rcf-lite 0.26.0 → 0.27.0

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15109.json

@@ -0,0 +1,71 @@
+{
+  "usId": "observability-logging-US-15109",
+  "prdId": "PRD-001",
+  "reqId": "observability-logging-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The audit-log stream carries actor, target, before and after fields per line with the ambient correlation identifier for consumer surfaces to join",
+  "asA": "operator of a consuming blueprint (application-admin-console) rendering an audit-log surface",
+  "iWant": "every audit event the applying application emits to land on the same shared logger stream with actor, target, before, after and correlationId fields on the top-level object",
+  "soThat": "the audit surface can read the stream directly, join each row to its originating request via the correlation identifier, and use the shared redaction and level-filter pipeline without a per-consumer adapter",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15109-1",
+      "description": "An audit event emission at info with a payload carrying { actor: 'principal:1', target: 'role:2', before: 'reader', after: 'admin' } produces one stdout line whose parsed object holds those four fields at the top level alongside message, level, timestamp, correlationId, environment, serviceName and serviceVersion; the correlationId equals the ambient request context's value. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
+      "given": "a running application in an ambient request context with correlationId 'req-777' and a caller issuing logger.info('role.granted', { actor: 'principal:1', target: 'role:2', before: 'reader', after: 'admin' })",
+      "when": "the emission passes through the factory",
+      "then": "stdout carries one line, JSON.parse yields an object with actor === 'principal:1', target === 'role:2', before === 'reader', after === 'admin', correlationId === 'req-777' and the shared minimum field set present",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15109-2",
+      "description": "An audit event emitted at debug with the elicited minimum-log-level set to info produces no stdout line, so the audit stream in production does not carry sub-threshold audit noise. Template values the applying agent sets: The applying agent sets the elicited minimum-log-level per environment; the AC substitutes the elicited threshold for the illustrative info.",
+      "given": "a running application with minimum-log-level info and a caller issuing logger.debug('role.hover', { actor: 'principal:1', target: 'role:2', before: 'reader', after: 'reader' })",
+      "when": "the emission is issued",
+      "then": "stdout carries no line for this emission",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15109-3",
+      "description": "An audit event whose actor value has category pii.email at the caller-side has that field replaced with [REDACTED:pii.email] on the emitted line; the caller-side object still holds the original address.",
+      "given": "a running application configured with the recommended redaction defaults and a caller issuing logger.info('login.success', { actor: 'alice@example.test', 'actor.pii.email': 'alice@example.test' })",
+      "when": "the emission passes through the redaction boundary",
+      "then": "the stdout line's `actor.pii.email` field value equals [REDACTED:pii.email] and the caller-side object still holds 'alice@example.test'",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1602-observability-logging-redaction-boundary",
+        "field": "interfaces.createRedactionBoundary"
+      }
+    },
+    {
+      "id": "AC-15109-4",
+      "description": "The blueprint's guide 'Known mechanism-reach gaps' section names the class of a bare console.log or bare stdout write bypassing the factory. This AC verifies that the guide states the gap and names at least one project-side workaround (an ESLint rule or a build-time grep gate) that a consuming project can adopt to close it; the blueprint does not itself supply the gate.",
+      "given": "the applied blueprint's guide file",
+      "when": "the guide is opened",
+      "then": "the guide names the mechanism-reach gap explicitly and states at least one project-side workaround by name",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory",
+    "TAC-1602-observability-logging-redaction-boundary"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/observability-probe-endpoints/CHANGELOG.md

@@ -0,0 +1,17 @@
+# observability-probe-endpoints CHANGELOG
+
+## 1.2.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.2.0 (hardening pass, 2026-09-09)
+
+- Adds `elicits[]` with four apply-time answers: `probe-interface-profile` (enum kubernetes/loadBalancer/uptimeMonitor/systemd/dockerHealthcheck/reverseProxy/custom, default kubernetes; REQ-001), `probe-paths-override` (string JSON; REQ-002/003), `probe-listener-separate-port` (string; REQ-004), `kubernetes-startup-enabled` (enum off/on, default off; ADR-1503). Every option value is backed by a must-priority REQ description.
+- Adds `deliveredBy` to every REQ (REQ-001-008 -> TAC-1501/1502/1503/1504 interface names; REQ-006 -> ADR-1505). Closes 7 pass-2 lint findings.
+- Closes F-1 chain-contradiction specimen: settles missing-profile semantics as fallback-to-Kubernetes-default (per ADR-1503), not refuse. REQ-001 rewritten to name precedence (explicit declaration wins, absent falls back, unknown/malformed refused with stable codes PROBE_PROFILE_UNKNOWN / PROBE_PROFILE_MALFORMED). AC-14101-2 rebased to the fallback path; AC-14101-4 added for malformed.
+- Closes F-3 (liveness failure without AC coverage): adds AC-14102-5 asserting a response-capable in-process liveness self-check predicate answers HTTP 503 with content-length 0 on fail; `template` because the predicate is project-owned.
+- Closes F-4 chain-contradiction specimen: rewrites the guide's `Boundary with observability-essentials` section to the current-shelf reality (essentials v2 dropped its `scope: global` claims on `healthProbes` and `readinessSemantics`; probe-endpoints is the sole claimant on both topics; both orders compose cleanly). The pre-v2 conflict-resolution paths move to a historical migration note.
+- Closes F-2 (systemd + TCP transport families with no AC): adds AC-14105-4 (systemd Type=notify: exactly-once READY=1 plus periodic WATCHDOG=1 at cadence; supervisor pull when the watchdog cadence lapses), AC-14105-5 (TCP transport: accept on pass, refuse on fail, zero bytes on the connection), AC-14105-6 (missing platform adapter refused at boot with PROBE_ADAPTER_MISSING).
+- Closes the pass-1 lint finding on AC-14106-3: `then` now uses the canonical lowercase `content-length` string owned by TAC-1502.responsibilities[2].
+- Re-sweeps every existing AC's `disposition` per section 7b: ACs whose text references profile names, dependency names, or the elicited separate-port option flipped to `template` with `templateFillIns`; the remaining ACs stay `fixed`.
+- Review fix pass (register scan): the band-spacing paragraph in `docs/topics.md` reads `shelf-lane`/`shelf lane` so shipped content carries no internal team labels.

package/blueprints/observability-probe-endpoints/README.md

@@ -1,4 +1,4 @@
-# observability-probe-endpoints blueprint (v1.1.0)
+# observability-probe-endpoints blueprint (v1.2.0)
 
 The tenth content blueprint on the rcf-build-lite blueprint mechanism, and the second in the `observability` category, sibling to the shipped `observability-essentials`. Scope: a health probe interface derived from an operator-declared target integration profile (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, plus a `custom:<name>` slot). Each profile fixes the probe transport, path or command surface, response contract, and semantic distinction between liveness and readiness for the supervisor at hand. Kubernetes is the shipped default (HTTPGet `/live` and `/ready` on the request-traffic listener); every HTTP profile ships with a `probeListener.separatePort` opt-in for probe-traffic isolation from user traffic. Response contracts are minimal by construction; the profile validator refuses any override that would add a field beyond the enumerated set. Targeted at rcf-lite projects that must integrate with a specific EXTERNAL supervising system whose conventions drive the probe wire shape; not targeted at the self-supervised all-in-one observability case (observability-essentials owns that).
 

package/blueprints/observability-probe-endpoints/blueprint.json

@@ -1,7 +1,46 @@
 {
   "slug": "observability-probe-endpoints",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "category": "observability",
+  "elicits": [
+    {
+      "id": "probe-interface-profile",
+      "prompt": "Target integration profile: name of the external supervising system the probe surface serves. Recommended default kubernetes (ADR-1503); the enumerated set is kubernetes, loadBalancer, uptimeMonitor, systemd, dockerHealthcheck, reverseProxy; a project-authored custom:<name> resolves to a project-supplied profile object.",
+      "kind": "enum",
+      "options": [
+        "kubernetes",
+        "loadBalancer",
+        "uptimeMonitor",
+        "systemd",
+        "dockerHealthcheck",
+        "reverseProxy",
+        "custom"
+      ],
+      "default": "kubernetes"
+    },
+    {
+      "id": "probe-paths-override",
+      "prompt": "Per-profile probe path overrides (empty for the profile defaults: /live and /ready for kubernetes, /health for loadBalancer and reverseProxy, exec entry for dockerHealthcheck, systemd notify for systemd). JSON object keyed by profile name.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "probe-listener-separate-port",
+      "prompt": "Separate-port listener option for probe traffic isolation from user traffic (per ADR-1504). Recommended default fused (probes on the request-traffic listener); set an integer TCP port to bind probes on their own listener.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "kubernetes-startup-enabled",
+      "prompt": "Enable the optional Kubernetes startup path /startup (per ADR-1503). Recommended default off; on emits a three-path set /live, /ready, /startup and generates a startup handler.",
+      "kind": "enum",
+      "options": [
+        "off",
+        "on"
+      ],
+      "default": "off"
+    }
+  ],
   "contributions": [
     {
       "id": "observability-probe-endpoints-REQ-001",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-001.json

@@ -2,7 +2,11 @@
   "reqId": "observability-probe-endpoints-REQ-001",
   "prdId": "PRD-001",
   "title": "The health probe interface is derived from an operator-declared target integration",
-  "description": "The application exposes health probes shaped for the external system that will probe it. The operator declares a target integration by name (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, or a project-authored `custom` profile). The profile fixes the probe transport (HTTP GET, TCP socket accept, exec command, or a supervisor notify call), the probe path or command surface, the response contract, and the port topology defaults. A probe surface not backed by a declared profile is refused at boot with a stable-coded error naming the missing declaration. Nothing in the process wires a probe on its own initiative; the profile drives every binding.",
+  "description": "The application exposes health probes shaped for the external system that will probe it. The operator declares a target integration by name (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, or a project-authored `custom` profile). The profile fixes the probe transport (HTTP GET, TCP socket accept, exec command, or a supervisor notify call), the probe path or command surface, the response contract, and the port topology defaults. Precedence at boot: an explicit `probeInterface.profile` declaration wins; when the declaration is absent, the shipped Kubernetes default (ADR-1503) resolves and the process boots on that profile. A profile name that is neither in the enumerated set nor a resolvable `custom` profile is refused at boot with a stable-coded `PROBE_PROFILE_UNKNOWN` error naming the offending value; a `probeInterface` declaration that is syntactically malformed (a non-object, or an object missing required per-profile keys) is refused with `PROBE_PROFILE_MALFORMED` naming the offending shape. Nothing in the process wires a probe on its own initiative; the profile drives every binding.",
+  "deliveredBy": {
+    "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+    "field": "interfaces.resolveProbeProfile"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A default Kubernetes profile ships with liveness /live and readiness /ready served over HTTP GET",
   "description": "When the operator selects the `kubernetes` target integration (the shipped default), the profile wires two HTTP GET probe handlers: a liveness handler at path `/live` and a readiness handler at path `/ready`. Both handlers return HTTP 200 for pass and HTTP 503 for fail. The liveness handler answers strictly on in-process event-loop responsiveness and never depends on any external condition. The readiness handler answers on the operator-declared readiness predicate for the profile (default: strict-any-fail over the declared dependency set). Both paths and the port topology are overridable at boot; the defaults hold when the operator does not override.",
+  "deliveredBy": {
+    "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+    "field": "interfaces.profileLoader"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Each supported target integration profile names its own probe path, response contract, transport, and semantic distinction",
   "description": "Every profile the blueprint ships names four things: the probe path or command surface (an HTTP path for HTTP profiles, a TCP port for socket profiles, a shell command for exec profiles, a supervisor call for notify profiles); the response contract (HTTP status code range with an optional minimal JSON body for HTTP profiles, connect-and-close for TCP, exit-code zero for exec, one notify call for supervisor); the transport (HTTP GET, TCP SYN, spawned process, or unix socket for supervisor calls); and the semantic distinction between liveness and readiness (two endpoints for Kubernetes; one health signal for load balancers and uptime monitors that do not distinguish; a boot-time readiness notification followed by a periodic watchdog for systemd; a single command answer for Docker HEALTHCHECK). A profile that does not resolve all four is refused at boot with a stable-coded error naming the missing field.",
+  "deliveredBy": {
+    "tacId": "TAC-1502-observability-probe-endpoints-handler-set",
+    "field": "interfaces.buildHandlerSet"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A separate-port listener option is offered per HTTP profile for probe traffic isolation from user traffic",
   "description": "Every HTTP-transport profile offers a `probeListener.separatePort` option: when unset, probe handlers bind to the same listener that serves user request traffic (the fused topology); when set to a port number, probe handlers bind to a dedicated HTTP listener on that port and the user-traffic listener does not serve probe paths. The separate-port listener binds the profile's probe path set only; no other route is served on that listener. The option is off by default and opt-in per environment.",
+  "deliveredBy": {
+    "tacId": "TAC-1503-observability-probe-endpoints-listener-topology",
+    "field": "interfaces.bindListenerTopology"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The response contract exposed to the external supervisor matches only what that supervisor consumes",
   "description": "Every profile's response is exactly what the supervising system reads and nothing more. HTTP-transport profiles that consume status code only (load balancer, uptime monitor, reverse proxy) return an empty response body with the resolved status code. HTTP-transport profiles that consume a body (Kubernetes HTTPGet, where the kubelet ignores body but operators inspect it during triage) return a minimal JSON body of the shape `{ \"status\": \"pass\" }` or `{ \"status\": \"fail\" }` with no additional fields. TCP-transport profiles complete the SYN-ACK handshake on pass and refuse the connection on fail. Exec-transport profiles exit with code 0 on pass and a non-zero code on fail. Supervisor-notify profiles emit exactly the notify calls the supervisor expects (for systemd: `READY=1` at startup, `WATCHDOG=1` on the configured watchdog cadence).",
+  "deliveredBy": {
+    "tacId": "TAC-1502-observability-probe-endpoints-handler-set",
+    "field": "interfaces.buildHandlerSet"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "No internal identifier is exposed on any external-visible probe response",
   "description": "The probe response, on every profile that emits a response payload, contains no dependency name, no environment name (dev, staging, live), no hostname, no replica id, no database identifier, no queue name, no internal URL, no build hash, no commit sha, no numeric metric value, no dependency count, no latency measurement, no error rate. The response is bounded to the fields REQ-005 enumerates for the profile and to the resolved status code. A profile that adds any field beyond that set is refused by the profile validator at boot with a stable-coded error naming the offending field.",
+  "deliveredBy": {
+    "adrId": "ADR-1505-observability-probe-endpoints-external-response-secrecy",
+    "field": "decision.externalResponseSecrecy"
+  },
   "category": "security",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-007.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The probe paths are auth-exempt scoped exactly to the resolved probe path set on the resolved listener",
   "description": "For every HTTP-transport profile, the probe path set the profile resolved (e.g., `/live` and `/ready` for Kubernetes default) is exempt from the project's auth middleware on the listener the profile bound those handlers to. The exemption is scoped by exact path match and by listener, never by prefix. When the fused topology is in effect, the exemption applies on the user-traffic listener for those exact paths only; when the separate-port topology is in effect, the exemption applies on the separate probe listener for those exact paths only and no auth middleware runs on the separate listener because no other route is served there. A path near a probe path but not on the resolved set (e.g., `/ready/next` when `/ready` is the probe) receives the project's normal auth treatment.",
+  "deliveredBy": {
+    "tacId": "TAC-1503-observability-probe-endpoints-listener-topology",
+    "field": "interfaces.exemptListInstaller"
+  },
   "category": "security",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-008.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A change of target integration profile is a configuration change; the source tree does not re-shape",
   "description": "Switching the target integration from one profile to another (for example, moving a service from a Kubernetes deployment to a Docker Compose deployment behind a load balancer) is expressed as a change to the operator-declared profile name and its per-profile options. The source tree that binds the profile handlers and the profile-resolver call site do not change; the profile shift takes effect on the next process start. A source-tree change is required only when the operator authors a new custom profile or extends the shipped profile set; existing profiles are switched by configuration alone.",
+  "deliveredBy": {
+    "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+    "field": "interfaces.contractValidator"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14101.json

@@ -11,21 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-14101-1",
-      "description": "A process configured with `probeInterface.profile: kubernetes` boots and binds probe handlers whose paths and port topology match the resolved Kubernetes profile.",
+      "description": "A process configured with `probeInterface.profile: kubernetes` boots and binds probe handlers whose paths and port topology match the resolved Kubernetes profile. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process configuration whose profile declaration resolves to `kubernetes` with default paths and fused-listener topology",
       "when": "the process boots and its probe-binding step completes",
       "then": "the running listener answers GET on the profile-declared liveness path (default /live) with 200 and on the profile-declared readiness path (default /ready) with 200 or 503, and no probe handler is bound at any path outside the profile-declared set",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14101-2",
-      "description": "A process configured without a `probeInterface.profile` declaration and no shipped default refuses to boot with a stable-coded error naming the missing declaration.",
-      "given": "a process configuration whose profile declaration is absent and whose environment has removed the shipped default",
-      "when": "the process boots and its profile-resolution step runs",
-      "then": "the process exits with a non-zero code and emits a `PROBE_PROFILE_MISSING` error naming the declaration field the operator must set",
+      "description": "A process configured without a `probeInterface.profile` declaration falls back to the shipped Kubernetes default per ADR-1503 and boots normally on the kubernetes profile handlers.",
+      "given": "a process with no `probeInterface.profile` declaration on the applied configuration and the shipped Kubernetes default present",
+      "when": "the process boots",
+      "then": "the process boots without error, the resolved profile is `kubernetes`, and the running listener answers GET on `/live` and `/ready` with 200",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1503-observability-probe-endpoints-kubernetes-default",
+        "field": "decision.kubernetesDefault"
+      }
     },
     {
       "id": "AC-14101-3",
@@ -34,7 +40,22 @@
       "when": "the process boots and its profile-resolution step runs",
       "then": "the process exits with a non-zero code and emits a `PROBE_PROFILE_UNKNOWN` error whose message contains the offending value and the enumerated valid profile names",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-14101-4",
+      "description": "A process configured with a `probeInterface` declaration that is syntactically malformed (not an object, or an object missing the required per-profile keys) refuses to boot with the stable-coded PROBE_PROFILE_MALFORMED error naming the offending shape.",
+      "given": "a process with `probeInterface` set to a non-object value (a bare string, an array), OR to an object that names a valid profile but omits per-profile required keys",
+      "when": "the process boots",
+      "then": "the process exits with a non-zero code and emits a `PROBE_PROFILE_MALFORMED` error whose message names the offending shape (the type it received and the required keys it expected); no listener binds",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+        "field": "interfaces.contractValidator"
+      }
     }
   ],
   "tacIds": [
@@ -42,5 +63,5 @@
     "TAC-1502-observability-probe-endpoints-handler-set"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14102.json

@@ -16,7 +16,8 @@
       "when": "an unauthenticated GET is issued against `/live` on the request-traffic listener port",
       "then": "the response status code is 200 and the JSON body equals `{\"status\":\"pass\"}`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14102-2",
@@ -25,7 +26,8 @@
       "when": "a GET is issued against `/live`",
       "then": "the observer records zero egress connections attributable to the handler between request receipt and response send",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14102-3",
@@ -34,16 +36,32 @@
       "when": "the stubbed state is set to pass and a GET is issued against `/ready`, then the stubbed state is set to fail and a GET is issued again",
       "then": "the first response has status 200 and body `{\"status\":\"pass\"}`; the second response has status 503 and body `{\"status\":\"fail\"}`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14102-4",
-      "description": "When the operator sets probeInterface.options.kubernetes.startup.enabled: true on the shipped Kubernetes profile, the resolver returns a three-path set including the startup path (default /startup) and the handler-set builder generates a startup handler that answers pass once the operator-declared startup predicate returns pass and fail otherwise.",
+      "description": "When the operator sets probeInterface.options.kubernetes.startup.enabled: true on the shipped Kubernetes profile, the resolver returns a three-path set including the startup path (default /startup) and the handler-set builder generates a startup handler that answers pass once the operator-declared startup predicate returns pass and fail otherwise. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the shipped kubernetes profile with probeInterface.options.kubernetes.startup.enabled set to true, a startup predicate wired against a stubbed initialisation state, and the paths option left at its default",
       "when": "the resolver runs at boot, and then GETs are issued against /startup with the stubbed state first fail then pass",
       "then": "the resolver returns { profile: kubernetes, paths: [/live, /ready, /startup] }; the first GET on /startup returns 503 with body {\"status\":\"fail\"}; the second GET on /startup returns 200 with body {\"status\":\"pass\"}; without the enable flag the resolver returns two paths and no /startup handler is registered",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-14102-5",
+      "description": "A Kubernetes-profile liveness handler on a process whose in-process liveness self-check predicate returns fail answers HTTP 503 with an empty body, so a kubelet restart is triggered on the next probe interval; the predicate is response-capable by design (a watchdog-style tick that runs on a scheduled interval and sets a boolean the handler reads without I/O). Template values the applying agent sets: The applying agent supplies the liveness self-check predicate the AC observes (the scheduled heartbeat and its budget); the AC exercises the failure branch of that predicate rather than proving the predicate itself.",
+      "given": "a process on the shipped Kubernetes default with a project-owned liveness self-check predicate (a scheduled 1-second heartbeat that has not fired within its 5-second budget flips the predicate to fail) and no dependency coupling on this handler",
+      "when": "kubelet issues HTTP GET /live while the predicate is in the fail state",
+      "then": "the response is HTTP 503 with content-length 0 and an empty body; a follow-up GET while the predicate is still fail continues to answer 503; a GET after the predicate returns to pass answers 200",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1502-observability-probe-endpoints-handler-set",
+        "field": "interfaces.readinessPredicate"
+      }
     }
   ],
   "tacIds": [
@@ -51,5 +69,5 @@
     "TAC-1503-observability-probe-endpoints-listener-topology"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-09-04T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14103.json

@@ -16,7 +16,8 @@
       "when": "the profile resolver runs at boot",
       "then": "the resolved profile object has non-null `transport`, non-empty `paths` or its transport-appropriate equivalent, non-null `responseContract`, and non-null `semanticModel`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14103-2",
@@ -25,7 +26,8 @@
       "when": "the profile resolver runs at boot",
       "then": "the process exits with a non-zero code and emits a `PROBE_PROFILE_INCOMPLETE` error naming the missing field and the profile name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14103-3",
@@ -34,7 +36,8 @@
       "when": "the profile resolver runs and the handler set binds",
       "then": "exactly one HTTP GET handler is bound at the profile's resolved path (default `/health`), no handler is bound at `/live` or `/ready`, and the resolved profile's `semanticModel` equals `singleHealthSignal`",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14104.json

@@ -11,30 +11,33 @@
   "acceptanceCriteria": [
     {
       "id": "AC-14104-1",
-      "description": "When `probeListener.separatePort: <N>` is set on the Kubernetes profile, probe handlers bind to port N and no probe handler is bound on the user-traffic listener.",
+      "description": "When `probeListener.separatePort: <N>` is set on the Kubernetes profile, probe handlers bind to port N and no probe handler is bound on the user-traffic listener. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process configured with `probeInterface.profile: kubernetes` and `probeListener.separatePort: 9091` with a distinct user-traffic port",
       "when": "the process boots and the topology binds",
       "then": "a GET against `/live` on port 9091 returns 200, a GET against `/live` on the user-traffic port returns 404 (or the project's default not-found response), and a GET against `/ready` on the user-traffic port returns 404",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14104-2",
-      "description": "The separate probe listener binds only the profile's resolved probe path set; any other path returns not-found on the probe listener.",
+      "description": "The separate probe listener binds only the profile's resolved probe path set; any other path returns not-found on the probe listener. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the Kubernetes profile with `probeListener.separatePort: 9091` and a user-authored `/api/orders` route on the traffic listener",
       "when": "a GET against `/api/orders` is issued against port 9091",
       "then": "the response status is 404 (or the profile's declared not-found), and the request is not routed to the `/api/orders` handler",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14104-3",
-      "description": "The default topology remains fused (probes bind on the user-traffic listener) when `probeListener.separatePort` is unset.",
+      "description": "The default topology remains fused (probes bind on the user-traffic listener) when `probeListener.separatePort` is unset. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the Kubernetes profile with no `probeListener.separatePort` override",
       "when": "the process boots and the topology binds",
       "then": "GET `/live` on the user-traffic listener returns 200 and no additional listener is opened",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14105.json

@@ -16,7 +16,8 @@
       "when": "an HTTP GET is issued against the resolved health path in each state",
       "then": "the pass response has status 200 with content-length 0 and no body; the fail response has status 503 with content-length 0 and no body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14105-2",
@@ -25,7 +26,8 @@
       "when": "an HTTP GET is issued against `/live` and `/ready` in each state and the parsed JSON body key set is inspected",
       "then": "the parsed body is exactly a one-key object whose only key is `status` and whose value is `pass` or `fail` matching the resolved answer",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-14105-3",
@@ -34,7 +36,50 @@
       "when": "the profile's healthcheck command entry point is invoked in each state",
       "then": "the pass invocation exits with code 0; the fail invocation exits with a non-zero code; the process opens no HTTP probe listener when this profile is selected",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-14105-4",
+      "description": "A systemd-profile process under Type=notify emits sd_notify(READY=1) exactly once after boot completes and sd_notify(WATCHDOG=1) at the configured watchdog cadence for the process lifetime; a process that fails to send WATCHDOG within the cadence budget is signalled fail by the systemd supervisor. Template values the applying agent sets: The applying agent supplies the elicited probe-interface-profile value (systemd or a TCP-transport profile), the systemd watchdog cadence, and the TCP probe port; the AC substitutes those for the illustrative values.",
+      "given": "a process configured with probe-interface-profile=systemd, watchdog cadence 10 seconds, and a project-owned readiness predicate returning pass",
+      "when": "the process boots and runs for 30 seconds under a mock systemd notify sink",
+      "then": "the sink records exactly one READY=1 line after boot and at least two WATCHDOG=1 lines within the 30-second window; if the process is paused past the watchdog budget, the sink records no further WATCHDOG=1 lines and the supervisor pull is signalled",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1504-observability-probe-endpoints-non-http-adapters",
+        "field": "interfaces.notifyImplementation"
+      }
+    },
+    {
+      "id": "AC-14105-5",
+      "description": "A TCP-transport probe profile answers a TCP socket connect on the configured probe port with an accept on pass and a refuse (RST) on fail; the response is the accept/refuse itself and no bytes are exchanged on the connection. Template values the applying agent sets: The applying agent supplies the elicited probe-interface-profile value (systemd or a TCP-transport profile), the systemd watchdog cadence, and the TCP probe port; the AC substitutes those for the illustrative values.",
+      "given": "a process configured with a TCP-transport profile (a custom profile or a supervising system that reads TCP accept/refuse), probe port 9091, and a readiness predicate returning pass then fail",
+      "when": "a supervisor issues one TCP connect while pass, then one TCP connect after the predicate flips to fail",
+      "then": "the pass connect completes the three-way handshake and reads zero bytes on the connection before close; the fail connect is refused (RST or connection refused) within the connect timeout; no application-layer data crosses the connection in either case",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1504-observability-probe-endpoints-non-http-adapters",
+        "field": "interfaces.selectAdapter"
+      }
+    },
+    {
+      "id": "AC-14105-6",
+      "description": "A process configured with a target-integration profile whose platform adapter is missing (the project has not supplied the systemd notify sink for the systemd profile, or the TCP listener factory for a TCP-transport profile) refuses to boot with the stable-coded PROBE_ADAPTER_MISSING error naming the missing adapter and the profile that requires it.",
+      "given": "a process configured with a systemd profile but without an sd_notify implementation supplied on TAC-1504 selectAdapter",
+      "when": "the process boots",
+      "then": "the process exits with a non-zero code and emits PROBE_ADAPTER_MISSING naming the profile (systemd) and the missing adapter (notify implementation); no listener binds",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1504-observability-probe-endpoints-non-http-adapters",
+        "field": "interfaces.selectAdapter"
+      }
     }
   ],
   "tacIds": [
@@ -42,5 +87,5 @@
     "TAC-1504-observability-probe-endpoints-non-http-adapters"
   ],
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-probe-endpoints/contributions/user-stories/observability-probe-endpoints-us-14106.json

@@ -11,30 +11,33 @@
   "acceptanceCriteria": [
     {
       "id": "AC-14106-1",
-      "description": "The Kubernetes profile's `/live` and `/ready` responses contain no substring matching a declared dependency name, environment name, hostname, replica identifier, build hash, or commit sha.",
+      "description": "The Kubernetes profile's `/live` and `/ready` responses contain no substring matching a declared dependency name, environment name, hostname, replica identifier, build hash, or commit sha. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a process on the Kubernetes profile with declared dependencies `paymentsProvider` and `primaryStore`, environment `live`, hostname `svc-abc-123`, build hash `deadbeef`, commit sha `abcd1234abcd1234abcd1234abcd12341234abcd`",
       "when": "an HTTP GET is issued against `/live` and against `/ready` and each response body is scanned for the tokens above",
       "then": "no scan finds any of the tokens on either response body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14106-2",
-      "description": "The profile validator refuses a profile override that adds a field beyond the enumerated response contract at boot.",
+      "description": "The profile validator refuses a profile override that adds a field beyond the enumerated response contract at boot. Template values the applying agent sets: The applying agent sets the elicited target-integration-profile (or its equivalent target-integration elicit); the AC substitutes the project's profile name for the illustrative Kubernetes / loadBalancer / reverseProxy / systemd tokens.",
       "given": "a profile configuration that adds a `dependencies` array to the Kubernetes profile's response body",
       "when": "the profile validator runs at boot",
       "then": "the process exits with a non-zero code and emits a `PROBE_RESPONSE_FIELD_REFUSED` error naming the offending field and the profile name",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-14106-3",
       "description": "The load-balancer and reverse-proxy profile responses contain content-length zero on every request.",
       "given": "a process on the `loadBalancer` profile and a second process on the `reverseProxy` profile, both booted normally",
       "when": "HTTP GET requests are issued against the resolved health path on each process for both pass and fail states",
-      "then": "every response carries `Content-Length: 0` and the response body is empty",
+      "then": "every response carries the `content-length` header with value 0 and the response body is empty",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [