rcf-lite 0.25.0 → 0.27.0

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-001.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The application exposes a liveness probe endpoint at a configured HTTP path",
   "description": "The application serves a liveness probe endpoint at a project-supplied HTTP path. A 2xx response means the process is running its event loop and is not wedged; a 5xx response means the process is stuck and the orchestrator should restart it. The endpoint answer never depends on any external dependency: a database outage, a broker outage or a partner API outage never turns liveness red on its own. The endpoint runs entirely inside the process boundary. The liveness path is supplied by project configuration under probeInterface.paths.liveness; when observability-probe-endpoints is composed on the same project the resolved profile liveness path binds automatically (Kubernetes profile default /live). Essentials-alone projects supply the one config line at boot and the blueprint refuses boot with a stable-coded error when it is missing.",
+  "deliveredBy": {
+    "tacId": "TAC-801-observability-essentials-liveness-probe",
+    "field": "interfaces.createLivenessHandler"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The application exposes a readiness probe endpoint at a configured HTTP path",
   "description": "The application serves a readiness probe endpoint at a project-supplied HTTP path distinct from the liveness path. A 2xx response means the process is ready to accept request traffic; a 5xx response means the orchestrator should stop routing traffic to this replica while the process itself remains up. The readiness answer aggregates the health of the specific dependencies the process needs to serve requests correctly, evaluated through non-blocking cached checks that never hang the endpoint on a slow dep. The readiness path is supplied by project configuration under probeInterface.paths.readiness; when observability-probe-endpoints is composed on the same project the resolved profile readiness path binds automatically (Kubernetes profile default /ready). Essentials-alone projects supply the one config line at boot and the blueprint refuses boot with a stable-coded error when it is missing.",
+  "deliveredBy": {
+    "tacId": "TAC-802-observability-essentials-readiness-probe",
+    "field": "interfaces.createReadinessHandler"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The readiness dependency set is declared in configuration and every declared dependency is named in the probe response",
   "description": "The set of dependencies whose health contributes to the readiness answer is declared at boot from application configuration. Each declared dependency has a stable string name that appears in the readiness probe's structured response body under a checks field, alongside its individual pass/fail state and the timestamp of the last check evaluation. Dependencies not declared in the readiness set never appear in the probe response, never affect readiness, and are surfaced to operators only through the status page or the notification outcome record.",
+  "deliveredBy": {
+    "tacId": "TAC-802-observability-essentials-readiness-probe",
+    "field": "interfaces.dependencyRegistry"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The application serves a public status page listing every declared component and its current state",
   "description": "The application serves a public status page at a stable HTTP path intended for external readers (users, partners, unauthenticated visitors). The page renders a list of declared components (subsystems the project chooses to publish state for), each with a current state field from a fixed enum (operational, degraded, outage, maintenance) and a human-readable component name. The page has no login gate. The component list, the enum, and the display order are declared at boot from application configuration; no component appears on the page that was not declared.",
+  "deliveredBy": {
+    "tacId": "TAC-803-observability-essentials-status-page",
+    "field": "interfaces.componentRegistry"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The status page surfaces active incident notices with a stable structure and stable field names",
   "description": "When the operator has posted one or more active incident notices, the status page renders them above the component list. Each notice carries a title (short human string), a body (longer human string), a severity from a fixed enum (info, warning, critical), a startedAt ISO-8601 timestamp, and an optional componentIds array naming which declared components the notice relates to. When no notices are active, the notice region is either absent from the rendered page or clearly labelled as empty; no phantom notices, no stale notices carried over from a previous incident.",
+  "deliveredBy": {
+    "tacId": "TAC-803-observability-essentials-status-page",
+    "field": "interfaces.noticeReader"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-006.json

@@ -2,7 +2,11 @@
   "reqId": "observability-essentials-REQ-006",
   "prdId": "PRD-001",
   "title": "Every notification the application sends records an outcome on a durable sink that operators can query by recipient and window",
-  "description": "The application records the outcome of every notification it attempts to send (email, SMS, push, webhook, or any other channel the project ships) as a structured record on a durable outcome sink. Each record carries a notification identifier, a channel name from a fixed enum, a recipient identifier, an outcome from a fixed enum (delivered, failed, pending, suppressed), an attemptedAt ISO-8601 timestamp, and an optional errorCode string when the outcome is failed. An operator queries the sink by recipient identifier and time window and receives the outcome records that match. Notifications never succeed silently: an attempt with no recorded outcome is a defect the project must gate against.",
+  "description": "The application records the outcome of every notification it attempts to send (email, SMS, push, webhook, or any other channel the project ships) as a structured record on a durable outcome sink. Each record carries a notification identifier, a channel name from a fixed enum, a recipient identifier, an outcome from a fixed enum (delivered, failed, pending, suppressed), an attemptedAt ISO-8601 timestamp, and an optional errorCode string when the outcome is failed. An operator queries the sink by recipient identifier and time window and receives the outcome records that match. Notifications never succeed silently: an attempt with no recorded outcome is a defect the project must gate against. The elicited notification-outcome-substrate is one of three named values whose runtime behaviour this blueprint pins: `sqlite` persists outcome records to a process-local SQLite file at the project-configured path and MUST survive a process restart (AC-7106-4 exercises the restart path against a sqlite path); `postgres` persists outcome records to a PostgreSQL server the project connects to and MUST survive a stop-and-start of that server (AC-7106-4 exercises the restart path against a postgres server); `custom` accepts a project-supplied substrate module conforming to the sink interface on TAC-804 whose implementation guarantees the same restart-survival semantics as the shipped `sqlite` and `postgres` branches (AC-7106-4 and AC-7106-5 exercise the branch through the same TAC-804 interface). Every substrate value the elicit accepts is backed by this runtime clause; a substrate not named here is not accepted at boot.",
+  "deliveredBy": {
+    "tacId": "TAC-804-observability-essentials-notification-outcome",
+    "field": "interfaces.createOutcomeSink"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-007.json

@@ -2,7 +2,11 @@
   "reqId": "observability-essentials-REQ-007",
   "prdId": "PRD-001",
   "title": "Probe responses carry a stable JSON body shape with stable field names and an ISO-8601 timestamp",
-  "description": "The liveness and readiness probe endpoints respond with a JSON body carrying a stable shape: a status field (one of pass or fail), a checkedAt field with an ISO-8601 timestamp of when the probe body was evaluated, and, on the readiness probe, a checks field mapping declared-dependency name to that dependency's individual pass/fail. Content-Type is application/json. Field names do not change across patch or minor versions of the blueprint; a change is a major version bump.",
+  "description": "The liveness and readiness probe endpoints respond with a JSON body carrying a stable shape: a status field (one of pass or fail), a checkedAt field with an ISO-8601 timestamp of when the probe body was evaluated, and, on the readiness probe, a checks field mapping declared-dependency name to that dependency individual pass/fail. The response header naming the media type is the one owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1]. Field names do not change across patch or minor versions of the blueprint; a change is a major version bump.",
+  "deliveredBy": {
+    "tacId": "TAC-802-observability-essentials-readiness-probe",
+    "field": "interfaces.createReadinessHandler"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:observability-essentials",
     "category:07-probe-shape"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-008.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Probes and the public status page are served without an authentication gate",
   "description": "The liveness probe, the readiness probe, and the public status page respond to unauthenticated HTTP requests. No cookie, no header, no source-IP allowlist gates access to these three surfaces. The three paths are declared at boot as auth-exempt in whatever authentication middleware the application uses, and that exemption is the only auth policy the surfaces run under.",
+  "deliveredBy": {
+    "adrId": "ADR-804-observability-essentials-probe-secrecy",
+    "field": "decision.probeSecrecy"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-009.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The public status page never leaks internal identifiers, metric values, or dependency detail beyond the declared surface",
   "description": "The public status page renders only the declared component list and their per-component states, plus the active incident notices. It never renders internal identifiers (host names, replica ids, database identifiers, queue names), never renders raw metric values (request counts, latency numbers, error rates), and never names the specific dependencies that failed a readiness check. The status enum values, the component names, and the incident notice fields are the public vocabulary; anything more granular is operator-only surface, exposed through the readiness probe body or an authenticated operator dashboard.",
+  "deliveredBy": {
+    "adrId": "ADR-803-observability-essentials-status-page-contract",
+    "field": "decision.statusPageContract"
+  },
   "category": "security",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-010.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Probe handlers evaluate in bounded time and never block on a network call to a downstream dependency",
   "description": "The liveness probe handler completes its evaluation entirely in-process and returns without issuing any network call. The readiness probe handler completes within a bounded ceiling (the readiness evaluation budget, declared at boot with a documented default) and never blocks on a synchronous network round trip to a declared dependency: readiness checks read from a per-dependency last-known state that a background evaluator refreshes on its own cadence. A slow or hanging downstream dependency causes the last-known state for that dependency to age or fail, not the probe handler itself to hang.",
+  "deliveredBy": {
+    "tacId": "TAC-802-observability-essentials-readiness-probe",
+    "field": "interfaces.createReadinessHandler"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/tacs/tac-802-observability-essentials-readiness-probe.json

@@ -40,10 +40,15 @@
       "name": "checkFor",
       "kind": "callback",
       "description": "Project-supplied per-dependency probe: (name) -> Promise<{ state: pass or fail, checkedAt: <ISO-8601> }>. Called by the evaluator, not by the handler."
+    },
+    {
+      "name": "probeBodyShapeCompatibility",
+      "kind": "compatibility-contract",
+      "description": "Cross-probe response body shape compatibility. Owns the release-time check that compares a candidate release's /live and /ready response bodies against the checked-in v2 baseline snapshot at blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json. A field name or JSON type present on the baseline that a candidate renames or removes is refused with the stable error code PROBE_BODY_SHAPE_DRIFT naming the offending field; a candidate that adds fields without renaming or removing any passes. TAC-802 hosts the contract because the readiness body is the richer of the two shapes; TAC-801's liveness body is jointly covered by the same contract."
     }
   ],
   "dependencies": [],
   "tradeoffs": "The cached-state pattern means the probe response is at worst one cadence interval stale; a dep that fails mid-cycle takes up to the cadence to reflect on the probe. That staleness is the cost of never hanging the probe handler. Path binding is now the operator or the composed observability-probe-endpoints blueprint decision, not an essentials default: the v2.0.0 breaking change is exactly this shift. Projects that want tighter freshness turn down the cadence at the cost of extra background work; projects that never want the probe to falsely fail on a transient dep blip turn up the cadence at the cost of slower fail-open detection.",
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-09-04T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/tacs/tac-803-observability-essentials-status-page.json

@@ -7,7 +7,7 @@
   "name": "Public status page",
   "purpose": "Owns the public status page: the HTTP handler that renders it, the declared component registry it renders from, and the active-notice reader it renders alongside. The public reader is the primary audience; the renderer commits to the declared component vocabulary and the declared notice fields and to nothing else.",
   "responsibilities": [
-    "Register a GET handler on the configured status page path (default /status) at the application's HTTP router; respond with 200 and Content-Type text/html to unauthenticated requests (AC-7104-1, AC-7108-1, AC-7108-2).",
+    "Register a GET handler on the configured status page path (default /status) at the application's HTTP router; respond with 200 and the response header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1] carrying text/html for this endpoint, to unauthenticated requests (AC-7104-1, AC-7108-1, AC-7108-2).",
     "Render exactly the declared component list in declared order, with each component's current state as a machine-readable attribute drawn from the operational/degraded/outage/maintenance enum; no phantom components, no missing components, no other state values (AC-7104-1, AC-7104-2, AC-7104-3).",
     "Render active incident notices in a notices region above the component list; each notice element carries the title, body, severity, startedAt, and componentIds fields as machine-readable attributes with severity drawn from the info/warning/critical enum; when no notices are active, the notices region is either absent or carries an emptyState marker (AC-7105-1, AC-7105-2, AC-7105-3).",
     "Refuse to render internal identifiers, raw metric values, or declared readiness dependency names on the page; the vocabulary is the declared component names and the declared notice fields, and nothing else (AC-7109-1, AC-7109-2, AC-7109-3)."

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7101.json

@@ -14,18 +14,20 @@
       "description": "The application serves the liveness endpoint at a stable HTTP path supplied by project configuration under `probeInterface.paths.liveness` (with no shipped default from v2.0.0); a GET returns 200 when the process is running its event loop and returns application/json with a status field equal to pass. When observability-probe-endpoints v1.1.0 or later is composed on the same project the resolved profile liveness path substitutes for this configuration entry automatically.",
       "given": "the process is running normally with its event loop responsive",
       "when": "an unauthenticated GET is issued against the liveness path",
-      "then": "the response status code is 200, the Content-Type is application/json, and the JSON body's status field equals pass",
+      "then": "the response status code is 200, the response carries the header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1], and the JSON body's status field equals pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7101-2",
-      "description": "The liveness probe handler evaluates entirely in-process; a probe hit issues zero network calls to any declared dependency, verifiable by observing the network egress from the probe path.",
+      "description": "The liveness probe handler evaluates entirely in-process; a probe hit issues zero network calls to any declared dependency, verifiable by observing the network egress from the probe path. Template values the applying agent sets: The applying agent sets the elicited declared-dependency-set; the AC substitutes the project's dependency names for the illustrative paymentsProvider / primaryStore tokens.",
       "given": "the process is running and a network-egress observer is attached to the probe path",
       "when": "a GET is issued against the liveness path",
       "then": "the observer records zero egress connections attributable to the probe handler between request receipt and response send",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-7101-3",
@@ -34,7 +36,8 @@
       "when": "a GET is issued against the liveness path",
       "then": "the response status code is 200 and the JSON body's status field equals pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7101-4",
@@ -43,12 +46,27 @@
       "when": "the process attempts to boot",
       "then": "the boot fails with the stable-coded error PROBE_INTERFACE_PATHS_MISSING and the error message names probeInterface.paths.liveness as the missing key",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-7101-5",
+      "description": "A liveness handler on a process whose in-process self-check predicate returns fail (a scheduled watchdog tick that has not fired within its budget) answers HTTP 503 with content-length 0 and an empty body, so the orchestrator restarts the process on the next probe interval. The predicate is response-capable by design: it observes a boolean the handler reads without I/O. Template values the applying agent sets: The applying agent supplies the elicited liveness-probe-path and the project-owned self-check predicate; the AC substitutes both.",
+      "given": "a running application with an operator-declared watchdog tick scheduled every 1 second and a 5-second budget; the tick has not fired for 6 seconds so the predicate is fail",
+      "when": "the orchestrator issues HTTP GET on the elicited liveness-probe-path",
+      "then": "the response is HTTP 503 with content-length 0 and an empty body; a follow-up GET while the predicate stays fail continues to answer 503; a GET after the predicate returns pass answers 200",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-801-observability-essentials-liveness-probe",
+        "field": "interfaces.createLivenessHandler"
+      }
     }
   ],
   "tacIds": [
     "TAC-801-observability-essentials-liveness-probe"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-09-04T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7102.json

@@ -14,9 +14,10 @@
       "description": "The application serves the readiness endpoint at a stable HTTP path supplied by project configuration under `probeInterface.paths.readiness` (with no shipped default from v2.0.0), distinct from the liveness path; a GET returns 200 with a JSON body when every declared readiness dependency is passing and returns 503 with a JSON body when at least one declared readiness dependency is failing. When observability-probe-endpoints v1.1.0 or later is composed on the same project the resolved profile readiness path substitutes for this configuration entry automatically.",
       "given": "the process is running and the readiness dependency set is declared",
       "when": "an unauthenticated GET is issued against the readiness path against a healthy dependency set, then against a set with at least one failing dependency",
-      "then": "the first response has status code 200 with JSON body status equal to pass; the second response has status code 503 with JSON body status equal to fail; both bodies have Content-Type application/json",
+      "then": "the first response has status code 200 with JSON body status equal to pass; the second response has status code 503 with JSON body status equal to fail; both responses carry the header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1]",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7102-2",
@@ -25,7 +26,8 @@
       "when": "a GET is issued against the readiness path targeting the same listener address as request traffic",
       "then": "the response is served by the application, not refused with a connection error, and the readiness handler and a representative request handler both bind to the same address:port pair as reported by the process",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7102-3",
@@ -34,7 +36,8 @@
       "when": "the readiness probe returns 503 across a five-minute window",
       "then": "the process exit code is not emitted, the process remains running throughout the window, and the liveness probe continues to return 200 with status pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7102-4",
@@ -43,7 +46,8 @@
       "when": "the process attempts to boot",
       "then": "the boot fails with the stable-coded error PROBE_INTERFACE_PATHS_MISSING and the error message names probeInterface.paths.readiness as the missing key",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7103.json

@@ -11,12 +11,13 @@
   "acceptanceCriteria": [
     {
       "id": "AC-7103-1",
-      "description": "The readiness dependency set is declared at boot from application configuration; the application refuses to boot with a stable error code if the declaration is missing or if any declared entry lacks a name, and the declaration set is inspectable from the running process through the probe response.",
+      "description": "The readiness dependency set is declared at boot from application configuration; the application refuses to boot with a stable error code if the declaration is missing or if any declared entry lacks a name, and the declaration set is inspectable from the running process through the probe response. Template values the applying agent sets: The applying agent sets the elicited declared-dependency-set; the AC substitutes the project's dependency names for the illustrative paymentsProvider / primaryStore tokens.",
       "given": "the process is configured with a readiness dependency declaration that names each dependency",
       "when": "the readiness probe is hit after successful boot",
       "then": "the JSON body's checks object contains one entry per declared dependency, keyed by the dependency name from the declaration, with no additional keys and no missing keys",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-7103-2",
@@ -25,21 +26,65 @@
       "when": "the response body is inspected",
       "then": "every entry in the checks object has a state field valued pass or fail and a checkedAt field valued as a parseable ISO-8601 timestamp no older than the readiness evaluation budget declared in configuration",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7103-3",
-      "description": "Dependencies not present in the readiness declaration never appear in the probe response and never affect the aggregate status.",
+      "description": "Dependencies not present in the readiness declaration never appear in the probe response and never affect the aggregate status. Template values the applying agent sets: The applying agent sets the elicited declared-dependency-set; the AC substitutes the project's dependency names for the illustrative paymentsProvider / primaryStore tokens.",
       "given": "the process depends on several downstream services but declares only a strict subset as readiness dependencies",
       "when": "the readiness probe is hit while an undeclared downstream service is offline",
       "then": "the undeclared service name never appears as a key in the checks object, and the aggregate status field remains pass so long as every declared dependency is passing",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-7103-4",
+      "description": "The readiness probe refuses to boot when the dependency-set declaration is absent from the applied configuration; the process exits with a non-zero code and emits READINESS_DEPS_MISSING naming the missing configuration key.",
+      "given": "a running application with no declared-dependency-set entry on the applied configuration",
+      "when": "the readiness handler boots",
+      "then": "the process exits with a non-zero code and emits a READINESS_DEPS_MISSING error naming the missing configuration key; no readiness listener binds",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-802-observability-essentials-readiness-probe",
+        "field": "interfaces.dependencyRegistry"
+      }
+    },
+    {
+      "id": "AC-7103-5",
+      "description": "The readiness probe refuses to boot when the declared dependency set contains a duplicate name; the process exits with a non-zero code and emits READINESS_DEPS_DUPLICATE naming the offending duplicate. Template values the applying agent sets: The applying agent supplies the declared-dependency-set (which will contain the duplicate the AC exercises); the AC substitutes those names.",
+      "given": "a running application with the elicited declared-dependency-set including two dependencies with the same name",
+      "when": "the readiness handler boots",
+      "then": "the process exits with a non-zero code and emits READINESS_DEPS_DUPLICATE naming the duplicate name; no readiness listener binds",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-802-observability-essentials-readiness-probe",
+        "field": "interfaces.dependencyRegistry"
+      }
+    },
+    {
+      "id": "AC-7103-6",
+      "description": "The readiness probe refuses to boot when a declared dependency has a blank name or a name that fails the accepted grammar; the process exits with a non-zero code and emits READINESS_DEPS_MALFORMED naming the offending value.",
+      "given": "a running application with a declared dependency name set to the empty string OR containing a whitespace character",
+      "when": "the readiness handler boots",
+      "then": "the process exits with a non-zero code and emits READINESS_DEPS_MALFORMED naming the offending value; no readiness listener binds",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-802-observability-essentials-readiness-probe",
+        "field": "interfaces.dependencyRegistry"
+      }
     }
   ],
   "tacIds": [
     "TAC-802-observability-essentials-readiness-probe"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7104.json

@@ -14,9 +14,10 @@
       "description": "The application serves the status page at a stable HTTP path declared in configuration (default /status), responds to an unauthenticated GET with 200 and text/html, and renders exactly the declared component list with no phantom components and no missing components.",
       "given": "the process is running with a component declaration that names N components",
       "when": "an unauthenticated GET is issued against the status page path",
-      "then": "the response status code is 200, the Content-Type begins with text/html, and the rendered document contains exactly N component elements, each carrying the declared component name as text content",
+      "then": "the response status code is 200, the response carries the status-page variant of the header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1] (text/html for this endpoint), and the rendered document contains exactly N component elements, each carrying the declared component name as text content",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7104-2",
@@ -25,7 +26,8 @@
       "when": "the rendered document is queried for the per-component state attribute",
       "then": "every component element carries a state attribute whose value is one of the four enum strings; no other value appears",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7104-3",
@@ -34,7 +36,8 @@
       "when": "the status page is rendered",
       "then": "the rendered component elements appear in the same order as the declaration, verified by walking the rendered document's component elements top-to-bottom and comparing to the declared order",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7105.json

@@ -16,7 +16,8 @@
       "when": "the status page is rendered and the notices region is queried",
       "then": "the notices region contains exactly two notice elements, each with a title field, a body field, a severity field, and a startedAt field; the first notice element carries a componentIds field naming the two referenced components, the second notice element either omits the componentIds field or renders it as an empty list",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7105-2",
@@ -25,7 +26,8 @@
       "when": "the status page is rendered and every notice element's severity field is inspected",
       "then": "every severity value is one of info, warning, or critical; no notice renders with any other severity value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7105-3",
@@ -34,7 +36,8 @@
       "when": "the status page is rendered",
       "then": "the rendered document either contains no notices region element or contains a notices region element carrying an emptyState marker; no notice element from any previously active incident is present",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7106.json

@@ -11,21 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-7106-1",
-      "description": "Every notification attempt writes exactly one outcome record to the durable outcome sink before the attempting code returns; the record carries notificationId, channel, recipient, outcome, attemptedAt, and (when outcome is failed) errorCode fields.",
+      "description": "Every notification attempt writes exactly one outcome record to the durable outcome sink before the attempting code returns; the record carries notificationId, channel, recipient, outcome, attemptedAt, and (when outcome is failed) errorCode fields. Template values the applying agent sets: The applying agent sets the elicited notification-outcome-substrate; the AC substitutes the project's substrate for the illustrative sqlite.",
       "given": "the process is instrumented to attempt one notification per invocation across each declared channel",
       "when": "an attempt is invoked and returns, and the sink is queried for that notificationId",
       "then": "the sink returns exactly one record for that notificationId with all required fields populated, and the record's attemptedAt is no later than the return time of the attempt call",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-7106-2",
-      "description": "The outcome field is one of a fixed enum (delivered, failed, pending, suppressed); the channel field is one of a fixed enum declared in configuration (email, sms, push, webhook, or the project's declared channel set).",
+      "description": "The outcome field is one of a fixed enum (delivered, failed, pending, suppressed); the channel field is one of a fixed enum declared in configuration (email, sms, push, webhook, or the project's declared channel set). Template values the applying agent sets: The applying agent sets the elicited notification-outcome-substrate; the AC substitutes the project's substrate for the illustrative sqlite.",
       "given": "the process attempts notifications across every declared channel including deliberately-failing and deliberately-suppressed cases",
       "when": "the sink is queried for the attempt records",
       "then": "every record's outcome field is one of delivered, failed, pending, or suppressed, and every record's channel field is a member of the declared channel enum",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-7106-3",
@@ -34,12 +36,41 @@
       "when": "the operator issues a query for a recipient identifier within a bounded time window",
       "then": "the returned result set contains every outcome record whose recipient equals the queried recipient and whose attemptedAt is within the window, and a query for a recipient with zero matching records returns an empty result set",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-7106-4",
+      "description": "Notification outcome records persist across a process restart of the outcome sink: after N outcome records are written and the sink process is restarted, a query by recipient returns the same N records with the same fields as before the restart. Template values the applying agent sets: The applying agent supplies the elicited notification-outcome-substrate; the AC substitutes it for the illustrative sqlite path.",
+      "given": "a running application configured with the elicited notification-outcome-substrate on a durable path; 5 outcome records written with distinct recipient values",
+      "when": "the sink process is stopped and restarted, then a query is issued for each recipient",
+      "then": "the query returns 5 records; every returned record has the same outcome fields as the record that was written before the restart",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-804-observability-essentials-notification-outcome",
+        "field": "interfaces.createOutcomeSink"
+      }
+    },
+    {
+      "id": "AC-7106-5",
+      "description": "A failed write to the notification outcome sink (a substrate error, a full disk, a network partition on a remote substrate) is signalled to the caller with a stable-coded NOTIFICATION_OUTCOME_WRITE_FAILED error; the notification send call itself does not silently succeed with the outcome record lost. Template values the applying agent sets: The applying agent supplies the failure-mode fixture per its chosen substrate (a disk fill for sqlite, a stopped daemon for postgres); the AC substitutes the substrate.",
+      "given": "a running application with a notification-outcome-substrate that has been forced into a failure mode (a full disk on sqlite, a stopped postgres server)",
+      "when": "a caller records an outcome",
+      "then": "the recordOutcome call rejects with NOTIFICATION_OUTCOME_WRITE_FAILED naming the substrate error; the notification's own send status reflects the failure per the caller's policy; a subsequent queryByRecipient shows no fabricated record for the failed write",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-804-observability-essentials-notification-outcome",
+        "field": "interfaces.recordOutcome"
+      }
     }
   ],
   "tacIds": [
     "TAC-804-observability-essentials-notification-outcome"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7107.json

@@ -11,30 +11,37 @@
   "acceptanceCriteria": [
     {
       "id": "AC-7107-1",
-      "description": "Both probe responses declare Content-Type application/json; both bodies parse as JSON and contain a status field (pass or fail) and a checkedAt field with a parseable ISO-8601 timestamp.",
+      "description": "Both probe responses carry the response header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1]; both bodies parse as JSON and contain a status field (pass or fail) and a checkedAt field with a parseable ISO-8601 timestamp.",
       "given": "the process is running and both probes are reachable",
       "when": "GETs are issued against each probe path and each response body is JSON-parsed",
-      "then": "each response has Content-Type application/json, each body parses without error, each parsed body has a status field valued pass or fail, and each body has a checkedAt field that parses as a valid ISO-8601 date-time",
+      "then": "each response carries the response header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1], each body parses without error, each parsed body has a status field valued pass or fail, and each body has a checkedAt field that parses as a valid ISO-8601 date-time",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7107-2",
-      "description": "The readiness body carries a checks object keyed by declared dependency name; the liveness body has no checks field.",
+      "description": "The readiness body carries a checks object keyed by declared dependency name; the liveness body has no checks field. Template values the applying agent sets: The applying agent sets the elicited declared-dependency-set; the AC substitutes the project's dependency names for the illustrative paymentsProvider / primaryStore tokens.",
       "given": "the process has declared a readiness dependency set and both probes are reachable",
       "when": "the two probe response bodies are compared",
       "then": "the readiness body contains a checks object with one entry per declared readiness dependency, and the liveness body contains no checks field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-7107-3",
-      "description": "Field names on both probe response bodies are stable across the blueprint's version series: a patch or minor release does not rename status, checkedAt, or checks.",
-      "given": "the blueprint at v1.0.0 declares its probe body field names",
-      "when": "a project inspects the field names on both probe bodies at v1.0.0 and again at any subsequent v1.x.y release",
-      "then": "the top-level field names status, checkedAt, and checks (readiness only) are present at both versions with the same casing and the same value shapes; a rename would require a major version bump per the blueprint's own versioning policy",
+      "description": "The probe response JSON body shape is snapshot-locked against the v2 baseline captured at 2026-09-09: any candidate release comparing against the current v2 baseline SHALL keep every documented field name and JSON type on the /live and /ready responses, and any field addition SHALL preserve the shape of every earlier v2.x release. A candidate that renames or removes a documented field fails the check with a stable code naming the offending field. Template values the applying agent sets: The applying agent sets the elicited liveness-probe-path; the AC substitutes it for the illustrative /live.",
+      "given": "the v2 baseline snapshot at blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json and a candidate release's /live and /ready JSON body samples on the same profile",
+      "when": "the release-time compatibility check runs the candidate samples against the v2 baseline snapshot",
+      "then": "every field name and JSON type present on the v2 baseline is present on the candidate at the same top-level path; a rename or removal fails with the stable code PROBE_BODY_SHAPE_DRIFT naming the offending field; a candidate that adds fields without renaming or removing any passes",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-802-observability-essentials-readiness-probe",
+        "field": "interfaces.probeBodyShapeCompatibility"
+      }
     }
   ],
   "tacIds": [
@@ -42,5 +49,5 @@
     "TAC-802-observability-essentials-readiness-probe"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7108.json

@@ -16,7 +16,8 @@
       "when": "unauthenticated GETs are issued against each of the three paths in turn",
       "then": "no response carries status code 401 or 403 and none carries a WWW-Authenticate response header; each response is either a 2xx probe pass, a 5xx probe fail, or a 2xx status page",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7108-2",
@@ -25,7 +26,8 @@
       "when": "the running process's exempt list is inspected",
       "then": "the list contains the three configured paths (liveness, readiness, status page) and no others that were not deliberately declared",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7108-3",
@@ -34,7 +36,8 @@
       "when": "an authenticated GET is issued against each of the three exempt paths",
       "then": "each response is identical in shape and status code to the unauthenticated case; no path refuses the authenticated caller",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [