rcf-lite 0.26.0 → 0.27.0

package/blueprints/object-storage-s3/blueprint.json

@@ -1,10 +1,14 @@
 {
   "slug": "object-storage-s3",
-  "version": "1.1.0",
+  "version": "1.2.2",
   "category": "object-storage",
-  "capabilities": ["objectStorage"],
+  "capabilities": [
+    "objectStorage"
+  ],
   "requiresAppliedCapabilities": {
-    "capabilities": ["secretsProvider"],
+    "capabilities": [
+      "secretsProvider"
+    ],
     "allowSkipFlag": "allow-no-secrets-yet",
     "refusalMessageId": "object-storage-s3-no-secrets"
   },
@@ -19,23 +23,91 @@
     }
   ],
   "contributions": [
-    { "id": "object-storage-s3-REQ-001", "kind": "req", "path": "requirements/object-storage-s3-req-001.json" },
-    { "id": "object-storage-s3-REQ-002", "kind": "req", "path": "requirements/object-storage-s3-req-002.json" },
-    { "id": "object-storage-s3-REQ-003", "kind": "req", "path": "requirements/object-storage-s3-req-003.json" },
-    { "id": "object-storage-s3-REQ-004", "kind": "req", "path": "requirements/object-storage-s3-req-004.json" },
-    { "id": "object-storage-s3-REQ-005", "kind": "req", "path": "requirements/object-storage-s3-req-005.json" },
-    { "id": "object-storage-s3-REQ-006", "kind": "req", "path": "requirements/object-storage-s3-req-006.json" },
-    { "id": "object-storage-s3-US-28101", "kind": "us", "path": "user-stories/object-storage-s3-us-28101.json" },
-    { "id": "object-storage-s3-US-28102", "kind": "us", "path": "user-stories/object-storage-s3-us-28102.json" },
-    { "id": "object-storage-s3-US-28103", "kind": "us", "path": "user-stories/object-storage-s3-us-28103.json" },
-    { "id": "object-storage-s3-US-28104", "kind": "us", "path": "user-stories/object-storage-s3-us-28104.json" },
-    { "id": "object-storage-s3-US-28105", "kind": "us", "path": "user-stories/object-storage-s3-us-28105.json" },
-    { "id": "object-storage-s3-US-28106", "kind": "us", "path": "user-stories/object-storage-s3-us-28106.json" },
-    { "id": "object-storage-s3-US-28107", "kind": "us", "path": "user-stories/object-storage-s3-us-28107.json" },
-    { "id": "object-storage-s3-US-28108", "kind": "us", "path": "user-stories/object-storage-s3-us-28108.json" },
-    { "id": "TAC-2901-object-storage-s3-facade", "kind": "tac", "path": "tacs/tac-2901-object-storage-s3-facade.json" },
-    { "id": "TAC-2902-object-storage-s3-multipart-uploader", "kind": "tac", "path": "tacs/tac-2902-object-storage-s3-multipart-uploader.json" },
-    { "id": "TAC-2903-object-storage-s3-event-sink", "kind": "tac", "path": "tacs/tac-2903-object-storage-s3-event-sink.json" },
+    {
+      "id": "object-storage-s3-REQ-001",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-001.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-002",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-002.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-003",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-003.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-004",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-004.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-005",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-005.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-006",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-006.json"
+    },
+    {
+      "id": "object-storage-s3-US-28101",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28101.json"
+    },
+    {
+      "id": "object-storage-s3-US-28102",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28102.json"
+    },
+    {
+      "id": "object-storage-s3-US-28103",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28103.json"
+    },
+    {
+      "id": "object-storage-s3-US-28104",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28104.json"
+    },
+    {
+      "id": "object-storage-s3-US-28105",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28105.json"
+    },
+    {
+      "id": "object-storage-s3-US-28106",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28106.json"
+    },
+    {
+      "id": "object-storage-s3-US-28107",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28107.json"
+    },
+    {
+      "id": "object-storage-s3-US-28108",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28108.json"
+    },
+    {
+      "id": "TAC-2901-object-storage-s3-facade",
+      "kind": "tac",
+      "path": "tacs/tac-2901-object-storage-s3-facade.json"
+    },
+    {
+      "id": "TAC-2902-object-storage-s3-multipart-uploader",
+      "kind": "tac",
+      "path": "tacs/tac-2902-object-storage-s3-multipart-uploader.json"
+    },
+    {
+      "id": "TAC-2903-object-storage-s3-event-sink",
+      "kind": "tac",
+      "path": "tacs/tac-2903-object-storage-s3-event-sink.json"
+    },
     {
       "id": "ADR-2901-object-storage-s3-adapter",
       "kind": "adr",
@@ -68,9 +140,21 @@
       "topic": "objectStorageContract",
       "standardsTraceClause": "AWS S3 API and Cloudflare R2 S3-compatibility notes"
     },
-    { "id": "object-storage-s3-REQ-101", "kind": "req", "path": "requirements/object-storage-s3-req-101.json" },
-    { "id": "object-storage-s3-US-28110", "kind": "us", "path": "user-stories/object-storage-s3-us-28110.json" },
-    { "id": "TAC-2904-object-storage-s3-hetzner-endpoint-helper", "kind": "tac", "path": "tacs/tac-2904-object-storage-s3-hetzner-endpoint-helper.json" },
+    {
+      "id": "object-storage-s3-REQ-101",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-101.json"
+    },
+    {
+      "id": "object-storage-s3-US-28110",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28110.json"
+    },
+    {
+      "id": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+      "kind": "tac",
+      "path": "tacs/tac-2904-object-storage-s3-hetzner-endpoint-helper.json"
+    },
     {
       "id": "ADR-2905-object-storage-s3-hetzner-object-storage-provider",
       "kind": "adr",
@@ -79,5 +163,52 @@
       "elicited": true,
       "standardsTraceClause": "Hetzner Object Storage S3 compatibility documented endpoint shape"
     }
+  ],
+  "elicits": [
+    {
+      "id": "s3-endpoint-url",
+      "prompt": "S3-compatible endpoint URL: an AWS S3 URL, a Cloudflare R2 URL, a MinIO URL, or any S3-compatible remote (including Hetzner Object Storage under the endpoint-shape helper). The facade opens the client against this at boot.",
+      "kind": "string",
+      "default": "https://s3.amazonaws.com"
+    },
+    {
+      "id": "s3-bucket-name",
+      "prompt": "Bucket name the facade opens against. The applied project asserts a real bucket at apply; the facade dereferences the elicited value once at boot.",
+      "kind": "string",
+      "default": "app-bucket"
+    },
+    {
+      "id": "s3-adapter",
+      "prompt": "S3 client adapter per ADR-2901. aws-sdk-client-s3 is the AWS SDK v3 client for Node targets; aws4fetch is the small SigV4 fetch adapter for Workers targets.",
+      "kind": "enum",
+      "options": [
+        "aws-sdk-client-s3",
+        "aws4fetch"
+      ],
+      "default": "aws-sdk-client-s3"
+    },
+    {
+      "id": "presigned-ttl-ceiling-seconds",
+      "prompt": "Ceiling on the TTL a presignGetUrl verb may accept, in seconds. Floor is 60 seconds; default cap is 3600 seconds; the shipped default TTL is 900 seconds per ADR-2902.",
+      "kind": "string",
+      "default": "3600"
+    },
+    {
+      "id": "multipart-threshold-bytes",
+      "prompt": "Payload size at or above which the put path switches to multipart-upload. Default 8388608 bytes (8 MiB) per ADR-2903.",
+      "kind": "string",
+      "default": "8388608"
+    },
+    {
+      "id": "hetzner-location-code",
+      "prompt": "Hetzner Object Storage location code per the Hetzner storage overview: fsn1 Falkenstein, hel1 Helsinki, nbg1 Nuremberg. Only meaningful when the endpoint composes through the Hetzner endpoint-shape helper (TAC-2904).",
+      "kind": "enum",
+      "options": [
+        "fsn1",
+        "hel1",
+        "nbg1"
+      ],
+      "default": "fsn1"
+    }
   ]
 }

package/blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs

@@ -22,7 +22,7 @@
  * module for its `accountBound` flag), the SDK-touching imports are
  * DYNAMIC and gated on the CI_HAS_HETZNER_OBJECT_STORAGE env var.
  *
- * Mutation-purity discipline (per HQ hard gate row 2026-09-08): this
+ * Mutation-purity discipline (per the operator estate hard gate row 2026-09-08): this
  * module reads NO SIMULATE_ variable. Every fixture-side mutation
  * hook (SIMULATE_HETZNER_ENDPOINT_MISSHAPEN,
  * SIMULATE_HETZNER_EVENT_LEAK) lives in

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-001",
   "prdId": "PRD-001",
   "title": "One facade module is the sole reader of the S3 client and opens on boot",
-  "description": "The application accesses object storage through a single facade module in the project's source tree that is the ONLY module in the tree that imports the S3 client (either @aws-sdk/client-s3 on Node targets or aws4fetch on Workers targets per ADR-2901). Every other module that touches object storage imports the facade and calls its named domain verbs; no other module holds the raw S3 client, an S3Client instance, or an aws4fetch AwsClient instance. On process boot, the facade opens the client against the elicited endpoint URL and bucket name, and once the first successful ready-check completes, emits a facadeReady lifecycle event carrying endpoint host and bucket name. The endpoint URL (a Cloudflare R2 URL, an AWS S3 URL, a MinIO URL, or any S3-compatible remote) and the bucket name are elicited at apply time.",
+  "description": "The application accesses object storage through a single facade module in the project's source tree that is the ONLY module in the tree that imports the S3 client (either @aws-sdk/client-s3 on Node targets or aws4fetch on Workers targets per ADR-2901). Every other module that touches object storage imports the facade and calls its named domain verbs; no other module holds the raw S3 client, an S3Client instance, or an aws4fetch AwsClient instance. On process boot, the facade opens the client against the elicited endpoint URL and bucket name, and once the first successful ready-check completes, emits a facadeReady lifecycle event carrying endpoint host and bucket name. The endpoint URL (a Cloudflare R2 URL, an AWS S3 URL, a MinIO URL, or any S3-compatible remote) and the bucket name are elicited at apply time. This blueprint declares the objectStorage applied capability at runtime: the facade module is the sole channel through which consumer code sees the S3-shaped store, and any downstream blueprint whose requiresAppliedCapabilities lists objectStorage is satisfied by an applied object-storage-s3 pinning the facade to its client and the elicited endpoint URL and bucket name. The s3-endpoint-url and s3-bucket-name are elicited at apply time and dereferenced once at boot. The s3-adapter is elicited between aws-sdk-client-s3 (AWS SDK v3 client for Node targets) and aws4fetch (small SigV4 fetch adapter for Workers targets). The presigned-ttl-ceiling-seconds is elicited within the ADR-2902 default cap.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "responsibilities.facade"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-002",
   "prdId": "PRD-001",
   "title": "Put, get, delete, list contract on typed keys",
-  "description": "The facade exposes named domain verbs (putObject, getObject, deleteObject, listObjects) that take a typed key (a project-defined key namespace, not a raw string on the public surface where a typed alternative fits), a content-type string on put, and return either the object body (get), a boolean success (put, delete), or a paginated key listing (list). Every read and write goes through the S3 client's public request surface; no facade verb accepts a raw request object or a general-purpose passthrough from consumer code. The put verb emits objectPut with key, size, contentType, timestamp; the delete verb emits objectDeleted with key, timestamp.",
+  "description": "The facade exposes named domain verbs (putObject, getObject, deleteObject, listObjects) that take a typed key (a project-defined key namespace, not a raw string on the public surface where a typed alternative fits), a content-type string on put, and return either the object body (get), a boolean success (put, delete), or a paginated key listing (list). Every read and write goes through the S3 client's public request surface; no facade verb accepts a raw request object or a general-purpose passthrough from consumer code. The put verb emits objectPut with key, size, contentType, timestamp; the delete verb emits objectDeleted with key, timestamp. Keys reach the facade as strings; the facade validates them at the boundary against a shipped key-shape check: reject empty keys, keys with a leading slash, keys that contain the literal traversal segments \"..\" or \"//\", and keys longer than 1024 bytes. The applying project may layer a stricter project-typed key on top of the string, but the facade's public verbs accept the shape-validated string as the primitive.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "responsibilities.crudVerbs"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "interfaces.store.verbs"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-004",
   "prdId": "PRD-001",
   "title": "Multipart-upload contract above an elicited threshold",
-  "description": "For payloads above the elicited threshold (default 8 MiB per ADR-2903), the facade's put path switches transparently to multipart-upload: initiate multipart upload, part-upload each chunk with a stable part number and returned ETag, complete-multipart-upload with the ordered part list. A part-upload failure aborts the in-flight upload (AbortMultipartUpload) before propagating the error; leaving an incomplete multipart upload behind is not the shipped path. On completion the objectPut lifecycle event fires with the final total size. Multipart re-upload semantics (per the R2 doc, a re-upload to the same part number replaces the previous with loss-on-fail) is a documented gotcha named in the README; the multipart-upload probe asserts an end-to-end round-trip of at least 10 MiB.",
+  "description": "For payloads above the elicited threshold (default 8 MiB per ADR-2903), the facade's put path switches transparently to multipart-upload: initiate multipart upload, part-upload each chunk with a stable part number and returned ETag, complete-multipart-upload with the ordered part list. A part-upload failure aborts the in-flight upload (AbortMultipartUpload) before propagating the error; leaving an incomplete multipart upload behind is not the shipped path. On completion the objectPut lifecycle event fires with the final total size. Multipart re-upload semantics (per the R2 doc, a re-upload to the same part number replaces the previous with loss-on-fail) is a documented gotcha named in the README; the multipart-upload probe asserts an end-to-end round-trip of at least 10 MiB. The multipart-threshold-bytes is elicited at apply time (default 8388608, 8 MiB, per ADR-2903); at or above the threshold the facade's put path switches to multipart-upload.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2902-object-storage-s3-multipart-uploader",
+    "field": "responsibilities.multipart"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-005",
   "prdId": "PRD-001",
   "title": "Lifecycle events at four moments with metadata-only fields",
-  "description": "The facade emits four lifecycle events on the injected event sink: facadeReady (endpoint host, bucket name, timestamp), objectPut (key, size, contentType, timestamp), objectDeleted (key, timestamp), presignedIssued (key, ttl, timestamp). No event record carries object body bytes, no body checksum, no user id fields beyond what appears in the key itself, no PII drawn from the object body, and no adapter internal state. The event sink is a synchronous callback the operator wires; the facade never invokes it with domain-row values or authentication tokens. TAC-2903 realises the event-sink contract; the event-secrecy probe asserts field-level whitelist compliance against a PII fixture.",
+  "description": "The facade emits four lifecycle events on the injected event sink: facadeReady (endpoint host, bucket name, ts), objectPut (key, size, contentType, ts), objectDeleted (key, ts), presignedIssued (key, ttl, ts). No event record carries object body bytes, no body checksum, no user id fields beyond what appears in the key itself, no PII drawn from the object body, and no adapter internal state. The event sink is a synchronous callback the operator wires; the facade never invokes it with domain-row values or authentication tokens. TAC-2903 realises the event-sink contract; the event-secrecy probe asserts field-level whitelist compliance against a PII fixture.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2903-object-storage-s3-event-sink",
+    "field": "responsibilities.lifecycle"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-006",
   "prdId": "PRD-001",
   "title": "Credential-pair discipline via security-secrets-management; refuses composition without",
-  "description": "The credential pair (accessKeyId, secretAccessKey) required to sign S3 requests is a secretRef value delegated to security-secrets-management: an opaque string agreed between object-storage-s3 and security-secrets-management naming the secret entry, never the credential value itself. The apply verb refuses composition on a project that has NOT applied security-secrets-management with exit code 3 and the stable message id object-storage-s3-no-secrets on stderr, per infra round 5 spec section 5.2 (Baz decision 6). The refusal names the required predecessor blueprint (security-secrets-management) and the override flag (--allow-no-secrets-yet). The override records a note on the applied blueprint's source.notes so rcf define validate can later flag the surface as not-yet-activated. The compose-test path checks the pair through the applied secrets facade before the object-store facade opens.",
+  "description": "The credential pair (accessKeyId, secretAccessKey) required to sign S3 requests is a secretRef value delegated to security-secrets-management: an opaque string agreed between object-storage-s3 and security-secrets-management naming the secret entry, never the credential value itself. The apply verb refuses composition on a project that has NOT applied security-secrets-management with exit code 3 and the stable message id object-storage-s3-no-secrets on stderr, per infra round 5 spec section 5.2 (maintainer decision). The refusal names the required predecessor blueprint (security-secrets-management) and the override flag (--allow-no-secrets-yet). The override records a note on the applied blueprint's source.notes so rcf define validate can later flag the surface as not-yet-activated. The compose-test path checks the pair through the applied secrets facade before the object-store facade opens. The facade factory accepts only the opaque secretRef and a resolver callback: the applying project passes an unresolved secretRef ({ id, provider }) plus a resolver that dereferences it inside the facade module. The factory refuses a plain { accessKeyId, secretAccessKey } object at the boundary; the resolver runs once per boot inside the module and never leaks the resolved pair beyond the S3 client construction call.",
   "category": "security",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "responsibilities.credential"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-101.json

@@ -14,5 +14,9 @@
   "version": "1.1.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+    "field": "responsibilities.composeEndpoint"
+  }
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28101.json

@@ -16,7 +16,8 @@
       "when": "the process boots and the facade's ready-check returns",
       "then": "a facadeReady event fires on the injected event sink with a payload containing endpointHost and bucketName, and the client is ready to accept verbs; the facade exposes named domain verbs and does not re-export the raw S3 client",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-28101-2",
@@ -25,10 +26,41 @@
       "when": "grep 'from \\'@aws-sdk/client-s3\\'' or 'from \\'aws4fetch\\'' walks the tree outside the facade directory",
       "then": "no match is found outside the facade directory; the facade's public surface exports named domain verbs only, no raw S3 client reference",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28101-3",
+      "description": "Facade refuses at boot when the elicited endpoint is unreachable. Given the elicited s3-endpoint-url resolves to a host the runner cannot reach (or refuses a ready-check inside the connection timeout), when the facade opens on boot, then the facade refuses with a named error kind (endpointUnreachable) carrying the endpoint host but no credential material, and facadeReady does not fire.",
+      "given": "s3-endpoint-url resolves to an unreachable host or times out on ready-check",
+      "when": "the facade opens on boot",
+      "then": "the facade refuses with endpointUnreachable carrying host but no credentials; facadeReady does not fire",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.createObjectStore"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28101-4",
+      "description": "S3 adapter aws-sdk-client-s3. Given the elicited s3-adapter answers aws-sdk-client-s3, when the facade opens on process boot, then the facade constructs one `new S3Client(...)` from @aws-sdk/client-s3 v3 and the outbound HeadBucket request carries the SDK's default User-Agent header of shape `aws-sdk-js/<version> ...` (grep on the client's user-agent middleware output confirms the aws-sdk-js prefix); the aws4fetch package is NOT present in the facade module's imports; a grep across the applied source refuses any import of aws4fetch outside the facade.",
+      "given": "s3-adapter = aws-sdk-client-s3",
+      "when": "the facade opens on boot and issues its first HeadBucket ready-check",
+      "then": "the facade constructs one S3Client from @aws-sdk/client-s3 v3 and the outbound HeadBucket carries a User-Agent starting with `aws-sdk-js/`; aws4fetch is absent from the applied source",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2901-object-storage-s3-adapter",
+        "field": "decision"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28102.json

@@ -16,7 +16,12 @@
       "when": "putObject(key, contentType='application/octet-stream', body=<1 KiB Buffer>) then getObject(key)",
       "then": "the returned body's byte length equals 1024 and the returned content-type equals application/octet-stream; the events list captured on the sink contains an objectPut record with matching key, size 1024, contentType, timestamp; no body bytes appear in any event record",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-28102-2",
@@ -25,7 +30,12 @@
       "when": "deleteObject(key) followed by getObject(key)",
       "then": "the getObject rejects with a not-found shape (NoSuchKey on S3/R2/MinIO); an objectDeleted event fires on the sink with matching key and timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-28102-3",
@@ -34,10 +44,27 @@
       "when": "listObjects(prefix='probe/list/')",
       "then": "the returned keys include every put key with matching prefix, and the paginated envelope carries an isTruncated boolean",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-28102-4",
+      "description": "Key-shape refusal. Given a call to put, get, delete or list on the facade, when the key argument is an empty string, starts with a \"/\", contains \"..\" or \"//\", or exceeds 1024 bytes, then the facade refuses with a named error kind (invalidKey) before any client call, and no lifecycle event fires on the sink.",
+      "given": "a facade verb call with an invalid key shape",
+      "when": "the verb runs",
+      "then": "the facade refuses with error kind invalidKey; no client call is issued; no lifecycle event fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28103.json

@@ -16,10 +16,49 @@
       "when": "presignGetUrl(key, ttl=60) then fetch(url) immediately, then wait ttl+2 seconds and fetch(url) again",
       "then": "first fetch returns 200 with body bytes equal to the put payload; second fetch returns 403; the events list contains a presignedIssued record with key, ttl=60, timestamp; no URL or credential material appears in any event record",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-28103-2",
+      "description": "Presigned URL beyond TTL returns 403. Given a presigned GET URL issued with TTL of 60 seconds, when a fetch runs against it more than 60 seconds after issuance, then the vendor returns HTTP 403 (SignatureDoesNotMatch or expired-URL family), and the facade's subsequent presign call for the same key issues a fresh URL with a fresh TTL boundary.",
+      "given": "a presigned GET URL issued with a 60-second TTL",
+      "when": "a fetch runs against it more than 60 seconds after issuance",
+      "then": "the vendor returns HTTP 403 (expired-URL family); a subsequent presign issues a fresh URL",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-28103-3",
+      "description": "Presigned TTL above ceiling refused at the facade edge. Given a presignGetUrl call with a TTL argument above the elicited presigned-ttl-ceiling-seconds, when the verb runs, then the facade refuses with a named error kind (presignTtlAboveCeiling); no vendor call issues.",
+      "given": "presignGetUrl call with TTL above the elicited ceiling",
+      "when": "the verb runs",
+      "then": "the facade refuses with presignTtlAboveCeiling; no vendor call issues",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28104.json

@@ -16,7 +16,8 @@
       "when": "putObject(key, contentType, body=<10 MiB Buffer>) then getObject(key)",
       "then": "the getObject returns a body of exact size 10485760 with byte equality to the put payload; the events list contains one objectPut record with size=10485760; no ListMultipartUploads on the bucket surfaces an in-flight upload after completion",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-28104-2",
@@ -25,10 +26,27 @@
       "when": "putObject(key, contentType, body=<10 MiB Buffer>) rejects mid-upload",
       "then": "the rejection propagates to the caller; a probe-side ListMultipartUploads(prefix=key) returns zero uploads; no completed object appears at key",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28104-3",
+      "description": "Multipart aborted on part failure. Given a multipart-upload with N parts where part K uploadPart returns a non-2xx (a mid-stream 5xx or client abort), when the uploader catches the failure, then it calls AbortMultipartUpload against the upload id, no CompleteMultipartUpload runs, no partial object survives at the target key, and the facade emits multipartAborted with { key, uploadId, failedPartNumber } on the event sink.",
+      "given": "a multipart-upload with N parts where uploadPart K returns non-2xx",
+      "when": "the uploader catches the failure",
+      "then": "AbortMultipartUpload runs; no CompleteMultipartUpload runs; no partial object survives; multipartAborted fires with {key, uploadId, failedPartNumber}",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2902-object-storage-s3-multipart-uploader",
+        "field": "interfaces.putMultipart"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2902-object-storage-s3-multipart-uploader"],
+  "tacIds": [
+    "TAC-2902-object-storage-s3-multipart-uploader"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28105.json

@@ -11,15 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-28105-1",
-      "description": "Given a lifecycle-event spy attached to the sink, when put, get, delete, and presign verbs run against a PII fixture (key users/1234/passport.jpg, body carrying the PII fixture text), then every event record on the sink carries only fields from the whitelist {event, key, size, contentType, ttl, timestamp, endpointHost, bucketName}; no field name matches userId or ssn or dob or email; no field value contains the PII fixture body text; no field value contains any part of the object body bytes.",
+      "description": "Given a lifecycle-event spy attached to the sink, when put, get, delete, and presign verbs run against a PII fixture (key users/1234/passport.jpg, body carrying the PII fixture text), then every event record on the sink carries only fields from the whitelist {event, key, size, contentType, ttl, ts (number of milliseconds since epoch), endpointHost, bucketName}; no field name matches userId or ssn or dob or email; no field value contains the PII fixture body text; no field value contains any part of the object body bytes.",
       "given": "the facade opened, a spy on the event sink, a PII fixture body PII-FIXTURE-DO-NOT-LOG",
       "when": "putObject(users/1234/passport.jpg, image/jpeg, <body containing PII-FIXTURE-DO-NOT-LOG>), then getObject, then presignGetUrl, then deleteObject",
       "then": "every event record on the sink has keys drawn from the whitelist above; no event value contains the string PII-FIXTURE-DO-NOT-LOG; no event value contains a userId, ssn, dob, or email field; the key users/1234/passport.jpg appears on records as the key field only (not decomposed into userId)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2903-object-storage-s3-event-sink",
+        "field": "interfaces.onEvent"
+      }
+    },
+    {
+      "id": "AC-28105-2",
+      "description": "Repeat-emission secrecy at high fanout. Given every facade verb exercised across N iterations, when the accumulated event stream is inspected, then every one of the N records is restricted to the metadata whitelist on AC-28105-1 with no body bytes, no user id and no PII; a mutation SIMULATE_BODY_BYTES_IN_EVENT=true injects payload bytes into a putCompleted record and the sink observer FAILS naming the leaked field.",
+      "given": "every facade verb exercised N times",
+      "when": "the accumulated event stream is inspected",
+      "then": "every record is restricted to metadata whitelist; the body-byte mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2903-object-storage-s3-event-sink",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2903-object-storage-s3-event-sink"],
+  "tacIds": [
+    "TAC-2903-object-storage-s3-event-sink"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }