rcf-lite 0.26.0 → 0.28.0

package/blueprints/object-storage-s3/CHANGELOG.md

@@ -1,11 +1,97 @@
+# Changelog
+
+## 1.2.9 - 2026-09-12
+
+R2 and Hetzner account-bound skips now emit the exact anatomy-accepted shape (`<VAR> (not "true")` with no `set to "..."` preamble); a new synthetic negative-case test in the object-storage-s3 anatomy proves the accepted shapes parse to a bare declared env-var name and rejects the earlier malformed emissions. Anatomy pin bumped to 1.2.9.
+
+- fix: `blueprints/object-storage-s3/contributions/probes/r2-real-account-smoke.mjs` non-"true" skip emits `CI_HAS_CLOUDFLARE_ACCOUNT (not "true")` (no value preamble, no `set to`).
+- fix: `blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs` non-"true" skip emits `CI_HAS_HETZNER_OBJECT_STORAGE (not "true")` (same rule).
+- test: `packages/rcf-lite/test/blueprint/object-storage-s3-anatomy.test.js` adds `TC-071-skip-shape-negative` covering `CI_HAS_CLOUDFLARE_ACCOUNT`, `CI_HAS_HETZNER_OBJECT_STORAGE` and `S3_ENDPOINT_URL` in both accepted shapes and the malformed shapes the anatomy MUST reject (including the earlier R2 and Hetzner emissions that carried a `set to "..."` preamble).
+
+## 1.2.8 - 2026-09-12
+
+The Hetzner event-secrecy row anchor is corrected, the R2 inventory-diff row is de-claimed to `conformanceOnly`, the event-secrecy fixture stops leaking engine-returned ids on the lifecycle event stream, and `STRICT_ID_KEYS` is tightened to engine-returned scalars only. Anatomy pin bumped to 1.2.8.
+
+- fix: `blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs` lifecycle-event whitelist row is now `conformanceOnly` naming AC-28105-1 (metadata-only lifecycle events, whose contract this row actually observes). It previously anchored AC-28110-1, which states endpoint composition / put-get-delete / teardown / skip / malformed-endpoint behaviour and does NOT state event secrecy.
+- fix: `blueprints/object-storage-s3/contributions/probes/r2-real-account-smoke.mjs` per-object inventory-diff row is now `conformanceOnly` naming AC-28108-2. The AC's object round-trip clause is anchored on the byte-equal put/get row (which carries the engine-returned `ETag`); R2 does not surface a per-object `$metadata.requestId` on `listObjects` / `deleteObject`, so the inventory-diff row has no engine-returned scalar id and cannot be an anchor.
+- fix: `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs` `objectPut` and `objectDeleted` lifecycle events no longer carry `requestId` or `eTag` fields (AC-28105-1's metadata-only whitelist); the engine-returned ids live on the RETURN value of each verb, which the probes read directly.
+- fix: `packages/rcf-lite/test/blueprint/object-storage-s3-anatomy.test.js` STRICT_ID_KEYS removed the plural / probe-selected keys (`requestIds`, `vendorRequestIds`, `metadataRequestId`, `httpRequestId`, `observedUploadId`, `dlqTransportMessageIds`, `primaryTransportMessageId`, `jobIds`, `dlqPayloadJobIds`, `expectedPayloadJobId`) so only engine-returned scalar identifiers qualify as id-witnesses.
+- prose: anatomy header comment corrected to describe the in-memory validation the anatomy performs (probes invoked directly; no `.rcf/reports` record read on this seam).
+
+
+## 1.2.7 - 2026-09-11
+
+Engine-returned identifiers only. The object-storage-s3 facade fixture now surfaces `$metadata.requestId` and `ETag` from every operation (`putObject`, `getObject`, `deleteObject`, `listObjects`, `listMultipartUploads`, `completeMultipartUpload`) as return-value scalars. Every counting probe row records `vendorRequestId` (and where the operation returns it, `eTag` or `uploadId`) as its engine-returned identifier witness, alongside its derived witnesses. STRICT_ID_KEYS on the anatomy shrank to engine-returned scalars only; the anatomy now also enforces that idWitness and derivedWitness sit under DIFFERENT keys. Anatomy pin bumped to 1.2.7.
+
+- fix: `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs` returns `{ size, requestId, eTag, uploadId }` from `putObject`, `{ body, contentType, requestId, eTag }` from `getObject`, `{ requestId }` from `deleteObject`, `{ keys, isTruncated, nextContinuationToken, requestId }` from `listObjects`, an array with a non-enumerable `requestId` from `listMultipartUploads`. Multipart `completeMultipartUpload` also propagates `uploadId` + `requestId` on the aggregate return.
+- fix: `put-get-round-trip`, `multipart-upload`, `presigned-url`, `event-secrecy`, `r2-real-account-smoke`, `hetzner-object-storage-round-trip` each stamp the engine-returned `vendorRequestId` (and `eTag` / `uploadId` where relevant) as their strict id witness on every counting row.
+- fix: `packages/rcf-lite/test/blueprint/object-storage-s3-anatomy.test.js` STRICT_ID_KEYS retains engine-returned scalars only (`requestId`, `vendorRequestId`, `eTag`, `versionId`, `uploadId`, `queueId`, `messageId`, `jobId`, `rowId`, `insertedId`, `backendPid`, `transactionId`, `migrationVersion` and their labelled siblings). `bucketName`, `scratchBucket`, `queueName`, `databaseName` and the checksum keys were removed. Same-file strict-AND now asserts idWitness and derivedWitness sit under DIFFERENT keys.
+- prose: run-notes now says `S3_ENDPOINT_URL` is a required declared variable with no fixture default; the earlier "fixture default overridden" line was corrected.
+
+
+
+## 1.2.6 - 2026-09-11
+
+Lazy engine-client load discipline. Under a CI condition where the fixture's `node_modules` has not been installed and `S3_ENDPOINT_URL` is unset, the probe module surface must load without touching `@aws-sdk/client-s3`: an anatomy or tooling walk imports the probe, the probe calls `endpointFromEnv`, catches `MissingS3EndpointError`, and returns the exact one-variable `accountBoundSkipped` row. The prior module-level `import * as awsS3 from '@aws-sdk/client-s3'` and `import { getSignedUrl } from '@aws-sdk/s3-request-presigner'` in `object-store.mjs` resolved the SDK on module load and failed the anatomy TC-071-fixture-and-switches test with `ERR_MODULE_NOT_FOUND` in CI. The SDK is now loaded LAZILY inside `createObjectStore` and via the exported `loadSdk()` helper; `createObjectStore` is async and every probe `await`s it. Anatomy pin bumped to 1.2.6.
+
+- fix: `packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs` no longer carries module-level imports of `@aws-sdk/client-s3` or `@aws-sdk/s3-request-presigner`. The retired top-level `export const sdk = awsS3` is replaced by an exported async `loadSdk()` helper that returns the SDK namespace on demand; `createObjectStore` is async and loads the SDK plus signer inside its body, after `S3_ENDPOINT_URL` is present.
+- fix: every probe that instantiates the facade (`facade-round-trip`, `put-get-round-trip`, `presigned-url`, `multipart-upload`, `event-secrecy`, `r2-real-account-smoke`, `hetzner-object-storage-round-trip`) prefixes `createObjectStore` with `await`; behaviour on both the run path and the skip path is unchanged.
+- fix: the two probes that dip into raw SDK constructors on the run path (`facade-round-trip`, `event-secrecy`) now call `loadSdk()` on the same run-path branch that already dynamically imports the fixture facade; the SDK never resolves on the skip path.
+- fix: every counting row on `put-get-round-trip`, `multipart-upload`, `presigned-url` and `event-secrecy` carries `bucketName` as its string id witness so the row satisfies the strict AND-witness rule alongside its existing derived witnesses (the strict identifier predicate refuses non-string id keys).
+
+
+## 1.2.5 - 2026-09-11
+
+The probe owns its skip, the anatomy invokes every probe unconditionally, and no endpoint-host literal remains in shipped fixture code. The infra-s3-and-queue fixture helper `endpointFromEnv` no longer carries an endpoint-host default: when `S3_ENDPOINT_URL` is unset the helper throws a typed `MissingS3EndpointError` and each S3 local probe (facade-round-trip, put-get-round-trip, presigned-url, multipart-upload, event-secrecy) declares `DECLARED_ENV=['S3_ENDPOINT_URL']`, catches the error, and returns the exact one-variable `accountBoundSkipped` row rather than reaching a hard-coded endpoint. The anatomy no longer fabricates a skip row when the gate is unset; it invokes every probe and validates whatever comes back. The identifier predicate is now string-only (booleans, numbers, arrays and objects never qualify) and the limitation-token check sweeps every `AC-[A-Za-z0-9-]+` token. Anatomy pin bumped to 1.2.5.
+
+- fix: `endpointFromEnv` throws `MissingS3EndpointError` when `S3_ENDPOINT_URL` is unset; the retired endpoint-host default is gone from shipped fixture code.
+- fix: every S3 local probe (facade, put-get, presigned, multipart, event-secrecy) catches `MissingS3EndpointError` and returns the exact one-variable `accountBoundSkipped` row per authoring-standard section 7d.
+- fix: anatomy identifier predicate is string-only and non-empty; booleans, numbers, arrays and objects never satisfy an engine-minted id key.
+- fix: anatomy limitation-token regex broadened to `AC-[A-Za-z0-9-]+` so every AC token is checked for membership in the shipped user-story AC set.
+
+
+## 1.2.4 - 2026-09-11
+
+Strict-anatomy rewrite of the 7d witness rules. The anatomy test now REQUIRES an AC-id-membership check on every limitation and every notObservableHere.ac (must exist in the shipped user-story set), REQUIRES both an id-shape witness AND a derived-value witness on every non-declaimed row (strict AND), invokes every probe directly and validates each returned row in-memory, and requires accountBoundSkipped rows to name exactly one env var declared on the probe DECLARED_ENV. Anatomy pin bumped to 1.2.4. Probe enrichment scope: presigned-url row 2 now carries `refusalFired` and `refusalCode` alongside the `refused`/`requestedTtlSeconds`/`floorSeconds` derived witnesses. Section-header comment on the anatomy test rewritten to drop internal work-item terminology.
+
+- fix: run-notes correction so the DeleteBucket HTTP status matches the record (204).
+
+## 1.2.3 - 2026-09-11
+
+Positive-evidence conformance work on the probe pack (authoring standard section 7d), plus live-engine runs on Cloudflare R2 for the real-account probe. The r2-real-account-smoke and hetzner-object-storage-round-trip skip records carry a `reason` field naming the exact unset env var alongside `accountBoundSkipped: true`; both probes export a `DECLARED_ENV` list and gate every second-tier variable so an undeclared short-circuit is impossible. r2-real-account-smoke additionally records the S3 endpoint host prefix (redacted), a scratch bucket lifecycle (create with HTTP status, ListBuckets present-after-create with HTTP status, DeleteBucket with HTTP status, ListBuckets absent-after-delete with HTTP status), and an object round trip inside the scratch bucket (key, byteCount, byteEqual); vendor request ids on the R2 lifecycle rows are recorded when the S3 SDK surfaces them and omitted otherwise. Facade-round-trip and event-secrecy rows embed the vendor request id (SDK $metadata.requestId) and response excerpt from the underlying MinIO or R2 call directly on each result row. probe-utils' `runShim` accepts the `{results, extra}` envelope so account-bound probes surface `accountBoundSkipped`, `envDeclared` and `evidence` bags on the aggregate report; aggregate flips to pass when every result is an account-bound skip. The infra-s3-and-queue fixture README gains a Declared env vars table for the object-storage-s3 pack (endpoint quintet, R2 tier, Hetzner tier, induced-failure switches). Local MinIO runs cover the five in-process probes; the Cloudflare R2 branch mints a throwaway bucket and destroys it inside the run; the Hetzner branch honestly skips with `reason: CI_HAS_HETZNER_OBJECT_STORAGE unset`.
+
+- fix: r2-real-account-smoke mints and DELETES a scratch bucket via S3 CreateBucket/DeleteBucket, records each call's HTTP status, records the bucket present on ListBuckets after create and absent on ListBuckets after delete, and treats a failed inventory as a FAIL (never converted to an empty list). Bucket-lifecycle rows are conformance-only (anchorAcId: null) and their limitation names AC-28108-2 explicitly, since AC-28108-2 states an object-level round trip on an already-provisioned bucket, not bucket-level lifecycle; the object-round-trip and inventory-diff rows anchor AC-28108-2. Endpoint-resolution failure after a preflight is a FAIL, not a compound account skip.
+- fix: multipart-upload forces the induced-failure branch inside the probe (sets `SIMULATE_PART_UPLOAD_FAIL` for the second put, restoring the prior value on exit) so the abort-branch acceptance criterion always carries observed evidence, not "path not run". The propagated error carries `uploadId` and, when the abort itself fails, `abortError` (the uploader no longer swallows abort failures). The row records `observedUploadId` and `abortError` as evidence and matches `observedUploadId` against the create-multipart-upload response's id.
+- fix: presigned-url fetches the same URL after `ttl+2` seconds and asserts HTTP 403 per the presigned TTL acceptance criterion; the tampered-signature shortcut path is removed from the canonical row. The below-floor refusal row is anchored to the presigned TTL requirement (no AC states a below-floor refusal shape). The raw record carries a `urlSha256` of the fetched URL so URL identity across the two fetches is self-contained.
+- fix: hetzner-object-storage-round-trip's honest-skip rows name exactly one unset variable per row (one row for the gate, one for each second-tier variable when set-but-not-true); teardown of the scratch object AND the facade close are each recorded on a result row (a teardown FAIL fails the verdict).
+- fix: `run-*.mjs` shims replace the fabricated engine wrapper with a real MinIO `/minio/health/live` observation (httpStatus + responseTimeMs) for local runs; the R2 shim carries a real ListBuckets observation on the account.
+- fix: facade-round-trip and event-secrecy rows embed the vendor request id (SDK's `$metadata.requestId`) and a response excerpt from the underlying MinIO or R2 call on the row itself, not only in the report envelope.
+- fix: every result row on every probe carries its own `evidence` object; the shared `aggregate([])` helper returns `fail` with `no checks ran` instead of a default success verdict on an empty results array.
+- fix: the R2 evidence records a placeholder for the endpoint host prefix rather than the raw account-id fragment.
+- fixture: `src/bucket-ops.mjs` added (thin wrapper over `@aws-sdk/client-s3`'s bucket-lifecycle commands, dependency-resolved through the fixture's own `node_modules`) so the R2 probe drives scratch-bucket lifecycle without adding an SDK dep to rcf-lite. `src/object-store.mjs`'s multipart uploader attaches `uploadId` and, on abort failure, `abortError` to the propagated error instead of swallowing the abort.
+
+
+## 1.2.2 (register patch, 2026-09-10)
+
+- Register: remove residual internal editorial and provenance phrases from README and guide (closes F-1, F-2 register findings).
+
+
+## 1.2.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.2.0 - 2026-09-09
+
+Adds the elicits block (s3-endpoint-url, s3-bucket-name, s3-adapter, presigned-ttl-ceiling-seconds, multipart-threshold-bytes, hetzner-location-code) that the REQs and guide were already describing in prose. Adds a runtime clause naming the objectStorage applied capability on REQ-001. Adds deliveredBy on REQ-003, REQ-005 and REQ-006. REQ-006 boundary tightened: the facade factory accepts only `{ secretRef, resolver }` and refuses a resolved `{ accessKeyId, secretAccessKey }` object at the boundary with error kind `rejectedResolvedCredentials`; AC-28106-1 asserts the refusal. REQ-005 and AC-28105-1 standardise on `ts` as the wall-clock milliseconds-since-epoch field name, aligning with TAC-2903. REQ-002 gains the shipped key-shape check on the facade's public verbs; new AC-28102-3 asserts the `invalidKey` refusal for empty keys, leading-slash, `..` or `//` segments, and keys longer than 1024 bytes. Adds disposition to every AC.
+
 # object-storage-s3 changelog
 
