rcf-lite 0.25.0 → 0.27.0

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15102.json

@@ -11,21 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15102-1",
-      "description": "A request arriving with the elicited correlation header (default X-Correlation-Id per ADR-1602) causes every log line emitted during the handler and its callees to carry correlationId equal to the header value; a request arriving without the header causes the application to mint a v4 UUID and the same value appears on every log line for the request.",
+      "description": "A request arriving with the elicited correlation header (default X-Correlation-Id per ADR-1602) causes every log line emitted during the handler and its callees to carry correlationId equal to the header value; a request arriving without the header causes the application to mint a v4 UUID and the same value appears on every log line for the request. Template values the applying agent sets: The applying agent sets the elicited correlation header name on the correlation-header-name elicit; the AC substitutes the elicited value for the illustrative X-Correlation-Id token.",
       "given": "a running application with the correlation header configured and an inbound request",
       "when": "the request is processed (with or without the header set)",
       "then": "every log line emitted during the request carries the same correlationId value; header value wins when present; a v4 UUID is minted otherwise",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-15102-2",
-      "description": "An outbound HTTP request initiated from within a request-scoped handler carries the ambient correlationId as the same elicited header name.",
+      "description": "An outbound HTTP request initiated from within a request-scoped handler carries the ambient correlationId as the same elicited header name. Template values the applying agent sets: The applying agent sets the elicited correlation header name on the correlation-header-name elicit; the AC substitutes the elicited value for the illustrative X-Correlation-Id token.",
       "given": "an inbound request handler that issues an outbound HTTP call",
       "when": "the outbound request is sent",
       "then": "the outbound request headers include the correlation header with the ambient value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-15102-3",
@@ -34,10 +36,13 @@
       "when": "a boot-time or background emission occurs",
       "then": "the line carries correlationId: null",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
   "updatedAt": "2026-09-04T12:20:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15103.json

@@ -16,19 +16,51 @@
       "when": "the emission passes through the boundary",
       "then": "the stdout line's field value equals [REDACTED:pii.email] and the caller-side object still holds the original address",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-15103-2",
-      "description": "A project may add its own redaction categories at apply through the ADR-1603 elicited-additions parameter; a new category name (kebab or dotted-namespace) is accepted and applied by the boundary in the same round.",
+      "description": "A project may add its own redaction categories at apply through the ADR-1603 elicited-additions parameter; a new category name (kebab or dotted-namespace) is accepted and applied by the boundary in the same round. Template values the applying agent sets: The applying agent sets any project-added redaction categories on the redaction-categories-additions elicit; the AC substitutes the project's category names for the illustrative ssn token.",
       "given": "a project that elicited an additional category ssn on ADR-1603",
       "when": "an emission includes a field tagged ssn",
       "then": "the stdout line's field value equals [REDACTED:ssn]",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-15103-3",
+      "description": "A category name whose kebab or dotted-namespace grammar looks valid but is not present in the current recommended-default set and not in the elicited additions is left unredacted; the emitted payload field carries its original value.",
+      "given": "a running application configured only with the recommended defaults and a caller emitting a payload with a field tagged `custom.internal.token` (not in defaults, not in elicited additions)",
+      "when": "the emission is issued",
+      "then": "the stdout line's `custom.internal.token` field carries the caller value verbatim; no [REDACTED:...] rewrite happens for that field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1602-observability-logging-redaction-boundary",
+        "field": "interfaces.createRedactionBoundary"
+      }
+    },
+    {
+      "id": "AC-15103-4",
+      "description": "The redaction boundary reads a nested payload path: an object with a `user.pii.email` shape has the leaf redacted; the sibling `user.id` retains its original value. Template values the applying agent sets: the AC exercises the recommended-default category vocabulary configured on the boundary.",
+      "given": "a running application with recommended defaults and a caller emitting `{ user: { id: \"u-1\", pii: { email: \"a@b\" } } }`",
+      "when": "the emission is issued",
+      "then": "the stdout line has `user.id` equal to \"u-1\" and `user.pii.email` equal to \"[REDACTED:pii.email]\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1602-observability-logging-redaction-boundary",
+        "field": "interfaces.createRedactionBoundary"
+      }
     }
   ],
-  "tacIds": ["TAC-1602-observability-logging-redaction-boundary"],
+  "tacIds": [
+    "TAC-1602-observability-logging-redaction-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15104.json

@@ -11,15 +11,46 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15104-1",
-      "description": "With the elicited minimum level set to info, an emission at trace or debug produces no stdout line; an emission at info, warn, error or fatal produces one stdout line each.",
+      "description": "With the elicited minimum level set to info, an emission at trace or debug produces no stdout line; an emission at info, warn, error or fatal produces one stdout line each. Template values the applying agent sets: The applying agent sets the elicited minimum-log-level per environment; the AC substitutes the elicited threshold for the illustrative info.",
       "given": "a running application with minimum level set to info",
       "when": "one emission is issued at each of the six levels",
       "then": "the stdout line count equals 4 (info, warn, error, fatal), and no line at trace or debug appears",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-15104-2",
+      "description": "A minimum level of `fatal` drops every emission strictly below fatal, so only fatal emissions land on stdout; emissions at trace, debug, info, warn and error all produce zero lines.",
+      "given": "a running application with minimum-log-level fatal",
+      "when": "one emission is issued at each of the six levels",
+      "then": "stdout carries exactly one line (fatal); no line for any of trace, debug, info, warn or error",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15104-3",
+      "description": "Toggling the minimum level between two constructions of the factory produces the corresponding filter change; the level is fixed for the process lifetime per REQ-004 and re-reading the elicit at boot is a new factory construction, never a mid-run hook.",
+      "given": "a factory constructed with minimum-log-level info; a second factory constructed in a subsequent process with minimum-log-level warn",
+      "when": "one emission is issued at info under each factory",
+      "then": "the first factory's emission lands on stdout; the second factory's emission does not; no mid-run flag flips the level in either process",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15105.json

@@ -11,24 +11,42 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15105-1",
-      "description": "The logger factory refuses to construct when environment, serviceName or serviceVersion is missing or blank; construction failure throws with a message naming the missing field.",
+      "description": "The logger factory refuses to construct when environment, serviceName or serviceVersion is missing or blank; construction failure throws with a message naming the missing field. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
       "given": "an application booting with one of the three fields absent",
       "when": "the logger factory is constructed",
       "then": "the construction throws, the error message names the missing field, and the process exits before any emission is possible",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-15105-2",
-      "description": "Every emitted line carries environment, serviceName and serviceVersion at fixed field names and equal to the values the operator supplied at boot.",
+      "description": "Every emitted line carries environment, serviceName and serviceVersion at fixed field names and equal to the values the operator supplied at boot. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
       "given": "a running application constructed with the three fields set",
       "when": "any emission is issued",
       "then": "the stdout line's three fields equal the operator-supplied values verbatim",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-15105-3",
+      "description": "The factory refuses to construct when environment, serviceName or serviceVersion is set to a whitespace-only string; the thrown error names the offending field and treats blank as absent.",
+      "given": "an application booting with serviceName equal to \"  \" (two spaces)",
+      "when": "the factory is constructed",
+      "then": "construction throws with a message naming serviceName as the offending blank field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15106.json

@@ -11,15 +11,33 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15106-1",
-      "description": "The factory refuses to construct when the elicited minimum level is not one of the recommended-default vocabulary (trace, debug, info, warn, error, fatal); the thrown error names the offending value and lists the accepted set.",
+      "description": "The factory refuses to construct when the elicited minimum level is not one of the recommended-default vocabulary (trace, debug, info, warn, error, fatal); the thrown error names the offending value and lists the accepted set. Template values the applying agent sets: The applying agent sets the elicited minimum-log-level per environment; the AC substitutes the elicited threshold for the illustrative info.",
       "given": "an application booting with minimum level set to 'verbose'",
       "when": "the factory is constructed",
       "then": "the construction throws with a message naming 'verbose' as the offending value and listing the accepted vocabulary",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-15106-2",
+      "description": "The factory refuses to construct when the elicited minimum level is provided in the wrong case (e.g. \"INFO\", \"Warn\"); the thrown error names the offending value and lists the accepted lower-case vocabulary. The vocabulary is case-sensitive by design.",
+      "given": "an application booting with minimum level set to \"INFO\"",
+      "when": "the factory is constructed",
+      "then": "construction throws with a message naming \"INFO\" as the offending value and listing the accepted lower-case vocabulary trace/debug/info/warn/error/fatal",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "description": "Section 7a floor: two ACs. ADR-1604 and TAC-1601 name no US-15106-specific failure paths beyond unknown-level-value (AC-15106-1) and wrong-case (AC-15106-2); further boundary classes for construction-time level validation are not documented on this mechanism."
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15107.json

@@ -16,10 +16,41 @@
       "when": "the code under test emits any number of log lines",
       "then": "the returned array contains one entry per emission with the same object shape the runtime writes to stdout, and stdout carries no line",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-15107-2",
+      "description": "The in-memory capture mode maintains insertion order; emissions issued in the order A, B, C appear in the returned array as A, B, C at indexes 0, 1, 2, with the same shape a stdout sink would have written.",
+      "given": "a factory in capture mode with no ambient correlation context and a caller issuing three distinct emissions in order",
+      "when": "capturedLines() is read",
+      "then": "the returned array has length 3 with emissions in insertion order and each entry's shape matches the shared minimum field set",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
+    },
+    {
+      "id": "AC-15107-3",
+      "description": "Constructing the factory in capture mode does not open stdout: an assertion that captures the process's stdout file descriptor writes across the same test finds zero bytes written by the factory. The mechanism has no documented failure path beyond a caller misusing the capture-mode flag; the standard stdout-vs-capture confusion is caught by AC-15107-1.",
+      "given": "a test that constructs the factory in capture mode and intercepts stdout for the entire scope",
+      "when": "the code under test emits any number of lines",
+      "then": "the intercepted stdout carries zero bytes attributable to the factory; every emission is on the returned capture array",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15108.json

@@ -16,10 +16,28 @@
       "when": "the factory is constructed",
       "then": "construction throws with a message naming 'PII Email' as the offending value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-15108-2",
+      "description": "The factory refuses to construct when the redaction categories list contains an entry that is a valid grammar shape but empty; the thrown error names the offending index and treats empty as invalid.",
+      "given": "a factory configured with redaction categories including an empty string entry ([\"credential\", \"\"])",
+      "when": "the factory is constructed",
+      "then": "construction throws with a message naming the offending index and the empty value",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1602-observability-logging-redaction-boundary",
+        "field": "interfaces.createRedactionBoundary"
+      }
     }
   ],
-  "tacIds": ["TAC-1602-observability-logging-redaction-boundary"],
+  "tacIds": [
+    "TAC-1602-observability-logging-redaction-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "description": "Section 7a floor: two ACs. ADR-1603 and TAC-1602 name no US-15108-specific failure paths beyond grammar-invalid shape (AC-15108-1 already binds the shape refusal at construction) and grammar-valid-but-empty entries (AC-15108-2); further boundary classes for redaction-category validation are not documented on this mechanism."
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15109.json

@@ -0,0 +1,71 @@
+{
+  "usId": "observability-logging-US-15109",
+  "prdId": "PRD-001",
+  "reqId": "observability-logging-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The audit-log stream carries actor, target, before and after fields per line with the ambient correlation identifier for consumer surfaces to join",
+  "asA": "operator of a consuming blueprint (application-admin-console) rendering an audit-log surface",
+  "iWant": "every audit event the applying application emits to land on the same shared logger stream with actor, target, before, after and correlationId fields on the top-level object",
+  "soThat": "the audit surface can read the stream directly, join each row to its originating request via the correlation identifier, and use the shared redaction and level-filter pipeline without a per-consumer adapter",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15109-1",
+      "description": "An audit event emission at info with a payload carrying { actor: 'principal:1', target: 'role:2', before: 'reader', after: 'admin' } produces one stdout line whose parsed object holds those four fields at the top level alongside message, level, timestamp, correlationId, environment, serviceName and serviceVersion; the correlationId equals the ambient request context's value. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
+      "given": "a running application in an ambient request context with correlationId 'req-777' and a caller issuing logger.info('role.granted', { actor: 'principal:1', target: 'role:2', before: 'reader', after: 'admin' })",
+      "when": "the emission passes through the factory",
+      "then": "stdout carries one line, JSON.parse yields an object with actor === 'principal:1', target === 'role:2', before === 'reader', after === 'admin', correlationId === 'req-777' and the shared minimum field set present",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15109-2",
+      "description": "An audit event emitted at debug with the elicited minimum-log-level set to info produces no stdout line, so the audit stream in production does not carry sub-threshold audit noise. Template values the applying agent sets: The applying agent sets the elicited minimum-log-level per environment; the AC substitutes the elicited threshold for the illustrative info.",
+      "given": "a running application with minimum-log-level info and a caller issuing logger.debug('role.hover', { actor: 'principal:1', target: 'role:2', before: 'reader', after: 'reader' })",
+      "when": "the emission is issued",
+      "then": "stdout carries no line for this emission",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15109-3",
+      "description": "An audit event whose actor value has category pii.email at the caller-side has that field replaced with [REDACTED:pii.email] on the emitted line; the caller-side object still holds the original address.",
+      "given": "a running application configured with the recommended redaction defaults and a caller issuing logger.info('login.success', { actor: 'alice@example.test', 'actor.pii.email': 'alice@example.test' })",
+      "when": "the emission passes through the redaction boundary",
+      "then": "the stdout line's `actor.pii.email` field value equals [REDACTED:pii.email] and the caller-side object still holds 'alice@example.test'",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1602-observability-logging-redaction-boundary",
+        "field": "interfaces.createRedactionBoundary"
+      }
+    },
+    {
+      "id": "AC-15109-4",
+      "description": "The blueprint's guide 'Known mechanism-reach gaps' section names the class of a bare console.log or bare stdout write bypassing the factory. This AC verifies that the guide states the gap and names at least one project-side workaround (an ESLint rule or a build-time grep gate) that a consuming project can adopt to close it; the blueprint does not itself supply the gate.",
+      "given": "the applied blueprint's guide file",
+      "when": "the guide is opened",
+      "then": "the guide names the mechanism-reach gap explicitly and states at least one project-side workaround by name",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory",
+    "TAC-1602-observability-logging-redaction-boundary"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/observability-logging/docs/topics.md

@@ -28,7 +28,7 @@
 | application-account-settings | 25101-25899 | 26xx | shipped v1.0.0 | none |
 | application-onboarding-tour | 26101-26899 | 27xx | shipped v1.0.0 | none |
 | persistence-data-postgres | 27101-27899 | 28xx | shipped v1.0.0 | `persistenceStore`, `migrationDiscipline` |
-| object-storage-s3 | 28101-28899 | 29xx | shipped v1.0.0 | `objectStorageContract` |
+| object-storage-s3 | 28101-28899 | 29xx | shipped v1.1.0 | `objectStorageContract` |
 | messaging-queue-cloudflare | 29101-29899 | 30xx | shipped v1.0.0 | `deliverySemantics` |
 | jobs-background | 30101-30899 | 31xx | shipped v1.0.0 | `backgroundJobModel` |
 | platform-cloudflare-kv | 31101-31899 | 32xx | shipped v1.0.0 | `keyValueStoreContract` |

package/blueprints/observability-probe-endpoints/CHANGELOG.md

@@ -0,0 +1,17 @@
+# observability-probe-endpoints CHANGELOG
+
+## 1.2.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.2.0 (hardening pass, 2026-09-09)
+
+- Adds `elicits[]` with four apply-time answers: `probe-interface-profile` (enum kubernetes/loadBalancer/uptimeMonitor/systemd/dockerHealthcheck/reverseProxy/custom, default kubernetes; REQ-001), `probe-paths-override` (string JSON; REQ-002/003), `probe-listener-separate-port` (string; REQ-004), `kubernetes-startup-enabled` (enum off/on, default off; ADR-1503). Every option value is backed by a must-priority REQ description.
+- Adds `deliveredBy` to every REQ (REQ-001-008 -> TAC-1501/1502/1503/1504 interface names; REQ-006 -> ADR-1505). Closes 7 pass-2 lint findings.
+- Closes F-1 chain-contradiction specimen: settles missing-profile semantics as fallback-to-Kubernetes-default (per ADR-1503), not refuse. REQ-001 rewritten to name precedence (explicit declaration wins, absent falls back, unknown/malformed refused with stable codes PROBE_PROFILE_UNKNOWN / PROBE_PROFILE_MALFORMED). AC-14101-2 rebased to the fallback path; AC-14101-4 added for malformed.
+- Closes F-3 (liveness failure without AC coverage): adds AC-14102-5 asserting a response-capable in-process liveness self-check predicate answers HTTP 503 with content-length 0 on fail; `template` because the predicate is project-owned.
+- Closes F-4 chain-contradiction specimen: rewrites the guide's `Boundary with observability-essentials` section to the current-shelf reality (essentials v2 dropped its `scope: global` claims on `healthProbes` and `readinessSemantics`; probe-endpoints is the sole claimant on both topics; both orders compose cleanly). The pre-v2 conflict-resolution paths move to a historical migration note.
+- Closes F-2 (systemd + TCP transport families with no AC): adds AC-14105-4 (systemd Type=notify: exactly-once READY=1 plus periodic WATCHDOG=1 at cadence; supervisor pull when the watchdog cadence lapses), AC-14105-5 (TCP transport: accept on pass, refuse on fail, zero bytes on the connection), AC-14105-6 (missing platform adapter refused at boot with PROBE_ADAPTER_MISSING).
+- Closes the pass-1 lint finding on AC-14106-3: `then` now uses the canonical lowercase `content-length` string owned by TAC-1502.responsibilities[2].
+- Re-sweeps every existing AC's `disposition` per section 7b: ACs whose text references profile names, dependency names, or the elicited separate-port option flipped to `template` with `templateFillIns`; the remaining ACs stay `fixed`.
+- Review fix pass (register scan): the band-spacing paragraph in `docs/topics.md` reads `shelf-lane`/`shelf lane` so shipped content carries no internal team labels.

package/blueprints/observability-probe-endpoints/README.md

@@ -1,4 +1,4 @@
-# observability-probe-endpoints blueprint (v1.1.0)
+# observability-probe-endpoints blueprint (v1.2.0)
 
 The tenth content blueprint on the rcf-build-lite blueprint mechanism, and the second in the `observability` category, sibling to the shipped `observability-essentials`. Scope: a health probe interface derived from an operator-declared target integration profile (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, plus a `custom:<name>` slot). Each profile fixes the probe transport, path or command surface, response contract, and semantic distinction between liveness and readiness for the supervisor at hand. Kubernetes is the shipped default (HTTPGet `/live` and `/ready` on the request-traffic listener); every HTTP profile ships with a `probeListener.separatePort` opt-in for probe-traffic isolation from user traffic. Response contracts are minimal by construction; the profile validator refuses any override that would add a field beyond the enumerated set. Targeted at rcf-lite projects that must integrate with a specific EXTERNAL supervising system whose conventions drive the probe wire shape; not targeted at the self-supervised all-in-one observability case (observability-essentials owns that).
 

package/blueprints/observability-probe-endpoints/blueprint.json

@@ -1,7 +1,46 @@
 {
   "slug": "observability-probe-endpoints",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "category": "observability",
+  "elicits": [
+    {
+      "id": "probe-interface-profile",
+      "prompt": "Target integration profile: name of the external supervising system the probe surface serves. Recommended default kubernetes (ADR-1503); the enumerated set is kubernetes, loadBalancer, uptimeMonitor, systemd, dockerHealthcheck, reverseProxy; a project-authored custom:<name> resolves to a project-supplied profile object.",
+      "kind": "enum",
+      "options": [
+        "kubernetes",
+        "loadBalancer",
+        "uptimeMonitor",
+        "systemd",
+        "dockerHealthcheck",
+        "reverseProxy",
+        "custom"
+      ],
+      "default": "kubernetes"
+    },
+    {
+      "id": "probe-paths-override",
+      "prompt": "Per-profile probe path overrides (empty for the profile defaults: /live and /ready for kubernetes, /health for loadBalancer and reverseProxy, exec entry for dockerHealthcheck, systemd notify for systemd). JSON object keyed by profile name.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "probe-listener-separate-port",
+      "prompt": "Separate-port listener option for probe traffic isolation from user traffic (per ADR-1504). Recommended default fused (probes on the request-traffic listener); set an integer TCP port to bind probes on their own listener.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "kubernetes-startup-enabled",
+      "prompt": "Enable the optional Kubernetes startup path /startup (per ADR-1503). Recommended default off; on emits a three-path set /live, /ready, /startup and generates a startup handler.",
+      "kind": "enum",
+      "options": [
+        "off",
+        "on"
+      ],
+      "default": "off"
+    }
+  ],
   "contributions": [
     {
       "id": "observability-probe-endpoints-REQ-001",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-001.json

@@ -2,7 +2,11 @@
   "reqId": "observability-probe-endpoints-REQ-001",
   "prdId": "PRD-001",
   "title": "The health probe interface is derived from an operator-declared target integration",
-  "description": "The application exposes health probes shaped for the external system that will probe it. The operator declares a target integration by name (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, or a project-authored `custom` profile). The profile fixes the probe transport (HTTP GET, TCP socket accept, exec command, or a supervisor notify call), the probe path or command surface, the response contract, and the port topology defaults. A probe surface not backed by a declared profile is refused at boot with a stable-coded error naming the missing declaration. Nothing in the process wires a probe on its own initiative; the profile drives every binding.",
+  "description": "The application exposes health probes shaped for the external system that will probe it. The operator declares a target integration by name (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, or a project-authored `custom` profile). The profile fixes the probe transport (HTTP GET, TCP socket accept, exec command, or a supervisor notify call), the probe path or command surface, the response contract, and the port topology defaults. Precedence at boot: an explicit `probeInterface.profile` declaration wins; when the declaration is absent, the shipped Kubernetes default (ADR-1503) resolves and the process boots on that profile. A profile name that is neither in the enumerated set nor a resolvable `custom` profile is refused at boot with a stable-coded `PROBE_PROFILE_UNKNOWN` error naming the offending value; a `probeInterface` declaration that is syntactically malformed (a non-object, or an object missing required per-profile keys) is refused with `PROBE_PROFILE_MALFORMED` naming the offending shape. Nothing in the process wires a probe on its own initiative; the profile drives every binding.",
+  "deliveredBy": {
+    "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+    "field": "interfaces.resolveProbeProfile"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A default Kubernetes profile ships with liveness /live and readiness /ready served over HTTP GET",
   "description": "When the operator selects the `kubernetes` target integration (the shipped default), the profile wires two HTTP GET probe handlers: a liveness handler at path `/live` and a readiness handler at path `/ready`. Both handlers return HTTP 200 for pass and HTTP 503 for fail. The liveness handler answers strictly on in-process event-loop responsiveness and never depends on any external condition. The readiness handler answers on the operator-declared readiness predicate for the profile (default: strict-any-fail over the declared dependency set). Both paths and the port topology are overridable at boot; the defaults hold when the operator does not override.",
+  "deliveredBy": {
+    "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+    "field": "interfaces.profileLoader"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Each supported target integration profile names its own probe path, response contract, transport, and semantic distinction",
   "description": "Every profile the blueprint ships names four things: the probe path or command surface (an HTTP path for HTTP profiles, a TCP port for socket profiles, a shell command for exec profiles, a supervisor call for notify profiles); the response contract (HTTP status code range with an optional minimal JSON body for HTTP profiles, connect-and-close for TCP, exit-code zero for exec, one notify call for supervisor); the transport (HTTP GET, TCP SYN, spawned process, or unix socket for supervisor calls); and the semantic distinction between liveness and readiness (two endpoints for Kubernetes; one health signal for load balancers and uptime monitors that do not distinguish; a boot-time readiness notification followed by a periodic watchdog for systemd; a single command answer for Docker HEALTHCHECK). A profile that does not resolve all four is refused at boot with a stable-coded error naming the missing field.",
+  "deliveredBy": {
+    "tacId": "TAC-1502-observability-probe-endpoints-handler-set",
+    "field": "interfaces.buildHandlerSet"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A separate-port listener option is offered per HTTP profile for probe traffic isolation from user traffic",
   "description": "Every HTTP-transport profile offers a `probeListener.separatePort` option: when unset, probe handlers bind to the same listener that serves user request traffic (the fused topology); when set to a port number, probe handlers bind to a dedicated HTTP listener on that port and the user-traffic listener does not serve probe paths. The separate-port listener binds the profile's probe path set only; no other route is served on that listener. The option is off by default and opt-in per environment.",
+  "deliveredBy": {
+    "tacId": "TAC-1503-observability-probe-endpoints-listener-topology",
+    "field": "interfaces.bindListenerTopology"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The response contract exposed to the external supervisor matches only what that supervisor consumes",
   "description": "Every profile's response is exactly what the supervising system reads and nothing more. HTTP-transport profiles that consume status code only (load balancer, uptime monitor, reverse proxy) return an empty response body with the resolved status code. HTTP-transport profiles that consume a body (Kubernetes HTTPGet, where the kubelet ignores body but operators inspect it during triage) return a minimal JSON body of the shape `{ \"status\": \"pass\" }` or `{ \"status\": \"fail\" }` with no additional fields. TCP-transport profiles complete the SYN-ACK handshake on pass and refuse the connection on fail. Exec-transport profiles exit with code 0 on pass and a non-zero code on fail. Supervisor-notify profiles emit exactly the notify calls the supervisor expects (for systemd: `READY=1` at startup, `WATCHDOG=1` on the configured watchdog cadence).",
+  "deliveredBy": {
+    "tacId": "TAC-1502-observability-probe-endpoints-handler-set",
+    "field": "interfaces.buildHandlerSet"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "No internal identifier is exposed on any external-visible probe response",
   "description": "The probe response, on every profile that emits a response payload, contains no dependency name, no environment name (dev, staging, live), no hostname, no replica id, no database identifier, no queue name, no internal URL, no build hash, no commit sha, no numeric metric value, no dependency count, no latency measurement, no error rate. The response is bounded to the fields REQ-005 enumerates for the profile and to the resolved status code. A profile that adds any field beyond that set is refused by the profile validator at boot with a stable-coded error naming the offending field.",
+  "deliveredBy": {
+    "adrId": "ADR-1505-observability-probe-endpoints-external-response-secrecy",
+    "field": "decision.externalResponseSecrecy"
+  },
   "category": "security",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-007.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The probe paths are auth-exempt scoped exactly to the resolved probe path set on the resolved listener",
   "description": "For every HTTP-transport profile, the probe path set the profile resolved (e.g., `/live` and `/ready` for Kubernetes default) is exempt from the project's auth middleware on the listener the profile bound those handlers to. The exemption is scoped by exact path match and by listener, never by prefix. When the fused topology is in effect, the exemption applies on the user-traffic listener for those exact paths only; when the separate-port topology is in effect, the exemption applies on the separate probe listener for those exact paths only and no auth middleware runs on the separate listener because no other route is served there. A path near a probe path but not on the resolved set (e.g., `/ready/next` when `/ready` is the probe) receives the project's normal auth treatment.",
+  "deliveredBy": {
+    "tacId": "TAC-1503-observability-probe-endpoints-listener-topology",
+    "field": "interfaces.exemptListInstaller"
+  },
   "category": "security",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-008.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A change of target integration profile is a configuration change; the source tree does not re-shape",
   "description": "Switching the target integration from one profile to another (for example, moving a service from a Kubernetes deployment to a Docker Compose deployment behind a load balancer) is expressed as a change to the operator-declared profile name and its per-profile options. The source tree that binds the profile handlers and the profile-resolver call site do not change; the profile shift takes effect on the next process start. A source-tree change is required only when the operator authors a new custom profile or extends the shipped profile set; existing profiles are switched by configuration alone.",
+  "deliveredBy": {
+    "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+    "field": "interfaces.contractValidator"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",