What shipped, when, why.

The GOV-DS-2026-02 rev. v4.4 programme (ships with the next minor release):

• Agent surface: @risqbase-inc/ui-components-mcp MCP server (11 read-only tools over components, tokens, recipes, lifecycle, scanner rules and Layer-3 showcase entries), Streamable HTTP endpoint at /mcp, llms.txt + llms-full.txt + per-page .md mirrors — all generated from one registry (build:agent-surface), freshness CI-gated (scanner rule R14).
• Tokens: DTCG 2025.10 source (*.tokens.json, OKLCH colors with round-trip-exact hex fallbacks, $deprecated, resolver-driven theming). Consumer-visible CSS is value-identical; oklch() lands as a progressive enhancement under @supports.
• Dark theme: complete coverage of every semantic + component color token (62 newly derived values, contrast-verified per theme); lint-enforced completeness; docs-site theme switcher. New color.action.link token for interactive text (resolves identically to action.primary in light).
• High contrast: forced-colors compliance pass — data-fc roles on meaning-bearing SVG geometry, system-color mappings in tokens.css (replaces the never-populated hc token theme; 'hc' stays accepted but deprecated).
• Motion: MotionProvider + useReducedMotion (beta) — localStorage preference over the OS signal, data-motion CSS contract, all four animated primitives migrated; motion-preference settings-toggle recipe.
• Charts: area, heatmap, metric-card and the restored choropleth (CEO 10 Jun reversal of the rung-1 cut) complete 7/7 of the ChartContainer taxonomy; visually-hidden data-table fallback on every chart type.
• Scanner rules: R12 token hygiene, R13 motion gating, R14 agent-surface freshness, R15 brand-mark integrity — each proven to fail on committed fixtures before passing on clean source.
• AAA text tier (PR-B, 2026-06-11): color.text.subtle stone-500 → stone-600 (4.8:1 → 7.6:1 on white) and color.text.on-inverse-subtle stone-400 → stone-300 (6.9:1 → 11.7:1 on stone-900) — every secondary-text role now clears WCAG 1.4.6 AAA (≥7:1) in both themes (dark overrides already cleared: 7.73 / 7.44, no adjustment needed). Direct aliases (header tagline / nav links / launch date, gauge caption) re-annotated contrastLevel: aaa. Rationale + audit trail: the AAA programme in the brand-mark v3 hand-off's AAA Compliance Catalogue. Visual delta: secondary text reads slightly darker in light theme — deliberate, no structural change.
• Brand mark v3 (rev. A1 v1.1, 2026-06-11 — surface-relative): frozen Geist-Bold outline assets replace the drifted Helvetica-<text> mark — public/icon.svg (card), public/mark.svg (bare currentColor), optional inverse favicon; exported as @risqbase-inc/ui-components/assets/*. New semantic tokens color.brand.mark (indigo-700 light / indigo-300 dark — deliberately diverges from color.action.primary, which is unchanged) and color.brand.mark-on-inverse (the per-theme mirror for inverse surfaces). color.header.logo / color.footer.logo re-pointed to the brand chain; Header and Footer inline the frozen mark glyph; Footer raw classes (bg-stone-900/text-gray-400/text-indigo-400/border-gray-800) rewired to color.footer.* tokens with AAA meta/link bumps (stone-400 → stone-300 on the inverse surface, ≥7:1 in both themes). The WCAG 1.4.6/1.4.9 logotype exemption remains documented belt-and-braces only — all brand pairs clear AAA outright.

Features

brand: brand-mark v3 — replace drifted icon, ship mark assets, A1 header tint (3e12cd0) brand: central migration PR-A — brand-mark tokens, Footer/Header rewire, R15 guard (e9e7855) * Design System v4.4 — agent surface, DTCG 2025.10, full dark theme, MotionProvider, 7/7 chart taxonomy (GOV-DS-2026-02 rev. v4.4) (#84) (5872b05)

Bug Fixes

* tokens: central migration PR-B — AAA text tier, stone upgrade (41b15bf)

Documentation

* brand: align records with A1 spec v1.1 — deviations ratified as spec (02f725f)

Bug Fixes

deps: bump tmp 0.2.5→0.2.7 to patch GHSA-ph9p-34f9-6g65 (284e737) deps: override uuid to ^11.1.1 to patch CVE-2026-41907 (0f82945) * deps: override uuid to ^11.1.1 to patch CVE-2026-41907 (#82) (eabad23)

Features

readme: auto-generate README factual sections from source of truth (5b3d985) readme: auto-generate README from source of truth (kill drift) (#73) (60bada2)

Bug Fixes

changelog: stop design.risqbase.com showing shipped work as 'Unreleased' (56e4b4b) changelog: stop design.risqbase.com showing shipped work as 'Unreleased' (#76) (2efa134) deps: bump next 16.2.4→16.2.6 + qs 6.15.1→6.15.2 (Dependabot) (b755ce7) deps: bump next 16.2.4→16.2.6 + qs 6.15.1→6.15.2 (Dependabot) (#77) (a834648) docs: count tokens from json source-of-truth + regenerate public/.html (081d975) docs: deterministic token count + regenerate stale public/.html (unblocks #73–#77) (#78) (69478d4) security: close 2 CodeQL alerts (prototype-pollution + workflow permissions) (#75) (69ab53a) security: close 2 CodeQL alerts (prototype-pollution guard + workflow permissions) (57347a2)

Documentation

salvage v2.2.0 core-split brief + post-merge audit (were uncommitted) (#74) (4498261) salvage v2.2.0 core-split brief + v2.1.0 post-merge audit (9c4b8e0)

Miscellaneous

* pin next release to 2.1.3 (readme autogen is tooling, not a feature) (b5c476e)

Bug Fixes

ci: publish workflow uses --legacy-peer-deps (c780827) ci: publish workflow uses --legacy-peer-deps (#72) (c780827) * v2.1.1: G4 Tier 2 sweep — 14 NIT/OBSERVATION fixes (#70) (9689afb)

Bug Fixes

v2.1.1: post-merge audit bundle — useId + env-guard + React 19 hygiene + figcaption (9b2c686) v2.1.1: post-merge audit bundle (useId + env-guard + React 19 hygiene + figcaption) (#65) (9b2c686)

Documentation

* v2.1.1: chromatic-acceptance discipline + BRIEF-439 test-runner wiring (#67) (41a5d02)

Footer — port canonical MarketingFooter content; add hiddenLinks prop

CEO directive 2026-05-20 ("Footer Option C"): the marketing site's MarketingFooter is the authoritative public-marketing footer. This release re-ports its content into core/Footer and gives downstream consumers a way to suppress links pointing to pages that haven't yet shipped to a given deployment.

• Breaking — drops the variant: 'risqbase' | 'ralia' prop. Authed-product

footers live in-product (RALIA owns its own AuthenticatedFooter); this primitive is now single-purpose (public marketing). Migration: remove the prop entirely. The five-column nav grid + brand block + bottom-bar legal triad now ship as the canonical default.

• New — hiddenLinks?: string[] prop. Pass exact-match hrefs of pages

that haven't shipped on the current deployment; matched links are filtered, and sections that end up empty collapse entirely (no orphan heading). The bottom-bar Terms / Privacy / Cookies triad is never filtered (these MUST exist on any production surface for GDPR / consent reasons).

• New — sections?: FooterSection[] (full override), tagline?: string,

copyrightHolder?: string props for partner / co-brand surfaces.

• Exports — FooterLink, FooterSection types plus

FOOTER_DEFAULT_{PLATFORM,PRACTICE,SOLUTIONS,COMPANY,LEGAL}_LINKS + FOOTER_DEFAULT_SECTIONS constants so consumers can extend the default link map rather than redeclaring it.

• Accessibility — <footer role="contentinfo"> + <nav aria-label="Footer navigation">

preserved; tested against axe-core wcag22aa tag (zero violations on Default and WithHiddenLinks stories). Contrast ratios documented in src/core/Footer/accessibility.md (all pass WCAG 2.2 AAA on bg-stone-900).

• Stories — Default, WithHiddenLinks (mirrors actual production-vs-staging

delta on risqbase.com), Mobile, AllNavHidden, CustomSections, PrintGallery (Chromatic @media print mode).

Consumer migration (marketing site): <Footer hiddenLinks={[...]} /> is consumed in Risqbase-Inc/RisqBase. The local src/components/layout/MarketingFooter.tsx is retained as fallback until the upstream component is verified stable in production.

Features

brief-436: docs-site generator — replace hand-maintained HTML (#64) (4b91fb6) v2.1.0: CitationChip stories + ArcDecoration + Header polish (#63) (6264aa8) v2.1.0: CompliancePostureStrip + ClientGrid — Practice Cockpit elements (#62) (7055e07) v2.1.0: HeroVideo wrapper (#61) (cb07f6d) v2.1.0: HeroVideo wrapper + v4.4 elevation/loading tokens (cb07f6d) v2.1.0: ImpactGraph primitive + MarketingImpactGraph wrapper + v4.4 token extension (#60) (0ad0fae)

Bug Fixes

security: guard mergeDeep against prototype pollution (CodeQL alert from PR #54) (#58) (542fe7b) security: guard mergeDeep against prototype pollution (codeql alert) (b78609e)

Documentation

* v2.1.0: spec pack post-G4 corrections (Elena PASS) (ce91627)

⚠ BREAKING CHANGES

* design system v4.3 — package side (@risqbase-inc/ui-components@2.0.0) (#49)

Features

contrast verification script + CI integration (PR 3) (eca0f7a) contrast verification script + CI integration (PR 3) (8f4576d) contrast verification script + CI integration (v4.3 PR 3 of programme — supersedes closed #51) (#54) (eca0f7a) design system v4.3 — package side (@risqbase-inc/ui-components@2.0.0) (#49) (faef998) iris.accent-on §4.2 contrast contract + R11 scanner rule (PR 4) (c0db3b4) iris.accent-on §4.2 contrast contract + R11 scanner rule (v4.3 PR 4 — supersedes closed #52) (#55) (2ac62dc) v4.3 stories + Chromatic baseline (PR 2 of programme) (b7a0a52) v4.3 stories + Chromatic baseline (v4.3 PR 2 — supersedes closed #50) (#56) (2d6ef82)

Design System v4.3 — package side (@risqbase-inc/ui-components@2.0.0)

MAJOR. Implements the package half of GOV-DS-2026-02 v4.3 (CEO-approved 18 May 2026). The docs site (design.risqbase.com), telemetry dashboard, consumer migrations (RALIA, marketing), and Layer-3 showcase pages land in separate PRs per spec §9 / §11.

Three-layer model

• Layer 1 / Layer 2 / Layer 3 separation codified per v4.3 §2. Domain barrels (/core, /ai, /data-viz) are the public surface. Root barrel is soft-deprecated — dev builds emit a one-shot console warning; removal target v5.0 (§9.2).

New components — 20 primitives across three domains

/core (Layer 1) — 12 new + extended Badge.

• IconButton (3 sizes × 3 variants, hit target ≥ 24×24 — closes RALIA F-015 / F-028 / F-037 / F-050).
• SkipLink (closes RALIA F-053 + WCAG 2.4.1).
• Card (3 variants × 4 padding levels, 16px default radius — closes RALIA F-060).
• Callout (5 intents, replaces left-border-accent — closes RALIA F-002 + marketing C-05).
• Skeleton (5 variants, motion-reduce safe — closes RALIA F-004).
• EmptyState (8 variants — closes RALIA F-020 / F-055).
• WizardProgress (auto-style by step count — closes RALIA F-010).
• Modal, Drawer, Sheet (shared focus-trap + scrim + Esc + body inert — closes RALIA F-046).
• Toast + ToastViewport (focus-aware quadrant positioner — closes RALIA F-054, WCAG 2.4.11).
• Badge extended with band-very-low / band-low / band-medium / band-high / band-very-high variants + BandBadge wrapper (closes RALIA F-018).

/ai (Layer 2) — 5 new.

• CitationChip (9 variants — closes RALIA F-012 / F-025).
• IrisThinking (3-arc rotation, reduced-motion fallback — closes RALIA F-011 / F-051).
• StreamingText (constant 35 tok/s cadence — closes O-006).
• PromptChip (Iris-accent halo on hover).
• ClientScopeBanner (persistent below-header strip — closes RALIA F-043).

/data-viz (Layer 2) — 3 new.

• Gauge (generic stroked-arc, 4 sizes, 3 palettes — closes v4.2 audit U2.1).
• RiskGauge (compliance-semantics wrapper: dual-ring + band-derivation + delta pill — closes v4.2 audit U2.2).
• ChartContainer (line / bar / sparkline ship in v4.3; heatmap / area / choropleth / metric-card deferred to v4.4 per v4.1 §8.1.1).

Tokens

• **New iris.* semantic namespace** (9 tokens: accent, accent-hover, accent-subtle, accent-on, surface, streamhead, thinking-outer, thinking-mid, thinking-inner). Resolves through the teal palette but named explicitly so RALIA / Cortex / future products can re-bind the Iris character per product without touching primitives.
• Badge band variants — tokens/component/badge.json extended with 15 band.* tokens (5 bands × 3 properties: background / foreground / border).
• New component-tier token files: card.json, callout.json, citation-chip.json, gauge.json, iris-thinking.json.

Tailwind preset

• font-sans default updated to lead with Geist / Geist Sans (canonical primary per v4.3 §4.5); font-mono defaults to Geist Mono.
• New keyframes and animation entries: skeleton-shimmer, streamhead-blink, iris-thinking-rotate, iris-thinking-rotate-reverse, iris-thinking-pulse.

Resolutions

• D-001 Button radius ratified at 12px (rounded-xl / --dimension-radius-button-default).
• D-002 Header logo weight ratified at font-bold.
• D-003 Footer surface ratified at surface-inverse (stone-900).

Spec

• docs/design-system/v4.3/RisqBase-DS-v4.3-Comprehensive.md recorded as the canonical reference (GOV-DS-2026-02 v4.3, CEO-approved 18 May 2026).

Design System v4.3 — package side, addendum (Claude Design strategic decisions)

• <TelemetryBeacon> stub landed. New no-op primitive at core/TelemetryBeacon — production no-op, dev console.debug gated on NEXT_PUBLIC_TELEMETRY_DEBUG=1. All 25 primitives (5 v4.2.1 + 20 v4.3) now emit a mount beacon. When the collector lands (audit U4.2 / U4.3), the dispatch wires in at the Beacon — no component-side change.
• Modal / Drawer / Sheet rebased on @radix-ui/react-dialog. Public API unchanged (open / onClose / title / aria-label / dismissOnBackdrop / dismissOnEsc). The hand-rolled Overlay.tsx is deleted; Radix handles focus trap, focus restoration, ARIA wiring, scroll-lock, and pointer suppression on background siblings. The inertBackground prop is removed (Radix's modal=true default supersedes; nested overlays don't need it).
• ChartContainer rebased on visx@^3 (honouring v4.2.1 audit row A1's pin). line / bar / sparkline use @visx/scale, @visx/shape, @visx/group. heatmap / area / choropleth / metric-card deferred to v4.4 unlock by importing the matching visx package; no architecture change.
• **iris.* namespace retained.** Confirmed canonical; no ai.character.* rebase.
• Packaging shape — Radix Dialog + visx land as peerDependencies, not runtime dependencies. @radix-ui/react-dialog is required (every consumer of Modal / Drawer / Sheet needs it). The three visx packages (@visx/group, @visx/scale, @visx/shape) are flagged optional in peerDependenciesMeta — consumers that never import ChartContainer aren't forced to install them. All four are mirrored in devDependencies so local builds, tests, and Storybook keep resolving. This is the standard packaging shape for a React UI library that wraps third-party primitives (mirrors Radix-derived libs, MUI, Chakra, Mantine, shadcn).

Design System v4.3 — package side, addendum 2 (iris.accent-on contrast contract + R11)

Resolves the contrast finding surfaced by PR #51's verify:contrast script. Claude Design's call: accept the 3.74:1 ratio (don't darken iris.accent), constrain where the white glyph applies, enforce via a new scanner rule.

• New token iris.accent-on-dark → stone-900. Computes to 4.67:1 on iris.accent (teal-600) — clears AA Normal. Carries a contrastPair annotation so the verifier picks it up. The iris.accent-on token (white) stays at 3.74:1 with a contract update in its $description constraining it to AA Large + Non-Text uses.
• Spec doc — docs/design-system/v4.3/RisqBase-DS-v4.3-Comprehensive.md §4.2 contrast contract — table of approved / not-approved surface categories, rationale for keeping teal-600, and pointers to the enforcement mechanisms.
• Scanner rule R11 — new in v4.3. docs/design-system/v4.3/scanner-rule-r11.md is the canonical rule definition; scripts/scanner-rules/r11-iris-accent-on.mjs is the reference detection implementation (regex-based; emits error for clear violations, warn for ambiguous). Consumer scanners (RALIA, marketing) import or copy the function into their scripts/lib/design-rules.mjs. The package's files array now publishes scripts/scanner-rules/ so consumers pick up rule updates through their normal version bump.
• Primitive docs — IrisThinking/accessibility.md and PromptChip/accessibility.md now reference the §4.2 contract. The package's own primitives don't violate R11 (verified: node scripts/scanner-rules/r11-iris-accent-on.mjs src → no violations); the contract is for consumer compositions that use Iris-accent backgrounds.

Out of scope (consumer-repo work):

• Updates to the 10 RALIA redesigns (audit-deliverable/redesigns/*.html) — live in Risqbase-Inc/Ralia.
• Updates to the 8 marketing demos — live in the marketing-site repo.
• Wiring R11 into consumer-side scripts/lib/design-rules.mjs + CI — happens in each consumer scanner.
• Baseline generation for existing showcase violations — each consumer regenerates against its own tree.

Features

design site v1 — Claude Design import (replaces #40 prototype) (1709d7e) design site v1 — Claude Design import (supersedes #40) (#42) (d0992e2) design-site: import favicon — current r|ↄ brand mark (ddcb942) design-site: recover lost commits + close v4.2.1 G5 (#45) (2bebb33) design-system v1 site + RisqBase d.o.o. registered office in Footer (18185bc) design-system v1 site + RisqBase d.o.o. registered office in Footer (#40) (4eed2a0) * tokens: add scopes[] to semantic + component figma extensions (BRIEF-401) (#34) (d83c774)

Bug Fixes

* design-site: rename Cortex to RisqBase operations externally (03f3184)

Documentation

* mark v4.2.1 G5 resolved + add Chromatic changelog entry (fec4a97)

S1 of the v4.2 implementation programme is the largest single sprint in the package's history: ~1,800 lines of new and changed code across src/, tokens/, and tools/, plus the W3C-format token corpus, the Style Dictionary build pipeline, and the SSR-safe theming infrastructure. This release ships those changes; subsequent v4.2 sprints (S2 — data-viz, S3 — ai, S4 — content/dark/HC, S5 — Figma, S6 — consumer migration) layer additional v1.3.x and v1.4.x releases on top.

Added

Sub-path imports (spec §22.2)

• src/ restructured into domain folders (core/, ai/, data-viz/, content/, tokens/, primitives/). Consumers can import from sub-paths:
• @risqbase-inc/ui-components/core — the five v1.x components plus theming primitives.
• @risqbase-inc/ui-components/tokens — typed design tokens.
• @risqbase-inc/ui-components/ai, /data-viz, /content — empty placeholders today; reserved for S2 (data-viz), S3 (ai), S4 (content). Imports resolve cleanly from S1 onwards.
• primitives/ is intentionally internal-only.

Design tokens — three-tier W3C corpus

• ~150+ tokens authored as W3C Design Tokens Format JSON across primitive, semantic, and component tiers in tokens/.
• Style Dictionary build pipeline (npm run build:tokens) emits four artefacts: dist/tokens.css, dist/tailwind-tokens.js, dist/figma-tokens.json, and src/tokens/generated.ts.
• Schema lint (npm run lint:tokens) rejects W3C violations and unresolved {token.path} references.
• See tokens/README.md for authoring guidance.

Theming infrastructure (spec §15.2.1, plan D11)

• data-theme attribute on <html> is the single switch for light | dark | hc. CSS custom properties cascade off the attribute; theme swaps require no React re-render.
• New public API (exported from both root and /core):
• setTheme(theme) — runtime mode setter; persists to localStorage. SSR-safe (no-op on server).
• getTheme() — read the active mode (returns 'light' during SSR).
• themeInitScript — ~280-byte SSR-safe init string. Inline as the first <script> in <head> to avoid flash-of-wrong-theme on reload.
• THEME_STORAGE_KEY — localStorage key name ('risqbase-ds-theme') for consumer integrations.
• Theme — exported type alias: 'light' | 'dark' | 'hc'.
• Light values shipped now; dark and HC token overrides are stub layers (tokens/themes/{dark,hc}.json) that G4 fills in S4. Until then, setTheme('dark') renders light values.
• See docs/theming.md for the consumer integration guide.

Toolchain

• npm run lint:tokens — schema lint over tokens/**/*.json.
• npm run build:tokens — Style Dictionary build, runs first in npm run build.

Changed

• Header, Footer, Button, Badge, SectionEyebrow migrated to consume role tokens via Tailwind arbitrary values (e.g. bg-[var(--color-action-primary)]). Migration is structural; no visual change is intended at light-mode parity (Chromatic verifies in G5).
• Stone-* (warm) neutral palette per spec §1; replaces gray-* references in component classNames where applicable.
• ESLint configuration moved into package.json#eslintConfig (single source of truth). @typescript-eslint remains at v6.21.0; the v8 upgrade is in flight in G1's parallel PR and will close behind it.

Backwards compatibility

• Every v1.x export remains at the package root: import { Button } from '@risqbase-inc/ui-components' continues to work for all five components and for the new theme primitives. Sub-path imports are additive — no consumer is forced to migrate.
• The Tailwind preset (@risqbase-inc/ui-components/tailwind.preset) is unchanged in shape; new role tokens layer in.

Known gaps closing in later sprints

• dist/tokens.css ships [data-theme="dark"] and [data-theme="hc"] as stub blocks today — switching modes will render light values until G4 fills the overrides in S4 (per implementation-plan.md §6 R3). No consumer code change is required when those values land.
• .github/workflows/publish.yml is gated by if: false pending the apps/docs path and monorepo-tool decision; the npm-publish-on-v*.*.*-tag flow is wired but not yet active. Owner: G1 (G1).

Documentation

This release lands alongside documentation that has shipped to main separately:

• v4.2 spec, plan, audit, and v4.2 README — PR #2.
• v4.2 implementation plan — PR #4.
• DevOps stubs (workflow scaffolding, Vercel placeholder, CODEOWNERS) — PR #3.
• Per-component tokens.md content — PR #9 (Frontend).

In this PR (s1/cleanup-3-doc-consistency):

• notes/gov-id-format.md flipped from PENDING VERIFICATION to VERIFIED; canonical format is GOV-DS-<YEAR>-<SEQ>[-<DOC-TYPE>-<VERSION>] with <VERSION> rendered dotted (e.g. 4.2, not 420).
• plan.md and audit.md Document IDs corrected to GOV-DS-2026-02-PLAN-4.2 and GOV-DS-2026-02-AUDIT-4.2.
• notes/audit-row-counts.md and notes/glossary-scope.md carried forward from PR #11.
• implementation-plan.md row-count reconciliation carried forward from PR #11 (§1 executive summary, §4 heading, §7 DoD).
• README.md (repo root) refreshed: install, sub-path imports, theme API, build commands, available components, design-system reference.

Tracking

• v4.2 supersedes v4.1.1 at the document level.
• v4.2.1 patch backlog is enumerated in docs/design-system/v4.2/implementation-plan.md §8 (motion tokens, sonification reconciliation, U1.9 chart-library decision, glossary term list, Figma metadata extension key, plus the historical -420 strings preserved in PR #2's commit message footer — repo working tree is clean).

• Initial Header, Footer, Button, Badge, SectionEyebrow components.
• Tailwind preset with brand colours (indigo-600 primary).
• Documented in CLAUDE.md.

• Footer legal-links route correction (always risqbase.com).

See git tags v1.0.0 through v1.1.0 for prior history.