rcf-lite 0.26.0 → 0.27.0

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35105.json

@@ -16,21 +16,31 @@
       "when": "the composition wire is walked in the source tree",
       "then": "the magic-link mint surface reads the Turnstile guard before invoking the mint",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-35105-2",
-      "description": "A live POST to /api/magic-link without a Cf-Turnstile-Response field, and a POST carrying the always-fail response token that fails siteverify, are both refused with 400 by the Turnstile guard and no magic-link mint side-effect is observable. The Playwright pack check magicLinkGuard drives this against the fixture with a real browser.",
+      "description": "A live POST to /api/magic-link without a cf-turnstile-response field, and a POST carrying the always-fail response token that fails siteverify, are both refused with 400 by the Turnstile guard and no magic-link mint side-effect is observable. The Playwright pack check magicLinkGuard drives this against the fixture with a real browser.",
       "given": "the pack fixture running with both blueprints applied and a real Playwright browser driving the fixture",
       "when": "a magic-link mint submit is issued without a Turnstile response, or with the always-fail response token",
       "then": "the Turnstile guard refuses with 400 and no magic-link mint side-effect is observable",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-3603-edge-cloudflare-turnstile-magic-link-hook",
+        "field": "responsibilities.guardMint"
+      },
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/get-started/server-side-validation/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3603-edge-cloudflare-turnstile-magic-link-hook"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-09T12:00:00.000Z"
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35106.json

@@ -11,17 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-35106-1",
-      "description": "The blueprint elicit widget-mode is enum with values managed, non-interactive, invisible; recommendedDefault managed per ADR-3602. The pack fixture accepts ?mode=<managed|non-interactive|invisible> and mounts the widget with the pinned invisible-widget test sitekeys (1x00000000000000000000BB, 2x00000000000000000000BB per https://developers.cloudflare.com/turnstile/troubleshooting/testing/). Each mode renders the Turnstile iframe from https://challenges.cloudflare.com and no other origin.",
+      "description": "The blueprint elicit widget-mode is enum with values managed, non-interactive, invisible; recommendedDefault managed per ADR-3602. The pack fixture accepts ?mode=<managed|non-interactive|invisible> and mounts the widget with the pinned invisible-widget test sitekeys (1x00000000000000000000BB, 2x00000000000000000000BB per https://developers.cloudflare.com/turnstile/troubleshooting/testing/). Each mode renders the Turnstile iframe from https://challenges.cloudflare.com and no other origin. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the pack fixture loaded with mode=managed, mode=non-interactive and mode=invisible respectively",
       "when": "each variant renders",
       "then": "each renders the Turnstile widget from Cloudflare Turnstile origin only and no third-party script is loaded",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/turnstile/troubleshooting/testing/",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-3601-edge-cloudflare-turnstile-widget-mount"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the widget-mode enum shape and its three-value coverage against the pinned Cloudflare test sitekeys. Per section 7a, this story carries a single AC because the enum-coverage mechanism has no additional documented failure path in the guide (a missing sitekey surfaces via US-35102 AC-35102-2, not via widget-mode)."
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35107.json

@@ -11,17 +11,19 @@
   "acceptanceCriteria": [
     {
       "id": "AC-35107-1",
-      "description": "A source-tree AST scan of the pack fixture (packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile) asserts that TURNSTILE_SECRET is read only via env-shaped identifiers (process.env.TURNSTILE_SECRET or an env facade) and that no plain-string secret literal appears in the fixture source; the Node probe secret-shape-scan implements the assertion and exits 0.",
+      "description": "A source-tree AST scan of the pack fixture (packages/rcf-lite/test/fixtures/probe-pack-edge-cloudflare-turnstile) asserts that TURNSTILE_SECRET is read only via env-shaped identifiers (process.env.TURNSTILE_SECRET or an env facade) and that no plain-string secret literal appears in the fixture source; the Node probe secret-shape-scan implements the assertion and exits 0. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the shipped pack fixture with the pinned test secrets sourced from environment",
       "when": "the source-tree AST scan runs over the fixture",
       "then": "the scan finds only env-shaped reads for TURNSTILE_SECRET and reports no plain-string secret literal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the secret-shape-scan probe (env-shaped reads only, no plain-string secret literal in the pack fixture source). Per section 7a, this story carries a single AC because the source-scan mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-turnstile/contributions/user-stories/edge-cloudflare-turnstile-us-35108.json

@@ -11,17 +11,19 @@
   "acceptanceCriteria": [
     {
       "id": "AC-35108-1",
-      "description": "The Node probe event-secrecy drives siteverify against Cloudflare with the pinned test keys and asserts every event record carries {sitekeyHash, outcome, timestamp} keys only; no record carries the token, no record carries the secret, and no forbidden substring is present in the serialised record.",
+      "description": "The Node probe event-secrecy drives siteverify against Cloudflare with the pinned test keys and asserts every event record carries {sitekeyHash, outcome, timestamp} keys only; no record carries the token, no record carries the secret, and no forbidden substring is present in the serialised record. Per section 7a, this AC is legal as the single AC on the story because the guide and the anchored TAC name no additional documented failure path for this mechanism (adjacent failure paths are owned by sibling stories on the same blueprint, not by this one).",
       "given": "the pack fixture running with the event-secrecy probe attached and the pinned test keys in the environment",
       "when": "the probe drives one pass and one fail through the verifier",
       "then": "every emitted event carries only sitekeyHash, outcome and timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-3602-edge-cloudflare-turnstile-server-verifier"
   ],
   "createdAt": "2026-09-07T20:00:00.000Z",
-  "updatedAt": "2026-09-07T20:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00.000Z",
+  "description": "Story owns the event-secrecy probe against Cloudflare siteverify with the pinned test keys (record carries {sitekeyHash, outcome, timestamp} only; no token or secret substring). Verifier-error record shapes are covered by US-35103; per section 7a, this story carries a single AC because the event-shape mechanism has no additional documented failure path in the guide or the anchored TAC."
 }

package/blueprints/edge-cloudflare-turnstile/probe-packs/edge-cloudflare-turnstile.pack.mjs

@@ -27,7 +27,7 @@ export default {
     {
       id: 'AC-turnstile-widgetRendered',
       severity: 'block',
-      description: 'Turnstile client widget mounts with the pinned always-pass sitekey; the mount injects Cloudflare Turnstile JS from the Cloudflare Turnstile origin only, populates the Cf-Turnstile-Response token input, and no third-party script from any other origin is loaded on the page.',
+      description: 'Turnstile client widget mounts with the pinned always-pass sitekey; the mount injects Cloudflare Turnstile JS from the Cloudflare Turnstile origin only, populates the cf-turnstile-response token input, and no third-party script from any other origin is loaded on the page.',
       run: async ({ browser, runtimeUrl }) => {
         if (!browser) return { verdict: 'fail', detail: 'no packBrowser wired' };
         await browser.goto(withUrl(runtimeUrl, '/?sitekey=pass'));
@@ -114,9 +114,23 @@ export default {
     {
       id: 'AC-turnstile-magicLinkGuard',
       severity: 'block',
-      description: 'Magic-link mint route composed with the Turnstile guard refuses a mint submit without a Turnstile response with 400 and refusal errorCode=turnstile.token-missing; no magic-link mint side-effect.',
+      description: 'Magic-link mint route composed with the Turnstile guard refuses a mint submit without a Turnstile response with 400 and refusal errorCode=turnstile.token-missing; the fixture event sink at /api/events records a mint-outcome count of zero after both refusals so the positive evidence proves no magic-link mint side-effect landed.',
       run: async ({ browser, runtimeUrl }) => {
-        // Two probes: (a) missing token refuse (400), (b) fail-secret refuse (400).
+        // Positive-evidence: capture a pre-mint outcome count from the fixture event
+        // sink, then two probes: (a) missing token refuse (400), (b) fail-secret refuse
+        // (400). The pass branch requires both refusals observed AND the mint-outcome
+        // delta (pre vs post) to be exactly zero on /api/events; the observed delta is
+        // included in the positive-evidence detail.
+        async function mintOutcomeCount() {
+          const eventsResp = await fetch(withUrl(runtimeUrl, '/api/events'));
+          if (!eventsResp.ok) return null;
+          try {
+            const list = await eventsResp.json();
+            if (!Array.isArray(list)) return null;
+            return list.filter((e) => e && e.outcome === 'minted').length;
+          } catch { return null; }
+        }
+        const mintedPre = await mintOutcomeCount();
         const missingBody = new URLSearchParams();
         missingBody.set('email', 'reviewer@example.com');
         missingBody.set('turnstile-sitekey', '1x00000000000000000000AA');
@@ -138,8 +152,16 @@ export default {
         let failJson = null; try { failJson = JSON.parse(failText); } catch {}
         const failOk = failResp.status === 400 && failJson && failJson.errorCode === 'turnstile.siteverify-failed';
 
-        if (missingOk && failOk) return { verdict: 'pass', detail: `magic-link guard: missing-token refused 400 turnstile.token-missing; fail-secret refused 400 turnstile.siteverify-failed errorCodes=${JSON.stringify(failJson.errorCodes)}` };
-        return { verdict: 'fail', detail: `magic-link guard unexpected: missing status=${missingResp.status} body=${missingText}; fail status=${failResp.status} body=${failText}` };
+        const mintedPost = await mintOutcomeCount();
+        const delta = (mintedPre == null || mintedPost == null) ? null : mintedPost - mintedPre;
+        const deltaZero = delta === 0;
+        if (missingOk && failOk && deltaZero) {
+          return { verdict: 'pass', detail: `magic-link guard: missing-token refused 400 turnstile.token-missing; fail-secret refused 400 turnstile.siteverify-failed errorCodes=${JSON.stringify(failJson.errorCodes)}; mint-outcome delta on /api/events pre=${mintedPre} post=${mintedPost} delta=0 (no mint side-effect landed)` };
+        }
+        if (missingOk && failOk && !deltaZero) {
+          return { verdict: 'fail', detail: `magic-link guard: both refusals observed but mint-outcome delta is not zero on /api/events (pre=${mintedPre} post=${mintedPost} delta=${delta}); a mint side-effect landed while the guard should have refused, or the fixture sink could not be read` };
+        }
+        return { verdict: 'fail', detail: `magic-link guard unexpected: missing status=${missingResp.status} body=${missingText}; fail status=${failResp.status} body=${failText}; mint-outcome pre=${mintedPre} post=${mintedPost} delta=${delta}` };
       },
     },
   ],

package/blueprints/email-smtp-resend/CHANGELOG.md

@@ -0,0 +1,24 @@
+# email-smtp-resend CHANGELOG
+
+## 1.1.3 - 2026-09-10
+
+Second closure fix on the dimension-d ownership sweep for REQ-001: removed the send-signature and outcome-field restatements from `AC-4101-2` (description and then-clause), `AC-4102-1` (description and then-clause), and the guide's "What a good outcome looks like" bullets; each surface now references the outcome record owned on `TAC-401-email-smtp-resend-send-adapter.interfaces.send` and, where relevant, the classification owned on `responsibilities[3]`. US-4101 and US-4102 patch-bumped. Chain-consistency lint zero on pass 1 and pass 2. Third-pass residues cleared without a further bump: the AC-4101-2 and AC-4102-1 when-clauses now reference the send interface owned on `TAC-401-email-smtp-resend-send-adapter.interfaces.send` instead of restating the `adapter.send(...)` signature.
+
+## 1.1.2 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-001: REQ description now references the send-adapter interface signature and outcome shape owned on TAC-401.interfaces.send rather than restating the send arguments and outcome fields. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 1.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.1.0 (hardening pass, 2026-09-09)
+
+- Adds `elicits[]` with six apply-time answers: `smtp-host-ref`, `smtp-username-ref`, `smtp-password-ref`, `verified-sender-ref` (string placeholder references the send adapter resolves at boot per REQ-002), `webhook-signing-secret-ref` (string placeholder reference the WEBHOOK VERIFIER resolves per REQ-005 - owned by TAC-402, not TAC-401), `replay-tolerance-ms` (string milliseconds, default 300000; REQ-006).
+- Adds `deliveredBy` to every REQ (REQ-001/003/004 -> TAC-401 interfaces; REQ-002 -> TAC-401.interfaces.secretResolver; REQ-005 -> TAC-402.interfaces.verify; REQ-006 -> TAC-402.interfaces.eventIdStore). Closes 3 pass-2 lint findings.
+- Closes F-3 chain-contradiction specimen (webhook secret ownership): AC-4106-2 rewritten to name only the three SMTP references plus the verified-sender-address (owned by TAC-401.responsibilities[8]); AC-4106-3 added asserting the webhook signing secret is resolved by TAC-402 and does not appear in the send adapter's source.
+- Closes F-1 (transport class retry not asserted): adds AC-4103-4 (transient transport failure ECONNRESET succeeds on retry with the returned envelope id) and AC-4103-5 (exhausted retry -> RESEND_TRANSPORT_ERROR naming the class and attempt count).
+- Closes F-2 (backoff delay range not asserted): adds AC-4103-6 with a deterministic jitter source and clock, asserting scheduled delay under exponential full-jitter caps within [0, 250] for the first retry at the ADR-402 baseline; no delay negative, no delay above the 8000ms cap.
+- Closes F-4 (TTL expiry not asserted): adds AC-4105-3 asserting the eventIdStore `putIfAbsentWithExpiry` receives expiryMs equal to the configured replay tolerance window; a re-post inside the window is refused as duplicate, a re-post after the window expires is accepted.
+- Re-sweeps every existing AC's `disposition` per section 7b: ACs referencing placeholder references and the tolerance window flipped to `template` with `templateFillIns`; the remaining ACs stay `fixed`.
+- Review fix pass (F-4): adds `secretResolver` interface entry to TAC-402 (mirrors the TAC-401 shape) naming the boot-time secret-reference resolver the webhook verifier consumes; corrects TAC-402.responsibilities[5] cross-reference from AC-4106-2 to AC-4106-3 (the F-3 closure split webhook-secret ownership off from the SMTP-secrets AC and the responsibility trailer still cited the older AC); updates AC-4106-3.ownerRef from `TAC-402.interfaces.verify` to `TAC-402.interfaces.secretResolver` so the ownership pointer names the actual secret-resolution interface.

package/blueprints/email-smtp-resend/README.md

@@ -1,4 +1,4 @@
-# Email SMTP Resend blueprint (v1.0.0)
+# Email SMTP Resend blueprint (v1.1.0)
 
 The ninth content blueprint on the rcf-build-lite blueprint mechanism. Scope: a Resend-backed mail-adapter that fills the magic-link blueprint's `TAC-504-security-auth-magic-link-email-delivery-adapter` slot as a shipped default. Transport is Resend's SMTP submission endpoint (keeps the adapter close to a generic SMTP shape a follow-up `email-smtp-<othervendor>` blueprint can sibling cleanly). Vendor default is Resend; the mail-adapter contract itself lives on the magic-link blueprint and remains vendor-neutral. Ships two TACs (send adapter, delivery-webhook verifier), no scope:global ADRs.
 
@@ -38,7 +38,7 @@ This blueprint contributes no `scope: "global"` ADR topics on purpose. The mail-
 
 ## Quality bar
 
-One `send({ to, subject, textBody, htmlBody })` method as the sole auth-facing surface; the fixed outcome shape `{ ok, providerStatus, providerMessageId, error }` on every call; exactly one SMTP submission per adapter call on the successful path; four-class error taxonomy (`RESEND_RATE_LIMITED`, `RESEND_SENDER_UNVERIFIED`, `RESEND_RECIPIENT_REJECTED`, `RESEND_TRANSPORT_ERROR`) surfaced on the `error` field with no recipient identity leaked; bounded jittered retry on transient classes and immediate return on terminal classes; webhook signature verification against the configured signing secret with constant-time comparison; HTTP 401 empty-body refusal on mismatch with a `webhookVerificationFailed` audit; stale-timestamp refusal against the configured tolerance window with a `webhookReplayStale` audit; duplicate-event-id refusal against a bounded event-id store with a `webhookReplayDuplicate` audit and HTTP 200 acknowledgement; the SMTP client library imported from exactly one module (the adapter); no literal SMTP credential, sender address, or signing secret in adapter source. Every bar is carried by ACs in the doc set, not by this README.
+One send method owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send as the sole auth-facing surface; that interface's outcome fields on every call; exactly one SMTP submission per adapter call on the successful path; four-class error taxonomy (`RESEND_RATE_LIMITED`, `RESEND_SENDER_UNVERIFIED`, `RESEND_RECIPIENT_REJECTED`, `RESEND_TRANSPORT_ERROR`) surfaced on the `error` field with no recipient identity leaked; bounded jittered retry on transient classes and immediate return on terminal classes; webhook signature verification against the configured signing secret with constant-time comparison; HTTP 401 empty-body refusal on mismatch with a `webhookVerificationFailed` audit; stale-timestamp refusal against the configured tolerance window with a `webhookReplayStale` audit; duplicate-event-id refusal against a bounded event-id store with a `webhookReplayDuplicate` audit and HTTP 200 acknowledgement; the SMTP client library imported from exactly one module (the adapter); no literal SMTP credential, sender address, or signing secret in adapter source. Every bar is carried by ACs in the doc set, not by this README.
 
 ## Known mechanism-reach gaps
 

package/blueprints/email-smtp-resend/assets/stub-adapter.md

@@ -4,6 +4,8 @@ TAC-401 names a stub-adapter implementation the project wires into its test harn
 
 ## Interface satisfied
 
+Owner: `TAC-401-email-smtp-resend-send-adapter.interfaces.send` names the shape below; this sample demonstrates the call surface.
+
 ```
 send({ to, subject, textBody, htmlBody })
   -> Promise<{ ok, providerStatus, providerMessageId, error }>

package/blueprints/email-smtp-resend/blueprint.json

@@ -1,23 +1,125 @@
 {
   "slug": "email-smtp-resend",
-  "version": "1.0.0",
+  "version": "1.1.3",
   "category": "email",
+  "elicits": [
+    {
+      "id": "smtp-host-ref",
+      "prompt": "Placeholder reference name the send adapter resolves at boot for the Resend SMTP host (per REQ-002). Recommended default RESEND_SMTP_HOST; the value itself is never literal in source.",
+      "kind": "string",
+      "default": "RESEND_SMTP_HOST"
+    },
+    {
+      "id": "smtp-username-ref",
+      "prompt": "Placeholder reference name for the SMTP username (per REQ-002). Recommended default RESEND_SMTP_USERNAME.",
+      "kind": "string",
+      "default": "RESEND_SMTP_USERNAME"
+    },
+    {
+      "id": "smtp-password-ref",
+      "prompt": "Placeholder reference name for the SMTP password (per REQ-002). Recommended default RESEND_SMTP_PASSWORD.",
+      "kind": "string",
+      "default": "RESEND_SMTP_PASSWORD"
+    },
+    {
+      "id": "verified-sender-ref",
+      "prompt": "Placeholder reference name for the verified sender address (per REQ-002). Recommended default RESEND_VERIFIED_SENDER_ADDRESS.",
+      "kind": "string",
+      "default": "RESEND_VERIFIED_SENDER_ADDRESS"
+    },
+    {
+      "id": "webhook-signing-secret-ref",
+      "prompt": "Placeholder reference name the webhook verifier resolves at boot for the Resend delivery-webhook signing secret (per REQ-005). Owned by TAC-402, not TAC-401. Recommended default RESEND_WEBHOOK_SIGNING_SECRET.",
+      "kind": "string",
+      "default": "RESEND_WEBHOOK_SIGNING_SECRET"
+    },
+    {
+      "id": "replay-tolerance-ms",
+      "prompt": "Replay tolerance window in milliseconds for webhook event id de-duplication (per REQ-006). Recommended default 300000 (5 minutes).",
+      "kind": "string",
+      "default": "300000"
+    }
+  ],
   "contributions": [
-    { "id": "email-smtp-resend-REQ-001", "kind": "req", "path": "requirements/email-smtp-resend-req-001.json" },
-    { "id": "email-smtp-resend-REQ-002", "kind": "req", "path": "requirements/email-smtp-resend-req-002.json" },
-    { "id": "email-smtp-resend-REQ-003", "kind": "req", "path": "requirements/email-smtp-resend-req-003.json" },
-    { "id": "email-smtp-resend-REQ-004", "kind": "req", "path": "requirements/email-smtp-resend-req-004.json" },
-    { "id": "email-smtp-resend-REQ-005", "kind": "req", "path": "requirements/email-smtp-resend-req-005.json" },
-    { "id": "email-smtp-resend-REQ-006", "kind": "req", "path": "requirements/email-smtp-resend-req-006.json" },
-    { "id": "email-smtp-resend-US-4101", "kind": "us", "path": "user-stories/email-smtp-resend-us-4101.json" },
-    { "id": "email-smtp-resend-US-4102", "kind": "us", "path": "user-stories/email-smtp-resend-us-4102.json" },
-    { "id": "email-smtp-resend-US-4103", "kind": "us", "path": "user-stories/email-smtp-resend-us-4103.json" },
-    { "id": "email-smtp-resend-US-4104", "kind": "us", "path": "user-stories/email-smtp-resend-us-4104.json" },
-    { "id": "email-smtp-resend-US-4105", "kind": "us", "path": "user-stories/email-smtp-resend-us-4105.json" },
-    { "id": "email-smtp-resend-US-4106", "kind": "us", "path": "user-stories/email-smtp-resend-us-4106.json" },
-    { "id": "TAC-401-email-smtp-resend-send-adapter", "kind": "tac", "path": "tacs/tac-401-email-smtp-resend-send-adapter.json" },
-    { "id": "TAC-402-email-smtp-resend-webhook-verifier", "kind": "tac", "path": "tacs/tac-402-email-smtp-resend-webhook-verifier.json" },
-    { "id": "ADR-401-email-smtp-resend-transport-choice", "kind": "adr", "path": "adrs/adr-401-email-smtp-resend-transport-choice.json" },
-    { "id": "ADR-402-email-smtp-resend-retry-and-backoff-posture", "kind": "adr", "path": "adrs/adr-402-email-smtp-resend-retry-and-backoff-posture.json" }
+    {
+      "id": "email-smtp-resend-REQ-001",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-001.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-002",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-002.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-003",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-003.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-004",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-004.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-005",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-005.json"
+    },
+    {
+      "id": "email-smtp-resend-REQ-006",
+      "kind": "req",
+      "path": "requirements/email-smtp-resend-req-006.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4101",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4101.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4102",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4102.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4103",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4103.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4104",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4104.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4105",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4105.json"
+    },
+    {
+      "id": "email-smtp-resend-US-4106",
+      "kind": "us",
+      "path": "user-stories/email-smtp-resend-us-4106.json"
+    },
+    {
+      "id": "TAC-401-email-smtp-resend-send-adapter",
+      "kind": "tac",
+      "path": "tacs/tac-401-email-smtp-resend-send-adapter.json"
+    },
+    {
+      "id": "TAC-402-email-smtp-resend-webhook-verifier",
+      "kind": "tac",
+      "path": "tacs/tac-402-email-smtp-resend-webhook-verifier.json"
+    },
+    {
+      "id": "ADR-401-email-smtp-resend-transport-choice",
+      "kind": "adr",
+      "path": "adrs/adr-401-email-smtp-resend-transport-choice.json"
+    },
+    {
+      "id": "ADR-402-email-smtp-resend-retry-and-backoff-posture",
+      "kind": "adr",
+      "path": "adrs/adr-402-email-smtp-resend-retry-and-backoff-posture.json"
+    }
   ]
 }

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-001.json

@@ -2,7 +2,11 @@
   "reqId": "email-smtp-resend-REQ-001",
   "prdId": "PRD-001",
   "title": "The adapter satisfies the mail-adapter interface named by the shipped magic-link blueprint's TAC-504",
-  "description": "The Resend send adapter exposes exactly the `send({ to, subject, textBody, htmlBody })` method the magic-link blueprint's `TAC-504-security-auth-magic-link-email-delivery-adapter` names, and resolves the fixed outcome shape `{ ok, providerStatus, providerMessageId, error }` on every call. No other method is added to the auth-facing surface; provider status codes and provider message ids are normalised into the four declared fields inside the adapter. A project composing this blueprint alongside the magic-link blueprint wires the adapter reference into the auth routes at composition time and calls `adapter.send` directly.",
+  "description": "The Resend send adapter exposes the send interface named by the magic-link blueprint's TAC-504-security-auth-magic-link-email-delivery-adapter, matching the signature owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send, and resolves the fixed outcome shape declared on that same owner on every call. No other method is added to the auth-facing surface; provider status codes and provider message ids are normalised into the declared outcome fields inside the adapter. A project composing this blueprint alongside the magic-link blueprint wires the adapter reference into the auth routes at composition time and calls the adapter send method directly.",
+  "deliveredBy": {
+    "tacId": "TAC-401-email-smtp-resend-send-adapter",
+    "field": "interfaces.send"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:email-smtp-resend",
     "category:01-mail-adapter-contract"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Transport is Resend's SMTP endpoint, credentialed from placeholder-referenced secrets and a placeholder-referenced verified sender address",
   "description": "The adapter dials Resend's SMTP submission endpoint (host and port declared as configuration references, not literal in-code strings) and authenticates with an SMTP username and an SMTP password sourced from a Secrets Manager slice. The from-address on every outgoing message is a project-configured verified sender address, also sourced from configuration rather than a literal. Three configuration references are named by the adapter: `RESEND_SMTP_USER`, `RESEND_SMTP_PASSWORD`, and `RESEND_FROM_ADDRESS`. The names are references only; the values live in the vendor the project's Secrets Manager resolves against. No SMTP credential, no signing secret, and no real sender domain is ever committed to the repo or embedded in the adapter's code paths.",
+  "deliveredBy": {
+    "tacId": "TAC-401-email-smtp-resend-send-adapter",
+    "field": "interfaces.secretResolver"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Provider-side failure modes are enumerated and each maps to a stable-coded error the adapter returns without leaking recipient identity",
   "description": "The adapter enumerates four provider-side failure classes and maps each to a stable error code on the `error` field of the send-contract return shape, with `ok: false` and the provider's own status code on `providerStatus` when the provider surfaced one. The classes are: rate-limit refusal (`RESEND_RATE_LIMITED`), unverified sender domain or address (`RESEND_SENDER_UNVERIFIED`), invalid or malformed recipient input the provider rejected before dispatch (`RESEND_RECIPIENT_REJECTED`), and generic transport error covering network faults and the provider's 5xx range (`RESEND_TRANSPORT_ERROR`). The error string carries the class code and a short structured reason; the recipient address, the message subject, and the message body never appear on the returned error string, on any log line the adapter writes, or on any exception the adapter throws.",
+  "deliveredBy": {
+    "tacId": "TAC-401-email-smtp-resend-send-adapter",
+    "field": "interfaces.send"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Retry-and-backoff posture is bounded, jittered, and refuses to loop on a rejection the provider has already classified as terminal",
   "description": "On a `RESEND_TRANSPORT_ERROR` or a `RESEND_RATE_LIMITED` return, the adapter retries up to a bounded budget (default 2 retries, project-configurable via a numeric configuration reference; total attempts including the first are therefore at most 3) with exponential backoff and full jitter (base 250ms, cap 8000ms). On `RESEND_SENDER_UNVERIFIED` and `RESEND_RECIPIENT_REJECTED` the adapter does not retry: the provider classified the request as terminally invalid and looping wastes budget and risks a rate-limit escalation. After exhausting the retry budget the adapter returns `{ ok: false, ... }` with the last-observed provider status and the class code that caused the exhaustion; the caller sees one adapter return, not a retry storm.",
+  "deliveredBy": {
+    "tacId": "TAC-401-email-smtp-resend-send-adapter",
+    "field": "interfaces.retryClock"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Delivery events posted by Resend's webhook are signature-verified and refused when verification fails",
   "description": "The project exposes one HTTP route the Resend webhook posts delivery events to. The webhook verifier reads the incoming request's signature header (name declared as a configuration reference), reads the timestamp header (name declared as a configuration reference), and computes the expected signature using the webhook signing secret sourced from configuration (`RESEND_WEBHOOK_SIGNING_SECRET` placeholder reference). The verifier compares the computed signature against the header using a constant-time comparison. On mismatch the verifier returns HTTP 401 with an empty body and emits a structured `webhookVerificationFailed` audit event; the delivery event is not delivered to any downstream handler. The signing secret never appears on any log line, error string, or exception message. The header names, the signing algorithm identifier, and the timestamp-tolerance window are configuration references, not literals baked into the verifier.",
+  "deliveredBy": {
+    "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
+    "field": "interfaces.verify"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/requirements/email-smtp-resend-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The webhook verifier refuses replayed events by rejecting stale timestamps and refusing already-seen delivery ids inside a bounded window",
   "description": "The verifier reads the webhook timestamp header and refuses any request whose timestamp is older than the configured tolerance window (default 300 seconds, project-configurable via a numeric configuration reference); a refused request returns HTTP 401 with an empty body and emits a `webhookReplayStale` audit event. On a verification-passing request, the verifier extracts the provider's delivery event id from the payload and consults a bounded event-id store (a stateful component the project realises: an in-memory LRU sized to the tolerance window's expected event volume, or a persisted store with a matching TTL); an event id that already appears in the store is refused with HTTP 200 (idempotent replay acknowledged, no downstream side effect), and emits a `webhookReplayDuplicate` audit event. New event ids are recorded in the store with an expiry equal to the tolerance window.",
+  "deliveredBy": {
+    "tacId": "TAC-402-email-smtp-resend-webhook-verifier",
+    "field": "interfaces.eventIdStore"
+  },
   "category": "functional",
   "domain": "email",
   "priority": "must",

package/blueprints/email-smtp-resend/contributions/tacs/tac-401-email-smtp-resend-send-adapter.json

@@ -5,10 +5,10 @@
   "version": "1.0.0",
   "status": "approved",
   "name": "Resend SMTP send adapter",
-  "purpose": "The one module in the project that submits outbound mail to Resend's SMTP endpoint. Satisfies the `send({ to, subject, textBody, htmlBody }) -> Promise<{ ok, providerStatus, providerMessageId, error }>` interface named by the magic-link blueprint's `TAC-504-security-auth-magic-link-email-delivery-adapter`. Normalises provider-specific status codes and error prose into the four declared fields, applies the bounded jittered retry posture named by ADR-402, and sources every credential and the from-address through configured references rather than embedded literals. Every module that hands mail to the provider imports this adapter; nothing else imports the SMTP client library or reaches around the interface.",
+  "purpose": "The one module in the project that submits outbound mail to Resend's SMTP endpoint. Satisfies the send interface owned on interfaces.send below, shape-compatible with the magic-link blueprint's TAC-504-security-auth-magic-link-email-delivery-adapter. Normalises provider-specific status codes and error prose into the outcome fields owned on interfaces.send, applies the bounded jittered retry posture named by ADR-402, and sources every credential and the from-address through configured references rather than embedded literals. Every module that hands mail to the provider imports this adapter; nothing else imports the SMTP client library or reaches around the interface.",
   "responsibilities": [
-    "Expose `send({ to, subject, textBody, htmlBody })` as the sole auth-facing method and no other public method matching that shape (AC-4101-1).",
-    "Return `{ ok, providerStatus, providerMessageId, error }` on every call; on success `ok === true`, `providerStatus` the provider's accepted-status integer, `providerMessageId` the provider's returned identifier, `error === null` (AC-4101-2).",
+    "Expose the send method owned on interfaces.send below as the sole auth-facing surface and no other public method matching that shape (AC-4101-1).",
+    "Return the outcome fields owned on interfaces.send below on every call; on success the ok field is true, the providerStatus field carries the provider's accepted-status integer, the providerMessageId field carries the provider's returned identifier, and the error field is null (AC-4101-2).",
     "Dispatch exactly one SMTP submission per adapter call on the successful path (AC-4101-3).",
     "Classify every non-success provider response into `RESEND_RATE_LIMITED`, `RESEND_SENDER_UNVERIFIED`, `RESEND_RECIPIENT_REJECTED`, or `RESEND_TRANSPORT_ERROR` and place the code at the start of the `error` string; carry the provider's own status code on `providerStatus` when the provider surfaced one (AC-4102-1, AC-4103-2).",
     "Suppress recipient address, subject, and body from the `error` string, every log line the adapter writes for the call, and every exception the adapter throws for the call (AC-4102-2).",

package/blueprints/email-smtp-resend/contributions/tacs/tac-402-email-smtp-resend-webhook-verifier.json

@@ -12,7 +12,7 @@
     "Suppress the signing secret from the response body, from every log line the verifier writes for the call, and from every exception the verifier throws for the call (AC-4104-3).",
     "Refuse a webhook whose timestamp header is older than the configured tolerance window (default 300 seconds) with HTTP 401, empty body, no handler invocation, and one `webhookReplayStale` audit event (AC-4105-1).",
     "On a signature-passing request, read the provider's delivery event id from the payload and consult the bounded event-id store; refuse a duplicate with HTTP 200, no handler invocation, and one `webhookReplayDuplicate` audit event; record a new id with an expiry equal to the tolerance window (AC-4105-2).",
-    "Resolve `RESEND_WEBHOOK_SIGNING_SECRET`, the signature header name, the timestamp header name, the signing algorithm identifier, and the tolerance window at boot through the project's configured resolver; carry no literal for the signing secret in verifier source (AC-4106-2)."
+    "Resolve `RESEND_WEBHOOK_SIGNING_SECRET`, the signature header name, the timestamp header name, the signing algorithm identifier, and the tolerance window at boot through the project's configured resolver; carry no literal for the signing secret in verifier source (AC-4106-3)."
   ],
   "internalStructure": "One stateless verifier per process, constructed at boot with an injected signature-computation function (a project-selected HMAC implementation matching the configured algorithm identifier), an injected event-id store (an in-memory LRU sized to the tolerance window or a project-authored persistent store with a matching TTL, satisfying the same put-if-absent-with-expiry interface), an injected audit sink, and an injected clock the tolerance check consults. The route handler is a thin adapter over the verifier: the verifier is the thing under test, the route wiring is not.",
   "interfaces": [
@@ -35,6 +35,11 @@
       "name": "verifierClock",
       "kind": "read-api",
       "description": "Project-supplied clock the tolerance check consults; a real clock in production, a test double in unit tests. Injected at boot; deterministic under test."
+    },
+    {
+      "name": "secretResolver",
+      "kind": "read-api",
+      "description": "Project-supplied secret-reference resolver. The verifier reads the webhook signing secret (`RESEND_WEBHOOK_SIGNING_SECRET`), the signature header name, the timestamp header name, the signing algorithm identifier, and the tolerance window through it at boot; carries no literal for the signing secret in verifier source (AC-4106-3). The resolver shape matches the resolver TAC-401 consumes for the SMTP secrets, so a project realises one resolver for both TACs."
     }
   ],
   "dependencies": [
@@ -52,5 +57,5 @@
   ],
   "tradeoffs": "The event-id store is a stateful component the project realises; an in-memory LRU sized to the tolerance window is cheap and defends the replay class the tolerance window bounds, but does not defend cross-process replay in a horizontally-scaled deployment. Projects running multiple webhook-consuming processes supply a shared store (a small Redis, a small database table) implementing the same put-if-absent-with-expiry interface. The constant-time comparison assumes a comparison function that itself runs in constant time over the byte length of the expected signature; a project that provides a naive comparison re-opens the timing side channel the verifier is closing.",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/email-smtp-resend/contributions/user-stories/email-smtp-resend-us-4101.json

@@ -2,7 +2,7 @@
   "usId": "email-smtp-resend-US-4101",
   "prdId": "PRD-001",
   "reqId": "email-smtp-resend-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "The magic-link route hands a composed sign-in URL to the adapter and the adapter dispatches one message",
   "asA": "operator using a project that composed this blueprint alongside the magic-link blueprint",
@@ -11,21 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-4101-1",
-      "description": "The adapter exposes exactly the `send({ to, subject, textBody, htmlBody })` method the magic-link blueprint's TAC-504 names and no other auth-facing method.",
+      "description": "The adapter exposes exactly the send method owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send (shape-compatible with the magic-link blueprint's TAC-504) as the sole auth-facing method.",
       "given": "the adapter module imported into a running process",
       "when": "the process enumerates the adapter's exported surface",
       "then": "the enumeration returns `send` as the sole async method and no other public method matches the auth-facing shape",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-4101-2",
-      "description": "A successful send resolves the fixed outcome shape `{ ok, providerStatus, providerMessageId, error }` with `ok: true`, `providerStatus` equal to the provider's own accepted-status code, `providerMessageId` equal to the provider's returned identifier, and `error` equal to null.",
+      "description": "A successful send resolves the outcome record owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send in its success shape (per that interface's contract).",
       "given": "a running project with valid configuration and a recipient the provider accepts",
-      "when": "the magic-link route calls `adapter.send({ to, subject, textBody, htmlBody })`",
-      "then": "the returned object matches the shape with `ok === true`, `providerStatus` a positive integer, `providerMessageId` a non-empty string, and `error === null`",
+      "when": "the magic-link route calls the adapter's send interface defined on `TAC-401-email-smtp-resend-send-adapter.interfaces.send`",
+      "then": "the returned object matches the success shape owned on TAC-401-email-smtp-resend-send-adapter.interfaces.send",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-401-email-smtp-resend-send-adapter",
+        "field": "interfaces.send"
+      }
     },
     {
       "id": "AC-4101-3",
@@ -34,7 +40,8 @@
       "when": "the magic-link route triggers one adapter send",
       "then": "the submission counter increments by exactly one and no additional submission is observed within the retry window",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [