rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-api-rest/CHANGELOG.md

@@ -0,0 +1,26 @@
+# application-api-rest CHANGELOG
+
+## 2.1.5 - 2026-09-10
+
+Findings closed: F-2, F-3, F-4, F-5, F-6, F-7, F-8. Template-AC fill-in clauses on AC-2102-2, AC-2104-6, AC-2106-4, AC-2108-4, AC-2112-1, AC-2118-3 and AC-2119-5 now enumerate the specific applying-project substitutions (declared property-name casing, documentation-exposure policy per environment, operation-to-auth-class mapping onto the four classes fixed on REQ-005, resolved startup-probe path, idempotency-key verb-and-class combinations, deploy documentation location and order, verification-pipeline definition) in place of the generic phrasing. TAC-303-application-api-rest-contract-surface patch-bumped to 1.0.2: responsibilities[2] now names `x-idempotency-key` (`required` or `forbidden`) explicitly and references AC-2112-1.
+
+
+## 2.1.4 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-013: REQ description now references the request-id header owned on TAC-301.responsibilities[0] rather than restating the header literal. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 2.1.3 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 2.1.2 (application-core completion pass, 2026-09-09)
+
+- Donor hand-sweep on all 118 ACs: flipped 24 additional ACs from fixed to template where the assertion carries a project-set literal (deprecation dates, per-endpoint auth-class binding, downstream dependency sets on readiness, resolved probe paths, declared page-size and maximum limits, filter parameter and sortable-key sets, key-required operation set, de-duplication TTL, per-class rate-limit values and window durations, per-endpoint rate-limit overrides, log-level per class, histogram bucket boundaries, per-endpoint CORS overrides, PII-redaction policy). Each flipped AC carries an Applying agent sets: <specific values> clause. Final split: 87 fixed / 31 template.
+- Adds vendorCitation to seven ACs whose assertions rest on RFC wire shapes: AC-2102-3 cites RFC 3339 (Date and Time on the Internet: Timestamps); AC-2111-1 through AC-2111-6 cite RFC 7807 (Problem Details for HTTP APIs). Both citation URLs point at datatracker.ietf.org and carry verifiedOn 2026-09-09 (fetched via WebFetch during this pass).
+
+## 2.1.1 (application-core hardening, 2026-09-09)
+
+- hardening pass: chain-consistency lint zero (pass1 + pass2); added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed case drifts on `content-type` and `idempotency-key` in REQ-002, REQ-010, AC-2102-4, AC-2102-5, AC-2112-1, AC-2112-2 and ADR-306 to match the owner spellings on TAC-301.
+- Added AC-2108-9 (readiness deadline: aggregate 503 naming the failed check id and the configured deadline while liveness continues at 200) covering the 2026-09-08 review finding F-1 on TAC-306.interfaces[0] (readiness check registry).
+
+

package/blueprints/application-api-rest/assets/samples/request-response-pairs.md

@@ -1,5 +1,7 @@
 # Sample request-response pairs per verb class
 
+Owner: the `X-Request-Id` header these pairs display is owned on `TAC-301-application-api-rest-request-pipeline.responsibilities[0]`. The samples below demonstrate wire shape.
+
 Reference realisations of the wire contract (application-api-rest-REQ-002, application-api-rest-REQ-007, application-api-rest-REQ-009, application-api-rest-REQ-010) using the illustrative `widgets` resource from the OpenAPI skeleton. The shapes are normative; the resource is not. All timestamps RFC-3339 UTC, all properties camelCase, every response with an explicit Content-Type.
 
 ## GET, collection page (filtered, sorted, paginated)

package/blueprints/application-api-rest/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-api-rest",
-  "version": "2.1.0",
+  "version": "2.1.5",
   "category": "application",
   "contributions": [
     {

package/blueprints/application-api-rest/contributions/adrs/adr-301-application-api-rest-error-envelope.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-301-application-api-rest-error-envelope",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "RFC 7807 problem details as the error shape the service produces",
   "context": "Every error the service emits is part of its wire contract, including the failures nobody plans: auth rejections, rate limits, malformed input, unhandled exceptions. The wire error shape is a whole-project decision with room for exactly one answer, shared with whatever consumes the API; this record is the producer half. A client-tier blueprint applied to the same project contributes its own decision on the same topic, and blueprint composition surfaces that pairing for the operator to reconcile at add time. That surfacing is intended.",

package/blueprints/application-api-rest/contributions/adrs/adr-302-application-api-rest-auth-model.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-302-application-api-rest-auth-model",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Four declared auth classes enforced by middleware as the service's authentication model",
   "context": "A project has one authentication model; endpoints, clients, and operators all reason against it. The server half of that model must make every endpoint's auth posture declared, enumerable, and enforced in one place. A client-tier blueprint applied to the same project contributes its own decision on this topic (how the client authenticates and holds session), and blueprint composition surfaces the pairing at add time for the operator to reconcile into one project-level model. That surfacing is intended.",

package/blueprints/application-api-rest/contributions/adrs/adr-303-application-api-rest-api-versioning.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-303-application-api-rest-api-versioning",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Major version in the URL path as the project's API versioning strategy",
   "context": "Versioning strategy is a whole-project decision: clients, caches, gateways, documentation, and support all key on it, and two strategies on one surface is chaos. The candidates are path versioning, header versioning, media-type versioning, and no versioning with additive-only evolution.",

package/blueprints/application-api-rest/contributions/adrs/adr-304-application-api-rest-logging.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-304-application-api-rest-logging",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "status": "accepted",
   "title": "Historical: structured JSON lines with request-scoped correlation as the project's primary logging shape (superseded by observability-logging-ADR-1601 as the shelf-canonical logging global-topic owner from api-rest v2.1.0)",
   "context": "A project has one primary logging shape; aggregation, alerting, retention, and redaction tooling are all built against it, and mixed shapes halve the value of every query. The decision covers the line format, the mandatory fields, and where correlation ids live.",

package/blueprints/application-api-rest/contributions/adrs/adr-305-application-api-rest-pagination.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-305-application-api-rest-pagination",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Cursor-based pagination as the collection traversal default",
   "context": "Every collection needs a pagination story, and the story must be the same everywhere or clients write one traversal routine per collection. The realistic candidates are offset/limit and cursor-based.",

package/blueprints/application-api-rest/contributions/adrs/adr-306-application-api-rest-idempotency.json

@@ -2,11 +2,11 @@
   "adrId": "ADR-306-application-api-rest-idempotency",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
-  "title": "Idempotency-Key with a server-side replay cache for duplicate-harmful mutations",
+  "title": "idempotency-key with a server-side replay cache for duplicate-harmful mutations",
   "context": "Clients retry; networks guarantee it. For mutations whose double application harms (creations, payments, state transitions), the service needs a mechanism that makes a retry safe without asking every client to build its own de-duplication.",
-  "decision": "Duplicate-harmful operations declare Idempotency-Key required in the contract. The server keys a replay cache on (endpoint, principal, key): first execution stores the response, repeats within the declared TTL (default 24 hours, project-configurable) replay it, same key with a different body is 422, concurrent duplicate is 409 while the original is in flight. The cache lives in the project's shared state store so replay works across instances (application-api-rest-REQ-010, application-api-rest-US-2112).",
+  "decision": "Duplicate-harmful operations declare idempotency-key required in the contract. The server keys a replay cache on (endpoint, principal, key): first execution stores the response, repeats within the declared TTL (default 24 hours, project-configurable) replay it, same key with a different body is 422, concurrent duplicate is 409 while the original is in flight. The cache lives in the project's shared state store so replay works across instances (application-api-rest-REQ-010, application-api-rest-US-2112).",
   "consequences": "Retries become free for clients and safe for the business. The costs: a state-store dependency for the cache, TTL-bounded storage per keyed mutation, and the declared-required set must be maintained as the surface grows; the contract validation that already checks auth classes checks the idempotency declaration the same way.",
   "alternativesConsidered": [
     {

package/blueprints/application-api-rest/contributions/adrs/adr-307-application-api-rest-openapi-generation.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-307-application-api-rest-openapi-generation",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "OpenAPI generated from source at build time, defended by drift validation",
   "context": "The contract document can be authored spec-first (hand-written spec, implementation follows) or generated from the implementation. Either can work; what cannot work is a hand-maintained spec beside a moving implementation with nothing enforcing agreement.",

package/blueprints/application-api-rest/contributions/adrs/adr-308-application-api-rest-rate-limiting.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-308-application-api-rest-rate-limiting",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Rate limits keyed to auth classes with per-endpoint overrides",
   "context": "Rate limiting needs a policy anchor: something stable that limits attach to. Candidates are one global limit, per-endpoint hand-tuning, or the auth classes the surface already declares.",

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-001.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:01-resource-modelling"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities.endpoint"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "application-api-rest-REQ-002",
   "prdId": "PRD-001",
   "title": "Wire contract: JSON only, consistent casing, RFC-3339 UTC timestamps, explicit content types",
-  "description": "Every request and response body is JSON. Property casing is consistent across the whole surface (camelCase by default; a project may configure another casing but must then apply it everywhere). Timestamps are ISO-8601 in RFC-3339 form, UTC, on every temporal field. Every response carries an explicit Content-Type header; no response relies on client-side sniffing.",
+  "description": "Every request and response body is JSON. Property casing is consistent across the whole surface (camelCase by default; a project may configure another casing but must then apply it everywhere). Timestamps are ISO-8601 in RFC-3339 form, UTC, on every temporal field. Every response carries an explicit content-type header; no response relies on client-side sniffing.",
   "category": "technical",
   "domain": "wire-contract",
   "priority": "must",
@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:02-wire-contract"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "purpose.content-type"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-003.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:03-versioning"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-004.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:04-openapi-generation"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-303-application-api-rest-contract-surface",
+    "field": "responsibilities.hand-written"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-005.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:05-auth-classes"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-006.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:06-probe-endpoints"
   ],
-  "version": "2.0.0",
+  "version": "2.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-09-04T00:00:00Z"
+  "updatedAt": "2026-09-04T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-007.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:07-pagination"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-008.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:08-filtering-sorting"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "interfaces.problem-details"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-009.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:09-error-envelope"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-010.json

@@ -1,8 +1,8 @@
 {
   "reqId": "application-api-rest-REQ-010",
   "prdId": "PRD-001",
-  "title": "Idempotency: declared Idempotency-Key handling on non-safe verbs with server-side de-duplication",
-  "description": "Non-safe verbs (POST, and any PATCH whose double application would harm) accept an Idempotency-Key header. The project declares which verbs and resource classes require the key; for those, the server de-duplicates by key in a cache with a declared TTL, replaying the original response on repeats within the TTL and rejecting key reuse with a different request body.",
+  "title": "Idempotency: declared idempotency-key handling on non-safe verbs with server-side de-duplication",
+  "description": "Non-safe verbs (POST, and any PATCH whose double application would harm) accept an idempotency-key header. The project declares which verbs and resource classes require the key; for those, the server de-duplicates by key in a cache with a declared TTL, replaying the original response on repeats within the TTL and rejecting key reuse with a different request body.",
   "category": "functional",
   "domain": "idempotency",
   "priority": "must",
@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:10-idempotency"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-011.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:11-rate-limiting"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-012.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:12-observability"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-013.json

@@ -2,7 +2,7 @@
   "reqId": "application-api-rest-REQ-013",
   "prdId": "PRD-001",
   "title": "Request-id propagation: every request carries or is assigned an id that survives the whole call chain",
-  "description": "Every inbound request either carries an X-Request-Id header or is assigned one at the edge. The response echoes the id, every request-scoped log line includes it, and every downstream call the service makes on behalf of the request propagates it, so one id follows one user action across every hop.",
+  "description": "Every inbound request either carries the request-id header named on TAC-301-application-api-rest-request-pipeline.responsibilities[0] or is assigned one at the edge. The response echoes the id, every request-scoped log line includes it, and every downstream call the service makes on behalf of the request propagates it, so one id follows one user action across every hop.",
   "category": "technical",
   "domain": "correlation",
   "priority": "must",
@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:13-request-id"
   ],
-  "version": "1.0.0",
+  "version": "1.0.2",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-10T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-014.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:14-migrations"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-015.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:15-contract-tests"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "responsibilities"
+  }
 }

package/blueprints/application-api-rest/contributions/requirements/application-api-rest-req-016.json

@@ -11,8 +11,12 @@
     "blueprint:application-api-rest",
     "category:16-security-baselines"
   ],
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-08-19T10:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-301-application-api-rest-request-pipeline",
+    "field": "interfaces.per-endpoint"
+  }
 }

package/blueprints/application-api-rest/contributions/tacs/tac-301-application-api-rest-request-pipeline.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-301-application-api-rest-request-pipeline",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Request pipeline",
   "purpose": "Owns the ordered middleware chain every request traverses: request-id assignment, auth-class enforcement, rate limiting, idempotency handling, body parsing with strict content-type and parameter validation, and the terminal error boundary that guarantees the problem-details envelope on every failure path.",

package/blueprints/application-api-rest/contributions/tacs/tac-302-application-api-rest-auth-middleware.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-302-application-api-rest-auth-middleware",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Auth middleware: the four class slots",
   "purpose": "Implements the four auth classes as distinct middleware slots (public, user, admin, service) so every endpoint's auth posture is a declared class membership enforced in one place, not handler-by-handler discipline.",

package/blueprints/application-api-rest/contributions/tacs/tac-303-application-api-rest-contract-surface.json

@@ -2,14 +2,14 @@
   "tacId": "TAC-303-application-api-rest-contract-surface",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "status": "approved",
   "name": "Contract surface: OpenAPI generation, serving, and drift defence",
   "purpose": "Owns the generated OpenAPI 3.1 document as a build artefact: generation from source, serving at /openapi.json, /openapi.yaml, and /docs, and the three-axis drift validation that keeps implementation and contract provably identical.",
   "responsibilities": [
     "Generate the OpenAPI 3.1 document from route definitions and schema annotations at build time; no hand-written parallel spec exists (application-api-rest-REQ-004).",
     "Serve the generated document and the interactive documentation UI per the declared exposure policy (AC-2104-6).",
-    "Publish per-operation metadata: operationId, schemas, x-auth-class, rate-limit overrides, idempotency requirements.",
+    "Publish per-operation metadata on the generated document: operationId, request and response schemas, `x-auth-class` (REQ-005), rate-limit overrides, and `x-idempotency-key` (`required` or `forbidden`) per non-safe verb on the declared verb-plus-resource-class combinations (AC-2112-1).",
     "Run contract validation in the build: implemented-but-undeclared, declared-but-unimplemented, and type-level schema mismatch each fail the build (application-api-rest-REQ-004, AC-2105-4).",
     "Drive spec-derived conformance verification so every declared operation is exercised on the request, error, and auth axes (application-api-rest-REQ-015)."
   ],

package/blueprints/application-api-rest/contributions/tacs/tac-304-application-api-rest-resource-layer.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-304-application-api-rest-resource-layer",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Resource layer: routes, representations, and collection conventions",
   "purpose": "Owns the versioned resource surface: the route inventory under /v1, one representation model per resource class, and the shared collection machinery for pagination, filtering, and sorting so every collection behaves identically.",

package/blueprints/application-api-rest/contributions/tacs/tac-305-application-api-rest-observability.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-305-application-api-rest-observability",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "name": "Observability: logs, metrics, and traces from one signal model",
   "purpose": "Owns the three telemetry signals as one coherent model: structured JSON logs, RED metrics with per-class and probe series, and OpenTelemetry-compatible traces, all keyed by the same request id and auth class so any signal pivots to the others.",

package/blueprints/application-api-rest/contributions/tacs/tac-306-application-api-rest-operability.json

@@ -2,7 +2,7 @@
   "tacId": "TAC-306-application-api-rest-operability",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "status": "approved",
   "name": "Operability: probes (at resolved paths), lifecycle, migrations, and the meta endpoint",
   "purpose": "Owns what an orchestrator and an operator need from the outside: the three probe endpoints, the initialisation lifecycle they report on, the forward-only migration machinery, and the /v1/_meta version report.",

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2101.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2101",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Noun-based resource surface with scoped hierarchy and declared representations",
   "asA": "API consumer building a client",
@@ -16,7 +16,8 @@
       "when": "path segments are checked against the resource model",
       "then": "every segment is a plural noun, a resource identifier, or a declared sub-resource; none is a verb",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2101-2",
@@ -25,7 +26,8 @@
       "when": "each nested path is compared against the relationship it models",
       "then": "every nested path corresponds to a declared 1:N always-scoped relationship and no independent resource is parent-scoped",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2101-3",
@@ -34,7 +36,8 @@
       "when": "the request shape is inspected",
       "then": "the filter travels as documented query parameters or a declared sub-resource path, not an invented segment",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2101-4",
@@ -43,7 +46,8 @@
       "when": "their response bodies are compared field by field",
       "then": "both conform to the same documented representation model",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2101-5",
@@ -52,7 +56,8 @@
       "when": "each operation's verb and behaviour are reviewed",
       "then": "every operation's behaviour matches its verb's declared semantics",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2101-6",
@@ -61,7 +66,8 @@
       "when": "the response is inspected",
       "then": "the body carries the resulting representation, or the 201 response carries a Location header resolving to it",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [