rcf-lite 0.25.0 → 0.27.0

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7109.json

@@ -16,7 +16,8 @@
       "when": "the fully-rendered status page document is fetched and grepped for each of H, R, D, Q, U, and B",
       "then": "every grep returns zero matches, including inside script tags and inline JSON payloads",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7109-2",
@@ -25,16 +26,18 @@
       "when": "the rendered status page document is inspected for numeric content outside the incident notice startedAt timestamps",
       "then": "no metric value from the internal metric surface appears as text content or data attribute on any element",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7109-3",
-      "description": "The readiness probe body may name declared dependencies (that is its purpose); the status page must not name them. The declared-component vocabulary and the declared-readiness-dependency vocabulary are distinct sets, and no declared readiness dependency name appears on the public status page.",
+      "description": "The readiness probe body may name declared dependencies (that is its purpose); the status page must not name them. The declared-component vocabulary and the declared-readiness-dependency vocabulary are distinct sets, and no declared readiness dependency name appears on the public status page. Template values the applying agent sets: The applying agent sets the elicited declared-dependency-set; the AC substitutes the project's dependency names for the illustrative paymentsProvider / primaryStore tokens.",
       "given": "the process declares a readiness dependency set with distinct names from the declared status-page component set",
       "when": "the public status page is fetched and grepped for each declared readiness dependency name",
       "then": "every grep returns zero matches; a grep of the readiness probe body for the same names returns non-zero matches, demonstrating the surfaces are distinct",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7110.json

@@ -11,21 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-7110-1",
-      "description": "The readiness probe handler returns a response within the readiness evaluation budget declared in configuration (default 1 second) regardless of the responsiveness of any declared dependency; the handler reads a cached last-known state populated by a background evaluator, never issues a synchronous network round trip to a dep from inside the handler.",
+      "description": "The readiness probe handler returns a response within the readiness evaluation budget declared in configuration (default 1 second) regardless of the responsiveness of any declared dependency; the handler reads a cached last-known state populated by a background evaluator, never issues a synchronous network round trip to a dep from inside the handler. Template values the applying agent sets: The applying agent sets the elicited declared-dependency-set; the AC substitutes the project's dependency names for the illustrative paymentsProvider / primaryStore tokens.",
       "given": "a declared readiness dependency's real endpoint is configured to hang indefinitely (a network sink with no responder)",
       "when": "a GET is issued against the readiness path and the response time is measured",
       "then": "the response arrives within the declared readiness evaluation budget (default 1 second) and the response's checks entry for the hanging dependency shows state fail with a checkedAt that reflects the last background evaluation attempt, not the current probe-hit time",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-7110-2",
-      "description": "The background dep-health evaluator runs on its own cadence, declared in configuration; every declared readiness dependency is evaluated at least once per cadence interval regardless of the state of any other dependency.",
+      "description": "The background dep-health evaluator runs on its own cadence, declared in configuration; every declared readiness dependency is evaluated at least once per cadence interval regardless of the state of any other dependency. Template values the applying agent sets: The applying agent sets the elicited declared-dependency-set; the AC substitutes the project's dependency names for the illustrative paymentsProvider / primaryStore tokens.",
       "given": "the process is running with N declared dependencies including one that hangs and the background evaluator cadence declared as C seconds",
       "when": "the process runs for at least 3 * C seconds and each dependency's checkedAt timestamp is sampled from the readiness body",
       "then": "every non-hanging dependency's checkedAt advances at least twice within the window; the hanging dependency's checkedAt advances or its state transitions to fail with a checkedAt that reflects the evaluator's own attempt time, and no other dependency's evaluation is starved by the hanging one",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-7110-3",
@@ -34,7 +36,8 @@
       "when": "a GET is issued against the liveness path and the response time is measured",
       "then": "the response status is 200, the response body's status field is pass, and the response arrives within 250 milliseconds",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/observability-essentials/docs/topics.md

@@ -61,7 +61,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |
@@ -76,7 +76,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 
 US 7101-7110 sit at the LOW end of the 7101-7899 band on purpose. A project-side story that mechanically derives from an observability-essentials REQs id into the number `7110` would collide against observability-essentials-US-7110 in this package; the band leaves headroom at the HIGH end (US 7181-7899) so a project's own stories anchored to observability-essentials REQs can allocate without conflict. The watchpost run4 lesson applies here too.
 
-Row-status caveat: the delivery-ci-workflows seat shipped first (PR #95 merged at 595cab9c on main). This branch was rebased onto that main; the delivery-ci-workflows row reflects the shipped state, and the observability row flips to `shipped v1.0.0` at this branch's merge (Dave coordinates that final flip in the merge commit or an immediate follow-up).
+Row-status caveat: the delivery-ci-workflows seat shipped first (PR #95 merged at 595cab9c on main). This branch was rebased onto that main; the delivery-ci-workflows row reflects the shipped state, and the observability row flips to `shipped v1.0.0` at this branch's merge (the maintainer coordinates that final flip in the merge commit or an immediate follow-up).
 
 ## Shared expectations for future composing blueprints
 

package/blueprints/observability-essentials/guide/observability-essentials.md

@@ -40,7 +40,7 @@ Do not reach for the observability-essentials blueprint when:
 - The observability posture is metrics-first or tracing-first (a project that has already committed to OpenTelemetry end-to-end and does not want a lightweight two-probe HTTP floor on top). A project with these needs supersedes the health probe ADR with a project-level ADR mapping to the OpenTelemetry contract; the notification outcome sink and the public status page contract stay useful.
 - The project needs multi-region status roll-up on the public page (per-region component state, per-region incident notices). Out of scope at v1.0.0; a future `multi-region-status` blueprint composes alongside this one, or a project supersedes ADR-803 with a project-level ADR extending the component vocabulary to include region.
 
-The design brief `w-2026-07-28-029` originally scoped observability as one of the five stock blueprint categories for the ergonomics ship gate. The observability-essentials blueprint at v1.0.0 does not include metrics export or distributed tracing because both are separate decision areas with their own contract surfaces (metrics-export names the wire format for a scrape or push; tracing names the propagation and sampling policy); folding them into one blueprint would produce a package with four global topics that a project has to resolve piecewise. Shipping the two-endpoint HTTP contract plus the public status page plus the notification outcome sink is the shape that fits the mechanism today; a future `metrics-export` blueprint plus a future `tracing` blueprint is the natural evolution.
+The original design brief scoped observability as one of the five stock blueprint categories for the ergonomics ship gate. The observability-essentials blueprint at v1.0.0 does not include metrics export or distributed tracing because both are separate decision areas with their own contract surfaces (metrics-export names the wire format for a scrape or push; tracing names the propagation and sampling policy); folding them into one blueprint would produce a package with four global topics that a project has to resolve piecewise. Shipping the two-endpoint HTTP contract plus the public status page plus the notification outcome sink is the shape that fits the mechanism today; a future `metrics-export` blueprint plus a future `tracing` blueprint is the natural evolution.
 
 ## What a good outcome looks like
 

package/blueprints/observability-logging/CHANGELOG.md

@@ -1,9 +1,24 @@
 # observability-logging CHANGELOG
 
-## 1.2.0 (visual round T-4, spec 2026-09-06 section 5.4.2, Baz Q2 default)
+## 1.3.1 (register-sweep patch, 2026-09-10)
 
-- Declares `capabilities: [auditLog, sessionInventory]` on `blueprint.json`. The `sessionInventory` addition ships the logging-as-session-inventory projection: a project may configure the logger session-emission channel as the source the account-settings sessions surface reads (device labels from the User-Agent header, last-active from the last event emitted per session, terminate as an operator write into the same channel). Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round T-4 `application-account-settings` blueprint. A project that does not run the logger as a session store leaves the surface capability supplied by the applied auth blueprint alone; the account-settings blueprint reads the union.
+- Register: neutral wording in shipped prose (no capability change).
 
-## 1.1.0 (visual round T-5, spec 2026-09-04 section 5.5.2, Baz Q2 default)
+## 1.3.0 (hardening pass, 2026-09-09)
 
-- Declares `capabilities: [auditLog]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump). Keeps a single grammar for capability declaration: consumer blueprints read the union of declared `capabilities[]` on applied blueprints, never the `providesRoles[]` -> capability inference. This is the ratified rule (one grammar, no role-to-capability inference); the section 6a table previously noted `auditLog` as "implicit through the `logging` role" and now names `observability-logging` as the explicit shelf provider. Consumed at apply time by the visual round T-5 `application-admin-console` blueprint to gate the audit-log surface (probe pack check `AC-21105-1`).
+- Removes `sessionInventory` from `capabilities[]`. The section 7c backing requirement never landed on this blueprint: a logging surface does not own or deliver a session-listing surface. The applied `security-auth-clerk` blueprint owns `sessionInventory` through `TAC-1003-security-auth-clerk-session-verifier.interfaces.sessionInventory` (being defined on the security branch tonight); a project that runs Clerk continues to gate the account-settings sessions surface via that capability, unchanged. Shelf-wide grep of `requiresAppliedCapabilities` names no consumer that requires `sessionInventory` from this blueprint; the soft consumer (`application-account-settings` probe pack check `AC-25106-1` via `readAppliedCapabilities`) reads the union across applied blueprints and is unaffected. Removal is reasoned per section 7c, not a downgrade of the semantic surface.
+- Adds `elicits[]` with four apply-time answers: `correlation-header-name` (string, default X-Correlation-Id; ADR-1602), `minimum-log-level` (enum trace/debug/info/warn/error/fatal, default info; ADR-1604), `redaction-categories-additions` (string, default blank; ADR-1603) and `boot-identity-fields` (string, JSON object with environment/serviceName/serviceVersion; REQ-005). Every option value is backed by a must-priority REQ description (section 7c criterion a). Closes the family-pass F-2 finding.
+- Adds `ADR-1605-observability-logging-serialisation-refusal`: BigInt values fold to their decimal string form on the emitted line; circular references and function references are dropped with one stderr notice naming the offending dotted path. Closes the family-pass F-4 chain-contradiction specimen (TAC-1601 internalStructure previously described a BigInt fold while REQ-001 / AC-15101-2 described a drop). TAC-1601 internalStructure and responsibility 4 are rewritten to reference ADR-1605; the F-4 outcome split is separately observable at AC-15101-2 (drop for circular/function) and AC-15101-3 (BigInt fold).
+- Adds `REQ-006` and `US-15109` naming the `auditLog` capability explicitly: the audit-log stream carries actor, target, before, after and correlationId on the shared minimum field set the consumer (application-admin-console AC-21105-1) reads. Backs the `auditLog` token per section 7c.
+- Grows `US-15101` from 2 ACs to 5 ACs: adds AC-15101-3 (BigInt fold oracle), AC-15101-4 (reserved-name collision refusal), AC-15101-5 (ISO-8601 timestamp millisecond oracle). Every existing and new AC on the story carries `disposition`; ACs observing a specific TAC surface carry `ownerRef`.
+- Adds `deliveredBy` to every REQ: REQ-001/002/003/005 point at TAC-1601 or TAC-1602 interfaces the responsibility genuinely carries; REQ-004 delivered by ADR-1604. Closes 5 pass-2 lint findings; per-blueprint `rcf define blueprint lint-consistency` reports zero on pass 1 and pass 2.
+- Review fix pass (F-9): adds section 7a coverage-note descriptions to US-15106 and US-15108 recording the guide-and-TAC trace outcome (no additional mechanism-specific failure paths named beyond the two ACs each story already binds).
+- Register scan fix (customer-facing register): neutralises historical CHANGELOG entries (1.1.0 and 1.2.0) so shipped content carries no internal author names.
+
+## 1.2.0 (visual round, spec 2026-09-06 section 5.4.2, operator Q2 default)
+
+- Declares `capabilities: [auditLog, sessionInventory]` on `blueprint.json`. The `sessionInventory` addition ships the logging-as-session-inventory projection: a project may configure the logger session-emission channel as the source the account-settings sessions surface reads (device labels from the User-Agent header, last-active from the last event emitted per session, terminate as an operator write into the same channel). Additive per section 6 of `blueprint-authoring.md`. Consumed at apply time by the visual round `application-account-settings` blueprint. A project that does not run the logger as a session store leaves the surface capability supplied by the applied auth blueprint alone; the account-settings blueprint reads the union.
+
+## 1.1.0 (visual round, spec 2026-09-04 section 5.5.2, operator Q2 default)
+
+- Declares `capabilities: [auditLog]` on `blueprint.json`. No other change. The new field is additive per section 6 of `blueprint-authoring.md` (an additive optional field with no global-topic change is a minor bump). Keeps a single grammar for capability declaration: consumer blueprints read the union of declared `capabilities[]` on applied blueprints, never the `providesRoles[]` -> capability inference. This is the ratified rule (one grammar, no role-to-capability inference); the section 6a table previously noted `auditLog` as "implicit through the `logging` role" and now names `observability-logging` as the explicit shelf provider. Consumed at apply time by the visual round `application-admin-console` blueprint to gate the audit-log surface (probe pack check `AC-21105-1`).

package/blueprints/observability-logging/README.md

@@ -3,7 +3,7 @@
 Structured single-line JSON emission for a rcf-lite project. General enterprise practice, no vendor lock-in. Ships the shelf-canonical `logging` global topic on `ADR-1601-observability-logging-line-shape` (transferred from `application-api-rest-ADR-304`, retained there as superseded history). Provides the `logging` role for the companion-suggestion mechanism. From 1.1.0, declares `capabilities: [auditLog]` on `blueprint.json` so the application-admin-console probe pack activates the audit-log surface check `AC-21105-1` when this blueprint is applied on the project (one grammar; consumer blueprints read declared capabilities, never a role-to-capability inference).
 
 
-> Latest: **v1.2.0** (visual round T-4, 2026-09-06). `capabilities: [auditLog, sessionInventory]`. See [CHANGELOG.md](CHANGELOG.md).
+> Latest: **v1.3.0** (hardening pass, 2026-09-09). `capabilities: [auditLog]`; elicits: correlation-header-name, minimum-log-level, redaction-categories-additions, boot-identity-fields. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Apply
 

package/blueprints/observability-logging/blueprint.json

@@ -1,40 +1,48 @@
 {
   "slug": "observability-logging",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "category": "observability",
   "providesRoles": [
     "logging"
   ],
   "capabilities": [
-    "auditLog",
-    "sessionInventory"
+    "auditLog"
+  ],
+  "elicits": [
+    {
+      "id": "correlation-header-name",
+      "prompt": "Inbound correlation header name accepted and reflected on outbound requests (per ADR-1602; recommended default X-Correlation-Id, elicited alternative per project).",
+      "kind": "string",
+      "default": "X-Correlation-Id"
+    },
+    {
+      "id": "minimum-log-level",
+      "prompt": "Minimum log level per environment (per ADR-1604 vocabulary trace / debug / info / warn / error / fatal; the factory refuses emissions below this level).",
+      "kind": "enum",
+      "options": [
+        "trace",
+        "debug",
+        "info",
+        "warn",
+        "error",
+        "fatal"
+      ],
+      "default": "info"
+    },
+    {
+      "id": "redaction-categories-additions",
+      "prompt": "Additional PII redaction categories on top of the recommended defaults (credential, pii.email, pii.name, pii.address, token, bearer per ADR-1603). Kebab-cased or dotted-namespace names; comma-separated list, blank when none.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "boot-identity-fields",
+      "prompt": "Boot identity: JSON object with environment, serviceName and serviceVersion string values the factory carries on every emitted line (REQ-005). All three refuse construction when blank.",
+      "kind": "string",
+      "default": "{\"environment\":\"\",\"serviceName\":\"\",\"serviceVersion\":\"\"}"
+    }
   ],
   "contributions": [
-    {
-      "id": "observability-logging-REQ-001",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-001.json"
-    },
-    {
-      "id": "observability-logging-REQ-002",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-002.json"
-    },
-    {
-      "id": "observability-logging-REQ-003",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-003.json"
-    },
-    {
-      "id": "observability-logging-REQ-004",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-004.json"
-    },
-    {
-      "id": "observability-logging-REQ-005",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-005.json"
-    },
     {
       "id": "observability-logging-US-15101",
       "kind": "us",
@@ -75,6 +83,11 @@
       "kind": "us",
       "path": "user-stories/observability-logging-us-15108.json"
     },
+    {
+      "id": "observability-logging-US-15109",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15109.json"
+    },
     {
       "id": "TAC-1601-observability-logging-logger-factory",
       "kind": "tac",
@@ -115,6 +128,41 @@
       "recommendedDefault": true,
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-1605-observability-logging-serialisation-refusal",
+      "kind": "adr",
+      "path": "adrs/adr-1605-observability-logging-serialisation-refusal.json"
+    },
+    {
+      "id": "observability-logging-REQ-001",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-001.json"
+    },
+    {
+      "id": "observability-logging-REQ-002",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-002.json"
+    },
+    {
+      "id": "observability-logging-REQ-003",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-003.json"
+    },
+    {
+      "id": "observability-logging-REQ-004",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-004.json"
+    },
+    {
+      "id": "observability-logging-REQ-005",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-005.json"
+    },
+    {
+      "id": "observability-logging-REQ-006",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-006.json"
     }
   ]
 }

package/blueprints/observability-logging/contributions/adrs/adr-1605-observability-logging-serialisation-refusal.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-1605-observability-logging-serialisation-refusal",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Serialisation refusal split: BigInt folded to string, circular reference and function reference dropped with stderr notice",
+  "context": "REQ-001 previously described any non-JSON-representable value as dropped, while TAC-1601's internalStructure described a JSON.stringify replacer that folded BigInt to string. Both cannot hold: an operator debugging a BigInt-carrying payload sees either the folded value on stdout OR a dropped emission on stderr, not both. The refusal semantics of a circular graph and a function reference is different from a BigInt (the former genuinely cannot serialise; the latter has a well-defined decimal string form). Splitting the two clears the chain contradiction the family-pass review flagged as F-4 and lands a stable oracle every AC can assert.",
+  "decision": "BigInt values in a log payload are folded to their decimal string form on the emitted line (the replacer calls `.toString()` on the value; the field's runtime type on stdout is `string`). Circular references and function references cannot be folded and cause the emission to be dropped: the boundary catches the SerializationRefusedError, writes one stderr notice naming the offending field's dotted path, and returns to the caller without throwing. The three classes are separately observable: a BigInt is on-stdout as a string, a circular reference is off-stdout with one stderr notice, a function reference is off-stdout with one stderr notice.",
+  "consequences": "Callers that hand the logger a BigInt (an id from a database driver returning arbitrary-precision numerics) see the value on the emitted line; downstream tooling reads it as a JSON string, which is the industry-standard representation for BigInt on the wire. Callers that hand the logger a circular graph see the emission dropped and one stderr notice; the caller's next line still runs. The TAC-1601 internalStructure names all three behaviours consistently. The AC-15101-2 refusal path splits into two observable ACs: one for BigInt (asserting the folded string on stdout), one for a circular payload (asserting the dropped emission and the stderr notice).",
+  "alternativesConsidered": [
+    {
+      "name": "Drop every non-JSON-representable value including BigInt",
+      "summary": "Treat BigInt the same as a circular graph: catch the SerializationRefusedError, drop the emission, write one stderr notice.",
+      "reasonNotChosen": "BigInt has a stable decimal string form every JSON consumer accepts, so dropping the emission loses information the folded form would have preserved. The class this blueprint targets (small greenfield applications with database drivers returning bigints) hits BigInt often enough that a drop-on-every-encounter would surprise operators."
+    },
+    {
+      "name": "Fold every non-representable value into a placeholder",
+      "summary": "Replace circular references and function references with the literal string [UNSERIALISABLE:<class>] on the emitted line.",
+      "reasonNotChosen": "A function reference on a log payload is almost certainly a coding defect (the caller wrote the wrong argument); silently folding it to a placeholder lets the defect ship. A drop with one stderr notice surfaces the class where a developer will see it."
+    }
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-001.json

@@ -2,14 +2,21 @@
   "reqId": "observability-logging-REQ-001",
   "prdId": "PRD-001",
   "title": "Every service surface emits structured single-line JSON log lines through the shared factory",
-  "description": "Every log emission from the applying application passes through the logger factory contract TAC-1601 produces, writes one JSON object per line to standard output, and includes at minimum the fields message (string), level (one of the level vocabulary in ADR-1604), timestamp (ISO-8601 with millisecond precision), correlationId (string, may be null when no ambient context), environment (string), serviceName (string) and serviceVersion (string). A log emission that fails to serialise (a value that is not JSON-representable, a circular reference) is caught, dropped with a one-time stderr notice, and the calling code path continues; a serialisation failure never crashes the service.",
+  "description": "Every log emission from the applying application passes through the logger factory contract TAC-1601 produces, writes one JSON object per line to standard output, and includes at minimum the fields message (string), level (one of the level vocabulary in ADR-1604), timestamp (ISO-8601 with millisecond precision), correlationId (string, may be null when no ambient context), environment (string), serviceName (string) and serviceVersion (string). This stream is the shelf provider of the `auditLog` capability: applied consumers (application-admin-console at AC-21105-1) read audit-relevant emissions from the same stream, so an audit-shaped payload with the caller-supplied actor, target, before and after fields folds onto the top level of the same JSON object. A log emission that fails to serialise (a function reference, a circular reference) is caught, dropped with a one-time stderr notice, and the calling code path continues; a BigInt value is folded to its decimal string form per ADR-1605 and the emission proceeds; a serialisation failure never crashes the service.",
+  "deliveredBy": {
+    "tacId": "TAC-1601-observability-logging-logger-factory",
+    "field": "interfaces.Logger"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
   "rationale": "Downstream log ingestion tooling (Elastic Common Schema pipelines, Loki, Datadog, Splunk) parses one JSON object per line. Multi-line stack traces or unstructured text break the pipeline and produce silent data loss. Threading every emission through one factory closes the drift class where a stray console.log lands unstructured text alongside structured lines.",
-  "tags": ["blueprint:observability-logging", "category:01-structured-emission"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:01-structured-emission"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-002.json

@@ -3,11 +3,18 @@
   "prdId": "PRD-001",
   "title": "The application accepts, propagates and reflects a correlation identifier on every log line",
   "description": "The application reads a correlation identifier from an inbound request header (name governed by ADR-1602; default X-Correlation-Id, elicited per project), threads it through the request-scoped context using the mechanism the TAC exposes, includes it on every log line emitted during that request, and reflects it on any outbound request initiated inside the same context. When no inbound identifier is present, the application mints a v4 UUID and treats it as the ambient value. Requests processed with no ambient context (a scheduled task boot, a background worker startup line) log with correlationId equal to null; the field is always present.",
+  "deliveredBy": {
+    "tacId": "TAC-1601-observability-logging-logger-factory",
+    "field": "interfaces.correlationHeader"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
   "rationale": "Correlation identifiers are the mechanism that stitches together the log lines of a single logical request across multiple services and multiple retries. Without acceptance-and-reflection at every hop, log search cannot follow the chain. Present-but-null is a legitimate ambient state (boot-time logs, cron); refusing to log without an identifier fights the operator when they need the emission most.",
-  "tags": ["blueprint:observability-logging", "category:02-correlation-id"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:02-correlation-id"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-003.json

@@ -3,11 +3,18 @@
   "prdId": "PRD-001",
   "title": "PII fields are redacted by named category at the emission boundary, not at the call site",
   "description": "The logger factory exposes a redaction contract (ADR-1603 recommended-default categories: credential, pii.email, pii.name, pii.address, token, bearer; elicited additions per project). A field named or path-labelled with a category is replaced with the string [REDACTED:<category>] before the line is serialised, whether the log call site remembered to redact or not. Redaction happens at the emission boundary (TAC-1602): a rogue field name in a caller-supplied object is redacted by rule, not by hope. The redaction pass never mutates the caller's original object; the emission pipeline copies the object first.",
+  "deliveredBy": {
+    "tacId": "TAC-1602-observability-logging-redaction-boundary",
+    "field": "interfaces.createRedactionBoundary"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",
   "rationale": "PII leaks through logs are one of the most common data-exposure defects in production systems. Placing the redaction responsibility at the call site produces a coverage gap the size of the codebase; placing it at the boundary is the only scalable enforcement. Named categories keep the vocabulary auditable and let a project add its own categories at apply time.",
-  "tags": ["blueprint:observability-logging", "category:03-pii-redaction"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:03-pii-redaction"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-004.json

@@ -3,11 +3,18 @@
   "prdId": "PRD-001",
   "title": "Every environment has an operator-elicited minimum log level; the factory refuses to emit below it",
   "description": "The logger factory reads a minimum level per environment (ADR-1604 recommended default vocabulary: trace, debug, info, warn, error, fatal; the minimum level per environment is elicited at apply). Emissions below the minimum are dropped before serialisation; emissions at or above the minimum land on stdout. The environment name is supplied at boot (REQ-005) and the level filter is applied per line, not batched. Changing the minimum level mid-run through a documented hook (SIGHUP re-read, admin endpoint, config reload) is out of scope for v1; the minimum is fixed for the process lifetime.",
+  "deliveredBy": {
+    "adrId": "ADR-1604-observability-logging-level-vocabulary",
+    "field": "decision.levelVocabulary"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
   "rationale": "Production log volume is dominated by debug and trace lines; enabling them everywhere buries the signal. Development wants them; production does not. A per-environment operator-elicited minimum keeps the discipline explicit at apply time and lets the same code path serve both environments with the same call sites.",
-  "tags": ["blueprint:observability-logging", "category:04-level-vocabulary"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:04-level-vocabulary"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-005.json

@@ -3,11 +3,18 @@
   "prdId": "PRD-001",
   "title": "Every log line carries environment, service name and service version, all operator-elicited at boot",
   "description": "The three fields (environment, serviceName, serviceVersion) are supplied to the logger factory at boot from operator-elicited configuration (environment variables, config file, deployment manifest); the factory refuses to construct a logger when any of the three is missing or blank. Every emitted line carries all three at fixed field names so log ingestion can partition by environment and service without prose parsing.",
+  "deliveredBy": {
+    "tacId": "TAC-1601-observability-logging-logger-factory",
+    "field": "interfaces.createLoggerFactory"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
   "rationale": "A shared log destination sees lines from every environment and every service. Without machine-readable partitioning fields, filtering by environment or service requires string search on the message field, which is fragile and prone to false positives. Requiring the three fields at boot puts the discipline at the earliest possible surface.",
-  "tags": ["blueprint:observability-logging", "category:05-boot-fields"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:05-boot-fields"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-006.json

@@ -0,0 +1,16 @@
+{
+  "reqId": "observability-logging-REQ-006",
+  "prdId": "PRD-001",
+  "title": "The applied logger emits an audit-log stream backing the shelf auditLog capability with the correlation identifier already threaded",
+  "description": "The blueprint declares the auditLog capability on blueprint.json and delivers it through the same emission stream REQ-001 defines. An audit event lands as one JSON object per line carrying the shared minimum field set plus caller-supplied actor, target, before and after payload fields on the top level of the same object. The correlationId REQ-002 threads is present on every audit line so the consumer (application-admin-console AC-21105-1) can join a role-change audit entry to the request that produced it. The line is subject to the REQ-003 redaction pass and the REQ-004 minimum-level filter; an audit event emitted at info or above lands, an audit event emitted at debug or trace is filtered out in production per the elicited minimum-level-per-environment.",
+  "deliveredBy": { "tacId": "TAC-1601-observability-logging-logger-factory", "field": "interfaces.Logger" },
+  "category": "functional",
+  "domain": "observability",
+  "priority": "must",
+  "rationale": "The shelf routes auditLog through observability-logging (application-admin-console-ADR-2201, application-account-settings-ADR-2601). Without a must-priority REQ naming that capability token, the delivery is a prose promise: consumer probe packs can be shipped but the chain does not have a load-bearing anchor. Making it explicit closes the section 7c gap on the auditLog token.",
+  "tags": ["blueprint:observability-logging", "category:06-audit-log-capability"],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/observability-logging/contributions/tacs/tac-1601-observability-logging-logger-factory.json

@@ -8,12 +8,12 @@
   "purpose": "Owns the construction of every logger the application uses. Threads the operator-elicited boot fields (environment, serviceName, serviceVersion, minimum level, correlation header name, redaction categories) into a shared factory contract; every call site takes a logger from the factory and never constructs one directly. Provides a hermetic in-memory capture mode for tests.",
   "responsibilities": [
     "Construct a logger from operator-elicited boot fields; refuse construction when environment, serviceName or serviceVersion is missing or blank (AC-15105-1), and refuse when the minimum level is not one of the recommended-default vocabulary (AC-15106-1).",
-    "Emit each log call as one JSON line to standard output carrying the shared minimum field set (AC-15101-1), applying the level filter per line (AC-15104-1).",
+    "Emit each log call as one JSON line to standard output carrying the shared minimum field set message, level, timestamp, correlationId, environment, serviceName, serviceVersion (AC-15101-1), applying the level filter per line (AC-15104-1), refusing to let a caller-supplied payload field of the same name as one of the seven collide with the factory-authored value (AC-15101-4), and using an ISO-8601 timestamp with millisecond precision the AC-15101-5 oracle asserts.",
     "Expose an in-memory capture mode returning an ordered array of the structured objects the same emission would have written to stdout (AC-15107-1), with zero stdout side effects.",
-    "Catch serialisation failures (BigInt, function reference, circular object) at the boundary, drop the emission with one stderr notice naming the offending field, and return without throwing to the caller (AC-15101-2).",
+    "Split serialisation refusal per ADR-1605: fold a BigInt payload value to its decimal string form on the emitted line (AC-15101-3); drop a circular graph or a function reference with one stderr notice naming the offending dotted path and return to the caller without throwing (AC-15101-2).",
     "Read the ambient correlation context per emission and thread it onto the correlationId field (AC-15102-1), or null when no context is active (AC-15102-3)."
   ],
-  "internalStructure": "One module exporting createLoggerFactory({ environment, serviceName, serviceVersion, minimumLevel, correlationHeader, redactionCategories, now, sink }) -> { getLogger(name) -> Logger, capturedLines() }. The factory closes over boot fields, a now() clock (default () -> new Date()) and a pluggable sink (default process.stdout; test-mode sink is an in-memory array). Loggers are lightweight wrappers around the sink. Serialisation is JSON.stringify with a replacer function that folds BigInt to string and short-circuits on circularity via a WeakSet, throwing a controlled SerializationRefusedError caught at the boundary.",
+  "internalStructure": "One module exporting createLoggerFactory({ environment, serviceName, serviceVersion, minimumLevel, correlationHeader, redactionCategories, now, sink }) -> { getLogger(name) -> Logger, capturedLines() }. The factory closes over boot fields, a now() clock (default () -> new Date()) and a pluggable sink (default process.stdout; test-mode sink is an in-memory array). Loggers are lightweight wrappers around the sink. Serialisation is JSON.stringify with a replacer function that folds BigInt values to their decimal string form (per ADR-1605), refuses to serialise circular graphs (short-circuits via a WeakSet) and refuses to serialise function references; a refusal throws a controlled SerializationRefusedError which the boundary catches, writes one stderr notice naming the offending dotted path, and returns to the caller without throwing.",
   "interfaces": [
     {
       "name": "createLoggerFactory",
@@ -42,5 +42,5 @@
   "tradeoffs": "The factory owns the field vocabulary; a project that wants an additional top-level field beyond the shared minimum authors it as a payload field (which appears on the line) rather than as a factory-side hook. Capture mode is a first-class interface, not a test-only afterthought: the runtime sink is one strategy the same interface serves, so the capture path exercises the same serialisation logic as the runtime path. The v1 blueprint does not ship a dynamic level-change interface; the level is fixed for the process lifetime (REQ-004).",
   "notes": "Known mechanism-reach gap: the blueprint cannot prove every emission call site uses the factory. A project-side grep gate ('every log call is a factory-returned logger method, not a bare console.log') or a lint rule closes the class; the blueprint's guide names this gap.",
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15101.json

@@ -11,24 +11,78 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15101-1",
-      "description": "A log emission at any level from any call site produces exactly one line on stdout, that line parses as valid JSON, and the parsed object carries every field of the shared minimum set: message, level, timestamp, correlationId, environment, serviceName, serviceVersion.",
+      "description": "A log emission at any level from any call site produces exactly one line on stdout, that line parses as valid JSON, and the parsed object carries every field of the shared minimum set: message, level, timestamp, correlationId, environment, serviceName, serviceVersion. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
       "given": "a running application with the logger factory constructed and an ambient correlation context",
       "when": "any call site emits at any level",
       "then": "one stdout line results, JSON.parse succeeds, and the object has all seven minimum fields present with the correct types",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
     },
     {
       "id": "AC-15101-2",
-      "description": "A log emission whose payload contains a non-JSON-representable value (a BigInt, a function reference, a circular object) is caught at the boundary, dropped with one stderr notice naming the offending field, and the calling code path returns as if the emission had succeeded; the service does not crash.",
-      "given": "a running application and a caller passing a BigInt or a circular object as part of a log payload",
+      "description": "A log emission whose payload contains a circular reference or a function reference is caught at the boundary, dropped with one stderr notice naming the offending dotted path, and the calling code path returns as if the emission had succeeded; the service does not crash.",
+      "given": "a running application and a caller passing a circular graph or a function reference as part of a log payload",
       "when": "the emission is attempted",
-      "then": "stdout carries no line for this emission, stderr carries one notice naming the offending field, and the caller's next line of code executes without throwing",
+      "then": "stdout carries no line for this emission, stderr carries one notice naming the offending dotted path, and the caller's next line of code executes without throwing",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "internalStructure"
+      }
+    },
+    {
+      "id": "AC-15101-3",
+      "description": "A log emission whose payload contains a BigInt value has that value folded to its decimal string form on the emitted line per ADR-1605; the emission proceeds normally, stderr carries no notice, and the JSON.parse of the stdout line yields a string equal to the BigInt's decimal representation.",
+      "given": "a running application and a caller passing { id: 9007199254740993n } (a BigInt beyond safe-integer) on a log payload",
+      "when": "the emission is attempted",
+      "then": "stdout carries one line; JSON.parse of it yields id === '9007199254740993' as a string; stderr carries no notice",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1605-observability-logging-serialisation-refusal",
+        "field": "decision.bigIntFold"
+      }
+    },
+    {
+      "id": "AC-15101-4",
+      "description": "The seven shared minimum fields (message, level, timestamp, correlationId, environment, serviceName, serviceVersion) never collide with a caller-supplied payload field of the same name: a caller payload field named 'level' or 'timestamp' does not overwrite the factory-authored value on the emitted line. The factory-authored value wins; the caller-supplied value with the same name is dropped with one stderr notice naming the offending key. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
+      "given": "a running application and a caller issuing logger.info('m', { level: 'boom', timestamp: 'yesterday' })",
+      "when": "the emission is attempted",
+      "then": "the stdout line's level equals the factory-computed level string and timestamp equals the factory-supplied ISO-8601 stamp; stderr names 'level' and 'timestamp' as reserved keys",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15101-5",
+      "description": "Every emitted line's timestamp field parses as a valid ISO-8601 instant with millisecond precision and lies within a 5-second wall-clock window of the emission call site (a documented oracle for the timestamp promise). The factory refuses construction when the now() strategy returns something that fails to render as an ISO-8601 instant.",
+      "given": "a running application with the default now() strategy and a caller issuing an emission",
+      "when": "the emission is issued at wall-clock time T",
+      "then": "the stdout line's timestamp field parses via Date.parse to a Date whose absolute difference from T is at most 5 seconds, and the string matches /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$/",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }