rcf-lite 0.29.0 → 0.30.0

package/CHANGELOG.md

@@ -7,6 +7,93 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 ## [Unreleased]
 
 
+## [0.30.0] - 2026-10-03
+
+0.30.0 lands the DEFINE step 3 gates bite (see spec section 10). The Remi path (PRs 1 to 3) shipped in 0.29.0. This release carries the gates bite (PRs 5, 6, 7 = rcf-lite PRs 282, 284, 286), the bundle refuse / override / skip + validate findings + NV-DL ruleset flip (PR 8 = rcf-lite PR 288), and the R11 ownerRef / deliveredBy grammar + blueprint recount + NV-DL wrap + test tightening (PR 9 = rcf-lite PR 289). A follow-up fix on this branch lands ruling R12 (NV-DL-ADM-02 override channel is `freeze.override` only). The release is built and gated on Node 24.
+
+Spec note: the DEFINE step 3 spec (`projects/rcf-lite-wsd/specs/2026-10-01_define-step3-po-elicitation-spec.md` section 16 and prose) names certain D2 behaviours "0.30.0" that in fact shipped in 0.29.0 (the `skeleton:resolvedBy` closed-grammar tightening, the `rcf define ledger <name> update <id>` subverb, and the `resolvedBy` closed grammar). The spec will be amended on the next pass.
+
+Breaking under the pre-1.0 convention: `rcf define readiness --check`, `rcf build bundle --next` and `rcf define validate` all change exit behaviour on verbs consumers run in CI. See "For consumers (upgrading)" below for the exact flags, override channels and the migration table.
+
+### Added
+
+- **DEFINE step 3 PR 5: D3 bite (template markers, entity join, resolved paths, ackable, --check exit 4 policy; #282).** `shapes:templateMarkers` enforces per-kind marker presence on `interfaces[].description` (recordShape needs `fields:`, httpRoute needs method/path/request/response/errors, fixture needs `instances:`, event needs `payload:`, cliCommand needs `usage:`, uiRoute needs `path`, port needs `protocol`, fileFormat needs `format:`, other needs a note); drafts included. `shapes:entityJoin` fails every `coreEntities[].name` not named by exactly one `recordShape` tree-wide. `shapes:pathsResolve` fails any `path:`-like token on an interface description that does not resolve on disk (readiness collects candidates; the CLI and tab pass `resolvedPaths` in the stage context). `ackable(stage)` returns true for D3/D5/D6 and false otherwise; `--check` exits 4 unacked and 0 at the current hash. ADR-4131, US-17404.
+- **DEFINE step 3 PR 6: D4 closed sets and ownerRef as findings, D5 concern catalogue, standards citation (#284).** `stories:closedSets` fails an AC whose description carries an enumeration cue ("one of", "any of", "the following", "types of", "status is") without an inline bracketed list or an `ownerRef`. `stories:ownerRefResolves` fails every `ownerRef { tacId, field }` that does not resolve to `interfaces[<name>]` on that TAC. `src/define/concern-catalogue.js` ships the eight-concern catalogue keyed by REQ shape; `crosscut:catalogue` enumerates every applicable pair per in-scope REQ against the concern ledger (applied or waived). `skeleton:standardsCited` fails every registered standards pack neither cited in a REQ `rationale` or an ADR nor waived by a concern-ledger entry with key `standards:<pack>`. D5 is ackable through the --check crosscut fold. US-17405.
+- **DEFINE step 3 PR 7: D6 consistency scans, probe seam, --litmus and rcf_define_litmus (#286).** Four D6 scans: `consistency:contradictions` (two ACs on one story sharing a `when` clause with a negated `then`), `consistency:unsatisfiable` (a `then` naming a field no `recordShape` `fields:` defines; a field in a `[draft]` recordShape counts as defined), `consistency:duplicates` (identical AC descriptions across stories), `consistency:orphanInterfaces` (no AC `ownerRef` and no REQ `deliveredBy` reaches an interface). `computeReadiness(tree, { probeRunner })` accepts an injectable runner; findings land as probe-ledger entries. `--litmus <n>` on readiness and freeze requires n distinct readers to have recorded a litmus reading at the current litmus hash (`tree.litmusHash`, the tree hash computed with the probes ledger excluded per R9 amendment 2026-10-03); `readiness --json` prints the litmus hash. The `rcf_define_litmus` prompt tells the harness to spawn n fresh-context readers and land their readings. US-17406, US-17504.
+- **DEFINE step 3 PR 9: R11 ownerRef / deliveredBy grammar, blueprint recount, NV-DL-ADM-02/03/04 enforcement locus, test tightening (this release).** `resolveOwnerRefField(doc, field)` widens the D4 `stories:ownerRefResolves` check and the `rcf define validate` `defineValidate:ownerRefResolves` / `defineValidate:deliveredByResolves` findings beyond `interfaces[<name>]` to every bracket-grammar path on the owning TAC or ADR: `interfaces[<name>]`, `responsibilities[<n>]`, `dependencies[<name>]`, `alternativesConsidered[<n>]`, and a bare schema field name (`purpose`, `internalStructure`, `decision`, `context`, `consequences`, `name`, `tradeoffs`, `notes`, `description`, `title`, and the arrays themselves). Dotted grammar is refused; validate names the dotted field so the author can rewrite. The ADR branch of `ownerRef { adrId, field }` now resolves (pre-R11 code recognised only `tacId`). `rcf define validate` now checks the OBJECT form of `deliveredBy` (`{ tacId | adrId, field }`), which was silently skipped before PR 9 (review 2026-10-03). `freeze.override.by` is resolved by `resolveOverrideBy({ projectRoot })` with the preference order `git config user.email` -> `GITHUB_ACTOR` -> `USER` -> `USERNAME` -> literal `operator`; each failing arm falls through silently to the next (AC-17702-6). The admissibility wrap (`src/query/refuse-on-admissibility.js`) now cites NV-DL-ADM-02 (failing D4), NV-DL-ADM-03 (failing D3) and NV-DL-ADM-04 (non-empty validate errors) alongside the NV-BL rules; readiness and freeze pass the computed `stages[]` and `validateErrors` via new `defineStages` / `defineValidateErrors` arguments. The wrap's refusal line names every biting rule; the recordedInChain override channel is `--ack <gate>=<reason>` on `freeze.gates` at the current tree hash for ADM-03 (D3 is ackable; `foldState` masks the stage as `acknowledged`), `freeze.override` only for ADM-02 (D4 is NOT ackable per decision 9; fix the D4 findings or record `freeze.override` via `rcf build bundle --next --override "<reason>"`) -- ruling R12 2026-10-03 corrected the pre-R12 wrap wording that named --ack as the ADM-02 channel -- and a chain-document correction committed to git is the override for ADM-04. Readiness itself stays informational (AC-17902-4 unchanged); freeze keeps its own `freezeableAfterAck` gate. `packages/rcf-lite/scripts/blueprint-r11-sweep.mjs` rewrites every dotted `interfaces.<name>` / `responsibilities.<key>` / `dependencies.<name>` / `decision.<key>` to bracket grammar across the shipped blueprint corpus (`blueprints/*/contributions/**`), then collapses every dead bracket name to its bare parent field (which resolves) or drops the ownerRef / deliveredBy where even the parent is empty (walker treats both as optional); the script is idempotent (re-run writes nothing) and tally-reports per blueprint. AC-17702-3 pins the two-FBS skip-and-hand-out to a single expected `exit 0` with the FBS-002 bundle; AC-17702-4 pins the all-impacted refusal to a single expected `exit 4`; AC-17702-5 compares byte-for-byte against the captured 0.29.0 bundle golden (`test/cli/fixtures/bundle-next-029-golden.md`, captured from `origin/main` at `9860aab3`). AC-17405-7, AC-17405-8, AC-17702-6 and AC-17902-5 extend US-17405, US-17702 and US-17902; FBS-202 gains the four new ac ids; TAC-4122, TAC-4123, TAC-4125, TAC-4126 and REQ-179 amended. No new ADR.
+- **DEFINE step 3 PR 8: bundle refuse / override / skip, validate findings, NV-DL enforced (this release).** `rcf build bundle --next` refuses on an unfrozen tree with exit 4 (message pointing at `rcf define readiness` and the `--override "<reason>"` channel), accepts `--override "<reason>"` writing `freeze.override { reason, by, at }` through `applyOverrideToFreezeRecord` and proceeds, skips re-execute FBS impacted by the delta with the reason on stderr and hands out the next unimpacted FBS; when every actionable FBS is impacted and no override is given the verb exits 4 (NV-DL-ADM-01, NV-DL-ADM-05). `rcf define validate` grows four findings: an interface kind outside the closed vocabulary (`INTERFACE_KINDS`), a bracketed AC class prefix outside the five known classes, a `tacIds` naming a non-TAC, and an unresolving `ownerRef` or `deliveredBy`; absence of a class marker is NOT a validate finding (decision 10 kept; D4 reports absence as the floor). `packages/rcf-lite/src/ruleset/ruleset.json` gains NV-DL-ADM-01..05 with `refuseByDefault: true` and `overrideChannel: recordedInChain`. The readiness compute still runs and prints under NV-DL refusal (ADR-4123, informational posture on the compute unchanged). REQ-177 / US-17702, REQ-178 / US-17802, REQ-179 / US-17902 under TAC-4125 and TAC-4126. No new ADR (spec section 11.9).
+
+### Changed
+
+- **Dogfood: 18 TAC files remapped off legacy interface kinds (DEFINE step 3 PR 8).** 64 interfaces across TAC-001..008, TAC-4101..4108, TAC-4129 and TAC-4134 carried pre-DEFINE-era kind labels (`function`, `command`, `mcpTool`, `type`, `prompt`, `artifact`, `constant`, `moduleApi`, `interface`) that pre-date the DEFINE spec section 5.2 closed vocabulary. The mapping (`function`/`mcpTool`/`prompt`/`constant`/`moduleApi`/`interface` -> `other`; `command` -> `cliCommand`; `type` -> `recordShape`; `artifact` -> `fileFormat`) is applied mechanically and the legacy label is preserved in the interface description for provenance. `rcf define validate` is now clean on the dogfood tree (AC-17802-3).
+
+- **Blueprints: 284 shipped contribution files remapped off legacy interface kinds and dotted ownerRef grammar (DEFINE step 3 PR 8).** 40 blueprints under `blueprints/` carried pre-DEFINE-era interface kinds (47 distinct labels across 330 interfaces) and 252 ownerRefs written in the `interfaces.<name>` form. The dogfood mapping table extends to this corpus (`function`/`mcpTool`/`prompt`/`constant`/`moduleApi`/`interface` -> `other`; `command` -> `cliCommand`; `type` -> `recordShape`; `artifact` / `artefact` -> `fileFormat`; everything else -> `other`); dotted ownerRefs rewrite to `interfaces[<name>]`; the legacy label is kept in the interface description. `rcf define validate` is now clean on the application-onboarding-tour blueprint applied to a fresh project (TC-057 passes without a skip).
+
+### Fixed
+
+- **NV-DL-ADM-02 override channel wording (ruling R12, 2026-10-03).** The PR 9 admissibility wrap, REQ-179 and the ruleset notes named `--ack <gate>=<reason>` as the override channel for NV-DL-ADM-02. ADM-02 maps to D4 (stories floor), and decision 9 keeps `ackable` to D3/D5/D6 only, so D4 cannot be masked by an ack. The only recordedInChain override channel for ADM-02 is `freeze.override` written by `rcf build bundle --next --override "<reason>"`; the normal path is to fix the failing D4 findings. ADM-03 (D3) keeps `--ack`; ADM-04 keeps the chain-document correction committed to git. `src/query/refuse-on-admissibility.js` refusal message rewritten; `src/ruleset/ruleset.json` NV-DL-ADM-02 notes rewritten; `rcf/requirements/req-179.json` PR 9 enforcement-locus paragraph split per rule; `test/query/refuse-on-admissibility-nvdl.test.js` asserts the R12 phrasing.
+
+### For consumers (upgrading)
+
+This release changes exit behaviour on three verbs that WSD, wespa and other consumers run in CI. Upgrade carefully.
+
+- **`rcf define readiness --check`** exits **4** on a failing D3, D5 or D6 at the current tree hash. Clear with `--ack <gate>=<reason>` recorded at the current hash on `freeze.gates` (D3/D5/D6 only; decision 9). Readiness itself (no `--check`) still prints and exits 0; the DEFINE-stage admissibility wrap writes a `[warn]` line naming any biting NV-DL rule.
+- **`rcf build bundle --next`** exits **4** on an unfrozen tree. Clear with `--override "<reason>"` which writes `freeze.override { reason, by, at }` and proceeds. `freeze.override.by` is resolved via `resolveOverrideBy({ projectRoot })` with the preference order `git config user.email` -> `GITHUB_ACTOR` -> `USER` -> `USERNAME` -> literal `operator`; set `USER` or a git identity in CI if you want something recognisable in the record. Impacted FBS are skipped with the reason on stderr; when every actionable FBS is impacted and no override is given the verb also exits 4.
+- **`rcf define validate`** exits **3** on four new finding kinds introduced in PR 8 (an interface kind outside the closed vocabulary, a bracketed AC class prefix outside the five known classes, a `tacIds` naming a non-TAC, and an unresolving `ownerRef` / `deliveredBy`), plus PR 9 extends the ownerRef / deliveredBy finding to the R11 bracket grammar on the full owner document AND checks the object form of `deliveredBy` (`{ tacId | adrId, field }`), which the pre-PR 9 code silently skipped. Dotted grammar is refused with the dotted field named so the author can rewrite. Absence of an AC class marker is NOT a finding (decision 10 kept; D4 reports absence as the floor).
+- **NV-DL-ADM-01..05 flip to `refuseByDefault: true`** with `overrideChannel: recordedInChain`. Per-rule enforcement locus and override channel (R12 split applied):
+  - NV-DL-ADM-01: `rcf build bundle --next` refuses without a freeze record. Override: `--override "<reason>"` writes `freeze.override`.
+  - NV-DL-ADM-02: D4 stories floor failing items are findings (closed sets, ownerRef). Surfaced through the admissibility wrap. Override: `freeze.override` only (D4 is NOT ackable); fix the D4 findings otherwise.
+  - NV-DL-ADM-03: D3 shapes bite failing items are findings (template markers, entity join, paths). Surfaced through the wrap. Override: `--ack <gate>=<reason>` on `freeze.gates` at the current tree hash (D3 is ackable).
+  - NV-DL-ADM-04: `rcf define validate` finding set refuses with exit 3. Surfaced through the wrap when callers pass `defineValidateErrors`. Override: a chain-document correction committed to git (not a gate ack).
+  - NV-DL-ADM-05: `rcf build bundle --next` skips re-execute FBS impacted by the delta with the reason on stderr; when every actionable FBS is impacted and no override is given, exit 4.
+- **Litmus flag (PR 7, R9).** `--litmus <n>` on `rcf define readiness` and `rcf define freeze` requires n distinct readers to have recorded a litmus reading at the current litmus hash. The litmus hash is `tree.litmusHash` -- the tree hash computed with the probes ledger EXCLUDED (R9 amendment 2026-10-03) -- and `readiness --json` prints it. The `rcf_define_litmus` prompt tells the harness to spawn n fresh-context readers and land their readings.
+- **probeRunner seam (PR 7).** `computeReadiness(tree, { probeRunner })` accepts an injectable runner; findings land as probe-ledger entries. No runner ships in 0.30.0; consumers (or harnesses) wire their own if they want D6 probes to execute.
+- **Node 24 is the build and gate floor.** `rcf-lite` requires `node >= 24` (`packages/rcf-lite/package.json#engines`) and is gated on Node 24. The sandbox default Node version is below the repo floor; use nvm, `~/.n`, or an equivalent in CI.
+- **Blueprint authors.** Tighten bare `interfaces` and `responsibilities` pointers to the bracket forms (`interfaces[<name>]`, `responsibilities[<n>]`) where you know the specific target; the bare field resolves under R11 while the owning doc carries a non-empty value under that key, but a bracketed form is the stricter and more useful record.
+- **Sweep script re-runnable in dry-run mode.** `packages/rcf-lite/scripts/blueprint-r11-sweep.mjs` can be run on a consumer's own tree with `--dry-run` to see what would change before any write; the script is idempotent either way (re-running it writes zero rewrites and reports zero findings once clean).
+- **Two blueprint REQs now resolve deliveredBy on owner presence alone.** PR 9's CI-fix pass restored `deliveredBy = { tacId }` entries on `application-spa` REQ-004 (points at `TAC-201-application-spa-app-shell`) and `application-api-rest` REQ-002 (points at `TAC-301-application-api-rest-request-pipeline`); `field` is schema-optional and R11 resolves on owner presence alone when it is absent.
+
+### Known gaps and parked rulings
+
+- **Parked rulings not resolved in PR 8** (named in the PR 8 report.md KNOWN GAPS section): write-back idempotency of the add/create verbs; D3 draft scope tree-wide vs delta; the stagePolicy label drift, D3 notApplicable ordering and Dockerfile-token path findings from the PR 5 review; `skeleton:standardsCited` inside the D2 scope early-return and a `standards:<pack>` ledger entry with disposition applied counting as a waiver from the PR 6 review; anything PR 7's review parked (R9 litmus-hash amendment landed; other PR 7 parked rulings carried forward).
+- **Decision 9 and decision 10 are binding:** `--ack` remains the recorded override for D3/D5/D6; validate reports no finding for a missing AC class marker (D4's floor).
+- **Node 24 re-gate:** Dave re-gates PR 8 and PR 9 on Node 24 before merge. The sandbox default Node version is below the repo floor; PR 8 was built and tested on Node 24 via nvm in the cloud session, PR 9 locally.
+
+### Migrating existing trees
+
+Consumers (WSD among them) will see one new failure class on upgrade. On a fresh project with an existing tree, `rcf define validate` now exits 3 under PR 8 for any of:
+
+1. **Interface kind outside the closed vocabulary** `recordShape`, `httpRoute`, `event`, `cliCommand`, `uiRoute`, `port`, `fileFormat`, `fixture`, `other`. Mechanical remap table (safe conservative default):
+
+   | Legacy kind                                                | Remap to      |
+   |------------------------------------------------------------|---------------|
+   | `function`, `mcpTool`, `prompt`, `constant`, `moduleApi`, `interface` | `other`       |
+   | `command`                                                  | `cliCommand`  |
+   | `type`                                                     | `recordShape` |
+   | `artifact`, `artefact`                                     | `fileFormat`  |
+   | anything else                                              | `other`       |
+
+   Keep the original kind in the interface `description` so the migration stays auditable (`"(legacy kind: factory)"` is the convention this release used across the shipped blueprint corpus).
+
+2. **AC `ownerRef.field` grammar (widened under R11, PR 9).** Bracket grammar is the only accepted form. Rewrite `interfaces.<name>` to `interfaces[<name>]`, `responsibilities.<key>` to `responsibilities[<key>]`, `dependencies.<name>` to `dependencies[<name>]`, and `decision.<key>` to the bare field `decision`. R11 broadens resolution so a bracket path or bare schema field name resolves when it exists on the owning document: `interfaces[<name>]`, `responsibilities[<n>]` (zero-based integer index into the string array), `dependencies[<name>]`, `alternativesConsidered[<n>]`, or a bare field name (`purpose`, `internalStructure`, `decision`, `context`, `consequences`, `name`, `tradeoffs`, `notes`, `description`, `title`, and the collection arrays themselves). The ADR branch of `ownerRef { adrId, field }` now resolves. Dotted grammar is refused; the validate finding names the dotted field so the author can rewrite. Any ownerRef that still resolves to nothing can be collapsed to its bare parent field (which does resolve while the owning doc carries a non-empty value under that key) or dropped (the walker treats ownerRef as optional).
+
+3. **Interface or path on `ownerRef`.** `interfaces[<name>]` must resolve to an interface declared on the referenced TAC; `responsibilities[<n>]` must land on an existing index; `dependencies[<name>]` must match a declared dependency name. Rename, add, or fall back to the bare field name before the AC is reconnected.
+
+4. **Object-form `deliveredBy` (PR 9).** `rcf define validate` now checks the `{ tacId | adrId, field }` object form of `deliveredBy` under the same R11 grammar; the pre-PR 9 code silently skipped it. `deliveredBy` without a `field` resolves on the owner's presence alone (field is schema-optional).
+
+5. **`freeze.override.by` identity (PR 9, AC-17702-6).** `bundle --next --override "<reason>"` now writes `freeze.override.by` from the preference order `git config user.email` -> `GITHUB_ACTOR` -> `USER` -> `USERNAME` -> literal `operator`. CI runners that set `GITHUB_ACTOR` get the actor identity on an unconfigured git; the literal `operator` is the never-null fallback.
+
+6. **NV-DL-ADM-02/03/04 enforcement locus (PR 9).** The admissibility wrap (`src/query/refuse-on-admissibility.js`) now cites NV-DL-ADM-02 (failing D4), NV-DL-ADM-03 (failing D3) and NV-DL-ADM-04 (non-empty validate errors) in its refusal line, next to the NV-BL rules. Override channels differ by rule (ruling R12 2026-10-03): for ADM-03 the channel is `--ack <gate>=<reason>` recorded on `freeze.gates` at the current tree hash (D3 is ackable per decision 9, same ack mechanism the stage gates already honour); for ADM-02 the channel is `freeze.override` only (D4 is NOT ackable; decision 9 keeps `ackable` to D3/D5/D6, so the only recordedInChain path is `rcf build bundle --next --override "<reason>"` writing `freeze.override`; the normal expectation is to fix the failing D4 findings); for ADM-04 the override is a chain-document correction committed to git. Readiness stays informational; freeze's own `freezeableAfterAck` gate still enforces.
+
+The AC class prefix check (`[happy]`, `[edge]`, `[failure]`, `[must-not]`, `[non-functional]`) and the `tacIds` / `deliveredBy` resolution rules are also enforced. Absence of a class prefix is NOT a finding (decision 10 kept; D4 reports absence as the floor).
+
+**Blueprint recount (PR 9, replaces the pre-PR 9 "about 295" estimate).** `packages/rcf-lite/scripts/blueprint-r11-sweep.mjs` records the authoritative numbers over the shipped `blueprints/` corpus of 39 blueprints. After PR 9 the shipped blueprints are clean under R11:
+
+- 31 dotted-to-bracket rewrites across 16 blueprints (phase 1).
+- 493 dead-bracket collapses to the bare parent field, plus 12 ownerRef / deliveredBy drops where even the parent was empty, across the full shelf (phase 2).
+- 0 `rcf define validate` findings and 0 D4 `stories:ownerRefResolves` failures across all 39 blueprints after the sweep (direct contribution-tree recount; `applyBlueprint` paths with pre-existing walker defects, orthogonal to R11, are flagged separately by the sweep).
+- The sweep is idempotent: re-running it writes zero rewrites and reports zero findings.
+
 ## [0.29.0] - 2026-10-03
 
 0.29.0 lands the viewer UI refresh train (nine PRs that rebuild the shell, add shared components, redesign the Requirements, Architecture, Build and Readiness tabs, ship a Build DAG sub-tab, add fast ID lookup, and prove the embedding contract with a same-origin test-host fixture), the DEFINE readiness persona split (two readiness levels, `--level` and `--persona` on `rcf define readiness`, a Readiness tab as tab 1), and the first three DEFINE step 3 PRs (document intake into the brief ledger with the closed `resolvedBy` grammar, a `rcf define questions` verb with three new MCP tools and two argument-free prompts for the harness loop, and the `[draft]` shapes gate across TAC purpose, interface and core-entity homes with a DISCOVERY prototypes doctrine). The brief said 0.29.0 was never tagged; it is tagged here, and the spec sections that referred to those D2 behaviours as "0.30.0" now read 0.29.0.

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-001.json

@@ -5,7 +5,7 @@
   "description": "The settings shell renders a single primary tabs region (ARIA APG tabs pattern) whose entries mirror the union of applied capabilities discovered via readAppliedCapabilities. The applied capability floor is principalDirectory: the shell reads the current authenticated principal (name, email, id) from the applied principalDirectory provider on first render and passes the identity to every child surface without re-reading it per tab switch. A tab whose capability is not applied does NOT render (no dead link, no disabled shell). A principal without an authenticated session reaching /account routes to the access-denied state through application-empty-error-states with a sign-in link; no bespoke access-denied UI is invented here. Landmark, headings, focus order per WCAG 2.4.6.",
   "deliveredBy": {
     "tacId": "TAC-2601-application-account-settings-shell",
-    "field": "responsibilities.renderShell"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-002.json

@@ -5,7 +5,7 @@
   "description": "The profile surface (/account/profile) is unconditional (any authenticated principal reaches it) and renders a form with WCAG 1.3.5 autocomplete tokens on every editable identifier (name, email, bday, country). Save success announces via aria-live polite (\"Profile saved\"). Save failure per field renders aria-invalid true with aria-describedby to the per-field error message and focus moves to the first invalid field (WCAG 3.3.1 Error Identification).",
   "deliveredBy": {
     "tacId": "TAC-2601-application-account-settings-shell",
-    "field": "responsibilities.renderProfileSurface"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-003.json

@@ -5,7 +5,7 @@
   "description": "The security surface (/account/security) renders when the applied capability set contains credentialSelfService (self-service branch of the security-surface-shape elicit: password change, MFA setup, session-based sign-out) or hostedIdentityUi (hosted-link-out or hosted-embed branch of the security-surface-shape elicit: hosted-link-out surfaces an operator-elicited href through the hosted-identity-url handle; hosted-embed surfaces the same handle inside a same-origin iframe when the applied hosted-identity provider names an embed clause). When NEITHER capability is applied, the security tab does not render and the surface refuses at apply with the two-remedy message (declare a capability, or drop the security tab from scope) per spec Q3.",
   "deliveredBy": {
     "tacId": "TAC-2603-application-account-settings-hosted-ui-bridge",
-    "field": "interfaces.renderSecuritySurface"
+    "field": "interfaces[renderSecuritySurface]"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-004.json

@@ -5,7 +5,7 @@
   "description": "The sessions surface (/account/sessions) renders when sessionInventory is applied. Lists active sessions in a table enumerated by data-session-id with device label, last-active timestamp and terminate control. Terminate opens an ARIA APG dialog-modal (role=dialog, aria-modal=true, aria-labelledby to the heading, focus trap, focus returns to the row on close) confirming the action; on submit the row disappears from the table and a polite \"Session ended\" announcement fires (WCAG 4.1.3 Status Messages).",
   "deliveredBy": {
     "tacId": "TAC-2604-application-account-settings-session-store",
-    "field": "interfaces.sessionInventoryConsumer"
+    "field": "interfaces[sessionInventoryConsumer]"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-005.json

@@ -5,7 +5,7 @@
   "description": "The notification-preferences surface (/account/notifications) renders when application-notifications-in-app is applied. Provides a per-category silence control and a per-channel opt-in (in-app, email, push where channels apply). The blueprint does NOT own the notification model; it delegates the model to the applied blueprint and renders the operator interface only. Save-success and save-failure announcements follow the profile surface contract.",
   "deliveredBy": {
     "tacId": "TAC-2601-application-account-settings-shell",
-    "field": "responsibilities.renderPreferencesSurface"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-006.json

@@ -5,7 +5,7 @@
   "description": "The theme surface (/account/theme) renders when application-spa is applied. Renders a light/dark/system radiogroup (ARIA APG radiogroup, keyboard reachable) and persists the choice per the theme-persistence elicit (spa-local-storage default, server-scoped, or none). Choice takes effect immediately (data-theme attribute on the html element flips) and honours the users prefers-color-scheme when set to system.",
   "deliveredBy": {
     "tacId": "TAC-2601-application-account-settings-shell",
-    "field": "responsibilities.renderThemeSurface"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-007.json

@@ -5,7 +5,7 @@
   "description": "The security and sessions surfaces honour the elicited reauth-window with a runtime clause per option, applied before a high-value change (credential change, session termination, MFA enrolment). `never` bypasses reauthentication for any interval since the last successful sign-in and permits the high-value action to proceed with only the standard confirmation dialog. `5`, `15` and `60` denote a minute-count: when more than that many minutes have elapsed since the principal's last successful sign-in (as recorded on the applied auth providers session inventory), the surface presents a reauth prompt before the high-value action; the action refuses with REAUTH_REQUIRED until the reauth prompt returns success, then proceeds. The comparison uses the last-active timestamp on the current session record from the applied provider (security-auth-clerk TAC-1003 sessionInventory or the equivalent TAC on another auth blueprint), never a local clock. The reauth prompt never accepts the current session's own credentials as sufficient for the reauth without a fresh challenge (a fresh password entry, a fresh MFA challenge or a fresh magic-link click).",
   "deliveredBy": {
     "tacId": "TAC-2604-application-account-settings-session-store",
-    "field": "responsibilities.reauthWindowGate"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "security",

package/blueprints/application-account-settings/contributions/requirements/application-account-settings-req-009.json

@@ -5,7 +5,7 @@
   "description": "When the applying project runs its own auth (no shipped security-auth-* blueprint) and answers the four custom-auth-provides-* boolean elicits, the account-settings shell binds each answer to the appliedCapabilities union with a runtime clause per token: when `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is `true` the union includes `principalDirectory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-credential-self-service]` is `true` the union includes `credentialSelfService` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-session-inventory]` is `true` the union includes `sessionInventory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-hosted-identity-ui]` is `true` the union includes `hostedIdentityUi` and `false` omits it. The sidecar the shell reads reflects the exact union the boolean answers produce.",
   "deliveredBy": {
     "tacId": "TAC-2602-application-account-settings-capability-discovery",
-    "field": "responsibilities.runElicitationPhase"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-account-settings/contributions/tacs/tac-2601-application-account-settings-shell.json

@@ -21,13 +21,13 @@
   "interfaces": [
     {
       "name": "renderShell",
-      "kind": "factory",
-      "description": "renderShell({ capsSidecarUrl, surfaceRegistry, sessionGuard, themeAdapter, notificationsAdapter }) -> { mount(rootElement), unmount() }. The project supplies the capsSidecarUrl (where the sidecar is served from), the surfaceRegistry (maps a capability string to a surface component), the sessionGuard (returns whether the current principal has an authenticated session), the themeAdapter (persists the theme per the elicited persistence strategy) and the notificationsAdapter (reads and writes preferences through the applied notifications blueprint)."
+      "kind": "other",
+      "description": "renderShell({ capsSidecarUrl, surfaceRegistry, sessionGuard, themeAdapter, notificationsAdapter }) -> { mount(rootElement), unmount() }. The project supplies the capsSidecarUrl (where the sidecar is served from), the surfaceRegistry (maps a capability string to a surface component), the sessionGuard (returns whether the current principal has an authenticated session), the themeAdapter (persists the theme per the elicited persistence strategy) and the notificationsAdapter (reads and writes preferences through the applied notifications blueprint). (legacy kind: factory)"
     },
     {
       "name": "capabilitiesSidecar",
-      "kind": "shape",
-      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
+      "kind": "other",
+      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell. (legacy kind: shape)"
     }
   ],
   "dependencies": [

package/blueprints/application-account-settings/contributions/tacs/tac-2602-application-account-settings-capability-discovery.json

@@ -16,8 +16,8 @@
   "interfaces": [
     {
       "name": "readAppliedCapabilities",
-      "kind": "function",
-      "description": "readAppliedCapabilities(projectRoot) -> Promise<string[]>. Reads rcf/blueprints/application-account-settings.applied.json and returns appliedCapabilities[] or []. Never throws."
+      "kind": "other",
+      "description": "readAppliedCapabilities(projectRoot) -> Promise<string[]>. Reads rcf/blueprints/application-account-settings.applied.json and returns appliedCapabilities[] or []. Never throws. (legacy kind: function)"
     }
   ],
   "dependencies": [],

package/blueprints/application-account-settings/contributions/tacs/tac-2603-application-account-settings-hosted-ui-bridge.json

@@ -16,8 +16,8 @@
   "interfaces": [
     {
       "name": "renderSecuritySurface",
-      "kind": "factory",
-      "description": "renderSecuritySurface({ appliedCapabilities, appliedElicitations }) -> { mount(root), unmount() }. Reads security-surface-shape and hosted-identity-url from appliedElicitations."
+      "kind": "other",
+      "description": "renderSecuritySurface({ appliedCapabilities, appliedElicitations }) -> { mount(root), unmount() }. Reads security-surface-shape and hosted-identity-url from appliedElicitations. (legacy kind: factory)"
     }
   ],
   "dependencies": [

package/blueprints/application-account-settings/contributions/tacs/tac-2604-application-account-settings-session-store.json

@@ -17,18 +17,18 @@
   "interfaces": [
     {
       "name": "renderSessionsSurface",
-      "kind": "factory",
-      "description": "renderSessionsSurface({ inventoryAdapter, terminateAdapter }) -> { mount(root), unmount() }. The project supplies the two adapters against the applied provider."
+      "kind": "other",
+      "description": "renderSessionsSurface({ inventoryAdapter, terminateAdapter }) -> { mount(root), unmount() }. The project supplies the two adapters against the applied provider. (legacy kind: factory)"
     },
     {
       "name": "sessionRecord",
-      "kind": "shape",
-      "description": "Shape owned by `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` (or the equivalent session-inventory TAC on the applied auth blueprint). The consumer reads that shape without restating it; the pack asserts the surface renders every session, the terminate control is present on every non-current row, and the current row (data-current-session=\"true\") does not carry the terminate action."
+      "kind": "other",
+      "description": "Shape owned by `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` (or the equivalent session-inventory TAC on the applied auth blueprint). The consumer reads that shape without restating it; the pack asserts the surface renders every session, the terminate control is present on every non-current row, and the current row (data-current-session=\"true\") does not carry the terminate action. (legacy kind: shape)"
     },
     {
       "name": "sessionInventoryConsumer",
-      "kind": "consumer",
-      "description": "Consumer contract on top of the applied auth providers sessionInventory (owner TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory or the equivalent TAC on another auth blueprint). Reads list()/revoke()/revokeAllExceptCurrent() and never restates the row shape."
+      "kind": "other",
+      "description": "Consumer contract on top of the applied auth providers sessionInventory (owner TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory or the equivalent TAC on another auth blueprint). Reads list()/revoke()/revokeAllExceptCurrent() and never restates the row shape. (legacy kind: consumer)"
     }
   ],
   "dependencies": [
@@ -43,4 +43,4 @@
   "notes": "Known mechanism-reach gap: the read-inventory adapter contract cannot prove the applied provider actually returns a device label the operator will recognise (User-Agent parsing varies); the pack asserts the DOM shape.",
   "createdAt": "2026-09-06T20:55:46Z",
   "updatedAt": "2026-09-10T00:00:00Z"
-}
+}

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25105.json

@@ -35,11 +35,7 @@
       "then": "the surface shows an inventory-read-failed banner, no data-session-id rows appear as terminated, and a retry control is keyboard-reachable",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25105-4",
@@ -49,11 +45,7 @@
       "then": "the row remains with data-terminate-outcome=failed, the polite live region announces the failure and no session-terminated-announce is emitted",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25105-5",
@@ -63,11 +55,7 @@
       "then": "the current row carries data-current-session=true and its terminate control is disabled with an aria-describedby explanation",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25106.json

@@ -14,11 +14,7 @@
       "testable": true,
       "scope": "runtime",
       "description": "The sessions surface reads sessionInventory from the applied auth provider (security-auth-clerk 1.3.0+, security-auth-keycloak 1.2.0+, security-auth-oauth2 1.2.0+); the render contract of AC-25105-1 is identical regardless of which auth blueprint supplied the capability. observability-logging 1.3.0 no longer provides sessionInventory and is not consulted on this surface.",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25106-2",
@@ -28,11 +24,7 @@
       "then": "the surface reads the first providers inventory only, no cross-provider merge occurs and a divergent-shape observation refuses with SESSION_PROVIDER_CONFLICT",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": {
-        "tacId": "TAC-1003-security-auth-clerk-session-verifier",
-        "field": "interfaces.sessionInventory"
-      }
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25111.json

@@ -27,8 +27,7 @@
       "then": "the action refuses with REAUTH_REQUIRED, a reauth prompt renders and the action proceeds only after the reauth prompt returns success",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25111-3",
@@ -38,8 +37,7 @@
       "then": "the action refuses with REAUTH_REQUIRED and a reauth prompt renders; below the threshold no reauth prompt renders",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+      "disposition": "fixed"
     },
     {
       "id": "AC-25111-4",
@@ -59,8 +57,7 @@
       "then": "the action refuses with REAUTH_WINDOW_UNKNOWN, a retry control renders keyboard-reachable and no client clock is used",
       "testable": true,
       "scope": "runtime",
-      "disposition": "fixed",
-      "ownerRef": { "tacId": "TAC-1003-security-auth-clerk-session-verifier", "field": "interfaces.sessionInventory" }
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-account-settings/contributions/user-stories/application-account-settings-us-25112.json

@@ -20,7 +20,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-2602-application-account-settings-capability-discovery",
-        "field": "responsibilities.runElicitationPhase"
+        "field": "responsibilities"
       }
     },
     {
@@ -34,7 +34,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-2602-application-account-settings-capability-discovery",
-        "field": "responsibilities.runElicitationPhase"
+        "field": "responsibilities"
       }
     },
     {
@@ -48,7 +48,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-2602-application-account-settings-capability-discovery",
-        "field": "responsibilities.runElicitationPhase"
+        "field": "responsibilities"
       }
     },
     {
@@ -62,7 +62,7 @@
       "disposition": "template",
       "ownerRef": {
         "tacId": "TAC-2602-application-account-settings-capability-discovery",
-        "field": "responsibilities.runElicitationPhase"
+        "field": "responsibilities"
       }
     }
   ],

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-001.json

@@ -5,7 +5,7 @@
   "description": "The application realises an admin-console surface whose navigation, on load, reads the applied blueprints capability declarations (via source read-back on manifest.blueprints[]) and renders links only for the surfaces the applied capabilities enable. A surface whose gating capability is not applied is neither linked nor reachable from the shell. The shell is the base surface REQ-002 to REQ-006 elaborate on.",
   "deliveredBy": {
     "tacId": "TAC-2201-application-admin-console-shell",
-    "field": "responsibilities.renderShell"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-002.json

@@ -5,7 +5,7 @@
   "description": "When an applied blueprint declares the principalDirectory capability, the console renders a users route: a directory table listing every principal identified by data-user-id, an invite control per row for a principal without an active session, a deactivate control per row for an active principal, and last-active plus status columns. A principal without admin scope reaching /admin renders an access-denied state (REQ-006) with a request-access control routed to a notification. The users table is a datatable (consumer) with the same ARIA APG contract.",
   "deliveredBy": {
     "tacId": "TAC-2201-application-admin-console-shell",
-    "field": "responsibilities.delegateUsersSurface"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-003.json

@@ -5,7 +5,7 @@
   "description": "When an applied blueprint declares the roleModel capability, the console renders a roles route: the Owner + Admin + Member + Viewer baseline (elicited additions per ADR-2202), and a permission matrix as an ARIA APG grid (rows = roles, columns = permissions, cells = allowed/denied). Each cell announces the exact permission string as it takes focus (WCAG 4.1.3). The matrix suppresses when roleModel is not applied.",
   "deliveredBy": {
     "tacId": "TAC-2203-application-admin-console-permission-matrix",
-    "field": "interfaces.renderMatrix"
+    "field": "interfaces[renderMatrix]"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-004.json

@@ -5,7 +5,7 @@
   "description": "When an applied blueprint declares the tenancy capability, the console renders an orgs route: an org switcher control on the shell and an org-scoped invite path from the users surface. The tenancy capability today has no shelf provider (reserved for a future application-tenancy-orgs blueprint per spec section 11); the surface is suppressed until that provider ships.",
   "deliveredBy": {
     "tacId": "TAC-2201-application-admin-console-shell",
-    "field": "responsibilities.delegateOrgsSurface"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-005.json

@@ -5,7 +5,7 @@
   "description": "When the auditLog capability is applied (through the observability-logging companion or a future dedicated audit blueprint), the console renders an audit-log route: an audit table listing every entry identified by data-audit-id and carrying actor, target, before, after, timestamp, and correlationId columns; per-actor filter chrome and per-target filter chrome; retention window per ADR-2204. Consumes application-datatable for the table shell. The retention window is the elicited `audit-retention-days` value (a number of days, default 90): the applied logging companion enforces retention at the write layer against that day-count so entries older than the window are not emitted, and the audit view uses the same day-count when computing the earliest-visible timestamp for the filter chrome. A project sets the value at apply time; a value below 1 is refused at apply.",
   "deliveredBy": {
     "tacId": "TAC-2204-application-admin-console-audit-view",
-    "field": "interfaces.renderAuditView"
+    "field": "interfaces[renderAuditView]"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-006.json

@@ -5,7 +5,7 @@
   "description": "A principal without admin scope reaching an admin route renders an access-denied state under WCAG 2.4.6 Headings and Labels and 3.3.4 Error Prevention: a heading naming the denied action, an explanation of why access was refused, and a request-access control routed to a POST /api/request-access endpoint the applied notification blueprint delivers on. The request-access control is keyboard-reachable and announces its state (idle, submitting, submitted) via a polite live region (WCAG 4.1.3).",
   "deliveredBy": {
     "tacId": "TAC-2201-application-admin-console-shell",
-    "field": "responsibilities.renderAccessDenied"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-007.json

@@ -5,7 +5,7 @@
   "description": "The users surface honours the elicited invite-transport with a runtime clause per option: `email` hands the invite to the applied email companion (an email sibling declaring an email transport) and records success only after the transport reports the message accepted, presenting a delivery-failed refusal with a retryable control when the transport rejects or times out; `in-app-only` never touches the email transport and writes an invite record to the applied notification stream, marking the row with a data-invite-transport=in-app-only attribute so the recipient can see the invite in their own console; `custom` hands the invite payload to the project-supplied invite handler at surface time (a registered function on the applied capability sidecar) and records success only after the handler resolves, refusing the invite when no handler is registered. Every branch writes an audit record naming the transport, the invitee, and the outcome (accepted, failed, or refused).",
   "deliveredBy": {
     "tacId": "TAC-2201-application-admin-console-shell",
-    "field": "responsibilities.deliverInvite"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "user-management",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-008.json

@@ -5,7 +5,7 @@
   "description": "When the tenancy capability is applied, the users surface, the org switcher and the invite path honour the elicited tenancy-shape with a runtime clause per option: `per-user` renders each principal in exactly one org (the directory row carries a single data-org-id and the org switcher only lists the principal's own org), and an org-scoped invite adds the invitee to exactly that org; `per-org` renders every principal in every org they can reach (the directory row carries a data-org-membership=* attribute and the org switcher lists every org the principal can enter), and an org-scoped invite adds the invitee to the currently switched org without touching the other orgs the principal already belongs to; `both` permits either shape per principal (the directory row carries data-org-scope=single or data-org-scope=many) and the invite path prompts for the org set when the invited principal is `many`. Every branch refuses a cross-org action (invite, deactivate) that the shape does not allow with a named error announcing the shape and the refused action.",
   "deliveredBy": {
     "tacId": "TAC-2201-application-admin-console-shell",
-    "field": "responsibilities.tenancyShapeGate"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "tenancy",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-009.json

@@ -5,7 +5,7 @@
   "description": "When the applying project runs its own auth (no shipped security-auth-* blueprint) and answers the four custom-auth-provides-* boolean elicits, the console binds each answer to the appliedCapabilities union with a runtime clause per token: when `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is `true` the union includes `principalDirectory` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-role-model]` is `true` the union includes `roleModel` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-tenancy]` is `true` the union includes `tenancy` and `false` omits it; when `blueprint.json.elicits[id=custom-auth-provides-audit-log]` is `true` the union includes `auditLog` and `false` omits it. The sidecar the shell reads reflects the exact union the boolean answers produce.",
   "deliveredBy": {
     "tacId": "TAC-2202-application-admin-console-capability-discovery",
-    "field": "responsibilities.runElicitationPhase"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-admin-console/contributions/requirements/application-admin-console-req-014.json

@@ -5,7 +5,7 @@
   "description": "application-admin-console v1.1.0 reads the appliedCapabilities set at apply-time via the shipped readAppliedCapabilities() helper (the visual-round mechanism). When zeroTrustGate is present alongside the sole hard requirement principalDirectory, the admin-console renders the Access-gated sign-in surface (no local login form; principal reads from request.auth via [data-role=principal-read]). When zeroTrustGate is absent the admin-console falls back to the local security-auth-* sign-in surface unchanged from v1.0.0. Q4 default per spec section 5.4.1: consumption is OPTIONAL; requiresAppliedCapabilities.capabilities[] remains [principalDirectory] (making Access-gate hard is a v2.0 change).",
   "deliveredBy": {
     "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
-    "field": "responsibilities.renderAccessGatedSurface"
+    "field": "responsibilities"
   },
   "category": "functional",
   "domain": "application",

package/blueprints/application-admin-console/contributions/tacs/tac-2201-application-admin-console-shell.json

@@ -18,13 +18,13 @@
   "interfaces": [
     {
       "name": "renderShell",
-      "kind": "factory",
-      "description": "renderShell({ capsSidecarUrl, surfaceRegistry, accessGuard }) -> { mount(rootElement), unmount() }. The project supplies the capsSidecarUrl (where the sidecar is served from), the surfaceRegistry (maps a capability string to a surface component), and the accessGuard (returns whether the current principal has admin scope)."
+      "kind": "other",
+      "description": "renderShell({ capsSidecarUrl, surfaceRegistry, accessGuard }) -> { mount(rootElement), unmount() }. The project supplies the capsSidecarUrl (where the sidecar is served from), the surfaceRegistry (maps a capability string to a surface component), and the accessGuard (returns whether the current principal has admin scope). (legacy kind: factory)"
     },
     {
       "name": "capabilitiesSidecar",
-      "kind": "shape",
-      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, skippedSources: Array<{ sourceId, reason }>, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell."
+      "kind": "other",
+      "description": "{ slug, version, appliedAt, appliedCapabilities: string[], appliedElicitations: {}, skippedSources: Array<{ sourceId, reason }>, allowNoAuthYet?: boolean, notes?: string }. Written by apply, read by the shell. (legacy kind: shape)"
     }
   ],
   "dependencies": [

package/blueprints/application-admin-console/contributions/tacs/tac-2202-application-admin-console-capability-discovery.json

@@ -16,18 +16,18 @@
   "interfaces": [
     {
       "name": "discoverAppliedCapabilities",
-      "kind": "function",
-      "description": "Returns { union: string[], perSlug: Record<slug, string[]> }."
+      "kind": "other",
+      "description": "Returns { union: string[], perSlug: Record<slug, string[]> }. (legacy kind: function)"
     },
     {
       "name": "runElicitationPhase",
-      "kind": "function",
-      "description": "Applies each elicits[] entry against the discovered capability set and coerces answers per kind."
+      "kind": "other",
+      "description": "Applies each elicits[] entry against the discovered capability set and coerces answers per kind. (legacy kind: function)"
     },
     {
       "name": "writeSidecar",
-      "kind": "function",
-      "description": "Writes rcf/blueprints/${slug}.applied.json."
+      "kind": "other",
+      "description": "Writes rcf/blueprints/${slug}.applied.json. (legacy kind: function)"
     }
   ],
   "dependencies": [
@@ -41,4 +41,4 @@
   "notes": "Reads the applied recordss source string. When the source is a library-qualified ref (wsd:auth-oauth2), the source blueprint is not on this local tree and the reader returns an empty capabilities list; the applied record is skipped from the union.",
   "createdAt": "2026-09-05T01:30:00Z",
   "updatedAt": "2026-09-10T00:00:00Z"
-}
+}

package/blueprints/application-admin-console/contributions/tacs/tac-2203-application-admin-console-permission-matrix.json

@@ -15,8 +15,8 @@
   "interfaces": [
     {
       "name": "renderMatrix",
-      "kind": "factory",
-      "description": "renderMatrix({ roles: RoleSpec[], permissions: PermissionSpec[], matrix: Record<roleId, Record<permissionId, boolean>> }) -> { mount(rootElement), unmount() }."
+      "kind": "other",
+      "description": "renderMatrix({ roles: RoleSpec[], permissions: PermissionSpec[], matrix: Record<roleId, Record<permissionId, boolean>> }) -> { mount(rootElement), unmount() }. (legacy kind: factory)"
     }
   ],
   "dependencies": [