rcf-lite 0.26.0 → 0.28.0

package/blueprints/object-storage-s3/contributions/probes/hetzner-object-storage-round-trip.mjs

@@ -22,7 +22,7 @@
  * module for its `accountBound` flag), the SDK-touching imports are
  * DYNAMIC and gated on the CI_HAS_HETZNER_OBJECT_STORAGE env var.
  *
- * Mutation-purity discipline (per HQ hard gate row 2026-09-08): this
+ * Mutation-purity discipline (per the operator estate hard gate row 2026-09-08): this
  * module reads NO SIMULATE_ variable. Every fixture-side mutation
  * hook (SIMULATE_HETZNER_ENDPOINT_MISSHAPEN,
  * SIMULATE_HETZNER_EVENT_LEAK) lives in
@@ -36,17 +36,48 @@
 import { probeKey } from './probe-utils.mjs';
 
 export const accountBound = true;
+export const DECLARED_ENV = Object.freeze([
+  'CI_HAS_HETZNER_OBJECT_STORAGE',
+  'HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID',
+  'HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY',
+  'HETZNER_OBJECT_STORAGE_BUCKET',
+  'HETZNER_OBJECT_STORAGE_LOCATION',
+]);
 
 const VENDOR_PATTERN = /^https:\/\/[^./]+\.(fsn1|hel1|nbg1)\.your-objectstorage\.com$/;
 
-export default async function runProbe() {
-  if (!process.env.CI_HAS_HETZNER_OBJECT_STORAGE) {
-    return [{
+const AC28110_1 = 'Given the extended infra-s3-and-queue fixture at packages/rcf-lite/test/fixtures/infra-s3-and-queue/ carrying';
+const REQ001 = 'The application accesses object storage through a single';
+
+function skipResult(reason) {
+  return {
+    results: [{
       anchorAcId: 'AC-28110-1',
       verdict: 'pass',
-      detail: 'accountBound: skipped (no CI_HAS_HETZNER_OBJECT_STORAGE)',
+      detail: `${AC28110_1} - accountBound: skipped (${reason})`,
       accountBoundSkipped: true,
-    }];
+      reason,
+      evidence: { skip: true, reason, envDeclared: [...DECLARED_ENV] },
+    }],
+    extra: { accountBoundSkipped: true, reason, envDeclared: [...DECLARED_ENV] },
+  };
+}
+
+export default async function runProbe() {
+  const gate = process.env.CI_HAS_HETZNER_OBJECT_STORAGE;
+  if (gate == null || gate === '') {
+    return skipResult('CI_HAS_HETZNER_OBJECT_STORAGE unset');
+  }
+  if (gate !== 'true') {
+    return skipResult('CI_HAS_HETZNER_OBJECT_STORAGE (not "true")');
+  }
+  for (const varName of [
+    'HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID',
+    'HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY',
+    'HETZNER_OBJECT_STORAGE_BUCKET',
+    'HETZNER_OBJECT_STORAGE_LOCATION',
+  ]) {
+    if (!process.env[varName]) return skipResult(`${varName} unset`);
   }
 
   // Dynamic imports so the accountBoundSkipped path above loads
@@ -65,7 +96,8 @@ export default async function runProbe() {
     return [{
       anchorAcId: 'AC-28110-1',
       verdict: 'fail',
-      detail: 'CI_HAS_HETZNER_OBJECT_STORAGE set but one or more required env vars missing (HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID, HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY, HETZNER_OBJECT_STORAGE_BUCKET, HETZNER_OBJECT_STORAGE_LOCATION)',
+      detail: `${AC28110_1} - CI_HAS_HETZNER_OBJECT_STORAGE set but one or more required env vars missing (HETZNER_OBJECT_STORAGE_ACCESS_KEY_ID, HETZNER_OBJECT_STORAGE_SECRET_ACCESS_KEY, HETZNER_OBJECT_STORAGE_BUCKET, HETZNER_OBJECT_STORAGE_LOCATION)`,
+      evidence: { envSet: false },
     }];
   }
 
@@ -77,19 +109,21 @@ export default async function runProbe() {
     return [{
       anchorAcId: 'AC-28110-1',
       verdict: 'fail',
-      detail: `endpoint composition threw on field ${err.field || 'unknown'}: ${err.message}`,
+      detail: `${AC28110_1} - endpoint composition threw on field ${err.field || 'unknown'}: ${err.message}`,
+      evidence: { endpointCompositionError: err && err.message, endpointField: err.field || 'unknown' },
     }];
   }
   if (!VENDOR_PATTERN.test(endpoint)) {
     return [{
       anchorAcId: 'AC-28110-1',
       verdict: 'fail',
-      detail: `composed endpoint does not match vendor pattern <bucket>.<location>.your-objectstorage.com; got ${endpoint}; missing subdomain: your-objectstorage.com`,
+      detail: `${AC28110_1} - composed endpoint does not match vendor pattern <bucket>.<location>.your-objectstorage.com; got ${endpoint}; missing subdomain: your-objectstorage.com`,
+      evidence: { composedEndpoint: endpoint, vendorPatternMatched: false },
     }];
   }
 
   const events = [];
-  const store = createObjectStore({
+  const store = await createObjectStore({
     endpointUrl: endpoint,
     bucket,
     credentialsRef: { accessKeyId, secretAccessKey },
@@ -110,27 +144,77 @@ export default async function runProbe() {
   const body = Buffer.alloc(1024, 0x48);
   try {
     await store.ready();
-    await store.putObject(key, 'application/octet-stream', body);
+    const putRes = await store.putObject(key, 'application/octet-stream', body);
     const got = await store.getObject(key);
     const roundTripEqual = got.body.length === 1024 && got.body.equals(body);
     results.push({
       anchorAcId: 'AC-28110-1',
       verdict: roundTripEqual ? 'pass' : 'fail',
       detail: roundTripEqual
-        ? `Hetzner Object Storage round-trip byte-equal against ${endpoint} bucket=${bucket} location=${location}`
-        : `Hetzner Object Storage round-trip failed byte equality; expected 1024 bytes got ${got.body.length}`,
+        ? `${AC28110_1} - Hetzner Object Storage round-trip byte-equal against the composed vendor endpoint`
+        : `${AC28110_1} - Hetzner Object Storage round-trip failed byte equality; expected 1024 bytes got ${got.body.length}`,
+      evidence: {
+        vendorRequestId: (putRes && putRes.requestId) || (got && got.requestId) || null,
+        eTag: (putRes && putRes.eTag) || (got && got.eTag) || null,
+        endpointVendorPatternMatched: true, bucketNamePresent: Boolean(bucket),
+        locationCode: location, byteCount: got.body.length,
+      },
     });
+    // Event-secrecy limitation: AC-28110-1 states endpoint composition,
+    // put/get/delete round-trip, teardown, skip, and malformed-endpoint
+    // behavior; it does NOT state event-record secrecy. The shipped AC
+    // for event-secrecy is AC-28105-1 (metadata-only lifecycle events),
+    // which the object-storage-s3 event-secrecy probe already anchors
+    // against the local MinIO engine. This Hetzner-run event assertion
+    // is recorded as conformanceOnly so it stops falsely counting
+    // toward AC-28110-1.
     const evAssertion = assertMetadataOnlyEventRecords(events);
     results.push({
-      anchorAcId: 'AC-28110-1',
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: `AC-28105-1: Given a lifecycle-event spy attached to the sink, when put, get, delete, and presign verbs run against a PII fixture, then every event record on the sink carries only fields from the whitelist {event, key, size, contentType, ttl, ts, endpointHost, bucketName}. Not observed as an anchor on this row: AC-28105-1 is observed against the local MinIO engine in event-secrecy.mjs; the Hetzner probe re-checks the same whitelist against the vendor engine and records the result as conformanceOnly evidence toward AC-28105-1.`,
       verdict: evAssertion.pass ? 'pass' : 'fail',
       detail: evAssertion.pass
-        ? `every lifecycle event carries only whitelisted fields (${[...HETZNER_EVENT_WHITELIST].join(',')})`
-        : `event-secrecy leak: forbidden fields present ${evAssertion.leaked.join(',')}`,
+        ? `conformanceOnly (AC-28105-1) - every Hetzner lifecycle event carries only whitelisted fields (${[...HETZNER_EVENT_WHITELIST].join(',')})`
+        : `conformanceOnly (AC-28105-1) - Hetzner event-secrecy leak: forbidden fields present ${evAssertion.leaked.join(',')}`,
+      evidence: {
+        whitelistedFields: [...HETZNER_EVENT_WHITELIST], leakedFields: evAssertion.leaked || [],
+        eventCount: events.length,
+      },
     });
   } finally {
-    try { await store.deleteObject(key); } catch { /* teardown best effort */ }
-    await store.close();
+    // Teardown outcomes are recorded on the results per authoring-standard rule
+    // 5; a teardown FAILURE fails the verdict.
+    const teardown = { deleteObject: null };
+    let teardownDeleteRequestId = null;
+    try {
+      const dRes = await store.deleteObject(key);
+      teardownDeleteRequestId = (dRes && dRes.requestId) || null;
+      teardown.deleteObject = { key, ok: true, requestId: teardownDeleteRequestId };
+    } catch (err) {
+      teardown.deleteObject = { key, ok: false, error: err && err.message };
+    }
+    let facadeCloseError = null;
+    try { await store.close(); } catch (err) { facadeCloseError = err && err.message; }
+    if (facadeCloseError) {
+      results.push({
+        anchorReqId: 'object-storage-s3-REQ-001',
+        verdict: 'fail',
+        detail: `${REQ001} - facade close FAILED on Hetzner teardown: ${facadeCloseError}`,
+        evidence: { teardownStep: 'facade close', error: facadeCloseError },
+      });
+    }
+    results.push({
+      anchorAcId: 'AC-28110-1',
+      verdict: teardown.deleteObject && teardown.deleteObject.ok ? 'pass' : 'fail',
+      detail: teardown.deleteObject && teardown.deleteObject.ok
+        ? `${AC28110_1} - scratch object ${key} deleted on teardown`
+        : `${AC28110_1} - scratch object teardown FAILED: ${JSON.stringify(teardown.deleteObject)}`,
+      evidence: {
+        vendorRequestId: teardownDeleteRequestId,
+        teardown, teardownOk: teardown.deleteObject && teardown.deleteObject.ok,
+      },
+    });
   }
-  return results;
+  return { results, extra: { envDeclared: [...DECLARED_ENV] } };
 }

package/blueprints/object-storage-s3/contributions/probes/multipart-upload.mjs

@@ -1,23 +1,60 @@
 /**
  * Multipart upload probe.
  *
- * Puts a 10 MiB payload above the ADR-2903 threshold, asserts multipart
- * upload completes, get returns full size, objectPut fires with size
- * 10485760. Asserts no in-flight multipart upload remains on the bucket
- * after completion.
+ * Two positive-evidence branches per user-story-28104:
  *
- * Anchors AC-28104-1, AC-28104-2.
+ *   1. Canonical multipart round-trip: puts a 10 MiB payload above the
+ *      ADR-2903 threshold, asserts multipart upload completes, get
+ *      returns full 10485760 bytes byte-equal, objectPut fires with
+ *      size=10485760, and no in-flight multipart upload remains.
+ *      Anchors AC-28104-1.
+ *
+ *   2. Abort-on-failure branch: forces SIMULATE_PART_UPLOAD_FAIL on
+ *      the facade for a second put, asserts the promise rejects, and
+ *      asserts a follow-up ListMultipartUploads on the failure key
+ *      returns zero in-flight uploads after the abort branch issues
+ *      AbortMultipartUpload on the failure key. Records the observed
+ *      error and the aborted upload id (if any).
+ *      Anchors AC-28104-2.
+ *
+ * The abort branch is REQUIRED , the probe sets SIMULATE_PART_UPLOAD
+ * _FAIL locally on process.env for the second put (restoring the
+ * previous value afterwards) so AC-28104-2 always carries observed
+ * behaviour on AC-28104-2, never "path not run".
  */
 
-import { createObjectStore, endpointFromEnv, credentialsFromShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
+import { createObjectStore, endpointFromEnv, credentialsFromShim, MissingS3EndpointError } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
 import { secretsShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs';
 import { probeKey } from './probe-utils.mjs';
 
+export const DECLARED_ENV = Object.freeze(['S3_ENDPOINT_URL']);
+
+const AC28104_FIRST8 = 'Given the elicited multipart threshold at 8 MiB';
+
+function skipRow(variable) {
+  return {
+    anchorAcId: null,
+    verdict: 'pass',
+    detail: `${AC28104_FIRST8} - accountBound: skipped (${variable} unset)`,
+    accountBoundSkipped: true,
+    reason: `${variable} unset`,
+    evidence: { skip: true, reason: `${variable} unset`, envDeclared: [...DECLARED_ENV] },
+  };
+}
+
 export default async function runProbe() {
-  const { endpoint, bucket, region, forcePathStyle } = endpointFromEnv();
+  let endpoint, bucket, region, forcePathStyle;
+  try {
+    ({ endpoint, bucket, region, forcePathStyle } = endpointFromEnv());
+  } catch (err) {
+    if (err instanceof MissingS3EndpointError) {
+      return { results: [skipRow(err.variable)], extra: { accountBoundSkipped: true, reason: `${err.variable} unset`, envDeclared: [...DECLARED_ENV] } };
+    }
+    throw err;
+  }
   const credentials = await credentialsFromShim(secretsShim);
   const events = [];
-  const store = createObjectStore({
+  const store = await createObjectStore({
     endpointUrl: endpoint,
     bucket,
     credentialsRef: credentials,
@@ -29,11 +66,11 @@ export default async function runProbe() {
   const key = probeKey('probe/multipart');
   const SIZE = 10 * 1024 * 1024; // 10 MiB
   const body = Buffer.alloc(SIZE);
-  // Fill with a stable pattern so byte equality is meaningful
   for (let i = 0; i < SIZE; i += 1) body[i] = i & 0xff;
   try {
     await store.ready();
-    await store.putObject(key, 'application/octet-stream', body);
+    // --- AC-28104-1: canonical multipart round-trip ---
+    const putRes = await store.putObject(key, 'application/octet-stream', body);
     const got = await store.getObject(key);
     const sizePass = got.body.length === SIZE && got.body.equals(body);
     const putEvent = events.find((e) => e.event === 'objectPut' && e.key === key);
@@ -42,43 +79,75 @@ export default async function runProbe() {
       anchorAcId: 'AC-28104-1',
       verdict: sizePass && eventPass ? 'pass' : 'fail',
       detail: sizePass && eventPass
-        ? `10 MiB multipart round-trip byte-equal; objectPut fired with size=${putEvent.size}`
-        : `sizePass=${sizePass} eventPass=${eventPass} got.size=${got.body.length} put=${JSON.stringify(putEvent)}`,
+        ? `Given the elicited multipart threshold at 8 MiB - 10 MiB round-trip byte-equal; objectPut fired with size=${putEvent.size}`
+        : `Given the elicited multipart threshold at 8 MiB - sizePass=${sizePass} eventPass=${eventPass} got.size=${got.body.length} put=${JSON.stringify(putEvent)}`,
+      evidence: {
+        uploadId: (putRes && putRes.uploadId) || null,
+        vendorRequestId: (putRes && putRes.requestId) || (got && got.requestId) || null,
+        eTag: (putRes && putRes.eTag) || (got && got.eTag) || null,
+        bucketName: bucket, key, size: SIZE,
+        gotSize: got.body.length, byteEqual: sizePass,
+        objectPutEvent: putEvent || null,
+      },
     });
-    // no in-flight uploads after complete
     const inflight = await store.listMultipartUploads(key);
+    const inflightRequestId = (inflight && inflight.requestId) || null;
     results.push({
       anchorAcId: 'AC-28104-1',
       verdict: inflight.length === 0 ? 'pass' : 'fail',
       detail: inflight.length === 0
-        ? 'no in-flight multipart uploads after complete'
-        : `unexpected in-flight uploads: ${JSON.stringify(inflight)}`,
+        ? 'Given the elicited multipart threshold at 8 MiB - no in-flight multipart uploads after complete'
+        : `Given the elicited multipart threshold at 8 MiB - unexpected in-flight uploads: ${JSON.stringify(inflight)}`,
+      evidence: {
+        vendorRequestId: inflightRequestId,
+        bucketName: bucket, key,
+        inflightCount: inflight.length, inflight: [...inflight],
+      },
     });
     await store.deleteObject(key);
 
-    // Abort-on-failure surface: run a second put with SIMULATE_PART_UPLOAD_FAIL
-    if (process.env.SIMULATE_PART_UPLOAD_FAIL === 'true') {
-      const failKey = probeKey('probe/multipart-fail');
-      let threw = false;
-      try { await store.putObject(failKey, 'application/octet-stream', body); }
-      catch { threw = true; }
-      const failInflight = await store.listMultipartUploads(failKey);
-      results.push({
-        anchorAcId: 'AC-28104-2',
-        verdict: threw && failInflight.length === 0 ? 'pass' : 'fail',
-        detail: threw && failInflight.length === 0
-          ? 'part-upload failure propagated and Abort left no in-flight uploads'
-          : `threw=${threw} inflight=${JSON.stringify(failInflight)}`,
-      });
-    } else {
-      results.push({
-        anchorAcId: 'AC-28104-2',
-        verdict: 'pass',
-        detail: 'abort-on-failure path exercised only when SIMULATE_PART_UPLOAD_FAIL=true; not-run on canonical fixture state',
-      });
+    // --- AC-28104-2: forced abort-on-failure branch ---
+    // The probe unconditionally exercises the induced-failure path.
+    const before = process.env.SIMULATE_PART_UPLOAD_FAIL;
+    process.env.SIMULATE_PART_UPLOAD_FAIL = 'true';
+    const failKey = probeKey('probe/multipart-fail');
+    let observedError = null;
+    let observedUploadId = null;
+    let observedAbortError = null;
+    try {
+      await store.putObject(failKey, 'application/octet-stream', body);
+    } catch (err) {
+      observedError = { name: err && err.name, message: err && err.message, uploadId: err && err.uploadId };
+      observedUploadId = err && err.uploadId;
+      observedAbortError = err && err.abortError ? err.abortError : null;
+    } finally {
+      if (before === undefined) delete process.env.SIMULATE_PART_UPLOAD_FAIL;
+      else process.env.SIMULATE_PART_UPLOAD_FAIL = before;
     }
+    const failInflight = await store.listMultipartUploads(failKey);
+    const failInflightRequestId = (failInflight && failInflight.requestId) || null;
+    const uploadIdPresent = typeof observedUploadId === 'string' && observedUploadId.length > 0;
+    const abortSucceeded = observedAbortError === null;
+    const abortPass = observedError !== null && failInflight.length === 0 && uploadIdPresent && abortSucceeded;
+    results.push({
+      anchorAcId: 'AC-28104-2',
+      verdict: abortPass ? 'pass' : 'fail',
+      detail: abortPass
+        ? `Given a simulated part-upload failure mid-multipart (SIMULATE_PART_UPLOAD_FAIL fixture) - propagated (${observedError.name || observedError.message}), aborted upload id=${observedUploadId}, no in-flight uploads for ${failKey}, abort call itself succeeded`
+        : `Given a simulated part-upload failure mid-multipart (SIMULATE_PART_UPLOAD_FAIL fixture) - abort-on-failure conditions not all met: errorObserved=${observedError !== null} inflightCount=${failInflight.length} uploadIdPresent=${uploadIdPresent} abortSucceeded=${abortSucceeded}${observedAbortError ? ` abortError=${JSON.stringify(observedAbortError)}` : ''}`,
+      evidence: {
+        observedUploadId,
+        vendorRequestId: failInflightRequestId,
+        bucketName: bucket,
+        failKey,
+        observedError,
+        abortError: observedAbortError,
+        inflightCountAfter: failInflight.length,
+        inflightAfter: [...failInflight],
+      },
+    });
   } finally {
     await store.close();
   }
-  return results;
+  return { results, extra: { key, size: SIZE, events } };
 }

package/blueprints/object-storage-s3/contributions/probes/presigned-url.mjs

@@ -1,24 +1,52 @@
 /**
  * Presigned URL probe.
  *
- * Issues a presigned URL with TTL 60 seconds, fetches it with Node
- * built-in fetch, asserts 200 within TTL. Sleeps to TTL+2 seconds,
- * fetches again, asserts 403 or the storage-side 403-equivalent.
+ * Per AC-28103-1 the property is: with a bounded TTL, a fetch WITHIN
+ * TTL returns 200, and the SAME URL fetched after TTL+2 seconds
+ * returns 403 (S3-shape AccessDenied). This probe proves the property
+ * exactly: it presigns a URL at the ADR-2902 floor of 60s, fetches it
+ * within TTL and records 200 + body-equal, then sleeps TTL+2s and
+ * fetches the SAME URL again and records 403.
  *
- * Anchors AC-28103-1.
+ * The floor-refusal below the 60s floor is also asserted (a separate
+ * result row) per ADR-2902.
  */
 
-import { createObjectStore, endpointFromEnv, credentialsFromShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
+import { createObjectStore, endpointFromEnv, credentialsFromShim, MissingS3EndpointError } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
 import { secretsShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs';
 import { probeKey } from './probe-utils.mjs';
+import { createHash } from 'node:crypto';
+
+export const DECLARED_ENV = Object.freeze(['S3_ENDPOINT_URL']);
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const AC28103_1 = 'Given a presignGetUrl call with ttl=60 seconds for';
+const REQ003 = 'The facade exposes a presignGetUrl verb that issues';
+
+function skipRow(variable) {
+  return {
+    anchorAcId: null,
+    verdict: 'pass',
+    detail: `${AC28103_1} - accountBound: skipped (${variable} unset)`,
+    accountBoundSkipped: true,
+    reason: `${variable} unset`,
+    evidence: { skip: true, reason: `${variable} unset`, envDeclared: [...DECLARED_ENV] },
+  };
+}
 
 export default async function runProbe() {
-  const { endpoint, bucket, region, forcePathStyle } = endpointFromEnv();
+  let endpoint, bucket, region, forcePathStyle;
+  try {
+    ({ endpoint, bucket, region, forcePathStyle } = endpointFromEnv());
+  } catch (err) {
+    if (err instanceof MissingS3EndpointError) {
+      return { results: [skipRow(err.variable)], extra: { accountBoundSkipped: true, reason: `${err.variable} unset`, envDeclared: [...DECLARED_ENV] } };
+    }
+    throw err;
+  }
   const credentials = await credentialsFromShim(secretsShim);
   const events = [];
-  const store = createObjectStore({
+  const store = await createObjectStore({
     endpointUrl: endpoint,
     bucket,
     credentialsRef: credentials,
@@ -31,71 +59,92 @@ export default async function runProbe() {
   const body = Buffer.from('presigned url payload');
   try {
     await store.ready();
-    await store.putObject(key, 'text/plain', body);
+    const putRes = await store.putObject(key, 'text/plain', body);
+
+    // AC-28103-1 canonical timing test: TTL=60, fetch within TTL, then
+    // fetch the SAME URL after TTL+2s.
     const ttl = 60;
     const url = await store.presignGetUrl(key, ttl);
+    const urlSha256 = createHash('sha256').update(url).digest('hex');
+    const issuedAt = Date.now();
     const first = await fetch(url);
     const firstBody = Buffer.from(await first.arrayBuffer());
-    const firstPass = first.status === 200 && firstBody.equals(body);
+    const firstStatus = first.status;
+    const firstEqual = firstBody.equals(body);
     const issued = events.find((e) => e.event === 'presignedIssued' && e.key === key && e.ttl === ttl);
     results.push({
       anchorAcId: 'AC-28103-1',
-      verdict: firstPass && issued ? 'pass' : 'fail',
-      detail: firstPass && issued
-        ? `fetch within TTL returned ${first.status} with matching body; presignedIssued fired with ttl=${ttl}`
-        : `firstStatus=${first.status} bodyMatch=${firstBody.equals(body)} issued=${Boolean(issued)}`,
+      verdict: firstStatus === 200 && firstEqual && issued ? 'pass' : 'fail',
+      detail: firstStatus === 200 && firstEqual && issued
+        ? `${AC28103_1} - fetch within TTL returned 200 with matching body; presignedIssued fired with ttl=${ttl}; urlSha256=${urlSha256.slice(0, 12)}`
+        : `${AC28103_1} - firstStatus=${firstStatus} bodyMatch=${firstEqual} issued=${Boolean(issued)}`,
+      evidence: {
+        eTag: (putRes && putRes.eTag) || null,
+        vendorRequestId: (putRes && putRes.requestId) || null,
+        bucketName: bucket,
+        key,
+        ttl,
+        firstStatus,
+        firstBodyBytes: firstBody.length,
+        firstBodyEqual: firstEqual,
+        presignedIssuedEvent: issued || null,
+        urlSha256,
+        elapsedMsSincePresign: Date.now() - issuedAt,
+      },
     });
 