 ## 1.1.0 - 2026-09-08
 
-Follow-up adapter minor bump adding the Hetzner Object Storage provider value under the shipped v1.0.0 S3-API facade contract. Landed via the hetzner-round-7-spec-2026-09-07 section 5.4 follow-up (ratified 2026-09-07T10:15Z on Baz's 09:50Z ruling "round 7 - agreee to all") as a sequential PR post round 7. Additive only: every existing v1.0.0 contribution id is byte-identical; the shipped Cloudflare R2 real-account smoke, the MinIO local emulator round-trip and the five shipped Node-only probes continue to pass byte-identical on the extended fixture. rcf-lite package version does NOT bump for this follow-up (spec section 8).
+Follow-up adapter minor bump adding the Hetzner Object Storage provider value under the shipped v1.0.0 S3-API facade contract. Additive only: every existing v1.0.0 contribution id is byte-identical; the shipped Cloudflare R2 real-account smoke, the MinIO local emulator round-trip and the five shipped Node-only probes continue to pass byte-identical on the extended fixture. rcf-lite package version does NOT bump for this follow-up.
 
 - 4 delta contributions on the blueprint side (25 total, up from 21): 1 REQ (`object-storage-s3-REQ-101`, endpoint-shape contract), 1 US (`object-storage-s3-US-28110` with `AC-28110-1` labelled `AC-hetznerObjectStorage-endpointRoundTrip`), 1 TAC (`TAC-2904-object-storage-s3-hetzner-endpoint-helper`, sole composer of `<bucket>.<location>.your-objectstorage.com`), 1 ADR (`ADR-2905-object-storage-s3-hetzner-object-storage-provider`, scope local, `standardsTraceClause: Hetzner Object Storage S3 compatibility documented endpoint shape`).
-- One new Node-only probe `hetzner-object-storage-round-trip.mjs` under `contributions/probes/`, `accountBound: true`, gated on `CI_HAS_HETZNER_OBJECT_STORAGE` alongside `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID`, `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY`, `HETZNER_OBJECT_STORAGE_BUCKET`, `HETZNER_OBJECT_STORAGE_LOCATION`; without the gate env var the probe records `accountBoundSkipped: true` per spec section 3.5. The round-5 T-2 R2 real-account smoke is unaffected and stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT`.
+- One new Node-only probe `hetzner-object-storage-round-trip.mjs` under `contributions/probes/`, `accountBound: true`, gated on `CI_HAS_HETZNER_OBJECT_STORAGE` alongside `HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID`, `HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY`, `HETZNER_OBJECT_STORAGE_BUCKET`, `HETZNER_OBJECT_STORAGE_LOCATION`; without the gate env var the probe records `accountBoundSkipped: true` per spec section 3.5. The round-5 R2 real-account smoke is unaffected and stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT`.
 - Extended the shared `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` fixture (no second fixture directory) with `src/hetzner-endpoint.mjs` (endpoint helper plus two fixture-side mutation switches per the 2026-09-08 mutation-purity discipline: `SIMULATE_HETZNER_ENDPOINT_MISSHAPEN` drops the vendor subdomain, `SIMULATE_HETZNER_EVENT_LEAK` appends fixture-labelled credential fields to event records) and a fixture-root shim `run-hetzner-object-storage-round-trip.mjs`. The probe module reads no `SIMULATE_` variable.
 - Vendor endpoint pattern and location codes verbatim from https://docs.hetzner.com/storage/object-storage/overview (`<bucket>.<location>.your-objectstorage.com`; locations `fsn1` Falkenstein, `hel1` Helsinki, `nbg1` Nuremberg). Composition helper refuses any location outside the enum.
 - Blueprint README extended with a Hetzner Object Storage sub-section under the provider-choice section; `guide/object-storage-s3.md` extended with a Hetzner section including the when-to-reach-for guidance; shelf-wide sweep on every blueprint's `docs/topics.md` updates the object-storage-s3 row from `shipped v1.0.0` to `shipped v1.1.0` per the round-6 admin-console 1.1.0 precedent (PR #169).
@@ -13,12 +99,14 @@ Follow-up adapter minor bump adding the Hetzner Object Storage provider value un
 
 ## 1.0.0 - 2026-09-06
 
-Initial release. Contract for S3-shape object storage on any S3-compatible endpoint (Cloudflare R2 first, MinIO for local dev, AWS S3, Backblaze B2, Wasabi, self-hosted). Accessed through a store facade that is the sole reader of the S3 client (`@aws-sdk/client-s3` on Node targets or `aws4fetch` on Workers targets). Landed via the infra round 5 spec (ratified 2026-09-06) as track T-2.
+Initial release. Contract for S3-shape object storage on any S3-compatible endpoint (Cloudflare R2 first, MinIO for local dev, AWS S3, Backblaze B2, Wasabi, self-hosted). Accessed through a store facade that is the sole reader of the S3 client (`@aws-sdk/client-s3` on Node targets or `aws4fetch` on Workers targets).
 
 - 21 contributions: 6 REQs on facade sole-reader / put-get-delete-list / presigned URL / multipart / lifecycle events / credential-pair discipline; 8 USs at 28101-28108; 3 TACs (2901 facade, 2902 multipart uploader, 2903 event sink); 4 ADRs (2901 adapter elicited between AWS SDK and aws4fetch, 2902 presigned TTL default 15 minutes floor 1 minute, 2903 multipart threshold default 8 MiB, 2904 objectStorageContract with scope global).
 - Six Node-only probes under `contributions/probes/` proven against a live MinIO container: `facade-round-trip`, `put-get-round-trip`, `presigned-url`, `multipart-upload`, `event-secrecy`, and the accountBound `r2-real-account-smoke`. The R2 smoke records `accountBoundSkipped: true` when `CI_HAS_CLOUDFLARE_ACCOUNT` is unset per spec section 3.5.
-- T-2 slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` boots MinIO via docker compose, exposes the facade over `@aws-sdk/client-s3`, ships a security-secrets-management shim realising the `secretRef` opaque-string contract, and hosts four wired induced-failure switches for the negative-run paths (SIMULATE_MINIO_DOWN, SIMULATE_403_ON_GET, SIMULATE_PART_UPLOAD_FAIL, SIMULATE_PRESIGN_MALFORMED).
+- The `object-storage-s3` slice of the shared sample-app fixture at `packages/rcf-lite/test/fixtures/infra-s3-and-queue/` boots MinIO via docker compose, exposes the facade over `@aws-sdk/client-s3`, ships a security-secrets-management shim realising the `secretRef` opaque-string contract, and hosts four wired induced-failure switches for the negative-run paths (SIMULATE_MINIO_DOWN, SIMULATE_403_ON_GET, SIMULATE_PART_UPLOAD_FAIL, SIMULATE_PRESIGN_MALFORMED).
 - Declares `capabilities: ["objectStorage"]`, `suggestedCompanions: [{role: "logging"}, {role: "errorHandling"}]`, `providesRoles` absent, `requiresAppliedCapabilities` absent.
 - Contributes ADR-2904 as `scope: global` on new topic `objectStorageContract`. Future non-S3-shape siblings (`object-storage-native-gcs`, `object-storage-native-azure`, reserved slugs) conflict here by design.
-- Refuses composition when `security-secrets-management` v1.0.1+ is not applied. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the T-5 capability mechanism. `rcf define blueprint add object-storage-s3` on a bare project exits 3 with `[object-storage-s3-no-secrets]` on stderr, names the shipped predecessor, and points at the override. `--allow-no-secrets-yet` records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Companion runner extensions (added by this PR to keep the mechanism whole): `src/blueprint/capabilities.js` `buildRefusalMessage` gains a bespoke template branch for `object-storage-s3-no-secrets` (echoes the message id as the first-line tag; other refusalMessageId values also gain a `[<id>]` tag on the first line of the generic fallback for dashboards/lint); `src/cli/blueprint.js` accepts the new `--allow-no-secrets-yet` flag; `src/blueprint/apply.js` sidecar `notes` prose derives predecessor family from the `allowSkipFlag` name (auth vs secrets-management) so the note reads sensibly for either predecessor.
-- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (per HQ mid-flight ruling after PR #154 gate).
+- Refuses composition when `security-secrets-management` v1.0.1+ is not applied. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the capability mechanism. `rcf define blueprint add object-storage-s3` on a bare project exits 3 with `[object-storage-s3-no-secrets]` on stderr, names the shipped predecessor, and points at the override. `--allow-no-secrets-yet` records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Companion runner extensions (added by this PR to keep the mechanism whole): `src/blueprint/capabilities.js` `buildRefusalMessage` gains a bespoke template branch for `object-storage-s3-no-secrets` (echoes the message id as the first-line tag; other refusalMessageId values also gain a `[<id>]` tag on the first line of the generic fallback for dashboards/lint); `src/cli/blueprint.js` accepts the new `--allow-no-secrets-yet` flag; `src/blueprint/apply.js` sidecar `notes` prose derives predecessor family from the `allowSkipFlag` name (auth vs secrets-management) so the note reads sensibly for either predecessor.
+- Every ADR contribution entry on `blueprint.json` carries a `standardsTraceClause` per section 8a.2 (per the operator estate mid-flight ruling after PR #154 gate).
+
+Adds one option-binding AC on s3-adapter aws-sdk-client-s3 (AC-28101-4) to close section 7c on the elicits catalogue. Adds deliveredBy on REQ-002, REQ-004, REQ-101. AC-28102-1, AC-28102-2, AC-28103-1, AC-28103-2, and AC-28108-1 carry vendorCitation.

package/blueprints/object-storage-s3/README.md

@@ -1,6 +1,6 @@
 # object-storage-s3
 
-Object storage on the S3 API, accessed through a store facade that is the sole reader of the S3 client. Cloudflare R2 is the first adapter, MinIO is the local dev target, any S3-compatible remote (AWS S3, Backblaze B2, Wasabi, self-hosted) composes cleanly. Ships put / get / delete / list, presigned GET URLs with a bounded TTL, and multipart-upload above an elicited threshold, plus a lifecycle-event sink with a metadata-only field discipline. Refuses composition without `security-secrets-management` applied (Baz decision 6): the credential pair is a `secretRef`, never a value.
+Object storage on the S3 API, accessed through a store facade that is the sole reader of the S3 client. Cloudflare R2 is the first adapter, MinIO is the local dev target, any S3-compatible remote (AWS S3, Backblaze B2, Wasabi, self-hosted) composes cleanly. Ships put / get / delete / list, presigned GET URLs with a bounded TTL, and multipart-upload above an elicited threshold, plus a lifecycle-event sink with a metadata-only field discipline. Refuses composition without `security-secrets-management` applied: the credential pair is a `secretRef`, never a value.
 
 ## What this blueprint gives you
 
@@ -55,7 +55,7 @@ A new Node-only probe `hetzner-object-storage-round-trip.mjs` binds AC-28110-1:
 
 ## Composition and conflicts
 
-Consumes `security-secrets-management` v1.0.1+ for the credential pair. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the T-5 capability mechanism (visual round spec 5.5.1). The apply verb refuses on a project without `secretsProvider` (exit 3, stderr carries `[object-storage-s3-no-secrets]` as the first-line tag and names the required capability, the shipped predecessor, and the override flag). `--allow-no-secrets-yet` overrides for a scaffolding pass and records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Contributes ADR-2904 as `scope: global` on new topic `objectStorageContract`; future `object-storage-native-gcs` or `object-storage-native-azure` siblings would conflict here by design. `capabilities: ["objectStorage"]`; `providesRoles: []`.
+Consumes `security-secrets-management` v1.0.1+ for the credential pair. Declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` per the capability mechanism. The apply verb refuses on a project without `secretsProvider` (exit 3, stderr carries `[object-storage-s3-no-secrets]` as the first-line tag and names the required capability, the shipped predecessor, and the override flag). `--allow-no-secrets-yet` overrides for a scaffolding pass and records a `notes` line on `rcf/blueprints/object-storage-s3.applied.json` for later reconciliation. Contributes ADR-2904 as `scope: global` on new topic `objectStorageContract`; future `object-storage-native-gcs` or `object-storage-native-azure` siblings would conflict here by design. `capabilities: ["objectStorage"]`; `providesRoles: []`.
 
 ## The six probes
 

package/blueprints/object-storage-s3/blueprint.json

@@ -1,10 +1,14 @@
 {
   "slug": "object-storage-s3",
-  "version": "1.1.0",
+  "version": "1.2.9",
   "category": "object-storage",
-  "capabilities": ["objectStorage"],
+  "capabilities": [
+    "objectStorage"
+  ],
   "requiresAppliedCapabilities": {
-    "capabilities": ["secretsProvider"],
+    "capabilities": [
+      "secretsProvider"
+    ],
     "allowSkipFlag": "allow-no-secrets-yet",
     "refusalMessageId": "object-storage-s3-no-secrets"
   },
@@ -19,23 +23,91 @@
     }
   ],
   "contributions": [
-    { "id": "object-storage-s3-REQ-001", "kind": "req", "path": "requirements/object-storage-s3-req-001.json" },
-    { "id": "object-storage-s3-REQ-002", "kind": "req", "path": "requirements/object-storage-s3-req-002.json" },
-    { "id": "object-storage-s3-REQ-003", "kind": "req", "path": "requirements/object-storage-s3-req-003.json" },
-    { "id": "object-storage-s3-REQ-004", "kind": "req", "path": "requirements/object-storage-s3-req-004.json" },
-    { "id": "object-storage-s3-REQ-005", "kind": "req", "path": "requirements/object-storage-s3-req-005.json" },
-    { "id": "object-storage-s3-REQ-006", "kind": "req", "path": "requirements/object-storage-s3-req-006.json" },
-    { "id": "object-storage-s3-US-28101", "kind": "us", "path": "user-stories/object-storage-s3-us-28101.json" },
-    { "id": "object-storage-s3-US-28102", "kind": "us", "path": "user-stories/object-storage-s3-us-28102.json" },
-    { "id": "object-storage-s3-US-28103", "kind": "us", "path": "user-stories/object-storage-s3-us-28103.json" },
-    { "id": "object-storage-s3-US-28104", "kind": "us", "path": "user-stories/object-storage-s3-us-28104.json" },
-    { "id": "object-storage-s3-US-28105", "kind": "us", "path": "user-stories/object-storage-s3-us-28105.json" },
-    { "id": "object-storage-s3-US-28106", "kind": "us", "path": "user-stories/object-storage-s3-us-28106.json" },
-    { "id": "object-storage-s3-US-28107", "kind": "us", "path": "user-stories/object-storage-s3-us-28107.json" },
-    { "id": "object-storage-s3-US-28108", "kind": "us", "path": "user-stories/object-storage-s3-us-28108.json" },
-    { "id": "TAC-2901-object-storage-s3-facade", "kind": "tac", "path": "tacs/tac-2901-object-storage-s3-facade.json" },
-    { "id": "TAC-2902-object-storage-s3-multipart-uploader", "kind": "tac", "path": "tacs/tac-2902-object-storage-s3-multipart-uploader.json" },
-    { "id": "TAC-2903-object-storage-s3-event-sink", "kind": "tac", "path": "tacs/tac-2903-object-storage-s3-event-sink.json" },
+    {
+      "id": "object-storage-s3-REQ-001",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-001.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-002",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-002.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-003",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-003.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-004",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-004.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-005",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-005.json"
+    },
+    {
+      "id": "object-storage-s3-REQ-006",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-006.json"
+    },
+    {
+      "id": "object-storage-s3-US-28101",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28101.json"
+    },
+    {
+      "id": "object-storage-s3-US-28102",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28102.json"
+    },
+    {
+      "id": "object-storage-s3-US-28103",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28103.json"
+    },
+    {
+      "id": "object-storage-s3-US-28104",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28104.json"
+    },
+    {
+      "id": "object-storage-s3-US-28105",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28105.json"
+    },
+    {
+      "id": "object-storage-s3-US-28106",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28106.json"
+    },
+    {
+      "id": "object-storage-s3-US-28107",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28107.json"
+    },
+    {
+      "id": "object-storage-s3-US-28108",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28108.json"
+    },
+    {
+      "id": "TAC-2901-object-storage-s3-facade",
+      "kind": "tac",
+      "path": "tacs/tac-2901-object-storage-s3-facade.json"
+    },
+    {
+      "id": "TAC-2902-object-storage-s3-multipart-uploader",
+      "kind": "tac",
+      "path": "tacs/tac-2902-object-storage-s3-multipart-uploader.json"
+    },
+    {
+      "id": "TAC-2903-object-storage-s3-event-sink",
+      "kind": "tac",
+      "path": "tacs/tac-2903-object-storage-s3-event-sink.json"
+    },
     {
       "id": "ADR-2901-object-storage-s3-adapter",
       "kind": "adr",
@@ -68,9 +140,21 @@
       "topic": "objectStorageContract",
       "standardsTraceClause": "AWS S3 API and Cloudflare R2 S3-compatibility notes"
     },
-    { "id": "object-storage-s3-REQ-101", "kind": "req", "path": "requirements/object-storage-s3-req-101.json" },
-    { "id": "object-storage-s3-US-28110", "kind": "us", "path": "user-stories/object-storage-s3-us-28110.json" },
-    { "id": "TAC-2904-object-storage-s3-hetzner-endpoint-helper", "kind": "tac", "path": "tacs/tac-2904-object-storage-s3-hetzner-endpoint-helper.json" },
+    {
+      "id": "object-storage-s3-REQ-101",
+      "kind": "req",
+      "path": "requirements/object-storage-s3-req-101.json"
+    },
+    {
+      "id": "object-storage-s3-US-28110",
+      "kind": "us",
+      "path": "user-stories/object-storage-s3-us-28110.json"
+    },
+    {
+      "id": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+      "kind": "tac",
+      "path": "tacs/tac-2904-object-storage-s3-hetzner-endpoint-helper.json"
+    },
     {
       "id": "ADR-2905-object-storage-s3-hetzner-object-storage-provider",
       "kind": "adr",
@@ -79,5 +163,53 @@
       "elicited": true,
       "standardsTraceClause": "Hetzner Object Storage S3 compatibility documented endpoint shape"
     }
-  ]
+  ],
+  "elicits": [
+    {
+      "id": "s3-endpoint-url",
+      "prompt": "S3-compatible endpoint URL: an AWS S3 URL, a Cloudflare R2 URL, a MinIO URL, or any S3-compatible remote (including Hetzner Object Storage under the endpoint-shape helper). The facade opens the client against this at boot.",
+      "kind": "string",
+      "default": "https://s3.amazonaws.com"
+    },
+    {
+      "id": "s3-bucket-name",
+      "prompt": "Bucket name the facade opens against. The applied project asserts a real bucket at apply; the facade dereferences the elicited value once at boot.",
+      "kind": "string",
+      "default": "app-bucket"
+    },
+    {
+      "id": "s3-adapter",
+      "prompt": "S3 client adapter per ADR-2901. aws-sdk-client-s3 is the AWS SDK v3 client for Node targets; aws4fetch is the small SigV4 fetch adapter for Workers targets.",
+      "kind": "enum",
+      "options": [
+        "aws-sdk-client-s3",
+        "aws4fetch"
+      ],
+      "default": "aws-sdk-client-s3"
+    },
+    {
+      "id": "presigned-ttl-ceiling-seconds",
+      "prompt": "Ceiling on the TTL a presignGetUrl verb may accept, in seconds. Floor is 60 seconds; default cap is 3600 seconds; the shipped default TTL is 900 seconds per ADR-2902.",
+      "kind": "string",
+      "default": "3600"
+    },
+    {
+      "id": "multipart-threshold-bytes",
+      "prompt": "Payload size at or above which the put path switches to multipart-upload. Default 8388608 bytes (8 MiB) per ADR-2903.",
+      "kind": "string",
+      "default": "8388608"
+    },
+    {
+      "id": "hetzner-location-code",
+      "prompt": "Hetzner Object Storage location code per the Hetzner storage overview: fsn1 Falkenstein, hel1 Helsinki, nbg1 Nuremberg. Only meaningful when the endpoint composes through the Hetzner endpoint-shape helper (TAC-2904).",
+      "kind": "enum",
+      "options": [
+        "fsn1",
+        "hel1",
+        "nbg1"
+      ],
+      "default": "fsn1"
+    }
+  ],
+  "updatedAt": "2026-09-12"
 }

package/blueprints/object-storage-s3/contributions/probes/event-secrecy.mjs

@@ -12,18 +12,41 @@
  * Anchors AC-28105-1.
  */
 
-import { createObjectStore, endpointFromEnv, credentialsFromShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
+import { createObjectStore, endpointFromEnv, credentialsFromShim, MissingS3EndpointError } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
 import { secretsShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs';
 
+export const DECLARED_ENV = Object.freeze(['S3_ENDPOINT_URL']);
+
 const WHITELIST = new Set(['event', 'ts', 'key', 'size', 'contentType', 'ttl', 'endpointHost', 'bucketName']);
 const FORBIDDEN_FIELDS = ['userId', 'ssn', 'dob', 'email', 'body', 'bodyBytes', 'bodyChecksum'];
 const PII_TEXT = 'PII-FIXTURE-DO-NOT-LOG';
 
+const AC28105_1 = 'Given a lifecycle-event spy attached to the sink,';
+
+function skipRow(variable) {
+  return {
+    anchorAcId: null,
+    verdict: 'pass',
+    detail: `${AC28105_1} - accountBound: skipped (${variable} unset)`,
+    accountBoundSkipped: true,
+    reason: `${variable} unset`,
+    evidence: { skip: true, reason: `${variable} unset`, envDeclared: [...DECLARED_ENV] },
+  };
+}
+
 export default async function runProbe() {
-  const { endpoint, bucket, region, forcePathStyle } = endpointFromEnv();
+  let endpoint, bucket, region, forcePathStyle;
+  try {
+    ({ endpoint, bucket, region, forcePathStyle } = endpointFromEnv());
+  } catch (err) {
+    if (err instanceof MissingS3EndpointError) {
+      return { results: [skipRow(err.variable)], extra: { accountBoundSkipped: true, reason: `${err.variable} unset`, envDeclared: [...DECLARED_ENV] } };
+    }
+    throw err;
+  }
   const credentials = await credentialsFromShim(secretsShim);
   const events = [];
-  const store = createObjectStore({
+  const store = await createObjectStore({
     endpointUrl: endpoint,
     bucket,
     credentialsRef: credentials,
@@ -34,8 +57,21 @@ export default async function runProbe() {
   const results = [];
   const key = 'users/1234/passport.jpg';
   const body = Buffer.from(`prefix-${PII_TEXT}-suffix`);
+  const vendorReq = { put: null, get: null, del: null };
   try {
     await store.ready();
+    // Drive one PutObject via SDK directly for per-row vendor
+    // evidence, then delete it, then run the shipped-facade path.
+    const { loadSdk } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs'); const sdk = await loadSdk();
+    const client = store.getClient();
+    const rawPut = await client.send(new sdk.PutObjectCommand({ Bucket: bucket, Key: `${key}.evidence`, Body: body, ContentType: 'image/jpeg' }));
+    vendorReq.put = { httpStatus: rawPut.$metadata && rawPut.$metadata.httpStatusCode, requestId: rawPut.$metadata && rawPut.$metadata.requestId };
+    const rawGet = await client.send(new sdk.GetObjectCommand({ Bucket: bucket, Key: `${key}.evidence` }));
+    vendorReq.get = { httpStatus: rawGet.$metadata && rawGet.$metadata.httpStatusCode, requestId: rawGet.$metadata && rawGet.$metadata.requestId };
+    try { await rawGet.Body.transformToByteArray(); } catch { /* drain */ }
+    const rawDel = await client.send(new sdk.DeleteObjectCommand({ Bucket: bucket, Key: `${key}.evidence` }));
+    vendorReq.del = { httpStatus: rawDel.$metadata && rawDel.$metadata.httpStatusCode, requestId: rawDel.$metadata && rawDel.$metadata.requestId };
+
     await store.putObject(key, 'image/jpeg', body);
     await store.getObject(key);
     await store.presignGetUrl(key, 60);
@@ -52,8 +88,14 @@ export default async function runProbe() {
       anchorAcId: 'AC-28105-1',
       verdict: nonWhitelistKeys.size === 0 ? 'pass' : 'fail',
       detail: nonWhitelistKeys.size === 0
-        ? `every event carries only whitelisted fields (${[...WHITELIST].join(',')})`
-        : `unexpected event fields: ${[...nonWhitelistKeys].join(',')}`,
+        ? `${AC28105_1} - every event carries only whitelisted fields (${[...WHITELIST].join(',')})`
+        : `${AC28105_1} - unexpected event fields: ${[...nonWhitelistKeys].join(',')}`,
+      evidence: {
+        vendorRequestId: (vendorReq.put && vendorReq.put.requestId) || null,
+        bucketName: bucket,
+        whitelist: [...WHITELIST], nonWhitelistedFields: [...nonWhitelistKeys],
+        eventCount: events.length, vendorRequestIdMetadata: vendorReq,
+      },
     });
 
     // No forbidden field names
@@ -67,8 +109,14 @@ export default async function runProbe() {
       anchorAcId: 'AC-28105-1',
       verdict: foundForbidden.length === 0 ? 'pass' : 'fail',
       detail: foundForbidden.length === 0
-        ? 'no forbidden PII field name appeared on any event'
-        : `forbidden fields present: ${foundForbidden.join(',')}`,
+        ? `${AC28105_1} - no forbidden PII field name appeared on any event`
+        : `${AC28105_1} - forbidden fields present: ${foundForbidden.join(',')}`,
+      evidence: {
+        vendorRequestId: (vendorReq.get && vendorReq.get.requestId) || null,
+        bucketName: bucket,
+        forbiddenFieldNames: FORBIDDEN_FIELDS, foundForbidden,
+        eventCount: events.length, vendorRequestIdMetadata: vendorReq,
+      },
     });
 
     // No event value contains the PII fixture text
@@ -82,8 +130,14 @@ export default async function runProbe() {
       anchorAcId: 'AC-28105-1',
       verdict: leaks.length === 0 ? 'pass' : 'fail',
       detail: leaks.length === 0
-        ? `no event value contained the PII fixture text ${PII_TEXT}`
-        : `PII fixture text leaked in: ${leaks.join(',')}`,
+        ? `${AC28105_1} - no event value contained the PII fixture text ${PII_TEXT}`
+        : `${AC28105_1} - PII fixture text leaked in: ${leaks.join(',')}`,
+      evidence: {
+        vendorRequestId: (vendorReq.del && vendorReq.del.requestId) || null,
+        bucketName: bucket,
+        piiFixtureLiteral: PII_TEXT, leakSites: leaks,
+        eventCount: events.length, vendorRequestIdMetadata: vendorReq,
+      },
     });
 
     // The key itself is passed through unchanged; it is not decomposed
@@ -93,11 +147,18 @@ export default async function runProbe() {
       anchorAcId: 'AC-28105-1',
       verdict: keyPass ? 'pass' : 'fail',
       detail: keyPass
-        ? `objectPut carried the key ${key} as an opaque string; no userId extraction`
-        : `key was decomposed or absent on objectPut: ${JSON.stringify(putEvent)}`,
+        ? `${AC28105_1} - objectPut carried the key ${key} as an opaque string; no userId extraction`
+        : `${AC28105_1} - key was decomposed or absent on objectPut: ${JSON.stringify(putEvent)}`,
+      evidence: {
+        vendorRequestId: (vendorReq.put && vendorReq.put.requestId) || null,
+        bucketName: bucket,
+        expectedKey: key,
+        objectPutEvent: putEvent || null,
+        vendorRequestIdMetadata: vendorReq,
+      },
     });
   } finally {
     await store.close();
   }
-  return results;
+  return { results, extra: { envDeclared: [...DECLARED_ENV] } };
 }

package/blueprints/object-storage-s3/contributions/probes/facade-round-trip.mjs

@@ -8,14 +8,37 @@
  * Anchors AC-28101-1.
  */
 
-import { createObjectStore, endpointFromEnv, credentialsFromShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
+import { createObjectStore, endpointFromEnv, credentialsFromShim, MissingS3EndpointError } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
 import { secretsShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs';
 
+export const DECLARED_ENV = Object.freeze(['S3_ENDPOINT_URL']);
+
+const AC28101_1 = 'On process boot, the facade opens an S3';
+
+function skipRow(variable) {
+  return {
+    anchorAcId: null,
+    verdict: 'pass',
+    detail: `${AC28101_1} - accountBound: skipped (${variable} unset)`,
+    accountBoundSkipped: true,
+    reason: `${variable} unset`,
+    evidence: { skip: true, reason: `${variable} unset`, envDeclared: [...DECLARED_ENV] },
+  };
+}
+
 export default async function runProbe() {
-  const { endpoint, bucket, region, forcePathStyle } = endpointFromEnv();
+  let endpoint, bucket, region, forcePathStyle;
+  try {
+    ({ endpoint, bucket, region, forcePathStyle } = endpointFromEnv());
+  } catch (err) {
+    if (err instanceof MissingS3EndpointError) {
+      return { results: [skipRow(err.variable)], extra: { accountBoundSkipped: true, reason: `${err.variable} unset`, envDeclared: [...DECLARED_ENV] } };
+    }
+    throw err;
+  }
   const credentials = await credentialsFromShim(secretsShim);
   const events = [];
-  const store = createObjectStore({
+  const store = await createObjectStore({
     endpointUrl: endpoint,
     bucket,
     credentialsRef: credentials,
@@ -28,16 +51,41 @@ export default async function runProbe() {
     await store.ready();
     const ready = events.find((e) => e.event === 'facadeReady');
     const endpointHost = new URL(endpoint).host;
-    const pass = ready && ready.endpointHost === endpointHost && ready.bucketName === bucket;
+    // Drive a HeadBucket call directly through the fixture's SDK
+    // client so the row carries a real vendor request id and HTTP
+    // status excerpt so the facade-ready and event-secrecy rows
+    // each carry per-row vendor evidence.
+    let vendorMetadata = null;
+    try {
+      const { loadSdk } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs'); const sdk = await loadSdk();
+      const head = await store.getClient().send(new sdk.HeadBucketCommand({ Bucket: bucket }));
+      vendorMetadata = head && head.$metadata ? {
+        httpStatusCode: head.$metadata.httpStatusCode,
+        requestId: head.$metadata.requestId,
+        extendedRequestId: head.$metadata.extendedRequestId,
+      } : null;
+    } catch (err) {
+      vendorMetadata = { error: err && err.message, httpStatusCode: err && err.$metadata && err.$metadata.httpStatusCode };
+    }
+    const pass = ready && ready.endpointHost === endpointHost && ready.bucketName === bucket && vendorMetadata && vendorMetadata.httpStatusCode === 200;
     results.push({
       anchorAcId: 'AC-28101-1',
       verdict: pass ? 'pass' : 'fail',
       detail: pass
-        ? `facadeReady fired with endpointHost=${ready.endpointHost} bucketName=${ready.bucketName}`
-        : `facadeReady did not fire cleanly; events=${JSON.stringify(events)}`,
+        ? `${AC28101_1} - facadeReady fired with endpointHost=${ready.endpointHost} bucketName=${ready.bucketName}; HeadBucket returned ${vendorMetadata.httpStatusCode} (requestId=${vendorMetadata.requestId})`
+        : `${AC28101_1} - facadeReady did not fire cleanly; ready=${JSON.stringify(ready)} vendorMetadata=${JSON.stringify(vendorMetadata)}`,
+      evidence: {
+        facadeReadyEvent: ready || null,
+        endpointHost,
+        bucketName: bucket,
+        vendorRequestId: vendorMetadata && vendorMetadata.requestId,
+        vendorHttpStatus: vendorMetadata && vendorMetadata.httpStatusCode,
+        vendorMetadata,
+        allEvents: events,
+      },
     });
   } finally {
     await store.close();
   }
-  return results;
+  return { results, extra: { envDeclared: [...DECLARED_ENV] } };
 }