rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2102.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2102",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-002",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "One wire contract: JSON bodies, consistent casing, UTC timestamps, explicit content types",
   "asA": "API consumer parsing responses mechanically",
@@ -16,16 +16,22 @@
       "when": "request and response media types are enumerated from the generated spec and observed responses",
       "then": "every body media type is application/json or a JSON-structured type such as application/problem+json",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-2102-2",
-      "description": "Property names follow the project's declared casing (camelCase unless configured otherwise) on every request and response body, with zero mixed-casing endpoints.",
+      "description": "Property names follow the project's declared casing (camelCase unless configured otherwise) on every request and response body, with zero mixed-casing endpoints. Applying agent sets: the declared property-name casing (default camelCase) recorded on the OpenAPI generator configuration, and any per-endpoint casing overrides.",
       "given": "the schemas in the generated OpenAPI spec",
       "when": "every property name is checked against the declared casing rule",
       "then": "no property deviates from the declared casing",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2102-3",
@@ -34,25 +40,32 @@
       "when": "the field value is parsed",
       "then": "it parses as RFC-3339, is in UTC, and carries the offset designator",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://datatracker.ietf.org/doc/html/rfc3339",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-2102-4",
-      "description": "Every response, including errors and empty-body statuses, carries an explicit Content-Type header appropriate to its body.",
+      "description": "Every response, including errors and empty-body statuses, carries an explicit content-type header appropriate to its body.",
       "given": "any endpoint response including 4xx and 5xx paths",
       "when": "response headers are inspected",
-      "then": "Content-Type is present and correct; no body-bearing response omits it",
+      "then": "content-type is present and correct; no body-bearing response omits it",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2102-5",
-      "description": "A request with an unsupported Content-Type is rejected with 415 and a problem-details body rather than being parsed permissively.",
-      "given": "a POST with a body and a non-JSON Content-Type",
+      "description": "A request with an unsupported content-type is rejected with 415 and a problem-details body rather than being parsed permissively.",
+      "given": "a POST with a body and a non-JSON content-type",
       "when": "the request is submitted",
       "then": "the service responds 415 with the declared error envelope",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2102-6",
@@ -61,7 +74,8 @@
       "when": "the request is submitted",
       "then": "the service responds 400 with the declared error envelope naming the parse failure",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -69,5 +83,5 @@
     "TAC-304-application-api-rest-resource-layer"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2103.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2103",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-003",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "status": "approved",
   "title": "Path-versioned contract with announced deprecation and a stated drop policy",
   "asA": "API consumer maintaining a long-lived integration",
@@ -16,7 +16,12 @@
       "when": "paths are checked for the version prefix",
       "then": "every path is version-prefixed except the resolved probe paths, /openapi.*, and /docs",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[1].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-2103-2",
@@ -25,7 +30,8 @@
       "when": "the request is submitted",
       "then": "the service responds 404 with the declared error envelope listing supported versions",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2103-3",
@@ -34,30 +40,33 @@
       "when": "their generated specs are diffed",
       "then": "no field is removed or retyped and no endpoint's contract narrows within the version",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2103-4",
-      "description": "Every response from a deprecated version carries Deprecation and Sunset headers with the retirement date.",
+      "description": "Every response from a deprecated version carries Deprecation and Sunset headers with the retirement date. Applying agent sets: the retirement date on Deprecation and Sunset headers per deprecated version.",
       "given": "a version marked deprecated",
       "when": "any of its endpoints responds",
       "then": "Deprecation and Sunset headers are present and the Sunset date matches the declared policy",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2103-5",
-      "description": "The version-drop policy is stated in the served documentation: minimum notice period and the response clients receive after drop (410 with a problem-details body pointing at the successor version).",
+      "description": "The version-drop policy is stated in the served documentation: minimum notice period and the response clients receive after drop (410 with a problem-details body pointing at the successor version). Applying agent sets: the minimum notice period and the successor version name in the served documentation.",
       "given": "the served documentation and a dropped version",
       "when": "a request reaches a dropped version",
       "then": "the service responds 410 with the declared error envelope naming the successor, matching the documented policy",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-304-application-api-rest-resource-layer"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-09-04T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2104.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2104",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-004",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "OpenAPI 3.1 generated from source and served alongside interactive documentation",
   "asA": "API consumer evaluating and integrating the service",
@@ -16,7 +16,8 @@
       "when": "the build runs",
       "then": "the OpenAPI document is emitted as a build artefact derived from source annotations or route definitions, and no hand-maintained duplicate exists",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2104-2",
@@ -25,7 +26,12 @@
       "when": "both documentation URLs are fetched",
       "then": "both return 200 with correct content types and parse to the same specification",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-2104-3",
@@ -34,7 +40,12 @@
       "when": "/docs is loaded",
       "then": "the documentation UI renders from the served spec and every endpoint in the spec is browsable",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-2104-4",
@@ -43,30 +54,41 @@
       "when": "an OpenAPI 3.1 validator runs against it",
       "then": "validation passes with zero errors",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2104-5",
-      "description": "Every operation in the generated spec carries an operationId, a summary, request and response schemas, and the x-auth-class extension; no operation ships undocumented.",
+      "description": "Every operation in the generated spec carries an operationId, a summary, request and response schemas, and the x-auth-class extension; no operation ships undocumented. Applying agent sets: the operationId, summary, request/response schemas and x-auth-class value per declared operation.",
       "given": "the generated OpenAPI document",
       "when": "each operation is inspected",
       "then": "operationId, summary, schemas, and x-auth-class are present on every operation",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "template"
     },
     {
       "id": "AC-2104-6",
-      "description": "The documentation endpoints (/openapi.json, /openapi.yaml, /docs) respond according to the project's declared exposure policy, and in non-production environments they are always available.",
+      "description": "The documentation endpoints (/openapi.json, /openapi.yaml, /docs) respond according to the project's declared exposure policy, and in non-production environments they are always available. Applying agent sets: the documentation-exposure policy per environment (which of /openapi.json, /openapi.yaml and /docs each environment serves), recorded on the API surface configuration.",
       "given": "the declared exposure policy and a non-production deployment",
       "when": "the documentation URLs are fetched",
       "then": "responses match the declared policy, and the non-production deployment serves all three",
       "testable": true,
-      "scope": "deployed"
+      "scope": "deployed",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[1].name"
+      },
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-303-application-api-rest-contract-surface"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2105.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2105",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-004",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Contract-drift detection: implementation and spec verified against each other",
   "asA": "platform operator relying on the published contract",
@@ -16,7 +16,12 @@
       "when": "the two inventories are compared",
       "then": "every implemented route appears in the spec, and a deliberately added undeclared route makes the comparison fail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-2105-2",
@@ -25,7 +30,12 @@
       "when": "each declared operation is exercised",
       "then": "none returns a routing-level 404 or 501; a deliberately orphaned spec entry makes validation fail",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed"
     },
     {
       "id": "AC-2105-3",
@@ -34,7 +44,8 @@
       "when": "each observed response is validated against the spec schema",
       "then": "every response validates; a type-level mismatch fails the check naming the operation, status, and path into the schema",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2105-4",
@@ -43,7 +54,8 @@
       "when": "the pipeline runs",
       "then": "the build fails at the contract-validation step with a message naming the drift",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2105-5",
@@ -52,7 +64,8 @@
       "when": "its report is read",
       "then": "every declared operation appears with its verification outcome",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2106.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2106",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-005",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "status": "approved",
   "title": "Auth-class declaration: every endpoint names its class and middleware enforces it",
   "asA": "security reviewer auditing the API surface",
@@ -16,7 +16,8 @@
       "when": "every operation's x-auth-class value is read",
       "then": "each carries exactly one of the four declared values and no other",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2106-2",
@@ -25,7 +26,8 @@
       "when": "contract validation runs",
       "then": "validation fails naming the classless endpoint",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2106-3",
@@ -34,16 +36,18 @@
       "when": "the request is processed",
       "then": "the middleware rejects it and the handler observably does not execute",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2106-4",
-      "description": "Enforcement is driven by the same declaration the spec publishes: changing an endpoint's declared class changes its enforcement with no second edit site.",
+      "description": "Enforcement is driven by the same declaration the spec publishes: changing an endpoint's declared class changes its enforcement with no second edit site. Applying agent sets: the mapping from each operation to one of the four auth classes named on `application-api-rest-REQ-005.description` (public, authenticated user, admin, service-to-service).",
       "given": "an endpoint whose declared class is changed from user to admin",
       "when": "the service is rebuilt and the endpoint called with a non-admin user token",
       "then": "the request is rejected per the new class, and the spec and enforcement agree",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2106-5",
@@ -52,7 +56,8 @@
       "when": "each is submitted to a protected endpoint",
       "then": "responses are 401, 401, and 403 respectively, each with a problem-details body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2106-6",
@@ -61,7 +66,8 @@
       "when": "auth logic outside the four class middlewares is searched for",
       "then": "none exists; every endpoint's auth behaviour is fully attributable to its declared class",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2107.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2107",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-005",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Per-class behaviour: the four auth classes each honour their declared contract",
   "asA": "platform operator running the service for multiple caller populations",
@@ -16,7 +16,8 @@
       "when": "requests with and without auth headers are submitted",
       "then": "both succeed with identical behaviour and no resolved identity appears in logs or context",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2107-2",
@@ -25,7 +26,8 @@
       "when": "the burst is submitted",
       "then": "requests beyond the limit receive 429 per the rate-limiting contract",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2107-3",
@@ -34,7 +36,8 @@
       "when": "requests with a valid token, an expired token, and no token are submitted",
       "then": "the valid token resolves an identity available to the handler; the other two receive 401 with the error envelope",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2107-4",
@@ -43,16 +46,18 @@
       "when": "an authenticated non-admin and an authenticated admin each call it",
       "then": "the non-admin receives 403 with the error envelope; the admin succeeds",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2107-5",
-      "description": "Every admin-class request is audit-logged with the acting identity, the endpoint, the outcome, and the request id.",
+      "description": "Every admin-class request is audit-logged with the acting identity, the endpoint, the outcome, and the request id. Applying agent sets: the audit-log destination and retention window applied to admin-class requests.",
       "given": "an admin-class request, successful or rejected",
       "when": "the audit log is read",
       "then": "an entry records identity, endpoint, outcome, and request id",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2107-6",
@@ -61,16 +66,18 @@
       "when": "a correctly signed or mTLS-authenticated peer calls it, and an unauthenticated caller attempts it",
       "then": "the peer succeeds with a service principal and no user identity; the unauthenticated caller receives 401",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2107-7",
-      "description": "Every service-class request is audit-logged with the calling service principal, and service-class traffic is counted under its own rate limit separate from user traffic.",
+      "description": "Every service-class request is audit-logged with the calling service principal, and service-class traffic is counted under its own rate limit separate from user traffic. Applying agent sets: the audit-log destination and the service principal namespace for service-class traffic; the per-service rate-limit tier.",
       "given": "service-class traffic at volume alongside user traffic",
       "when": "audit logs and rate-limit counters are inspected",
       "then": "service calls are attributed to the service principal and limited under the service-class limit, independent of user-class counters",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2107-8",
@@ -79,12 +86,13 @@
       "when": "it is presented to a service-class endpoint",
       "then": "the request is rejected with 403 and the error envelope; the admin token grants nothing outside its classes",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-302-application-api-rest-auth-middleware"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2108.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2108",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-006",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "status": "approved",
   "title": "Liveness, readiness, and startup probes that tell the orchestrator the truth, at the resolved paths",
   "asA": "platform operator running the service under Kubernetes",
@@ -16,43 +16,48 @@
       "when": "the resolved liveness path is called",
       "then": "it returns 200 against the specified schema, unaffected by the dependency outage",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2108-2",
-      "description": "GET on the resolved readiness path returns 200 only when every declared downstream dependency check (database, cache, queues) passes.",
+      "description": "GET on the resolved readiness path returns 200 only when every declared downstream dependency check (database, cache, queues) passes. Applying agent sets: the declared downstream dependency set (database, cache, queues) the readiness probe registers with.",
       "given": "an instance with all declared dependencies reachable and the readiness path resolved (Kubernetes profile default /ready) or supplied by project configuration",
       "when": "the resolved readiness path is called",
       "then": "it returns 200 with the specified schema listing each check as passing",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2108-3",
-      "description": "GET on the resolved readiness path returns 503 with a body enumerating the failed checks by name when any declared dependency is unreachable.",
+      "description": "GET on the resolved readiness path returns 503 with a body enumerating the failed checks by name when any declared dependency is unreachable. Applying agent sets: the declared dependency set whose names appear in the 503 body when unreachable.",
       "given": "an instance with one declared dependency down and the readiness path resolved as above",
       "when": "the resolved readiness path is called",
       "then": "it returns 503 and the body names the failing check while still listing the passing ones",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2108-4",
-      "description": "GET on the resolved startup path returns 200 only after initialisation (migrations applied, cache warmed, config loaded) completes, and a non-200 with the pending steps before that. The startup path is available when the composed observability-probe-endpoints blueprint enables it via `probeInterface.options.kubernetes.startup.enabled: true` or the project supplies `probeInterface.paths.startup` in configuration.",
+      "description": "GET on the resolved startup path returns 200 only after initialisation (migrations applied, cache warmed, config loaded) completes, and a non-200 with the pending steps before that. The startup path is available when the composed observability-probe-endpoints blueprint enables it via `probeInterface.options.kubernetes.startup.enabled: true` or the project supplies `probeInterface.paths.startup` in configuration. Applying agent sets: the resolved startup-probe path (the Kubernetes profile default `/startup` when enabled through `probeInterface.options.kubernetes.startup.enabled: true`, or a `probeInterface.paths.startup` override), and the enumeration of initialisation steps the pending response names.",
       "given": "an instance mid-initialisation and the same instance after initialisation, with the startup path resolved (Kubernetes profile default /startup when enabled) or supplied by project configuration",
       "when": "the resolved startup path is called in each state",
       "then": "the mid-initialisation call is non-200 naming pending steps; the post-initialisation call is 200",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2108-5",
-      "description": "All three probes sit outside the auth middleware and outside rate limiting: the auth-middleware installer consumes exactly the resolved probe path set (the same list observability-probe-endpoints emits via TAC-1501 getExemptPathSet, or the exact set derived from `probeInterface.paths` in the essentials-alone case), so each probe succeeds with no credentials and is never 401, 403, or 429; adjacent routes never fall under the same exemption.",
+      "description": "All three probes sit outside the auth middleware and outside rate limiting: the auth-middleware installer consumes exactly the resolved probe path set (the same list observability-probe-endpoints emits via TAC-1501 getExemptPathSet, or the exact set derived from `probeInterface.paths` in the essentials-alone case), so each probe succeeds with no credentials and is never 401, 403, or 429; adjacent routes never fall under the same exemption. Applying agent sets: the resolved probe path set the composed application ships (observability-probe-endpoints TAC-1501 getExemptPathSet output or the derived set).",
       "given": "a running instance with the resolved probe path set exposed to the auth-middleware installer",
       "when": "each probe is called with no credentials at sustained frequency AND an adjacent user-traffic route is also called unauthenticated",
       "then": "every probe call is answered on probe semantics alone, never with an auth or rate-limit status; the adjacent route returns the auth middleware unauthenticated response",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2108-6",
@@ -61,16 +66,18 @@
       "when": "info-level logs and endpoint metrics are inspected",
       "then": "probe requests appear in neither, and the dedicated probe-outcome metric carries their results",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2108-7",
-      "description": "The generated OpenAPI document names the three probe surfaces (liveness, readiness, startup) and their resolved paths, plus each probes success and failure schemas and its documented failure mode; the resolved paths are computed at documentation-generation time from the composed observability-probe-endpoints blueprint or from project configuration.",
+      "description": "The generated OpenAPI document names the three probe surfaces (liveness, readiness, startup) and their resolved paths, plus each probes success and failure schemas and its documented failure mode; the resolved paths are computed at documentation-generation time from the composed observability-probe-endpoints blueprint or from project configuration. Applying agent sets: the resolved probe path values named in the OpenAPI document at documentation-generation time.",
       "given": "the generated OpenAPI document produced for a project that has resolved its probe paths",
       "when": "the three probe entries are read",
       "then": "each declares its success and failure schemas and its documented failure mode; every entry path is the resolved path (no legacy literal probe-path prefix appears in the generated document)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2108-8",
@@ -79,12 +86,27 @@
       "when": "the resolved readiness path is called after restoration",
       "then": "it returns 200 without the process having restarted",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-2108-9",
+      "description": "Given a readiness check whose downstream dependency never responds and a per-check deadline configured on the readiness registry, when the deadline elapses, then the aggregate readiness response is 503 with a body listing that check as `failed: deadline-exceeded` (naming the check id and the configured deadline in milliseconds); liveness continues to answer 200 throughout, unaffected by the readiness-side timeout.",
+      "given": "a readiness check whose dependency will not respond within the configured deadline and a live liveness probe",
+      "when": "the deadline elapses on the pending check",
+      "then": "readiness returns 503 naming the failed check id and the deadline value, and liveness continues answering 200",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-306-application-api-rest-operability",
+        "field": "interfaces[0].name"
+      }
     }
   ],
   "tacIds": [
     "TAC-306-application-api-rest-operability"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-09-04T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }