rcf-lite 0.26.0 → 0.27.0

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2109.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2109",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-007",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Cursor pagination with a navigable envelope and enforced limits",
   "asA": "API consumer walking large collections",
@@ -16,7 +16,8 @@
       "when": "a page is requested with cursor and limit",
       "then": "the response conforms to the pagination envelope with items, next, and prev fields",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2109-2",
@@ -25,7 +26,8 @@
       "when": "the collection is walked via next from the first page",
       "then": "every item appears exactly once and the final page's next is null",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2109-3",
@@ -34,7 +36,8 @@
       "when": "it is submitted",
       "then": "the service responds 400 with the declared error envelope rather than best-effort interpretation",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2109-4",
@@ -43,16 +46,18 @@
       "when": "the walk completes",
       "then": "every item that existed throughout appears exactly once",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2109-5",
-      "description": "The declared maximum limit is enforced: a request exceeding it receives 400 with a problem-details body naming the maximum, and a request without a limit receives the declared default page size.",
+      "description": "The declared maximum limit is enforced: a request exceeding it receives 400 with a problem-details body naming the maximum, and a request without a limit receives the declared default page size. Applying agent sets: the declared maximum limit value and the declared default page size per collection.",
       "given": "requests with an oversized limit and with no limit",
       "when": "each is submitted",
       "then": "the oversized request receives 400 naming the maximum; the limitless request returns the default page size",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2109-6",
@@ -61,12 +66,13 @@
       "when": "both responses are compared",
       "then": "only the explicit request carries the total, per the envelope's documented count field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-304-application-api-rest-resource-layer"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2110.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2110",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-008",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Documented filters, one sort convention, and strict rejection of unknown parameters",
   "asA": "API consumer querying collections",
@@ -11,21 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-2110-1",
-      "description": "Every collection endpoint's filter parameters are declared in the generated spec with their types and accepted values; no undocumented filter is honoured.",
+      "description": "Every collection endpoint's filter parameters are declared in the generated spec with their types and accepted values; no undocumented filter is honoured. Applying agent sets: the filter parameter set (name and type) per collection endpoint.",
       "given": "the generated spec entry for a collection endpoint",
       "when": "its declared filters are compared with the parameters the implementation honours",
       "then": "the sets are identical",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "template"
     },
     {
       "id": "AC-2110-2",
-      "description": "Sorting uses ?sort=field,-field2: comma-separated keys, leading minus for descending, applied in declared key order.",
+      "description": "Sorting uses ?sort=field,-field2: comma-separated keys, leading minus for descending, applied in declared key order. Applying agent sets: the sortable-key set per resource.",
       "given": "a collection with sortable fields",
       "when": "?sort=fieldA,-fieldB is requested",
       "then": "results order by fieldA ascending then fieldB descending",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2110-3",
@@ -34,16 +40,18 @@
       "when": "a request carries an undeclared query parameter",
       "then": "the service responds 400 with the declared error envelope naming the parameter, and no handler logic runs",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2110-4",
-      "description": "A sort key that is not declared sortable for the resource is rejected with 400 and a problem-details body naming the key and the declared sortable set.",
+      "description": "A sort key that is not declared sortable for the resource is rejected with 400 and a problem-details body naming the key and the declared sortable set. Applying agent sets: the sortable-key set the resource declares.",
       "given": "a collection endpoint",
       "when": "?sort= names an undeclared key",
       "then": "the service responds 400 with the error envelope naming the key and the sortable fields",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2110-5",
@@ -52,7 +60,8 @@
       "when": "a value of the wrong type is submitted",
       "then": "the service responds 400 with the error envelope naming parameter and expected type",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2110-6",
@@ -61,12 +70,13 @@
       "when": "the next cursor is followed",
       "then": "subsequent pages honour the same filter and sort without restating them incorrectly or losing them",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-304-application-api-rest-resource-layer"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2111.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2111",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-009",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Problem details everywhere: one error shape on every failure path",
   "asA": "API consumer building error handling once",
@@ -16,7 +16,12 @@
       "when": "the body and content type are inspected",
       "then": "the body carries the five base fields and the content type is application/problem+json",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://datatracker.ietf.org/doc/html/rfc7807",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-2111-2",
@@ -25,7 +30,16 @@
       "when": "extension fields are compared against the declaration",
       "then": "every observed extension is declared",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "interfaces[0].name"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://datatracker.ietf.org/doc/html/rfc7807",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-2111-3",
@@ -34,7 +48,12 @@
       "when": "the body's status field and the HTTP status line are compared",
       "then": "they are equal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://datatracker.ietf.org/doc/html/rfc7807",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-2111-4",
@@ -43,7 +62,12 @@
       "when": "their detail fields are read",
       "then": "the 4xx names the client-side correction; the 5xx exposes the correlation instance and no internals",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://datatracker.ietf.org/doc/html/rfc7807",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-2111-5",
@@ -52,7 +76,12 @@
       "when": "the request is submitted",
       "then": "the response is a 500 with the declared envelope, not a framework default body",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://datatracker.ietf.org/doc/html/rfc7807",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-2111-6",
@@ -61,12 +90,17 @@
       "when": "each response is inspected",
       "then": "each carries the declared problem-details envelope with the appropriate 4xx status",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://datatracker.ietf.org/doc/html/rfc7807",
+        "verifiedOn": "2026-09-09"
+      }
     }
   ],
   "tacIds": [
     "TAC-301-application-api-rest-request-pipeline"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2112.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2112",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-010",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "status": "approved",
   "title": "Idempotency keys: retries replay, duplicates never apply twice",
   "asA": "API consumer retrying over an unreliable network",
@@ -11,21 +11,27 @@
   "acceptanceCriteria": [
     {
       "id": "AC-2112-1",
-      "description": "The project declares which verb and resource-class combinations require an Idempotency-Key; the declaration is published in the generated spec per operation.",
+      "description": "The project declares which verb and resource-class combinations require an idempotency-key; the declaration is published in the generated spec per operation. Applying agent sets: the declared verb-plus-resource-class combinations that require an idempotency-key. The per-operation `x-idempotency-key` value (`required` or `forbidden`) the OpenAPI generator emits is fixed on TAC-303-application-api-rest-contract-surface.responsibilities[2].",
       "given": "the generated OpenAPI document",
       "when": "operations on non-safe verbs are inspected",
-      "then": "each declares whether Idempotency-Key is required, and every duplicate-harmful operation declares it required",
+      "then": "each declares whether idempotency-key is required, and every duplicate-harmful operation declares it required",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-303-application-api-rest-contract-surface",
+        "field": "responsibilities[2]"
+      },
+      "disposition": "template"
     },
     {
       "id": "AC-2112-2",
-      "description": "An operation declared key-required rejects a request without the header: 400 with a problem-details body naming the missing header.",
+      "description": "An operation declared key-required rejects a request without the header: 400 with a problem-details body naming the missing header. Applying agent sets: the set of operations declared key-required.",
       "given": "a key-required operation",
-      "when": "a request without Idempotency-Key is submitted",
+      "when": "a request without idempotency-key is submitted",
       "then": "the service responds 400 with the error envelope naming the header",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2112-3",
@@ -34,7 +40,8 @@
       "when": "the identical request is repeated within the TTL",
       "then": "the original response is replayed and exactly one side effect exists",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2112-4",
@@ -43,7 +50,8 @@
       "when": "the same key arrives with a different body within the TTL",
       "then": "the service responds 422 with the error envelope naming the conflict",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2112-5",
@@ -52,21 +60,23 @@
       "when": "the same key and body arrive concurrently",
       "then": "the second request receives 409 with the error envelope and the side effect applies exactly once",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2112-6",
-      "description": "The de-duplication cache honours its declared TTL: within it replays occur, after it a reused key is treated as a fresh request, and the TTL value is documented.",
+      "description": "The de-duplication cache honours its declared TTL: within it replays occur, after it a reused key is treated as a fresh request, and the TTL value is documented. Applying agent sets: the de-duplication cache TTL value.",
       "given": "the declared TTL",
       "when": "a keyed request is repeated inside and after the TTL window",
       "then": "the inside repeat replays; the after repeat executes as new; the TTL matches its documentation",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
   "tacIds": [
     "TAC-301-application-api-rest-request-pipeline"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2113.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2113",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-011",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Class-scoped rate limits with mechanical back-off signals",
   "asA": "platform operator protecting the service from overload",
@@ -11,21 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-2113-1",
-      "description": "Each of the four auth classes has a declared rate limit, and requests are counted against the limit of the endpoint's class.",
+      "description": "Each of the four auth classes has a declared rate limit, and requests are counted against the limit of the endpoint's class. Applying agent sets: the declared rate-limit values per auth class (public, user, admin, service).",
       "given": "the declared per-class limits",
       "when": "traffic flows to endpoints of each class",
       "then": "each request decrements its class's budget and no other's",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2113-2",
-      "description": "A request over its limit receives 429 with a Retry-After header and a problem-details body naming the limit and window.",
+      "description": "A request over its limit receives 429 with a Retry-After header and a problem-details body naming the limit and window. Applying agent sets: the limit value and the window duration named in the 429 problem-details body.",
       "given": "a caller exceeding its class limit",
       "when": "the next request arrives",
       "then": "the response is 429 with Retry-After and the error envelope naming limit and window",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2113-3",
@@ -34,16 +36,18 @@
       "when": "the second caller sends a request",
       "then": "the second caller is served while the first receives 429",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2113-4",
-      "description": "A per-endpoint override of the class default is supported, declared in the spec alongside the endpoint, and enforcement follows the override.",
+      "description": "A per-endpoint override of the class default is supported, declared in the spec alongside the endpoint, and enforcement follows the override. Applying agent sets: the per-endpoint rate-limit override values declared in the spec alongside the endpoint.",
       "given": "an endpoint declaring a rate-limit override",
       "when": "traffic exceeds the override but not the class default (or vice versa)",
       "then": "enforcement follows the declared override exactly",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2113-5",
@@ -52,7 +56,8 @@
       "when": "the caller waits the advertised delay and retries",
       "then": "the retry succeeds",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2113-6",
@@ -61,7 +66,8 @@
       "when": "metrics and logs are inspected",
       "then": "the 429s appear in RED and class counters, and no error-level log line per rejection exists",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
@@ -69,5 +75,5 @@
     "TAC-302-application-api-rest-auth-middleware"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2114.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2114",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-012",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "Structured logs: JSON lines, request-scoped correlation, declared levels",
   "asA": "on-call engineer diagnosing a production incident",
@@ -16,7 +16,8 @@
       "when": "each line is parsed as JSON",
       "then": "every line parses and carries the four base fields",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2114-2",
@@ -25,16 +26,18 @@
       "when": "the lines are filtered by the request id",
       "then": "every line the request produced appears, each also carrying the trace id when a trace context existed",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2114-3",
-      "description": "The declared log level per auth class is honoured: request completion lines are emitted at the class's declared level, and level configuration changes take effect without a code change.",
+      "description": "The declared log level per auth class is honoured: request completion lines are emitted at the class's declared level, and level configuration changes take effect without a code change. Applying agent sets: the declared log level per auth class.",
       "given": "the declared per-class log levels",
       "when": "traffic flows through each class",
       "then": "completion lines appear at the declared level per class",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2114-4",
@@ -43,7 +46,8 @@
       "when": "its completion line is read",
       "then": "method, path template, status, duration, and auth class are present",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2114-5",
@@ -52,12 +56,13 @@
       "when": "all log output for that request is scanned",
       "then": "the token never appears and personal data appears only in redacted form",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-305-application-api-rest-observability"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2115.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2115",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-012",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "RED metrics per endpoint with per-class and probe-outcome series",
   "asA": "platform operator watching service health",
@@ -16,16 +16,18 @@
       "when": "the metrics endpoint or exporter output is read",
       "then": "RED series exist per path template and method, and no label carries a raw resource id",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2115-2",
-      "description": "Duration is recorded as a histogram with declared buckets so latency percentiles are computable, not as an average-only gauge.",
+      "description": "Duration is recorded as a histogram with declared buckets so latency percentiles are computable, not as an average-only gauge. Applying agent sets: the histogram bucket boundaries declared for duration.",
       "given": "recorded duration metrics",
       "when": "the metric type is inspected",
       "then": "durations are histograms with the declared bucket boundaries",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-2115-3",
@@ -34,7 +36,8 @@
       "when": "per-class counters are read",
       "then": "each class's requests and errors are counted under its own label",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2115-4",
@@ -43,7 +46,8 @@
       "when": "the probe metric is read",
       "then": "per-probe success and failure counts reflect the induced states",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2115-5",
@@ -52,12 +56,13 @@
       "when": "the metric series are enumerated",
       "then": "every declared endpoint's path template appears",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [
     "TAC-305-application-api-rest-observability"
   ],
   "createdAt": "2026-08-19T10:00:00Z",
-  "updatedAt": "2026-08-19T10:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/application-api-rest/contributions/user-stories/application-api-rest-us-2116.json

@@ -2,7 +2,7 @@
   "usId": "application-api-rest-US-2116",
   "prdId": "PRD-001",
   "reqId": "application-api-rest-REQ-012",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "approved",
   "title": "OpenTelemetry-compatible traces with declared span attributes",
   "asA": "on-call engineer following a slow request across services",
@@ -16,7 +16,8 @@
       "when": "exported spans are inspected",
       "then": "a server span exists with the method and path template name and timing that brackets the request",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2116-2",
@@ -25,7 +26,8 @@
       "when": "its span attributes are read",
       "then": "auth class, resource id, status code, and request id are present",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2116-3",
@@ -34,7 +36,8 @@
       "when": "the resulting span is inspected",
       "then": "it carries the inbound trace id as its parent context",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2116-4",
@@ -43,7 +46,8 @@
       "when": "the trace is assembled",
       "then": "the downstream call appears as a child span and the dependency received the propagated context",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-2116-5",
@@ -52,7 +56,8 @@
       "when": "its span is inspected",
       "then": "span status is error and the problem type is recorded as an attribute",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
   "tacIds": [