Given a listing endpoint returning an empty array, evidence gap: status=${empty.status} rid=${empty.requestId} region=${region} visual=${visualWrapper} recovery=${recoveryLink}`,
+      evidence: {
+        requestId: empty.requestId,
+        responseStatus: empty.status,
+        bodyExcerpt: excerpt((empty.body.match(/data-surface="empty-list"[^]{0,220}/) || [''])[0]),
+        derived: { region, visualWrapper, recoveryLink },
+      },
+    });
+
+    // AC-22107-1: query echoed verbatim inside data-query span.
+    const query = 'probe-search-' + Math.random().toString(36).slice(2, 8);
+    const noSearch = await fixtureFetch(fixture.url, `/probe/search?q=${encodeURIComponent(query)}`);
+    const nsRegion = /data-surface="no-search-results"[^>]*role="region"/.test(noSearch.body);
+    const nsVisual = /data-visual="no-search-results"/.test(noSearch.body);
+    const qMatch = noSearch.body.match(/<span data-query>([^<]*)<\/span>/);
+    const derivedQ = qMatch ? qMatch[1] : '';
+    const echoed = derivedQ === query;
+    const clearControl = /data-recovery="clear-filters"/.test(noSearch.body);
+    const nsPass = noSearch.status === 200 && !!noSearch.requestId && nsRegion && nsVisual && echoed && clearControl;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22107-1: clear-filters control activation and subsequent navigation (the AC clauses beyond the DOM shape and the query echo) are browser-driven and not observed by this Node HTTP probe; the no-search-results region + visual + clear-filters + varied-query echo walk is a partial observation of AC-22107-1',
+      verdict: nsPass ? 'warn' : 'fail',
+      detail: nsPass
+        ? `Given a search or filter yielding zero rows, observed role="region", data-visual="no-search-results" wrapper, [data-recovery="clear-filters"] control and a data-query span echoing the varied query verbatim ("${derivedQ}"); x-fixture-request-id=${noSearch.requestId}`
+        : `Given a search or filter yielding zero rows, evidence gap: status=${noSearch.status} rid=${noSearch.requestId} region=${nsRegion} visual=${nsVisual} echoed=${echoed} derived="${derivedQ}" expected="${query}" clear=${clearControl}`,
+      evidence: {
+        requestId: noSearch.requestId,
+        responseStatus: noSearch.status,
+        bodyExcerpt: excerpt((noSearch.body.match(/<span data-query>[^<]*<\/span>[^]{0,140}/) || [''])[0]),
+        derived: { query, derivedQ, echoed, clearControl },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/error-boundary-alert.mjs

@@ -0,0 +1,65 @@
+// application-empty-error-states probe: error-boundary state
+// (AC-22108-1). AC-22108-1 explicitly permits the sample-app
+// /probe/error-boundary?crash=1 route as the observation trigger; the
+// probe drives that route and observes the active crash state
+// (role="alert" region, [data-recovery="retry"] control, class-level
+// error label). The prior standby-absence row was removed under the
+// positive-anchor cleanup (positive-anchor on absence is void).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-empty-error-states-AC-22108-1';
+export const accountBound = false;
+
+function stripHtml(html) {
+  return String(html)
+    .replace(/<script[^]*?<\/script>/gi, ' ')
+    .replace(/<style[^]*?<\/style>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function stackFramePresent(text) {
+  // Backtrace frame ("at fn (file:line:col)"), a source path ending in
+  // a JS-family extension, an env-var key shape, or a node_modules
+  // segment. Correlation-id tokens are not stack frames.
+  if (/\bat\s+[A-Za-z_$][A-Za-z0-9_$.]*\s*\([^)]+:\d+:\d+\)/.test(text)) return true;
+  if (/(^|\s)(\.\.?\/|\/)[A-Za-z0-9_./-]+\.(js|mjs|cjs|ts|tsx|jsx)\b/i.test(text)) return true;
+  if (/process\.env\.[A-Z_][A-Z0-9_]*/.test(text)) return true;
+  if (/\bnode_modules\//.test(text)) return true;
+  return false;
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const crash = await fixtureFetch(fixture.url, '/probe/error-boundary?crash=1');
+    const surfaceText = stripHtml(crash.body);
+    const alertRegion = /data-surface="error-boundary"[^>]*role="alert"/.test(crash.body);
+    const retryControl = /data-recovery="retry"/.test(crash.body);
+    const errorClass = /data-error-class="render-failure"/.test(crash.body);
+    const plainSummary = /Widget failed to render/.test(surfaceText);
+    const noStack = !stackFramePresent(surfaceText);
+    const crashPass = crash.status === 200 && !!crash.requestId && alertRegion && retryControl && errorClass && plainSummary && noStack;
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22108-1: varied-input plain-summary derivation against a shipped origin (framework internal frames, arbitrary env keys the origin might have leaked) is not observed by this Node HTTP probe against a fixed fixture; the error-boundary alert + retry + error-class + plain-summary + no-stack-frame walk is a partial observation of AC-22108-1',
+      verdict: crashPass ? 'warn' : 'fail',
+      detail: crashPass
+        ? `Given a synthetic client-side render exception thrown via the sample-app /probe/error-boundary?crash=1 route: observed role="alert" region, [data-recovery="retry"] control, data-error-class="render-failure" label and plain summary "Widget failed to render" on the rendered surface; no stack-frame pattern hit; x-fixture-request-id=${crash.requestId}`
+        : `Given a synthetic client-side render exception thrown via /probe/error-boundary?crash=1 (evidence gap): status=${crash.status} rid=${crash.requestId} alert=${alertRegion} retry=${retryControl} errorClass=${errorClass} summary=${plainSummary} noStack=${noStack}`,
+      evidence: {
+        requestId: crash.requestId,
+        responseStatus: crash.status,
+        bodyExcerpt: excerpt(surfaceText),
+        derived: { alertRegion, retryControl, errorClass, plainSummary, noStack },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/forbidden-and-server-error.mjs

@@ -0,0 +1,167 @@
+// application-empty-error-states probe: 403 forbidden and 500 server
+// error states (AC-22102-1, AC-22103-1).
+//
+// AC-22102-1 requires the forbidden state to render inside role="region"
+// with a keyboard-reachable [data-action="request-access"] control that
+// POSTs to /api/request-access; the rendered surface must NOT contain
+// any sensitive-pattern hit (resource id shape, resource name shape,
+// path-shape strings starting with /).
+//
+// AC-22103-1 requires the server-error state to render inside
+// role="region" with a keyboard-reachable [data-recovery="retry"] control;
+// the rendered surface must NOT contain a backtrace-frame prefix
+// ("at " + function + file:line), a source path starting with /, ./
+// or ../, an environment-variable key shape (NAME= or process.env.NAME),
+// or a framework-internal frame prefix.
+//
+// Positive-anchor rows only: broken-variant rows on absence were removed
+// under the positive-anchor cleanup (they positively-anchor on absence and are void).
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+import { randomUUID } from 'node:crypto';
+
+export const anchorAcId = 'application-empty-error-states-AC-22102-1';
+export const accountBound = false;
+
+function stripHtml(html) {
+  return String(html)
+    .replace(/<script[^]*?<\/script>/gi, ' ')
+    .replace(/<style[^]*?<\/style>/gi, ' ')
+    .replace(/<[^>]+>/g, ' ')
+    .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+function forbiddenSensitiveHit(text) {
+  // Sensitive-pattern list per AC-22102-1: resource id shape (kind-digits-slug,
+  // e.g. widget-2039-alpha), a resource-name slug (kind-slug-slug preceded
+  // by resource identifiers), or a URL path-shape string with 2+ segments.
+  // A request-id shape (letters-letters-digits) is a correlation id, not a
+  // resource id, and is not sensitive.
+  if (/\b[a-z]+-\d{3,}-[a-z][a-z0-9]*\b/i.test(text)) return true;
+  if (/\b(resource|id|widget|entity)=[a-z0-9-]+/i.test(text)) return true;
+  if (/(^|\s)\/[a-z][a-z0-9_-]+\/[a-z0-9_-]+/i.test(text)) return true;
+  return false;
+}
+
+function serverErrorSensitiveHit(text) {
+  // Sensitive-pattern list per AC-22103-1: backtrace frame, source
+  // path (with file extension), env-var key shape (either process.env.NAME
+  // or a bare NAME=value form), framework-internal frame. Correlation-id
+  // tokens without file:line context are not stack frames and are ignored.
+  if (/\bat\s+[A-Za-z_$][A-Za-z0-9_$.]*\s*\([^)]+:\d+:\d+\)/.test(text)) return true;
+  if (/(^|\s)(\.\.?\/|\/)[A-Za-z0-9_./-]+\.(js|mjs|cjs|ts|tsx|jsx)\b/i.test(text)) return true;
+  if (/process\.env\.[A-Z_][A-Z0-9_]*/.test(text)) return true;
+  // Bare NAME=value: an uppercase env-key style token followed by '=' and a
+  // non-whitespace value. Matches leaked lines like "DB_PASSWORD=hunter2"
+  // that a naive error handler might have echoed back to the surface.
+  if (/(^|[^A-Z0-9_])[A-Z][A-Z0-9_]{2,}=[^\s]+/.test(text)) return true;
+  if (/\bnode_modules\//.test(text)) return true;
+  return false;
+}
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    // Mint varied sensitive tokens per run and inject them into the
+    // request that drives the 403. The confidentiality property under
+    // AC-22102-1 holds when none of the injected tokens appears in the
+    // rendered error copy (a real varied-input observation, not a fixed
+    // safe-copy self-agreement).
+    const leakToken = 'sk-live-' + randomUUID().replace(/-/g, '');
+    const leakResourceId = 'widget-' + Math.floor(Math.random() * 1_000_000) + '-' + randomUUID().slice(0, 6);
+    const leakEmail = 'probe-leak-' + randomUUID().slice(0, 8) + '@example.test';
+    const leakEnvKey = 'PROBE_LEAK_' + randomUUID().replace(/-/g, '').slice(0, 8).toUpperCase();
+    const leakEnvValue = 'v-' + randomUUID().slice(0, 12);
+    const leakEnvPair = `${leakEnvKey}=${leakEnvValue}`;
+
+    const injectedForbidden = new URLSearchParams({
+      'leak-token': leakToken,
+      'leak-resource-id': leakResourceId,
+      'leak-email': leakEmail,
+      'leak-env': leakEnvPair,
+      'x-injected-name': leakEnvKey,
+      'x-injected-value': leakEnvValue,
+    }).toString();
+    const forbidden = await fixtureFetch(fixture.url, `/probe/forbidden?${injectedForbidden}`, {
+      headers: { 'x-probe-leak-token': leakToken, 'x-probe-leak-email': leakEmail, 'x-probe-leak-env': leakEnvPair },
+    });
+    const surfaceText = stripHtml(forbidden.body);
+    const region = /data-surface="forbidden"[^>]*role="region"/.test(forbidden.body);
+    const control = /data-action="request-access"/.test(forbidden.body);
+    const stateCopyPresent = /You do not have scope on this workspace/.test(surfaceText);
+    const noSensitivePatternHit = !forbiddenSensitiveHit(surfaceText);
+    const injectedAbsent = !forbidden.body.includes(leakToken)
+      && !forbidden.body.includes(leakResourceId)
+      && !forbidden.body.includes(leakEmail)
+      && !forbidden.body.includes(leakEnvPair)
+      && !forbidden.body.includes(leakEnvValue);
+    const post = await fixtureFetch(fixture.url, '/api/request-access', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{}' });
+    let postBody = null; try { postBody = JSON.parse(post.body); } catch (_) { /* parse */ }
+    const roundTrip = post.status === 200 && !!post.requestId && postBody && postBody.ok === true;
+    const forbiddenPass = forbidden.status === 403 && !!forbidden.requestId
+      && region && control && stateCopyPresent
+      && noSensitivePatternHit && injectedAbsent && roundTrip;
+    results.push({
+      anchorAcId: 'application-empty-error-states-AC-22102-1',
+      verdict: forbiddenPass ? 'pass' : 'fail',
+      detail: forbiddenPass
+        ? `Given a 403 response, the forbidden state renders inside role="region" with a keyboard-reachable [data-action="request-access"] control that POSTs to /api/request-access; the probe minted varied sensitive input per run (token, resource id, email, NAME=value pair) and injected them via query and headers into the request that triggered the 403; the rendered document text contains none of the injected tokens and no sensitive-pattern hit on the surface; POST /api/request-access returned 200 with ok=true; x-fixture-request-id (state)=${forbidden.requestId}, (action)=${post.requestId}`
+        : `Given a 403 response, the forbidden state renders (evidence gap): status=${forbidden.status} rid=${forbidden.requestId} region=${region} control=${control} stateCopy=${stateCopyPresent} noSensitivePattern=${noSensitivePatternHit} injectedAbsent=${injectedAbsent} roundTrip=${roundTrip}`,
+      evidence: {
+        requestId: forbidden.requestId,
+        responseStatus: forbidden.status,
+        bodyExcerpt: excerpt(surfaceText),
+        derived: { region, control, stateCopyPresent, noSensitivePatternHit, injectedAbsent, injectedTokens: { leakToken, leakResourceId, leakEmail, leakEnvPair }, actionStatus: post.status, actionOk: !!(postBody && postBody.ok) },
+      },
+    });
+
+    // Mint a fresh set of tokens for the 500 leg and inject via query +
+    // headers into the request that triggers the server-error surface.
+    const svLeakStack = `at leakedFn__${randomUUID().slice(0, 6)} (/opt/leak/${randomUUID().slice(0, 8)}.js:${Math.floor(Math.random() * 500) + 1}:${Math.floor(Math.random() * 80) + 1})`;
+    const svLeakEnvKey = 'SV_LEAK_' + randomUUID().replace(/-/g, '').slice(0, 8).toUpperCase();
+    const svLeakEnvValue = randomUUID().slice(0, 12);
+    const svLeakEnvPair = `${svLeakEnvKey}=${svLeakEnvValue}`;
+    const svLeakPath = `/opt/leak/${randomUUID().slice(0, 8)}.mjs`;
+    const svInjected = new URLSearchParams({
+      'leak-stack': svLeakStack,
+      'leak-env': svLeakEnvPair,
+      'leak-path': svLeakPath,
+    }).toString();
+    const server = await fixtureFetch(fixture.url, `/probe/server-error?${svInjected}`, {
+      headers: { 'x-probe-leak-stack': svLeakStack, 'x-probe-leak-env': svLeakEnvPair, 'x-probe-leak-path': svLeakPath },
+    });
+    const svText = stripHtml(server.body);
+    const svRegion = /data-surface="server-error"[^>]*role="region"/.test(server.body);
+    const svRetry = /data-recovery="retry"/.test(server.body);
+    const svStateCopy = /The server hit an internal failure/.test(svText);
+    const svNoPatternHit = !serverErrorSensitiveHit(svText);
+    const svInjectedAbsent = !server.body.includes(svLeakStack)
+      && !server.body.includes(svLeakEnvPair)
+      && !server.body.includes(svLeakEnvValue)
+      && !server.body.includes(svLeakPath);
+    // The matcher itself must catch a bare NAME=value form: probe it here so
+    // regressions on the matcher are surfaced as a hard fail on this row.
+    const matcherCatchesBareName = serverErrorSensitiveHit('the payload was DB_PASSWORD=hunter2 rest');
+    const svPass = server.status === 500 && !!server.requestId && svRegion && svRetry && svStateCopy
+      && svNoPatternHit && svInjectedAbsent && matcherCatchesBareName;
+    results.push({
+      anchorAcId: 'application-empty-error-states-AC-22103-1',
+      verdict: svPass ? 'pass' : 'fail',
+      detail: svPass
+        ? `Given a mocked 500 response, the server-error state renders inside role="region" with a keyboard-reachable [data-recovery="retry"] control; the probe minted varied sensitive input per run (backtrace-frame line, bare NAME=value env-key pair, source path) and injected them via query and headers into the request that triggered the 500; the rendered document text contains none of the injected tokens and no backtrace/source-path/env-var/framework-frame hit on the surface; the sensitive-value matcher positively catches a bare NAME=value form; x-fixture-request-id=${server.requestId}`
+        : `Given a mocked 500 response, the server-error state renders (evidence gap): status=${server.status} rid=${server.requestId} region=${svRegion} retry=${svRetry} stateCopy=${svStateCopy} noPatternHit=${svNoPatternHit} injectedAbsent=${svInjectedAbsent} matcherCatchesBareName=${matcherCatchesBareName}`,
+      evidence: {
+        requestId: server.requestId,
+        responseStatus: server.status,
+        bodyExcerpt: excerpt(svText),
+        derived: { region: svRegion, retry: svRetry, stateCopy: svStateCopy, noPatternHit: svNoPatternHit, injectedAbsent: svInjectedAbsent, matcherCatchesBareName, injectedTokens: { svLeakStack, svLeakEnvPair, svLeakPath } },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}

package/blueprints/application-empty-error-states/contributions/probes/not-found-and-recovery.mjs

@@ -0,0 +1,61 @@
+// application-empty-error-states probe: 404 not-found state
+// (AC-22101-1). AC-22101-1 requires a role="region" with an
+// accessible name for the missing resource kind, a keyboard-reachable
+// recovery link to the parent surface, plus a search input as an
+// alternate recovery.
+//
+// The probe:
+//   - GETs /probe/not-found and derives status=404, the region role
+//     wrapper, the parent-surface recovery link and the search input.
+//   - Follows the parent-surface link and asserts the linked route
+//     responds (200): the derived observable of "recovery link works"
+//     is a two-request round-trip, not a magic string match.
+
+import { fixtureFetch, startFixture, excerpt } from './probe-utils.mjs';
+
+export const anchorAcId = 'application-empty-error-states-AC-22101-1';
+export const accountBound = false;
+
+export default async function runProbe() {
+  const fixture = await startFixture();
+  const results = [];
+  try {
+    const nf = await fixtureFetch(fixture.url, '/probe/not-found');
+    const regionPresent = /data-surface="not-found"[^>]*role="region"/.test(nf.body);
+    const parentLinkMatch = nf.body.match(/href="([^"]+)"[^>]*data-recovery="parent-surface"/);
+    const parentHref = parentLinkMatch ? parentLinkMatch[1] : null;
+    const searchInput = /data-recovery="search"[^>]*>[^]*<input[^>]*type="search"/.test(nf.body);
+    const statusOk = nf.status === 404;
+    const regionCheckPass = statusOk && !!nf.requestId && regionPresent && !!parentHref && searchInput;
+
+    // Follow the recovery link (varied input: a second request derived
+    // from the first response) and assert the target route responds.
+    let followStatus = null;
+    let followRid = null;
+    if (parentHref) {
+      const follow = await fixtureFetch(fixture.url, parentHref);
+      followStatus = follow.status;
+      followRid = follow.requestId;
+    }
+    const roundTripPass = regionCheckPass && followStatus === 200 && !!followRid;
+
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'application-empty-error-states-AC-22101-1: browser document-title state reflecting the missing resource kind and assistive-tech accessible-name resolution (the AC clauses beyond the DOM shape) are browser + AT driven and not observed by this Node HTTP probe; the 404 region + parent-link follow-through walk is a partial observation of AC-22101-1',
+      verdict: roundTripPass ? 'warn' : 'fail',
+      detail: roundTripPass
+        ? `Given a 404 response on a route the SPA declares: observed role="region" named for the missing resource, [data-recovery="parent-surface"] link (${parentHref}) and [data-recovery="search"] input on the rendered surface; follow-through GET ${parentHref} returned 200; x-fixture-request-id (not-found)=${nf.requestId}, (parent)=${followRid}`
+        : `Given a 404 response on a route the SPA declares (evidence gap): status=${nf.status} rid=${nf.requestId} region=${regionPresent} parentHref=${parentHref} searchInput=${searchInput} followStatus=${followStatus}`,
+      evidence: {
+        requestId: nf.requestId,
+        responseStatus: nf.status,
+        bodyExcerpt: excerpt((nf.body.match(/data-surface="not-found"[^]{0,200}/) || [''])[0]),
+        derived: { statusOk, regionPresent, parentHref, followStatus, followRequestId: followRid, searchInput },
+      },
+    });
+  } finally {
+    await fixture.kill();
+  }
+  return { results };
+}