rcf-lite 0.12.0 → 0.13.0

package/blueprints/observability-essentials/contributions/tacs/tac-803-observability-essentials-status-page.json

@@ -0,0 +1,37 @@
+{
+  "tacId": "TAC-803-observability-essentials-status-page",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Public status page",
+  "purpose": "Owns the public status page: the HTTP handler that renders it, the declared component registry it renders from, and the active-notice reader it renders alongside. The public reader is the primary audience; the renderer commits to the declared component vocabulary and the declared notice fields and to nothing else.",
+  "responsibilities": [
+    "Register a GET handler on the configured status page path (default /status) at the application's HTTP router; respond with 200 and Content-Type text/html to unauthenticated requests (AC-7104-1, AC-7108-1, AC-7108-2).",
+    "Render exactly the declared component list in declared order, with each component's current state as a machine-readable attribute drawn from the operational/degraded/outage/maintenance enum; no phantom components, no missing components, no other state values (AC-7104-1, AC-7104-2, AC-7104-3).",
+    "Render active incident notices in a notices region above the component list; each notice element carries the title, body, severity, startedAt, and componentIds fields as machine-readable attributes with severity drawn from the info/warning/critical enum; when no notices are active, the notices region is either absent or carries an emptyState marker (AC-7105-1, AC-7105-2, AC-7105-3).",
+    "Refuse to render internal identifiers, raw metric values, or declared readiness dependency names on the page; the vocabulary is the declared component names and the declared notice fields, and nothing else (AC-7109-1, AC-7109-2, AC-7109-3)."
+  ],
+  "internalStructure": "One handler module exporting createStatusPageHandler({ path, componentRegistry, noticeReader, now }) -> { path, handler }. The componentRegistry is the declared component list (name, order) loaded at boot from configuration. The noticeReader is a project-supplied async () -> Notice[] the handler invokes per render (with the same non-blocking budget the readiness pattern uses if the notice store is remote). The renderer emits HTML with machine-readable data attributes on component and notice elements so downstream consumers can parse the page without regex over prose.",
+  "interfaces": [
+    {
+      "name": "createStatusPageHandler",
+      "kind": "factory",
+      "description": "createStatusPageHandler({ path, componentRegistry, noticeReader, now }) -> { path, handler }. Returns the configured status path and a handler that renders the declared components and the notices reader's current notices."
+    },
+    {
+      "name": "componentRegistry",
+      "kind": "config",
+      "description": "Declared component list loaded at boot: an ordered list of { name, currentState? } entries. currentState may be static (operator-updated via a project-authored side channel) or read via a per-component reader function the project supplies."
+    },
+    {
+      "name": "noticeReader",
+      "kind": "callback",
+      "description": "Project-supplied async () -> Notice[] returning the current active notice list. Each Notice has { title, body, severity, startedAt, componentIds? } fields."
+    }
+  ],
+  "dependencies": [],
+  "tradeoffs": "The declared-component vocabulary is a public commitment the project owns; renaming a component is an operator-visible change to the public surface. That constraint is what keeps the page stable for external readers. Projects that want a richer public surface (component sub-states, historical uptime cells, per-region breakdowns) extend the declared component vocabulary rather than baking undocumented fields into the render. History over time (historical uptime chart, rolling reliability) is out of scope at v1.0.0; see the blueprint README's Known mechanism-reach gaps for the promotion signal.",
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/tacs/tac-804-observability-essentials-notification-outcome.json

@@ -0,0 +1,42 @@
+{
+  "tacId": "TAC-804-observability-essentials-notification-outcome",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "name": "Notification outcome sink",
+  "purpose": "Owns the durable sink that records the outcome of every notification the application attempts to send. The sink is the operator's answer to 'did the customer get the email'. Every notification-attempting code path in the project routes through a project-supplied recordOutcome verb this component wires; queries by recipient and window are the operator's read surface.",
+  "responsibilities": [
+    "Expose a recordOutcome verb the project's notification-attempting code paths invoke exactly once per attempt, before the attempting call returns; the verb accepts { notificationId, channel, recipient, outcome, attemptedAt, errorCode? } and writes a durable record on the sink (AC-7106-1).",
+    "Refuse to accept a record whose outcome is not one of delivered, failed, pending, or suppressed, or whose channel is not a member of the declared channel enum; the refusal is a stable-coded error the caller must handle (AC-7106-2).",
+    "Expose a queryByRecipient(recipient, { from, to }) verb returning the outcome records that match, with an empty result set when no records match rather than an error (AC-7106-3).",
+    "Persist records to a durable substrate the project owns; the substrate implementation lives inside the project (SQLite table when composing with the persistence-data-sqlite blueprint, a project-owned table otherwise). This TAC owns the sink verbs and the record shape, not the substrate choice."
+  ],
+  "internalStructure": "One module exporting createOutcomeSink({ substrate, channelEnum, now }) -> { recordOutcome, queryByRecipient }. The substrate parameter is a project-supplied durable writer conforming to a narrow interface (append(record), queryByRecipient(recipient, window)); when composing with the persistence-data-sqlite blueprint, the substrate is a facade verb on that store. The channelEnum is loaded at boot from configuration; declaration-set validation runs against every incoming record.",
+  "interfaces": [
+    {
+      "name": "createOutcomeSink",
+      "kind": "factory",
+      "description": "createOutcomeSink({ substrate, channelEnum, now }) -> { recordOutcome, queryByRecipient }. Returns the sink's write and read verbs bound to the project-owned substrate."
+    },
+    {
+      "name": "recordOutcome",
+      "kind": "write-api",
+      "description": "recordOutcome({ notificationId, channel, recipient, outcome, attemptedAt, errorCode? }) -> Promise<void>; refuses on unknown channel or unknown outcome with a stable error code."
+    },
+    {
+      "name": "queryByRecipient",
+      "kind": "read-api",
+      "description": "queryByRecipient(recipient, { from, to }) -> Promise<OutcomeRecord[]>; returns matching records; empty array on no match."
+    },
+    {
+      "name": "substrate",
+      "kind": "callback",
+      "description": "Project-supplied durable writer: { append(record) -> Promise<void>, queryByRecipient(recipient, window) -> Promise<OutcomeRecord[]> }. When composing with the persistence-data-sqlite blueprint, this is a facade verb on that store."
+    }
+  ],
+  "dependencies": [],
+  "tradeoffs": "The sink commits every project's notification code path to a single recordOutcome verb, which is a discipline: a code path that sends a notification without invoking the verb produces the silent-notification defect this blueprint exists to prevent. A grep-level gate ('every call to the notification transport is preceded by recordOutcome') is the practical enforcement; the blueprint states the invariant but does not ship the gate. Projects that want richer per-outcome metadata (correlation ids, retry counts) extend the record shape; the four required fields plus errorCode are the floor.",
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7101.json

@@ -0,0 +1,45 @@
+{
+  "usId": "observability-essentials-US-7101",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-001",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Orchestrator restarts a stuck replica via the liveness probe without external dependency coupling",
+  "asA": "orchestrator running the deployed application under a supervising process (Kubernetes kubelet, systemd, or equivalent)",
+  "iWant": "a liveness endpoint that answers pass or fail strictly on whether the process is running its event loop",
+  "soThat": "I restart a wedged replica without letting a downstream dependency outage cascade into a restart storm across every replica",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7101-1",
+      "description": "The application serves the liveness endpoint at a stable HTTP path declared in configuration (default /healthz); a GET returns 200 when the process is running its event loop and returns application/json with a status field equal to pass.",
+      "given": "the process is running normally with its event loop responsive",
+      "when": "an unauthenticated GET is issued against the liveness path",
+      "then": "the response status code is 200, the Content-Type is application/json, and the JSON body's status field equals pass",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7101-2",
+      "description": "The liveness probe handler evaluates entirely in-process; a probe hit issues zero network calls to any declared dependency, verifiable by observing the network egress from the probe path.",
+      "given": "the process is running and a network-egress observer is attached to the probe path",
+      "when": "a GET is issued against the liveness path",
+      "then": "the observer records zero egress connections attributable to the probe handler between request receipt and response send",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7101-3",
+      "description": "The liveness probe answer is independent of the readiness dependency set: pulling a declared readiness dependency offline never turns the liveness probe fail on its own.",
+      "given": "the process is running and every declared readiness dependency is offline",
+      "when": "a GET is issued against the liveness path",
+      "then": "the response status code is 200 and the JSON body's status field equals pass",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-801-observability-essentials-liveness-probe"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7102.json

@@ -0,0 +1,45 @@
+{
+  "usId": "observability-essentials-US-7102",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-002",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Load balancer pulls an unready replica from rotation via the readiness probe without triggering a restart",
+  "asA": "load balancer or service mesh routing traffic across replicas of the deployed application",
+  "iWant": "a readiness endpoint that answers pass or fail based on whether the process can serve request traffic against its declared dependencies",
+  "soThat": "I stop routing traffic to a replica that has lost a required dependency without the orchestrator restarting a process that would come back to the same failure",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7102-1",
+      "description": "The application serves the readiness endpoint at a stable HTTP path declared in configuration (default /readyz), distinct from the liveness path; a GET returns 200 with a JSON body when every declared readiness dependency is passing and returns 503 with a JSON body when at least one declared readiness dependency is failing.",
+      "given": "the process is running and the readiness dependency set is declared",
+      "when": "an unauthenticated GET is issued against the readiness path against a healthy dependency set, then against a set with at least one failing dependency",
+      "then": "the first response has status code 200 with JSON body status equal to pass; the second response has status code 503 with JSON body status equal to fail; both bodies have Content-Type application/json",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7102-2",
+      "description": "The readiness path is served on the same HTTP listener as the application's request traffic (not on a separate operator port), so a load balancer probing readiness observes the same reachability the traffic will observe.",
+      "given": "the process is running and the request-traffic listener address is declared",
+      "when": "a GET is issued against the readiness path targeting the same listener address as request traffic",
+      "then": "the response is served by the application, not refused with a connection error, and the readiness handler and a representative request handler both bind to the same address:port pair as reported by the process",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7102-3",
+      "description": "A readiness probe fail never triggers a process exit: the process remains up and continues answering liveness with pass while readiness answers fail.",
+      "given": "the process is running with at least one declared readiness dependency in a failed state",
+      "when": "the readiness probe returns 503 across a five-minute window",
+      "then": "the process exit code is not emitted, the process remains running throughout the window, and the liveness probe continues to return 200 with status pass",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-802-observability-essentials-readiness-probe"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7103.json

@@ -0,0 +1,45 @@
+{
+  "usId": "observability-essentials-US-7103",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-003",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Operator sees which dependency turned the replica unready by reading the readiness probe body",
+  "asA": "operator debugging why a replica went unready under load-balancer rotation",
+  "iWant": "the readiness probe response body to name each declared dependency, its individual pass/fail state, and when that state was last evaluated",
+  "soThat": "I move from 'readiness is failing' to 'the payments-provider check has been failing since 14:02' in one step, without opening a shell on the replica",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7103-1",
+      "description": "The readiness dependency set is declared at boot from application configuration; the application refuses to boot with a stable error code if the declaration is missing or if any declared entry lacks a name, and the declaration set is inspectable from the running process through the probe response.",
+      "given": "the process is configured with a readiness dependency declaration that names each dependency",
+      "when": "the readiness probe is hit after successful boot",
+      "then": "the JSON body's checks object contains one entry per declared dependency, keyed by the dependency name from the declaration, with no additional keys and no missing keys",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7103-2",
+      "description": "Each entry in the checks object carries a state field (one of pass or fail) and a checkedAt ISO-8601 timestamp naming when the per-dependency state was last evaluated by the background evaluator.",
+      "given": "the readiness probe is hit against a running process with a mixed dependency state",
+      "when": "the response body is inspected",
+      "then": "every entry in the checks object has a state field valued pass or fail and a checkedAt field valued as a parseable ISO-8601 timestamp no older than the readiness evaluation budget declared in configuration",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7103-3",
+      "description": "Dependencies not present in the readiness declaration never appear in the probe response and never affect the aggregate status.",
+      "given": "the process depends on several downstream services but declares only a strict subset as readiness dependencies",
+      "when": "the readiness probe is hit while an undeclared downstream service is offline",
+      "then": "the undeclared service name never appears as a key in the checks object, and the aggregate status field remains pass so long as every declared dependency is passing",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-802-observability-essentials-readiness-probe"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7104.json

@@ -0,0 +1,45 @@
+{
+  "usId": "observability-essentials-US-7104",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-004",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "External reader sees the current state of every declared component on a public status page",
+  "asA": "external reader visiting the status page without a login (customer, partner, or anonymous visitor)",
+  "iWant": "a public page that lists every declared component and shows its current state from a fixed vocabulary",
+  "soThat": "I answer 'is this service up right now' without opening a support ticket",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7104-1",
+      "description": "The application serves the status page at a stable HTTP path declared in configuration (default /status), responds to an unauthenticated GET with 200 and text/html, and renders exactly the declared component list with no phantom components and no missing components.",
+      "given": "the process is running with a component declaration that names N components",
+      "when": "an unauthenticated GET is issued against the status page path",
+      "then": "the response status code is 200, the Content-Type begins with text/html, and the rendered document contains exactly N component elements, each carrying the declared component name as text content",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7104-2",
+      "description": "Each rendered component element carries its current state as a machine-readable attribute drawn from the fixed enum (operational, degraded, outage, maintenance); the attribute value is one of those four strings and no other.",
+      "given": "the status page has been rendered with the declared components in mixed states",
+      "when": "the rendered document is queried for the per-component state attribute",
+      "then": "every component element carries a state attribute whose value is one of the four enum strings; no other value appears",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7104-3",
+      "description": "The component render order on the page matches the declaration order in configuration; a component appearing at position K in the declaration renders at position K on the page.",
+      "given": "the component declaration lists components in an order the operator has chosen",
+      "when": "the status page is rendered",
+      "then": "the rendered component elements appear in the same order as the declaration, verified by walking the rendered document's component elements top-to-bottom and comparing to the declared order",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-803-observability-essentials-status-page"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7105.json

@@ -0,0 +1,45 @@
+{
+  "usId": "observability-essentials-US-7105",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-005",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "External reader sees an active incident notice on the status page during an outage",
+  "asA": "external reader visiting the status page during an active incident",
+  "iWant": "the page to surface active incident notices with a stable structure the operator has populated",
+  "soThat": "I see what the operator has said about the incident, when it started, and how bad it is, without hunting for a Twitter thread",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7105-1",
+      "description": "When one or more incident notices are active, the status page renders a notices region above the component list; each notice is a distinct element carrying title, body, severity, startedAt and (optionally) componentIds as machine-readable fields.",
+      "given": "the operator has posted two active incident notices, one with componentIds referencing two declared components and one without",
+      "when": "the status page is rendered and the notices region is queried",
+      "then": "the notices region contains exactly two notice elements, each with a title field, a body field, a severity field, and a startedAt field; the first notice element carries a componentIds field naming the two referenced components, the second notice element either omits the componentIds field or renders it as an empty list",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7105-2",
+      "description": "The severity field on each notice is one of a fixed enum (info, warning, critical); no other value is renderable.",
+      "given": "notices exist at each of the three severities",
+      "when": "the status page is rendered and every notice element's severity field is inspected",
+      "then": "every severity value is one of info, warning, or critical; no notice renders with any other severity value",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7105-3",
+      "description": "When no notices are active, the notices region is either absent from the rendered document or clearly labelled as empty; no stale notice from a resolved incident appears.",
+      "given": "the operator has resolved every previously active incident and no notice is currently active",
+      "when": "the status page is rendered",
+      "then": "the rendered document either contains no notices region element or contains a notices region element carrying an emptyState marker; no notice element from any previously active incident is present",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-803-observability-essentials-status-page"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7106.json

@@ -0,0 +1,45 @@
+{
+  "usId": "observability-essentials-US-7106",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Operator answers 'did the customer get the notification' from the outcome sink",
+  "asA": "operator investigating a customer report of a missing notification (email, SMS, push, webhook)",
+  "iWant": "every notification attempt to record an outcome on a durable sink queryable by recipient and time window",
+  "soThat": "I answer whether the outcome was delivered, failed, pending, or suppressed without hunting a provider dashboard",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7106-1",
+      "description": "Every notification attempt writes exactly one outcome record to the durable outcome sink before the attempting code returns; the record carries notificationId, channel, recipient, outcome, attemptedAt, and (when outcome is failed) errorCode fields.",
+      "given": "the process is instrumented to attempt one notification per invocation across each declared channel",
+      "when": "an attempt is invoked and returns, and the sink is queried for that notificationId",
+      "then": "the sink returns exactly one record for that notificationId with all required fields populated, and the record's attemptedAt is no later than the return time of the attempt call",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7106-2",
+      "description": "The outcome field is one of a fixed enum (delivered, failed, pending, suppressed); the channel field is one of a fixed enum declared in configuration (email, sms, push, webhook, or the project's declared channel set).",
+      "given": "the process attempts notifications across every declared channel including deliberately-failing and deliberately-suppressed cases",
+      "when": "the sink is queried for the attempt records",
+      "then": "every record's outcome field is one of delivered, failed, pending, or suppressed, and every record's channel field is a member of the declared channel enum",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7106-3",
+      "description": "The operator queries the sink by recipient identifier and time window and receives the outcome records that match; a recipient with no attempts in the window returns an empty result rather than an error.",
+      "given": "the sink holds outcome records across a mix of recipients and time windows",
+      "when": "the operator issues a query for a recipient identifier within a bounded time window",
+      "then": "the returned result set contains every outcome record whose recipient equals the queried recipient and whose attemptedAt is within the window, and a query for a recipient with zero matching records returns an empty result set",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-804-observability-essentials-notification-outcome"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7107.json

@@ -0,0 +1,46 @@
+{
+  "usId": "observability-essentials-US-7107",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-007",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Monitoring integration consumes the probe JSON body without hand-parsing HTML",
+  "asA": "third-party monitoring integration or dashboard consuming the application's probe endpoints",
+  "iWant": "a stable JSON response shape from both probes with stable field names and an ISO-8601 timestamp on every response",
+  "soThat": "I wire the integration once and it does not break when a patch release ships",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7107-1",
+      "description": "Both probe responses declare Content-Type application/json; both bodies parse as JSON and contain a status field (pass or fail) and a checkedAt field with a parseable ISO-8601 timestamp.",
+      "given": "the process is running and both probes are reachable",
+      "when": "GETs are issued against each probe path and each response body is JSON-parsed",
+      "then": "each response has Content-Type application/json, each body parses without error, each parsed body has a status field valued pass or fail, and each body has a checkedAt field that parses as a valid ISO-8601 date-time",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7107-2",
+      "description": "The readiness body carries a checks object keyed by declared dependency name; the liveness body has no checks field.",
+      "given": "the process has declared a readiness dependency set and both probes are reachable",
+      "when": "the two probe response bodies are compared",
+      "then": "the readiness body contains a checks object with one entry per declared readiness dependency, and the liveness body contains no checks field",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7107-3",
+      "description": "Field names on both probe response bodies are stable across the blueprint's version series: a patch or minor release does not rename status, checkedAt, or checks.",
+      "given": "the blueprint at v1.0.0 declares its probe body field names",
+      "when": "a project inspects the field names on both probe bodies at v1.0.0 and again at any subsequent v1.x.y release",
+      "then": "the top-level field names status, checkedAt, and checks (readiness only) are present at both versions with the same casing and the same value shapes; a rename would require a major version bump per the blueprint's own versioning policy",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-801-observability-essentials-liveness-probe",
+    "TAC-802-observability-essentials-readiness-probe"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7108.json

@@ -0,0 +1,47 @@
+{
+  "usId": "observability-essentials-US-7108",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-008",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Orchestrator and external reader reach probes and status page without credentials",
+  "asA": "orchestrator, load balancer, or external reader that has no service credentials",
+  "iWant": "the liveness path, readiness path, and status page path to be exempt from every authentication gate the application applies to other paths",
+  "soThat": "the probes are usable by the systems that operate the deployment and the status page is usable by the readers it is written for",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7108-1",
+      "description": "The liveness, readiness, and status page paths respond to a GET carrying no cookie, no Authorization header, and no session token, with a 2xx response (or a 5xx that reflects the probe answer, not an auth challenge); no path returns 401 or 403 to an unauthenticated request.",
+      "given": "the process is running with the application's normal authentication middleware active",
+      "when": "unauthenticated GETs are issued against each of the three paths in turn",
+      "then": "no response carries status code 401 or 403 and none carries a WWW-Authenticate response header; each response is either a 2xx probe pass, a 5xx probe fail, or a 2xx status page",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7108-2",
+      "description": "The three paths are declared at boot as auth-exempt in the application's authentication middleware; the exempt list is inspectable from the running process (through configuration read or a debug endpoint operators use in staging).",
+      "given": "the process is running with an auth-exempt path list declared in configuration",
+      "when": "the running process's exempt list is inspected",
+      "then": "the list contains the three configured paths (liveness, readiness, status page) and no others that were not deliberately declared",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7108-3",
+      "description": "A request that carries valid authentication credentials against one of the three exempt paths still receives the probe or status-page response; the exemption is one-directional (auth not required), not one that refuses authenticated callers.",
+      "given": "the process is running with valid credentials available to the caller",
+      "when": "an authenticated GET is issued against each of the three exempt paths",
+      "then": "each response is identical in shape and status code to the unauthenticated case; no path refuses the authenticated caller",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-801-observability-essentials-liveness-probe",
+    "TAC-802-observability-essentials-readiness-probe",
+    "TAC-803-observability-essentials-status-page"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7109.json

@@ -0,0 +1,45 @@
+{
+  "usId": "observability-essentials-US-7109",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-009",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "External reader never sees internal identifiers, metric values, or dependency names on the status page",
+  "asA": "security-conscious external reader (and the security reviewer for the deployed application)",
+  "iWant": "the public status page to expose only the declared component vocabulary and the incident notice fields",
+  "soThat": "internal topology and performance detail is not committed as public contract and does not become reconnaissance material for a targeted attack",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7109-1",
+      "description": "The rendered status page contains no host identifiers, no replica identifiers, no database identifiers, no queue names, no internal URLs, and no build hashes anywhere in its markup or its script tags; a grep of the fully-rendered document for a known internal identifier of each class returns zero matches.",
+      "given": "the running process has known values for each identifier class (host name H, replica id R, database identifier D, queue name Q, internal URL U, build hash B)",
+      "when": "the fully-rendered status page document is fetched and grepped for each of H, R, D, Q, U, and B",
+      "then": "every grep returns zero matches, including inside script tags and inline JSON payloads",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7109-2",
+      "description": "The rendered status page contains no raw metric values: no request counts, no latency numbers, no error rates, no queue depths appear as text or as data attributes.",
+      "given": "the running process is emitting internal metrics with known non-zero values",
+      "when": "the rendered status page document is inspected for numeric content outside the incident notice startedAt timestamps",
+      "then": "no metric value from the internal metric surface appears as text content or data attribute on any element",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7109-3",
+      "description": "The readiness probe body may name declared dependencies (that is its purpose); the status page must not name them. The declared-component vocabulary and the declared-readiness-dependency vocabulary are distinct sets, and no declared readiness dependency name appears on the public status page.",
+      "given": "the process declares a readiness dependency set with distinct names from the declared status-page component set",
+      "when": "the public status page is fetched and grepped for each declared readiness dependency name",
+      "then": "every grep returns zero matches; a grep of the readiness probe body for the same names returns non-zero matches, demonstrating the surfaces are distinct",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-803-observability-essentials-status-page"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7110.json

@@ -0,0 +1,46 @@
+{
+  "usId": "observability-essentials-US-7110",
+  "prdId": "PRD-001",
+  "reqId": "observability-essentials-REQ-010",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Probes stay responsive under a downstream dependency outage",
+  "asA": "operator whose downstream dependency has gone slow or unresponsive",
+  "iWant": "the readiness probe to answer within its declared budget even when a declared dependency is hanging on network calls",
+  "soThat": "a downstream partial outage does not cause the load balancer to time out the probe and cascade the failure into every replica going unready simultaneously",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-7110-1",
+      "description": "The readiness probe handler returns a response within the readiness evaluation budget declared in configuration (default 1 second) regardless of the responsiveness of any declared dependency; the handler reads a cached last-known state populated by a background evaluator, never issues a synchronous network round trip to a dep from inside the handler.",
+      "given": "a declared readiness dependency's real endpoint is configured to hang indefinitely (a network sink with no responder)",
+      "when": "a GET is issued against the readiness path and the response time is measured",
+      "then": "the response arrives within the declared readiness evaluation budget (default 1 second) and the response's checks entry for the hanging dependency shows state fail with a checkedAt that reflects the last background evaluation attempt, not the current probe-hit time",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7110-2",
+      "description": "The background dep-health evaluator runs on its own cadence, declared in configuration; every declared readiness dependency is evaluated at least once per cadence interval regardless of the state of any other dependency.",
+      "given": "the process is running with N declared dependencies including one that hangs and the background evaluator cadence declared as C seconds",
+      "when": "the process runs for at least 3 * C seconds and each dependency's checkedAt timestamp is sampled from the readiness body",
+      "then": "every non-hanging dependency's checkedAt advances at least twice within the window; the hanging dependency's checkedAt advances or its state transitions to fail with a checkedAt that reflects the evaluator's own attempt time, and no other dependency's evaluation is starved by the hanging one",
+      "testable": true,
+      "scope": "runtime"
+    },
+    {
+      "id": "AC-7110-3",
+      "description": "The liveness probe handler under the same hanging-dependency conditions still returns 200 within a bounded budget (default 250 milliseconds), demonstrating that liveness is decoupled from downstream dep health.",
+      "given": "a declared readiness dependency is hanging and the readiness probe is returning 503",
+      "when": "a GET is issued against the liveness path and the response time is measured",
+      "then": "the response status is 200, the response body's status field is pass, and the response arrives within 250 milliseconds",
+      "testable": true,
+      "scope": "runtime"
+    }
+  ],
+  "tacIds": [
+    "TAC-801-observability-essentials-liveness-probe",
+    "TAC-802-observability-essentials-readiness-probe"
+  ],
+  "createdAt": "2026-08-24T00:00:00Z",
+  "updatedAt": "2026-08-24T00:00:00Z"
+}