rcf-lite 0.26.0 → 0.27.0

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28106.json

@@ -11,12 +11,17 @@
   "acceptanceCriteria": [
     {
       "id": "AC-28106-1",
-      "description": "Given a fresh scratch project with no security-secrets-management applied, when rcf define blueprint add ./blueprints/object-storage-s3 runs, then the command exits 3 and stderr contains the stable message id object-storage-s3-no-secrets, the required predecessor blueprint name security-secrets-management, and the override flag --allow-no-secrets-yet; the scratch project's rcf tree does not carry object-storage-s3 contributions after the refusal.",
+      "description": "Given a fresh scratch project with no security-secrets-management applied, when rcf define blueprint add ./blueprints/object-storage-s3 runs, then the command exits 3 and stderr contains the stable message id object-storage-s3-no-secrets, the required predecessor blueprint name security-secrets-management, and the override flag --allow-no-secrets-yet; the scratch project's rcf tree does not carry object-storage-s3 contributions after the refusal. The applying agent constructs the facade by passing { secretRef, resolver } (never { accessKeyId, secretAccessKey }); a mutation that swaps in a resolved credential object FAILS the boundary check with a named error kind (rejectedResolvedCredentials).",
       "given": "a fresh rcf init scratch project with no security-secrets-management applied",
       "when": "rcf define blueprint add ./blueprints/object-storage-s3 runs against the scratch project",
       "then": "the command exits 3; stderr contains the string object-storage-s3-no-secrets; stderr names security-secrets-management and the --allow-no-secrets-yet flag; the scratch tree has zero object-storage-s3 requirements after the refusal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.createObjectStore"
+      }
     },
     {
       "id": "AC-28106-2",
@@ -25,10 +30,13 @@
       "when": "rcf define blueprint add ./blueprints/object-storage-s3 --allow-no-secrets-yet runs against the scratch project",
       "then": "the command exits 0; the applied manifest entry for object-storage-s3 carries a source.notes string naming the security-secrets-management predecessor and the --allow-no-secrets-yet override; the contributions land on disk",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28107.json

@@ -16,7 +16,8 @@
       "when": "run-facade-round-trip.mjs, run-put-get-round-trip.mjs, run-presigned-url.mjs, run-multipart-upload.mjs, run-event-secrecy.mjs run in sequence",
       "then": "each shim exits 0; each per-blueprint report at .rcf/reports/blueprints/object-storage-s3/<probe>.json carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-28107-2",
@@ -25,10 +26,15 @@
       "when": "each induced-failure switch is set in turn and the paired probe runs",
       "then": "the paired probe exits non-zero and the aggregate verdict lands as fail on the anchored AC; the fixture README documents the paired switch and probe for each of the four wired switches",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade", "TAC-2902-object-storage-s3-multipart-uploader", "TAC-2903-object-storage-s3-event-sink"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade",
+    "TAC-2902-object-storage-s3-multipart-uploader",
+    "TAC-2903-object-storage-s3-event-sink"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28108.json

@@ -16,7 +16,12 @@
       "when": "node blueprints/object-storage-s3/contributions/probes/run-r2-real-account-smoke.mjs runs",
       "then": "the shim exits 0; the report at .rcf/reports/blueprints/object-storage-s3/r2-real-account-smoke.json carries aggregateVerdict pass and a single result with accountBoundSkipped true",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/r2/api/s3/api/",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-28108-2",
@@ -25,10 +30,13 @@
       "when": "node blueprints/object-storage-s3/contributions/probes/run-r2-real-account-smoke.mjs runs",
       "then": "the shim exits 0; the temporary object is deleted after the round-trip; the report carries aggregateVerdict pass and no accountBoundSkipped:true field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28110.json

@@ -16,10 +16,27 @@
       "when": "node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs runs",
       "then": "the probe either round-trips a byte-equal 1 KiB payload via put/get/delete against the composed <bucket>.<location>.your-objectstorage.com endpoint or records accountBoundSkipped true; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim and the probe FAILS naming the missing subdomain",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28110-2",
+      "description": "Unknown Hetzner location refused. Given the elicited hetzner-location-code answered as a value outside the shipped enum {fsn1, hel1, nbg1}, when the endpoint-shape helper composes the endpoint URL, then the helper refuses with a named error kind (unknownHetznerLocation) naming the offending value and the shipped enum; the facade does not open against the unknown location.",
+      "given": "hetzner-location-code answered outside {fsn1, hel1, nbg1}",
+      "when": "the endpoint-shape helper composes the URL",
+      "then": "the helper refuses with unknownHetznerLocation naming the offending value and the shipped enum; the facade does not open",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+        "field": "interfaces.composeHetznerEndpoint"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2904-object-storage-s3-hetzner-endpoint-helper"],
+  "tacIds": [
+    "TAC-2904-object-storage-s3-hetzner-endpoint-helper"
+  ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/guide/object-storage-s3.md

@@ -6,7 +6,7 @@ S3-shape object storage on any S3-compatible endpoint: Cloudflare R2 (the shippe
 
 ## Apply this blueprint
 
-`security-secrets-management` v1.0.1+ MUST be applied first per REQ-006 (Baz decision 6). The blueprint declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` and the T-5 capability mechanism (visual round spec 5.5.1) enforces the refusal at apply time. On a project that has not applied secrets-management:
+`security-secrets-management` v1.0.1+ MUST be applied first per REQ-006. The blueprint declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` and the capability mechanism enforces the refusal at apply time. On a project that has not applied secrets-management:
 
 ```sh
 rcf define blueprint add object-storage-s3
@@ -216,7 +216,7 @@ The Cloudflare R2 smoke stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT` and is not af
 
 - Storage region matters (European data-locality requirements or lower-latency reads from EU-hosted workloads). `fsn1`, `hel1`, `nbg1` cover Germany and Finland; R2 does not surface a per-region locality on the public shape.
 - Egress-pricing profile differs from R2's zero-egress-fee posture; a workload with high internal-only egress may prefer R2, while a workload with predictable public egress may prefer Hetzner's flat per-TB pricing.
-- The applying project already runs on Hetzner Cloud (deploy-hetzner-server v1.0.0 shipped in round 7 T-1) and pairing the storage on the same vendor account is operationally simpler.
+- The applying project already runs on Hetzner Cloud (deploy-hetzner-server v1.0.0 shipped in round 7) and pairing the storage on the same vendor account is operationally simpler.
 
 Reach for R2 for the zero-egress-fee posture, for AWS S3 for the widest feature surface (Object Lock, versioning, lifecycle policies), and for MinIO for local dev without any account.
 

package/blueprints/observability-essentials/CHANGELOG.md

@@ -0,0 +1,21 @@
+# observability-essentials CHANGELOG
+
+## 2.1.2 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-007: REQ description now references the JSON media-type header owned on TAC-801.responsibilities[1] rather than restating the header literal. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 2.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 2.1.0 (hardening pass, 2026-09-09)
+
+- Adds `elicits[]` with four apply-time answers: `liveness-probe-path` (string, default /live; REQ-001), `readiness-probe-path` (string, default /ready; REQ-002), `declared-dependency-set` (string, comma-separated; REQ-003), and `notification-outcome-substrate` (enum sqlite/postgres/custom, default sqlite; REQ-006). Every option value is backed by a must-priority REQ description (section 7c criterion a).
+- Adds `deliveredBy` to every REQ (REQ-001/002/003/007/010 -> TAC-801/TAC-802 interface names; REQ-004/005 -> TAC-803; REQ-006 -> TAC-804; REQ-008 -> ADR-804; REQ-009 -> ADR-803). Closes 8 pass-2 lint findings; per-blueprint lint reports zero on pass 1 and pass 2.
+- Closes F-4 chain-contradiction specimen: AC-7107-3 previously compared v1.0.0 to future v1.x while the blueprint is v2. Rewrites the AC as a v2-baseline snapshot compatibility check against `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` with stable-coded PROBE_BODY_SHAPE_DRIFT on rename or removal.
+- Closes F-1 (liveness self-check failure without AC coverage): adds AC-7101-5 asserting a response-capable in-process self-check predicate answers HTTP 503 with content-length 0 on fail and returns to 200 on pass; the AC is `template` because the predicate itself is project-owned.
+- Closes F-2 (boot-refuse ACs for dependency declaration): adds AC-7103-4 (deps missing -> READINESS_DEPS_MISSING), AC-7103-5 (duplicate name -> READINESS_DEPS_DUPLICATE, template on the declared set), AC-7103-6 (blank/malformed name -> READINESS_DEPS_MALFORMED).
+- Closes F-3 (durable outcome sink): adds AC-7106-4 asserting outcome records survive a sink restart (template on the elicited notification-outcome-substrate) and AC-7106-5 asserting a failed write signals NOTIFICATION_OUTCOME_WRITE_FAILED to the caller and does not fabricate a success record.
+- Re-sweeps every existing AC's `disposition` per section 7b: ACs marked `template` (those whose text references elicited paths, project-declared dependencies, or the elicited substrate) with `templateFillIns` naming which values the applying agent sets; the remaining ACs stay `fixed`.
+- Review fix pass (F-2/F-3): adds `probeBodyShapeCompatibility` interface entry to TAC-802 that owns the cross-probe response body shape contract and names `PROBE_BODY_SHAPE_DRIFT`; updates AC-7107-3.ownerRef from ADR-803.decision.probeBodyShape (which the decision text did not carry) to TAC-802.interfaces.probeBodyShapeCompatibility; moves the v2 baseline snapshot from `packages/rcf-lite/test/blueprint/` to `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` so its placement matches its documentation-fixture nature (no suite test read it in the previous location).
+- Review fix pass (F-7): extends REQ-006 description with a runtime clause per substrate option (`sqlite`, `postgres`, `custom`), literally named and each backed as the accepted values the notification-outcome-substrate elicit resolves at boot (AC-7106-4 exercises the restart path across substrates; AC-7106-5 exercises the failed-write path).

package/blueprints/observability-essentials/README.md

@@ -1,4 +1,4 @@
-# Observability blueprint (v2.0.0)
+# Observability blueprint (v2.1.0)
 
 The fifth content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 5 of the blueprint programme). Scope: two HTTP health probes (liveness and readiness, path-neutral from v2.0.0: liveness answering strictly on in-process state, readiness aggregating over an explicit boot-time-declared dependency set with strict-any-fail semantics), a public status page rendering a declared component list plus stable-fielded incident notices, and a durable notification-outcome sink recording every attempt's outcome for later query by recipient and window. Targeted at small greenfield rcf-lite projects. Historical uptime charts, metrics export, and distributed tracing are documented future variants; the v2.0.0 blueprint ships the current-state contract only.
 

package/blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json

@@ -0,0 +1,17 @@
+{
+  "// Baseline documented for observability-essentials AC-7107-3": "Hardening pass (2026-09-09): captures the v2 baseline shape of the /live and /ready probe response bodies so a release-time compatibility check can compare a candidate against the current v2 snapshot. A candidate that renames or removes a field named here fails with PROBE_BODY_SHAPE_DRIFT; additions are allowed.",
+  "live": {
+    "status": "pass",
+    "checkedAt": "ISO-8601 timestamp string"
+  },
+  "ready": {
+    "status": "pass",
+    "checkedAt": "ISO-8601 timestamp string",
+    "dependencies": [
+      {
+        "name": "string",
+        "status": "pass|fail"
+      }
+    ]
+  }
+}

package/blueprints/observability-essentials/blueprint.json

@@ -1,7 +1,38 @@
 {
   "slug": "observability-essentials",
-  "version": "2.0.0",
+  "version": "2.1.2",
   "category": "observability",
+  "elicits": [
+    {
+      "id": "liveness-probe-path",
+      "prompt": "HTTP path the liveness probe binds to on the request-traffic listener (REQ-001; default /live).",
+      "kind": "string",
+      "default": "/live"
+    },
+    {
+      "id": "readiness-probe-path",
+      "prompt": "HTTP path the readiness probe binds to on the request-traffic listener (REQ-002; default /ready).",
+      "kind": "string",
+      "default": "/ready"
+    },
+    {
+      "id": "declared-dependency-set",
+      "prompt": "Comma-separated names of dependencies whose availability the readiness probe evaluates (REQ-003; blank when no dependencies are declared). Each name resolves to a checkFor(name) predicate.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "notification-outcome-substrate",
+      "prompt": "Durable substrate for notification-outcome records (REQ-006). Recommended defaults: sqlite (single-node), postgres (multi-node). The substrate must survive a process restart.",
+      "kind": "enum",
+      "options": [
+        "sqlite",
+        "postgres",
+        "custom"
+      ],
+      "default": "sqlite"
+    }
+  ],
   "contributions": [
     {
       "id": "observability-essentials-REQ-001",

package/blueprints/observability-essentials/contributions/adrs/adr-801-observability-essentials-health-probes.json

@@ -6,7 +6,7 @@
   "status": "accepted",
   "title": "Historical: two HTTP health probes on the request-traffic listener with a stable JSON body shape (self-supervised design intent, superseded by observability-probe-endpoints as the shelf canonical path owner from v2.0.0)",
   "context": "Every deployed application runs under an orchestrator that needs a restart signal and under a load balancer that needs a routing signal. The two signals answer different questions: 'is this process wedged, restart it' versus 'is this process able to serve, route around it if not'. A single probe folded across both questions produces the outage-amplifying failure mode where a downstream dependency blip triggers a restart storm that dwarfs the original blip. The probes have to be structurally separate at the endpoint and semantically separate at the answer.",
-  "decision": "The application serves two probe endpoints on the same HTTP listener that serves request traffic: a liveness probe at /healthz (or the configured override) and a readiness probe at /readyz (or the configured override). Both respond with Content-Type application/json and a stable body shape: { status: 'pass' | 'fail', checkedAt: <ISO-8601> } for liveness, plus a { checks: { <depName>: { state, checkedAt } } } object for readiness. Liveness returns 200 whenever the event loop is responsive and never depends on any external condition; readiness returns 200 when every declared dependency's cached state is pass and 503 otherwise. Both endpoints are auth-exempt (see ADR-804). The probes bind to the request-traffic listener rather than a separate operator port so the load balancer's probe observes the same reachability the traffic will observe.",
+  "decision": "The application serves two probe endpoints on the same HTTP listener that serves request traffic: a liveness probe at /healthz (or the configured override) and a readiness probe at /readyz (or the configured override). Both respond with the response header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1] and a stable body shape: { status: 'pass' | 'fail', checkedAt: <ISO-8601> } for liveness, plus a { checks: { <depName>: { state, checkedAt } } } object for readiness. Liveness returns 200 whenever the event loop is responsive and never depends on any external condition; readiness returns 200 when every declared dependency's cached state is pass and 503 otherwise. Both endpoints are auth-exempt (see ADR-804). The probes bind to the request-traffic listener rather than a separate operator port so the load balancer's probe observes the same reachability the traffic will observe.",
   "consequences": "The orchestrator's restart action is coupled only to true process wedging: a downstream dependency outage never triggers a restart. The load balancer's rotation action is coupled to declared-dependency health only: an unready replica gets pulled from rotation without a restart the replica cannot recover from. The stable JSON shape lets third-party monitoring integrations wire once. A change to the probe path defaults or a rename of a top-level probe body field is a major version bump on this blueprint. Composing blueprints that hold a different opinion on the endpoint contract (a project that wants /health as a single endpoint answering both questions, a project that wants gRPC probes, a project that wants both probes on a separate admin port) conflict on the healthProbes topic; the expected resolution is one project-level ADR that fixes the endpoint contract. From essentials v2.0.0 this ADR is scope-local historical context: the shelf-wide healthProbes topic is claimed only by observability-probe-endpoints. The self-supervised body shape and the request-traffic-listener binding remain the intent for the essentials-alone case; the literal /healthz and /readyz path defaults were removed from TAC-801 and TAC-802 in the same bump.",
   "alternativesConsidered": [
     {

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-001.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The application exposes a liveness probe endpoint at a configured HTTP path",
   "description": "The application serves a liveness probe endpoint at a project-supplied HTTP path. A 2xx response means the process is running its event loop and is not wedged; a 5xx response means the process is stuck and the orchestrator should restart it. The endpoint answer never depends on any external dependency: a database outage, a broker outage or a partner API outage never turns liveness red on its own. The endpoint runs entirely inside the process boundary. The liveness path is supplied by project configuration under probeInterface.paths.liveness; when observability-probe-endpoints is composed on the same project the resolved profile liveness path binds automatically (Kubernetes profile default /live). Essentials-alone projects supply the one config line at boot and the blueprint refuses boot with a stable-coded error when it is missing.",
+  "deliveredBy": {
+    "tacId": "TAC-801-observability-essentials-liveness-probe",
+    "field": "interfaces.createLivenessHandler"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The application exposes a readiness probe endpoint at a configured HTTP path",
   "description": "The application serves a readiness probe endpoint at a project-supplied HTTP path distinct from the liveness path. A 2xx response means the process is ready to accept request traffic; a 5xx response means the orchestrator should stop routing traffic to this replica while the process itself remains up. The readiness answer aggregates the health of the specific dependencies the process needs to serve requests correctly, evaluated through non-blocking cached checks that never hang the endpoint on a slow dep. The readiness path is supplied by project configuration under probeInterface.paths.readiness; when observability-probe-endpoints is composed on the same project the resolved profile readiness path binds automatically (Kubernetes profile default /ready). Essentials-alone projects supply the one config line at boot and the blueprint refuses boot with a stable-coded error when it is missing.",
+  "deliveredBy": {
+    "tacId": "TAC-802-observability-essentials-readiness-probe",
+    "field": "interfaces.createReadinessHandler"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The readiness dependency set is declared in configuration and every declared dependency is named in the probe response",
   "description": "The set of dependencies whose health contributes to the readiness answer is declared at boot from application configuration. Each declared dependency has a stable string name that appears in the readiness probe's structured response body under a checks field, alongside its individual pass/fail state and the timestamp of the last check evaluation. Dependencies not declared in the readiness set never appear in the probe response, never affect readiness, and are surfaced to operators only through the status page or the notification outcome record.",
+  "deliveredBy": {
+    "tacId": "TAC-802-observability-essentials-readiness-probe",
+    "field": "interfaces.dependencyRegistry"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The application serves a public status page listing every declared component and its current state",
   "description": "The application serves a public status page at a stable HTTP path intended for external readers (users, partners, unauthenticated visitors). The page renders a list of declared components (subsystems the project chooses to publish state for), each with a current state field from a fixed enum (operational, degraded, outage, maintenance) and a human-readable component name. The page has no login gate. The component list, the enum, and the display order are declared at boot from application configuration; no component appears on the page that was not declared.",
+  "deliveredBy": {
+    "tacId": "TAC-803-observability-essentials-status-page",
+    "field": "interfaces.componentRegistry"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The status page surfaces active incident notices with a stable structure and stable field names",
   "description": "When the operator has posted one or more active incident notices, the status page renders them above the component list. Each notice carries a title (short human string), a body (longer human string), a severity from a fixed enum (info, warning, critical), a startedAt ISO-8601 timestamp, and an optional componentIds array naming which declared components the notice relates to. When no notices are active, the notice region is either absent from the rendered page or clearly labelled as empty; no phantom notices, no stale notices carried over from a previous incident.",
+  "deliveredBy": {
+    "tacId": "TAC-803-observability-essentials-status-page",
+    "field": "interfaces.noticeReader"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-006.json

@@ -2,7 +2,11 @@
   "reqId": "observability-essentials-REQ-006",
   "prdId": "PRD-001",
   "title": "Every notification the application sends records an outcome on a durable sink that operators can query by recipient and window",
-  "description": "The application records the outcome of every notification it attempts to send (email, SMS, push, webhook, or any other channel the project ships) as a structured record on a durable outcome sink. Each record carries a notification identifier, a channel name from a fixed enum, a recipient identifier, an outcome from a fixed enum (delivered, failed, pending, suppressed), an attemptedAt ISO-8601 timestamp, and an optional errorCode string when the outcome is failed. An operator queries the sink by recipient identifier and time window and receives the outcome records that match. Notifications never succeed silently: an attempt with no recorded outcome is a defect the project must gate against.",
+  "description": "The application records the outcome of every notification it attempts to send (email, SMS, push, webhook, or any other channel the project ships) as a structured record on a durable outcome sink. Each record carries a notification identifier, a channel name from a fixed enum, a recipient identifier, an outcome from a fixed enum (delivered, failed, pending, suppressed), an attemptedAt ISO-8601 timestamp, and an optional errorCode string when the outcome is failed. An operator queries the sink by recipient identifier and time window and receives the outcome records that match. Notifications never succeed silently: an attempt with no recorded outcome is a defect the project must gate against. The elicited notification-outcome-substrate is one of three named values whose runtime behaviour this blueprint pins: `sqlite` persists outcome records to a process-local SQLite file at the project-configured path and MUST survive a process restart (AC-7106-4 exercises the restart path against a sqlite path); `postgres` persists outcome records to a PostgreSQL server the project connects to and MUST survive a stop-and-start of that server (AC-7106-4 exercises the restart path against a postgres server); `custom` accepts a project-supplied substrate module conforming to the sink interface on TAC-804 whose implementation guarantees the same restart-survival semantics as the shipped `sqlite` and `postgres` branches (AC-7106-4 and AC-7106-5 exercise the branch through the same TAC-804 interface). Every substrate value the elicit accepts is backed by this runtime clause; a substrate not named here is not accepted at boot.",
+  "deliveredBy": {
+    "tacId": "TAC-804-observability-essentials-notification-outcome",
+    "field": "interfaces.createOutcomeSink"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-007.json

@@ -2,7 +2,11 @@
   "reqId": "observability-essentials-REQ-007",
   "prdId": "PRD-001",
   "title": "Probe responses carry a stable JSON body shape with stable field names and an ISO-8601 timestamp",
-  "description": "The liveness and readiness probe endpoints respond with a JSON body carrying a stable shape: a status field (one of pass or fail), a checkedAt field with an ISO-8601 timestamp of when the probe body was evaluated, and, on the readiness probe, a checks field mapping declared-dependency name to that dependency's individual pass/fail. Content-Type is application/json. Field names do not change across patch or minor versions of the blueprint; a change is a major version bump.",
+  "description": "The liveness and readiness probe endpoints respond with a JSON body carrying a stable shape: a status field (one of pass or fail), a checkedAt field with an ISO-8601 timestamp of when the probe body was evaluated, and, on the readiness probe, a checks field mapping declared-dependency name to that dependency individual pass/fail. The response header naming the media type is the one owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1]. Field names do not change across patch or minor versions of the blueprint; a change is a major version bump.",
+  "deliveredBy": {
+    "tacId": "TAC-802-observability-essentials-readiness-probe",
+    "field": "interfaces.createReadinessHandler"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
@@ -11,8 +15,8 @@
     "blueprint:observability-essentials",
     "category:07-probe-shape"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-08-24T00:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-008.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Probes and the public status page are served without an authentication gate",
   "description": "The liveness probe, the readiness probe, and the public status page respond to unauthenticated HTTP requests. No cookie, no header, no source-IP allowlist gates access to these three surfaces. The three paths are declared at boot as auth-exempt in whatever authentication middleware the application uses, and that exemption is the only auth policy the surfaces run under.",
+  "deliveredBy": {
+    "adrId": "ADR-804-observability-essentials-probe-secrecy",
+    "field": "decision.probeSecrecy"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-009.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The public status page never leaks internal identifiers, metric values, or dependency detail beyond the declared surface",
   "description": "The public status page renders only the declared component list and their per-component states, plus the active incident notices. It never renders internal identifiers (host names, replica ids, database identifiers, queue names), never renders raw metric values (request counts, latency numbers, error rates), and never names the specific dependencies that failed a readiness check. The status enum values, the component names, and the incident notice fields are the public vocabulary; anything more granular is operator-only surface, exposed through the readiness probe body or an authenticated operator dashboard.",
+  "deliveredBy": {
+    "adrId": "ADR-803-observability-essentials-status-page-contract",
+    "field": "decision.statusPageContract"
+  },
   "category": "security",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/requirements/observability-essentials-req-010.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Probe handlers evaluate in bounded time and never block on a network call to a downstream dependency",
   "description": "The liveness probe handler completes its evaluation entirely in-process and returns without issuing any network call. The readiness probe handler completes within a bounded ceiling (the readiness evaluation budget, declared at boot with a documented default) and never blocks on a synchronous network round trip to a declared dependency: readiness checks read from a per-dependency last-known state that a background evaluator refreshes on its own cadence. A slow or hanging downstream dependency causes the last-known state for that dependency to age or fail, not the probe handler itself to hang.",
+  "deliveredBy": {
+    "tacId": "TAC-802-observability-essentials-readiness-probe",
+    "field": "interfaces.createReadinessHandler"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-essentials/contributions/tacs/tac-802-observability-essentials-readiness-probe.json

@@ -40,10 +40,15 @@
       "name": "checkFor",
       "kind": "callback",
       "description": "Project-supplied per-dependency probe: (name) -> Promise<{ state: pass or fail, checkedAt: <ISO-8601> }>. Called by the evaluator, not by the handler."
+    },
+    {
+      "name": "probeBodyShapeCompatibility",
+      "kind": "compatibility-contract",
+      "description": "Cross-probe response body shape compatibility. Owns the release-time check that compares a candidate release's /live and /ready response bodies against the checked-in v2 baseline snapshot at blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json. A field name or JSON type present on the baseline that a candidate renames or removes is refused with the stable error code PROBE_BODY_SHAPE_DRIFT naming the offending field; a candidate that adds fields without renaming or removing any passes. TAC-802 hosts the contract because the readiness body is the richer of the two shapes; TAC-801's liveness body is jointly covered by the same contract."
     }
   ],
   "dependencies": [],
   "tradeoffs": "The cached-state pattern means the probe response is at worst one cadence interval stale; a dep that fails mid-cycle takes up to the cadence to reflect on the probe. That staleness is the cost of never hanging the probe handler. Path binding is now the operator or the composed observability-probe-endpoints blueprint decision, not an essentials default: the v2.0.0 breaking change is exactly this shift. Projects that want tighter freshness turn down the cadence at the cost of extra background work; projects that never want the probe to falsely fail on a transient dep blip turn up the cadence at the cost of slower fail-open detection.",
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-09-04T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/tacs/tac-803-observability-essentials-status-page.json

@@ -7,7 +7,7 @@
   "name": "Public status page",
   "purpose": "Owns the public status page: the HTTP handler that renders it, the declared component registry it renders from, and the active-notice reader it renders alongside. The public reader is the primary audience; the renderer commits to the declared component vocabulary and the declared notice fields and to nothing else.",
   "responsibilities": [
-    "Register a GET handler on the configured status page path (default /status) at the application's HTTP router; respond with 200 and Content-Type text/html to unauthenticated requests (AC-7104-1, AC-7108-1, AC-7108-2).",
+    "Register a GET handler on the configured status page path (default /status) at the application's HTTP router; respond with 200 and the response header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1] carrying text/html for this endpoint, to unauthenticated requests (AC-7104-1, AC-7108-1, AC-7108-2).",
     "Render exactly the declared component list in declared order, with each component's current state as a machine-readable attribute drawn from the operational/degraded/outage/maintenance enum; no phantom components, no missing components, no other state values (AC-7104-1, AC-7104-2, AC-7104-3).",
     "Render active incident notices in a notices region above the component list; each notice element carries the title, body, severity, startedAt, and componentIds fields as machine-readable attributes with severity drawn from the info/warning/critical enum; when no notices are active, the notices region is either absent or carries an emptyState marker (AC-7105-1, AC-7105-2, AC-7105-3).",
     "Refuse to render internal identifiers, raw metric values, or declared readiness dependency names on the page; the vocabulary is the declared component names and the declared notice fields, and nothing else (AC-7109-1, AC-7109-2, AC-7109-3)."

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7101.json

@@ -14,18 +14,20 @@
       "description": "The application serves the liveness endpoint at a stable HTTP path supplied by project configuration under `probeInterface.paths.liveness` (with no shipped default from v2.0.0); a GET returns 200 when the process is running its event loop and returns application/json with a status field equal to pass. When observability-probe-endpoints v1.1.0 or later is composed on the same project the resolved profile liveness path substitutes for this configuration entry automatically.",
       "given": "the process is running normally with its event loop responsive",
       "when": "an unauthenticated GET is issued against the liveness path",
-      "then": "the response status code is 200, the Content-Type is application/json, and the JSON body's status field equals pass",
+      "then": "the response status code is 200, the response carries the header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1], and the JSON body's status field equals pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7101-2",
-      "description": "The liveness probe handler evaluates entirely in-process; a probe hit issues zero network calls to any declared dependency, verifiable by observing the network egress from the probe path.",
+      "description": "The liveness probe handler evaluates entirely in-process; a probe hit issues zero network calls to any declared dependency, verifiable by observing the network egress from the probe path. Template values the applying agent sets: The applying agent sets the elicited declared-dependency-set; the AC substitutes the project's dependency names for the illustrative paymentsProvider / primaryStore tokens.",
       "given": "the process is running and a network-egress observer is attached to the probe path",
       "when": "a GET is issued against the liveness path",
       "then": "the observer records zero egress connections attributable to the probe handler between request receipt and response send",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-7101-3",
@@ -34,7 +36,8 @@
       "when": "a GET is issued against the liveness path",
       "then": "the response status code is 200 and the JSON body's status field equals pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7101-4",
@@ -43,12 +46,27 @@
       "when": "the process attempts to boot",
       "then": "the boot fails with the stable-coded error PROBE_INTERFACE_PATHS_MISSING and the error message names probeInterface.paths.liveness as the missing key",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-7101-5",
+      "description": "A liveness handler on a process whose in-process self-check predicate returns fail (a scheduled watchdog tick that has not fired within its budget) answers HTTP 503 with content-length 0 and an empty body, so the orchestrator restarts the process on the next probe interval. The predicate is response-capable by design: it observes a boolean the handler reads without I/O. Template values the applying agent sets: The applying agent supplies the elicited liveness-probe-path and the project-owned self-check predicate; the AC substitutes both.",
+      "given": "a running application with an operator-declared watchdog tick scheduled every 1 second and a 5-second budget; the tick has not fired for 6 seconds so the predicate is fail",
+      "when": "the orchestrator issues HTTP GET on the elicited liveness-probe-path",
+      "then": "the response is HTTP 503 with content-length 0 and an empty body; a follow-up GET while the predicate stays fail continues to answer 503; a GET after the predicate returns pass answers 200",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-801-observability-essentials-liveness-probe",
+        "field": "interfaces.createLivenessHandler"
+      }
     }
   ],
   "tacIds": [
     "TAC-801-observability-essentials-liveness-probe"
   ],
   "createdAt": "2026-08-24T00:00:00Z",
-  "updatedAt": "2026-09-04T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-essentials/contributions/user-stories/observability-essentials-us-7102.json

@@ -14,9 +14,10 @@
       "description": "The application serves the readiness endpoint at a stable HTTP path supplied by project configuration under `probeInterface.paths.readiness` (with no shipped default from v2.0.0), distinct from the liveness path; a GET returns 200 with a JSON body when every declared readiness dependency is passing and returns 503 with a JSON body when at least one declared readiness dependency is failing. When observability-probe-endpoints v1.1.0 or later is composed on the same project the resolved profile readiness path substitutes for this configuration entry automatically.",
       "given": "the process is running and the readiness dependency set is declared",
       "when": "an unauthenticated GET is issued against the readiness path against a healthy dependency set, then against a set with at least one failing dependency",
-      "then": "the first response has status code 200 with JSON body status equal to pass; the second response has status code 503 with JSON body status equal to fail; both bodies have Content-Type application/json",
+      "then": "the first response has status code 200 with JSON body status equal to pass; the second response has status code 503 with JSON body status equal to fail; both responses carry the header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1]",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7102-2",
@@ -25,7 +26,8 @@
       "when": "a GET is issued against the readiness path targeting the same listener address as request traffic",
       "then": "the response is served by the application, not refused with a connection error, and the readiness handler and a representative request handler both bind to the same address:port pair as reported by the process",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7102-3",
@@ -34,7 +36,8 @@
       "when": "the readiness probe returns 503 across a five-minute window",
       "then": "the process exit code is not emitted, the process remains running throughout the window, and the liveness probe continues to return 200 with status pass",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-7102-4",
@@ -43,7 +46,8 @@
       "when": "the process attempts to boot",
       "then": "the boot fails with the stable-coded error PROBE_INTERFACE_PATHS_MISSING and the error message names probeInterface.paths.readiness as the missing key",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [