rcf-lite 0.25.0 → 0.27.0

package/blueprints/object-storage-s3/contributions/tacs/tac-2904-object-storage-s3-hetzner-endpoint-helper.json

@@ -0,0 +1,34 @@
+{
+  "tacId": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.1.0",
+  "status": "approved",
+  "name": "Hetzner Object Storage endpoint-shape helper",
+  "purpose": "The single project-side module that composes the Hetzner Object Storage endpoint URL from an elicited bucket name and a vendor-documented location code (fsn1, hel1, nbg1 per https://docs.hetzner.com/storage/object-storage/overview). The helper is the sole composer of the pattern <bucket>.<location>.your-objectstorage.com; every consumer that needs the endpoint imports this module and calls composeHetznerEndpoint({ bucket, location }). Downstream, the composed https URL feeds the shipped S3 client (TAC-2901 facade over @aws-sdk/client-s3 per ADR-2901) unchanged so the outward facade shape does not move for the Hetzner provider. The Cloudflare R2, AWS S3 and MinIO paths stay byte-identical: the endpoint URL parameter on the facade remains freeform and only projects that elicit hetznerObjectStorage consume this helper.",
+  "responsibilities": [
+    "Compose the endpoint URL as https://<bucket>.<location>.your-objectstorage.com from an elicited bucket and location code per the vendor overview (AC-28110-1).",
+    "Refuse composition when the location code is not one of the vendor-documented values (fsn1, hel1, nbg1) so the applying project cannot silently ship an invalid endpoint (AC-28110-1).",
+    "Expose one named export composeHetznerEndpoint that returns the composed URL string; hold no S3 client reference so a future adapter or endpoint variant slots in as a helper module swap without changing this contract (AC-28110-1).",
+    "Read no SIMULATE_ environment variable in the helper module body; INPUT-side mutation (SIMULATE_HETZNER_ENDPOINT_MISSHAPEN) lives on the fixture-side shim, keeping the helper deterministic and probe-neutral (AC-28110-1)."
+  ],
+  "internalStructure": "One module exporting composeHetznerEndpoint({ bucket, location }) -> string. The function validates the bucket against the S3 bucket-name discipline the shipped facade already accepts and validates the location against the enum {fsn1, hel1, nbg1} sourced verbatim from the Hetzner Object Storage overview page. On invalid input it throws a named Error whose message names the offending field so a probe or a lint can surface it. The composed URL string is returned; no side effects, no client reference, no event emission.",
+  "interfaces": [
+    {
+      "name": "composeHetznerEndpoint",
+      "kind": "factory",
+      "description": "composeHetznerEndpoint({ bucket, location }) -> string. Returns https://<bucket>.<location>.your-objectstorage.com when bucket is a non-empty string and location is one of fsn1, hel1, nbg1; throws a named Error naming the invalid field otherwise."
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "Object-storage S3 facade",
+      "kind": "tac",
+      "tacId": "TAC-2901-object-storage-s3-facade",
+      "description": "The facade the composed URL feeds into as the elicited endpointUrl; the helper output is opaque at the facade boundary so the R2, AWS S3 and MinIO paths stay unchanged."
+    }
+  ],
+  "tradeoffs": "The helper holds the vendor pattern in code rather than in the applying project's config file. A vendor endpoint change (a new location code or a URL-shape update) is a helper edit and a version bump on this blueprint, not a project-side scramble. The three currently documented locations are hard-coded per the overview page; a future location addition ships as a minor bump on this blueprint (v1.2.0) not a project-side workaround. A project that needs a different endpoint shape for a non-Hetzner S3-compatible endpoint uses the elicited freeform endpointUrl on the facade directly and skips this helper.",
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-08T00:00:00.000Z"
+}

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28101.json

@@ -16,7 +16,8 @@
       "when": "the process boots and the facade's ready-check returns",
       "then": "a facadeReady event fires on the injected event sink with a payload containing endpointHost and bucketName, and the client is ready to accept verbs; the facade exposes named domain verbs and does not re-export the raw S3 client",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-28101-2",
@@ -25,10 +26,41 @@
       "when": "grep 'from \\'@aws-sdk/client-s3\\'' or 'from \\'aws4fetch\\'' walks the tree outside the facade directory",
       "then": "no match is found outside the facade directory; the facade's public surface exports named domain verbs only, no raw S3 client reference",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28101-3",
+      "description": "Facade refuses at boot when the elicited endpoint is unreachable. Given the elicited s3-endpoint-url resolves to a host the runner cannot reach (or refuses a ready-check inside the connection timeout), when the facade opens on boot, then the facade refuses with a named error kind (endpointUnreachable) carrying the endpoint host but no credential material, and facadeReady does not fire.",
+      "given": "s3-endpoint-url resolves to an unreachable host or times out on ready-check",
+      "when": "the facade opens on boot",
+      "then": "the facade refuses with endpointUnreachable carrying host but no credentials; facadeReady does not fire",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.createObjectStore"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28101-4",
+      "description": "S3 adapter aws-sdk-client-s3. Given the elicited s3-adapter answers aws-sdk-client-s3, when the facade opens on process boot, then the facade constructs one `new S3Client(...)` from @aws-sdk/client-s3 v3 and the outbound HeadBucket request carries the SDK's default User-Agent header of shape `aws-sdk-js/<version> ...` (grep on the client's user-agent middleware output confirms the aws-sdk-js prefix); the aws4fetch package is NOT present in the facade module's imports; a grep across the applied source refuses any import of aws4fetch outside the facade.",
+      "given": "s3-adapter = aws-sdk-client-s3",
+      "when": "the facade opens on boot and issues its first HeadBucket ready-check",
+      "then": "the facade constructs one S3Client from @aws-sdk/client-s3 v3 and the outbound HeadBucket carries a User-Agent starting with `aws-sdk-js/`; aws4fetch is absent from the applied source",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2901-object-storage-s3-adapter",
+        "field": "decision"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28102.json

@@ -16,7 +16,12 @@
       "when": "putObject(key, contentType='application/octet-stream', body=<1 KiB Buffer>) then getObject(key)",
       "then": "the returned body's byte length equals 1024 and the returned content-type equals application/octet-stream; the events list captured on the sink contains an objectPut record with matching key, size 1024, contentType, timestamp; no body bytes appear in any event record",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-28102-2",
@@ -25,7 +30,12 @@
       "when": "deleteObject(key) followed by getObject(key)",
       "then": "the getObject rejects with a not-found shape (NoSuchKey on S3/R2/MinIO); an objectDeleted event fires on the sink with matching key and timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-28102-3",
@@ -34,10 +44,27 @@
       "when": "listObjects(prefix='probe/list/')",
       "then": "the returned keys include every put key with matching prefix, and the paginated envelope carries an isTruncated boolean",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-28102-4",
+      "description": "Key-shape refusal. Given a call to put, get, delete or list on the facade, when the key argument is an empty string, starts with a \"/\", contains \"..\" or \"//\", or exceeds 1024 bytes, then the facade refuses with a named error kind (invalidKey) before any client call, and no lifecycle event fires on the sink.",
+      "given": "a facade verb call with an invalid key shape",
+      "when": "the verb runs",
+      "then": "the facade refuses with error kind invalidKey; no client call is issued; no lifecycle event fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28103.json

@@ -16,10 +16,49 @@
       "when": "presignGetUrl(key, ttl=60) then fetch(url) immediately, then wait ttl+2 seconds and fetch(url) again",
       "then": "first fetch returns 200 with body bytes equal to the put payload; second fetch returns 403; the events list contains a presignedIssued record with key, ttl=60, timestamp; no URL or credential material appears in any event record",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-28103-2",
+      "description": "Presigned URL beyond TTL returns 403. Given a presigned GET URL issued with TTL of 60 seconds, when a fetch runs against it more than 60 seconds after issuance, then the vendor returns HTTP 403 (SignatureDoesNotMatch or expired-URL family), and the facade's subsequent presign call for the same key issues a fresh URL with a fresh TTL boundary.",
+      "given": "a presigned GET URL issued with a 60-second TTL",
+      "when": "a fetch runs against it more than 60 seconds after issuance",
+      "then": "the vendor returns HTTP 403 (expired-URL family); a subsequent presign issues a fresh URL",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-28103-3",
+      "description": "Presigned TTL above ceiling refused at the facade edge. Given a presignGetUrl call with a TTL argument above the elicited presigned-ttl-ceiling-seconds, when the verb runs, then the facade refuses with a named error kind (presignTtlAboveCeiling); no vendor call issues.",
+      "given": "presignGetUrl call with TTL above the elicited ceiling",
+      "when": "the verb runs",
+      "then": "the facade refuses with presignTtlAboveCeiling; no vendor call issues",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28104.json

@@ -16,7 +16,8 @@
       "when": "putObject(key, contentType, body=<10 MiB Buffer>) then getObject(key)",
       "then": "the getObject returns a body of exact size 10485760 with byte equality to the put payload; the events list contains one objectPut record with size=10485760; no ListMultipartUploads on the bucket surfaces an in-flight upload after completion",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-28104-2",
@@ -25,10 +26,27 @@
       "when": "putObject(key, contentType, body=<10 MiB Buffer>) rejects mid-upload",
       "then": "the rejection propagates to the caller; a probe-side ListMultipartUploads(prefix=key) returns zero uploads; no completed object appears at key",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28104-3",
+      "description": "Multipart aborted on part failure. Given a multipart-upload with N parts where part K uploadPart returns a non-2xx (a mid-stream 5xx or client abort), when the uploader catches the failure, then it calls AbortMultipartUpload against the upload id, no CompleteMultipartUpload runs, no partial object survives at the target key, and the facade emits multipartAborted with { key, uploadId, failedPartNumber } on the event sink.",
+      "given": "a multipart-upload with N parts where uploadPart K returns non-2xx",
+      "when": "the uploader catches the failure",
+      "then": "AbortMultipartUpload runs; no CompleteMultipartUpload runs; no partial object survives; multipartAborted fires with {key, uploadId, failedPartNumber}",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2902-object-storage-s3-multipart-uploader",
+        "field": "interfaces.putMultipart"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2902-object-storage-s3-multipart-uploader"],
+  "tacIds": [
+    "TAC-2902-object-storage-s3-multipart-uploader"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28105.json

@@ -11,15 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-28105-1",
-      "description": "Given a lifecycle-event spy attached to the sink, when put, get, delete, and presign verbs run against a PII fixture (key users/1234/passport.jpg, body carrying the PII fixture text), then every event record on the sink carries only fields from the whitelist {event, key, size, contentType, ttl, timestamp, endpointHost, bucketName}; no field name matches userId or ssn or dob or email; no field value contains the PII fixture body text; no field value contains any part of the object body bytes.",
+      "description": "Given a lifecycle-event spy attached to the sink, when put, get, delete, and presign verbs run against a PII fixture (key users/1234/passport.jpg, body carrying the PII fixture text), then every event record on the sink carries only fields from the whitelist {event, key, size, contentType, ttl, ts (number of milliseconds since epoch), endpointHost, bucketName}; no field name matches userId or ssn or dob or email; no field value contains the PII fixture body text; no field value contains any part of the object body bytes.",
       "given": "the facade opened, a spy on the event sink, a PII fixture body PII-FIXTURE-DO-NOT-LOG",
       "when": "putObject(users/1234/passport.jpg, image/jpeg, <body containing PII-FIXTURE-DO-NOT-LOG>), then getObject, then presignGetUrl, then deleteObject",
       "then": "every event record on the sink has keys drawn from the whitelist above; no event value contains the string PII-FIXTURE-DO-NOT-LOG; no event value contains a userId, ssn, dob, or email field; the key users/1234/passport.jpg appears on records as the key field only (not decomposed into userId)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2903-object-storage-s3-event-sink",
+        "field": "interfaces.onEvent"
+      }
+    },
+    {
+      "id": "AC-28105-2",
+      "description": "Repeat-emission secrecy at high fanout. Given every facade verb exercised across N iterations, when the accumulated event stream is inspected, then every one of the N records is restricted to the metadata whitelist on AC-28105-1 with no body bytes, no user id and no PII; a mutation SIMULATE_BODY_BYTES_IN_EVENT=true injects payload bytes into a putCompleted record and the sink observer FAILS naming the leaked field.",
+      "given": "every facade verb exercised N times",
+      "when": "the accumulated event stream is inspected",
+      "then": "every record is restricted to metadata whitelist; the body-byte mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2903-object-storage-s3-event-sink",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2903-object-storage-s3-event-sink"],
+  "tacIds": [
+    "TAC-2903-object-storage-s3-event-sink"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28106.json

@@ -11,12 +11,17 @@
   "acceptanceCriteria": [
     {
       "id": "AC-28106-1",
-      "description": "Given a fresh scratch project with no security-secrets-management applied, when rcf define blueprint add ./blueprints/object-storage-s3 runs, then the command exits 3 and stderr contains the stable message id object-storage-s3-no-secrets, the required predecessor blueprint name security-secrets-management, and the override flag --allow-no-secrets-yet; the scratch project's rcf tree does not carry object-storage-s3 contributions after the refusal.",
+      "description": "Given a fresh scratch project with no security-secrets-management applied, when rcf define blueprint add ./blueprints/object-storage-s3 runs, then the command exits 3 and stderr contains the stable message id object-storage-s3-no-secrets, the required predecessor blueprint name security-secrets-management, and the override flag --allow-no-secrets-yet; the scratch project's rcf tree does not carry object-storage-s3 contributions after the refusal. The applying agent constructs the facade by passing { secretRef, resolver } (never { accessKeyId, secretAccessKey }); a mutation that swaps in a resolved credential object FAILS the boundary check with a named error kind (rejectedResolvedCredentials).",
       "given": "a fresh rcf init scratch project with no security-secrets-management applied",
       "when": "rcf define blueprint add ./blueprints/object-storage-s3 runs against the scratch project",
       "then": "the command exits 3; stderr contains the string object-storage-s3-no-secrets; stderr names security-secrets-management and the --allow-no-secrets-yet flag; the scratch tree has zero object-storage-s3 requirements after the refusal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.createObjectStore"
+      }
     },
     {
       "id": "AC-28106-2",
@@ -25,10 +30,13 @@
       "when": "rcf define blueprint add ./blueprints/object-storage-s3 --allow-no-secrets-yet runs against the scratch project",
       "then": "the command exits 0; the applied manifest entry for object-storage-s3 carries a source.notes string naming the security-secrets-management predecessor and the --allow-no-secrets-yet override; the contributions land on disk",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28107.json

@@ -16,7 +16,8 @@
       "when": "run-facade-round-trip.mjs, run-put-get-round-trip.mjs, run-presigned-url.mjs, run-multipart-upload.mjs, run-event-secrecy.mjs run in sequence",
       "then": "each shim exits 0; each per-blueprint report at .rcf/reports/blueprints/object-storage-s3/<probe>.json carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-28107-2",
@@ -25,10 +26,15 @@
       "when": "each induced-failure switch is set in turn and the paired probe runs",
       "then": "the paired probe exits non-zero and the aggregate verdict lands as fail on the anchored AC; the fixture README documents the paired switch and probe for each of the four wired switches",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade", "TAC-2902-object-storage-s3-multipart-uploader", "TAC-2903-object-storage-s3-event-sink"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade",
+    "TAC-2902-object-storage-s3-multipart-uploader",
+    "TAC-2903-object-storage-s3-event-sink"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28108.json

@@ -16,7 +16,12 @@
       "when": "node blueprints/object-storage-s3/contributions/probes/run-r2-real-account-smoke.mjs runs",
       "then": "the shim exits 0; the report at .rcf/reports/blueprints/object-storage-s3/r2-real-account-smoke.json carries aggregateVerdict pass and a single result with accountBoundSkipped true",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/r2/api/s3/api/",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-28108-2",
@@ -25,10 +30,13 @@
       "when": "node blueprints/object-storage-s3/contributions/probes/run-r2-real-account-smoke.mjs runs",
       "then": "the shim exits 0; the temporary object is deleted after the round-trip; the report carries aggregateVerdict pass and no accountBoundSkipped:true field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28110.json

@@ -0,0 +1,42 @@
+{
+  "usId": "object-storage-s3-US-28110",
+  "prdId": "PRD-001",
+  "reqId": "object-storage-s3-REQ-101",
+  "version": "1.1.0",
+  "status": "approved",
+  "title": "Hetzner Object Storage adapter: helper composes <bucket>.<location>.your-objectstorage.com; new hetzner-object-storage-round-trip probe drives put/get/delete against the composed endpoint",
+  "asA": "shelf consumer applying object-storage-s3 v1.1.0 on a Hetzner Object Storage bucket in one of the vendor-documented locations (fsn1, hel1, nbg1)",
+  "iWant": "an endpoint-shape helper that composes <bucket>.<location>.your-objectstorage.com from an elicited bucket and location code, and a Node-only probe hetzner-object-storage-round-trip.mjs driven from the extended infra-s3-and-queue fixture that either round-trips a byte-equal put/get/delete against a real Hetzner Object Storage bucket when CI_HAS_HETZNER_OBJECT_STORAGE is set alongside HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID, HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY, HETZNER_OBJECT_STORAGE_BUCKET and HETZNER_OBJECT_STORAGE_LOCATION or records accountBoundSkipped true when the env var is unset",
+  "soThat": "the shelf gains a fourth provider value alongside R2, AWS and MinIO with no runtime dependency added to the applying project, no facade re-shape, and no regression to the shipped MinIO local-emulator or R2 real-account paths",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-28110-1",
+      "description": "Given the extended infra-s3-and-queue fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ carrying src/hetzner-endpoint.mjs and run-hetzner-object-storage-round-trip.mjs, when node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs runs, then either (a) with CI_HAS_HETZNER_OBJECT_STORAGE set alongside the four Hetzner env vars the composed endpoint is https://<bucket>.<location>.your-objectstorage.com per https://docs.hetzner.com/storage/object-storage/overview and put/get/delete round-trips a byte-equal 1 KiB payload with teardown deleting the scratch object, or (b) without CI_HAS_HETZNER_OBJECT_STORAGE the probe records accountBoundSkipped true and the aggregate flips to pass per spec section 3.5. The endpoint-shape helper hetzner-endpoint.mjs is the sole composer of the vendor pattern; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim (INPUT-side mutation) and the probe FAILS naming the missing subdomain. Label AC-hetznerObjectStorage-endpointRoundTrip.",
+      "given": "the extended infra-s3-and-queue fixture with src/hetzner-endpoint.mjs (endpoint-shape helper) and the fixture-root probe shim, on either a runner with CI_HAS_HETZNER_OBJECT_STORAGE set (real-account round-trip path) or without it (accountBoundSkipped path)",
+      "when": "node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs runs",
+      "then": "the probe either round-trips a byte-equal 1 KiB payload via put/get/delete against the composed <bucket>.<location>.your-objectstorage.com endpoint or records accountBoundSkipped true; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim and the probe FAILS naming the missing subdomain",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28110-2",
+      "description": "Unknown Hetzner location refused. Given the elicited hetzner-location-code answered as a value outside the shipped enum {fsn1, hel1, nbg1}, when the endpoint-shape helper composes the endpoint URL, then the helper refuses with a named error kind (unknownHetznerLocation) naming the offending value and the shipped enum; the facade does not open against the unknown location.",
+      "given": "hetzner-location-code answered outside {fsn1, hel1, nbg1}",
+      "when": "the endpoint-shape helper composes the URL",
+      "then": "the helper refuses with unknownHetznerLocation naming the offending value and the shipped enum; the facade does not open",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+        "field": "interfaces.composeHetznerEndpoint"
+      },
+      "disposition": "template"
+    }
+  ],
+  "tacIds": [
+    "TAC-2904-object-storage-s3-hetzner-endpoint-helper"
+  ],
+  "createdAt": "2026-09-08T00:00:00.000Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/object-storage-s3/docs/topics.md

@@ -45,7 +45,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/object-storage-s3/guide/object-storage-s3.md

@@ -6,7 +6,7 @@ S3-shape object storage on any S3-compatible endpoint: Cloudflare R2 (the shippe
 
 ## Apply this blueprint
 
-`security-secrets-management` v1.0.1+ MUST be applied first per REQ-006 (Baz decision 6). The blueprint declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` and the T-5 capability mechanism (visual round spec 5.5.1) enforces the refusal at apply time. On a project that has not applied secrets-management:
+`security-secrets-management` v1.0.1+ MUST be applied first per REQ-006. The blueprint declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` and the capability mechanism enforces the refusal at apply time. On a project that has not applied secrets-management:
 
 ```sh
 rcf define blueprint add object-storage-s3
@@ -185,6 +185,41 @@ Alternate providers (GitLab CI, CircleCI, Buildkite) map through the same four-p
 
 The `accountBound` flag on the probe module surface flips the delivery-ci-workflows aggregate to pass on the skipped path per section 3.5.
 
+## Hetzner Object Storage adapter (v1.1.0)
+
+The v1.1.0 follow-up recognises Hetzner Object Storage as a shipped provider value under the same S3-API facade. Hetzner Object Storage is S3-compatible per https://docs.hetzner.com/storage/object-storage/overview and speaks the S3 wire protocol through `@aws-sdk/client-s3` unchanged; the one thing that differs from R2 and AWS S3 is that the endpoint URL is composed from two elicited values, a bucket name and a location code (one of `fsn1` Falkenstein, `hel1` Helsinki, `nbg1` Nuremberg per the same page), rather than pasted whole.
+
+A small helper in the applying project composes the endpoint:
+
+```js
+import { composeHetznerEndpoint } from './hetzner-endpoint.mjs';
+
+const endpoint = composeHetznerEndpoint({
+  bucket: process.env.HETZNER_OBJECT_STORAGE_BUCKET,
+  location: process.env.HETZNER_OBJECT_STORAGE_LOCATION, // fsn1 | hel1 | nbg1
+});
+// endpoint === 'https://<bucket>.<location>.your-objectstorage.com'
+```
+
+The composed URL feeds `createObjectStore` unchanged through the elicited `endpointUrl` parameter; `region` defaults to `auto`, `forcePathStyle` defaults to `false` (virtual-hosted-style). The credential pair reaches the facade through the same `security-secrets-management` surface; a Hetzner-shaped project stores the key pair as `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID` / `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY` and reads them through the secrets facade.
+
+The helper refuses composition on any location code outside `{fsn1, hel1, nbg1}` (throws a named `Error` with `err.field === 'location'`), so an applying project cannot silently ship an invalid endpoint by editing a config file. A future vendor location code lands as a v1.2.0 minor bump on this blueprint (helper edit plus one more enum entry), not a project-side workaround.
+
+`node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs`:
+
+- Without `CI_HAS_HETZNER_OBJECT_STORAGE`: exits 0, writes a report with `verdict: pass, detail: "accountBound: skipped (no CI_HAS_HETZNER_OBJECT_STORAGE)", accountBoundSkipped: true`. Aggregate verdict pass.
+- With `CI_HAS_HETZNER_OBJECT_STORAGE` set alongside `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID`, `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY`, `HETZNER_OBJECT_STORAGE_BUCKET`, `HETZNER_OBJECT_STORAGE_LOCATION` on the runner env (or `.rcf/secrets/dev.env` locally): composes the endpoint, puts a 1 KiB payload, gets it back byte-equal, deletes the temporary object on exit, and asserts every lifecycle event carries only whitelisted metadata (`event`, `ts`, `endpointHost`, `bucketName`, `location`, `key`, `size`, `contentType`). Aggregate verdict pass.
+
+The Cloudflare R2 smoke stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT` and is not affected by the Hetzner env var; the two smokes skip independently.
+
+### When to reach for Hetzner Object Storage
+
+- Storage region matters (European data-locality requirements or lower-latency reads from EU-hosted workloads). `fsn1`, `hel1`, `nbg1` cover Germany and Finland; R2 does not surface a per-region locality on the public shape.
+- Egress-pricing profile differs from R2's zero-egress-fee posture; a workload with high internal-only egress may prefer R2, while a workload with predictable public egress may prefer Hetzner's flat per-TB pricing.
+- The applying project already runs on Hetzner Cloud (deploy-hetzner-server v1.0.0 shipped in round 7) and pairing the storage on the same vendor account is operationally simpler.
+
+Reach for R2 for the zero-egress-fee posture, for AWS S3 for the widest feature surface (Object Lock, versioning, lifecycle policies), and for MinIO for local dev without any account.
+
 ## Elicited parameters
 
 | Parameter | Default | Notes |
@@ -204,4 +239,5 @@ The `accountBound` flag on the probe module surface flips the delivery-ci-workfl
 - Cloudflare R2 S3-compatibility surface: https://developers.cloudflare.com/r2/api/s3/api/ (supported ops, four deviations).
 - Cloudflare R2 overview and presigned URLs: https://developers.cloudflare.com/r2/.
 - MinIO S3 compatibility: https://docs.min.io/community/minio-object-store/administration/object-management/object-lifecycle-management.html.
+- Hetzner Object Storage overview (v1.1.0): https://docs.hetzner.com/storage/object-storage/overview (S3 compatibility, endpoint pattern `<bucket>.<location>.your-objectstorage.com`, three location codes fsn1, hel1, nbg1).
 - GitHub Actions service containers: https://docs.github.com/en/actions/using-containerized-services/about-service-containers.

package/blueprints/observability-essentials/CHANGELOG.md

@@ -0,0 +1,21 @@
+# observability-essentials CHANGELOG
+
+## 2.1.2 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-007: REQ description now references the JSON media-type header owned on TAC-801.responsibilities[1] rather than restating the header literal. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 2.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 2.1.0 (hardening pass, 2026-09-09)
+
+- Adds `elicits[]` with four apply-time answers: `liveness-probe-path` (string, default /live; REQ-001), `readiness-probe-path` (string, default /ready; REQ-002), `declared-dependency-set` (string, comma-separated; REQ-003), and `notification-outcome-substrate` (enum sqlite/postgres/custom, default sqlite; REQ-006). Every option value is backed by a must-priority REQ description (section 7c criterion a).
+- Adds `deliveredBy` to every REQ (REQ-001/002/003/007/010 -> TAC-801/TAC-802 interface names; REQ-004/005 -> TAC-803; REQ-006 -> TAC-804; REQ-008 -> ADR-804; REQ-009 -> ADR-803). Closes 8 pass-2 lint findings; per-blueprint lint reports zero on pass 1 and pass 2.
+- Closes F-4 chain-contradiction specimen: AC-7107-3 previously compared v1.0.0 to future v1.x while the blueprint is v2. Rewrites the AC as a v2-baseline snapshot compatibility check against `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` with stable-coded PROBE_BODY_SHAPE_DRIFT on rename or removal.
+- Closes F-1 (liveness self-check failure without AC coverage): adds AC-7101-5 asserting a response-capable in-process self-check predicate answers HTTP 503 with content-length 0 on fail and returns to 200 on pass; the AC is `template` because the predicate itself is project-owned.
+- Closes F-2 (boot-refuse ACs for dependency declaration): adds AC-7103-4 (deps missing -> READINESS_DEPS_MISSING), AC-7103-5 (duplicate name -> READINESS_DEPS_DUPLICATE, template on the declared set), AC-7103-6 (blank/malformed name -> READINESS_DEPS_MALFORMED).
+- Closes F-3 (durable outcome sink): adds AC-7106-4 asserting outcome records survive a sink restart (template on the elicited notification-outcome-substrate) and AC-7106-5 asserting a failed write signals NOTIFICATION_OUTCOME_WRITE_FAILED to the caller and does not fabricate a success record.
+- Re-sweeps every existing AC's `disposition` per section 7b: ACs marked `template` (those whose text references elicited paths, project-declared dependencies, or the elicited substrate) with `templateFillIns` naming which values the applying agent sets; the remaining ACs stay `fixed`.
+- Review fix pass (F-2/F-3): adds `probeBodyShapeCompatibility` interface entry to TAC-802 that owns the cross-probe response body shape contract and names `PROBE_BODY_SHAPE_DRIFT`; updates AC-7107-3.ownerRef from ADR-803.decision.probeBodyShape (which the decision text did not carry) to TAC-802.interfaces.probeBodyShapeCompatibility; moves the v2 baseline snapshot from `packages/rcf-lite/test/blueprint/` to `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` so its placement matches its documentation-fixture nature (no suite test read it in the previous location).
+- Review fix pass (F-7): extends REQ-006 description with a runtime clause per substrate option (`sqlite`, `postgres`, `custom`), literally named and each backed as the accepted values the notification-outcome-substrate elicit resolves at boot (AC-7106-4 exercises the restart path across substrates; AC-7106-5 exercises the failed-write path).

package/blueprints/observability-essentials/README.md

@@ -1,4 +1,4 @@
-# Observability blueprint (v2.0.0)
+# Observability blueprint (v2.1.0)
 
 The fifth content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 5 of the blueprint programme). Scope: two HTTP health probes (liveness and readiness, path-neutral from v2.0.0: liveness answering strictly on in-process state, readiness aggregating over an explicit boot-time-declared dependency set with strict-any-fail semantics), a public status page rendering a declared component list plus stable-fielded incident notices, and a durable notification-outcome sink recording every attempt's outcome for later query by recipient and window. Targeted at small greenfield rcf-lite projects. Historical uptime charts, metrics export, and distributed tracing are documented future variants; the v2.0.0 blueprint ships the current-state contract only.
 

package/blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json

@@ -0,0 +1,17 @@
+{
+  "// Baseline documented for observability-essentials AC-7107-3": "Hardening pass (2026-09-09): captures the v2 baseline shape of the /live and /ready probe response bodies so a release-time compatibility check can compare a candidate against the current v2 snapshot. A candidate that renames or removes a field named here fails with PROBE_BODY_SHAPE_DRIFT; additions are allowed.",
+  "live": {
+    "status": "pass",
+    "checkedAt": "ISO-8601 timestamp string"
+  },
+  "ready": {
+    "status": "pass",
+    "checkedAt": "ISO-8601 timestamp string",
+    "dependencies": [
+      {
+        "name": "string",
+        "status": "pass|fail"
+      }
+    ]
+  }
+}

package/blueprints/observability-essentials/blueprint.json

@@ -1,7 +1,38 @@
 {
   "slug": "observability-essentials",
-  "version": "2.0.0",
+  "version": "2.1.2",
   "category": "observability",
+  "elicits": [
+    {
+      "id": "liveness-probe-path",
+      "prompt": "HTTP path the liveness probe binds to on the request-traffic listener (REQ-001; default /live).",
+      "kind": "string",
+      "default": "/live"
+    },
+    {
+      "id": "readiness-probe-path",
+      "prompt": "HTTP path the readiness probe binds to on the request-traffic listener (REQ-002; default /ready).",
+      "kind": "string",
+      "default": "/ready"
+    },
+    {
+      "id": "declared-dependency-set",
+      "prompt": "Comma-separated names of dependencies whose availability the readiness probe evaluates (REQ-003; blank when no dependencies are declared). Each name resolves to a checkFor(name) predicate.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "notification-outcome-substrate",
+      "prompt": "Durable substrate for notification-outcome records (REQ-006). Recommended defaults: sqlite (single-node), postgres (multi-node). The substrate must survive a process restart.",
+      "kind": "enum",
+      "options": [
+        "sqlite",
+        "postgres",
+        "custom"
+      ],
+      "default": "sqlite"
+    }
+  ],
   "contributions": [
     {
       "id": "observability-essentials-REQ-001",

package/blueprints/observability-essentials/contributions/adrs/adr-801-observability-essentials-health-probes.json

@@ -6,7 +6,7 @@
   "status": "accepted",
   "title": "Historical: two HTTP health probes on the request-traffic listener with a stable JSON body shape (self-supervised design intent, superseded by observability-probe-endpoints as the shelf canonical path owner from v2.0.0)",
   "context": "Every deployed application runs under an orchestrator that needs a restart signal and under a load balancer that needs a routing signal. The two signals answer different questions: 'is this process wedged, restart it' versus 'is this process able to serve, route around it if not'. A single probe folded across both questions produces the outage-amplifying failure mode where a downstream dependency blip triggers a restart storm that dwarfs the original blip. The probes have to be structurally separate at the endpoint and semantically separate at the answer.",
-  "decision": "The application serves two probe endpoints on the same HTTP listener that serves request traffic: a liveness probe at /healthz (or the configured override) and a readiness probe at /readyz (or the configured override). Both respond with Content-Type application/json and a stable body shape: { status: 'pass' | 'fail', checkedAt: <ISO-8601> } for liveness, plus a { checks: { <depName>: { state, checkedAt } } } object for readiness. Liveness returns 200 whenever the event loop is responsive and never depends on any external condition; readiness returns 200 when every declared dependency's cached state is pass and 503 otherwise. Both endpoints are auth-exempt (see ADR-804). The probes bind to the request-traffic listener rather than a separate operator port so the load balancer's probe observes the same reachability the traffic will observe.",
+  "decision": "The application serves two probe endpoints on the same HTTP listener that serves request traffic: a liveness probe at /healthz (or the configured override) and a readiness probe at /readyz (or the configured override). Both respond with the response header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1] and a stable body shape: { status: 'pass' | 'fail', checkedAt: <ISO-8601> } for liveness, plus a { checks: { <depName>: { state, checkedAt } } } object for readiness. Liveness returns 200 whenever the event loop is responsive and never depends on any external condition; readiness returns 200 when every declared dependency's cached state is pass and 503 otherwise. Both endpoints are auth-exempt (see ADR-804). The probes bind to the request-traffic listener rather than a separate operator port so the load balancer's probe observes the same reachability the traffic will observe.",
   "consequences": "The orchestrator's restart action is coupled only to true process wedging: a downstream dependency outage never triggers a restart. The load balancer's rotation action is coupled to declared-dependency health only: an unready replica gets pulled from rotation without a restart the replica cannot recover from. The stable JSON shape lets third-party monitoring integrations wire once. A change to the probe path defaults or a rename of a top-level probe body field is a major version bump on this blueprint. Composing blueprints that hold a different opinion on the endpoint contract (a project that wants /health as a single endpoint answering both questions, a project that wants gRPC probes, a project that wants both probes on a separate admin port) conflict on the healthProbes topic; the expected resolution is one project-level ADR that fixes the endpoint contract. From essentials v2.0.0 this ADR is scope-local historical context: the shelf-wide healthProbes topic is claimed only by observability-probe-endpoints. The self-supervised body shape and the request-traffic-listener binding remain the intent for the essentials-alone case; the literal /healthz and /readyz path defaults were removed from TAC-801 and TAC-802 in the same bump.",
   "alternativesConsidered": [
     {