-    // Test TTL expiration: sleep past TTL, expect 403
-    // NOTE: TTL floor probe (below the 1-minute floor) is asserted via a
-    // separate try/catch below to avoid a 60+ second sleep in CI.
-    const shortUrl = await store.presignGetUrl(key, 60);
-    // Sleep past the 60s TTL is too slow for CI: instead we test the
-    // signature-expiry surface by asserting the presign floor refuses.
-    // The 200-then-403 expiration behaviour is asserted at real-time via
-    // the second URL fetch after a much shorter tampered TTL below.
-
-    // Truncated ttl test: use a 1s-expired presign by generating a URL
-    // with a very short (but at-floor) TTL and awaiting past it.
-    const shortTtl = 60;
-    const shortUrl2 = await store.presignGetUrl(key, shortTtl);
-    // We simulate expiry by tampering the X-Amz-Date to a stale value
-    // via SIMULATE_PRESIGN_MALFORMED; the real 200-then-403 timing test
-    // runs with SIMULATE_PRESIGN_EXPIRE=true which sleeps TTL+2 seconds.
-    if (process.env.SIMULATE_PRESIGN_EXPIRE === 'true') {
-      await sleep((shortTtl + 2) * 1000);
-      const second = await fetch(shortUrl2);
-      results.push({
-        anchorAcId: 'AC-28103-1',
-        verdict: second.status === 403 ? 'pass' : 'fail',
-        detail: `after TTL fetch returned ${second.status} (expected 403)`,
-      });
-    } else {
-      // Time-shortened path: presign at floor and immediately corrupt
-      // the signature so the endpoint returns 403 without a wall-clock
-      // wait. This proves the 403-shape on tampered signatures; the
-      // real timing test remains available via SIMULATE_PRESIGN_EXPIRE.
-      const tampered = shortUrl2.replace(/X-Amz-Signature=[^&]*/, 'X-Amz-Signature=deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef');
-      const second = await fetch(tampered);
-      results.push({
-        anchorAcId: 'AC-28103-1',
-        verdict: second.status === 403 ? 'pass' : 'fail',
-        detail: `tampered signature fetch returned ${second.status} (expected 403; set SIMULATE_PRESIGN_EXPIRE=true for full TTL wall-clock)`,
-      });
-    }
+    // Wait past TTL and fetch the SAME URL. AC-28103-1 explicitly says
+    // "the same URL". This is a wall-clock wait; the probe budget
+    // includes it.
+    const waitMs = (ttl + 2) * 1000;
+    await sleep(waitMs);
+    const second = await fetch(url);
+    const secondStatus = second.status;
+    results.push({
+      anchorAcId: 'AC-28103-1',
+      verdict: secondStatus === 403 ? 'pass' : 'fail',
+      detail: secondStatus === 403
+        ? `${AC28103_1} - after TTL+2s the SAME presigned URL (urlSha256=${urlSha256.slice(0, 12)}) returned 403 (AccessDenied / expired-URL family)`
+        : `${AC28103_1} - after TTL+2s the SAME presigned URL returned ${secondStatus}, expected 403`,
+      evidence: {
+        eTag: (putRes && putRes.eTag) || null,
+        vendorRequestId: (putRes && putRes.requestId) || null,
+        bucketName: bucket,
+        key,
+        ttl,
+        waitedMs: waitMs,
+        secondStatus,
+        urlSha256,
+        totalElapsedMsSincePresign: Date.now() - issuedAt,
+      },
+    });
 
-    // Floor refusal (1 minute per ADR-2902)
+    // ADR-2902 floor refusal is not stated by any AC (AC-28103-1
+    // states TTL 60 success/expiry). Anchor to REQ-003 which names
+    // the floor of 1 minute.
     let refusedBelowFloor = false;
-    try { await store.presignGetUrl(key, 30); } catch { refusedBelowFloor = true; }
+    let refusedError = null;
+    try { await store.presignGetUrl(key, 30); } catch (err) { refusedBelowFloor = true; refusedError = err && err.message; }
     results.push({
-      anchorAcId: 'AC-28103-1',
+      anchorReqId: 'object-storage-s3-REQ-003',
       verdict: refusedBelowFloor ? 'pass' : 'fail',
-      detail: refusedBelowFloor ? 'presign below 60s floor refused per ADR-2902' : 'presign below floor did not refuse',
+      detail: refusedBelowFloor
+        ? `${REQ003} - presign below the 60s floor refused per ADR-2902 (${refusedError})`
+        : `${REQ003} - presign below the 60s floor did not refuse`,
+      evidence: {
+        eTag: (putRes && putRes.eTag) || null,
+        vendorRequestId: (putRes && putRes.requestId) || null,
+        bucketName: bucket,
+        requestedTtlSeconds: 30, floorSeconds: 60,
+        refused: refusedBelowFloor, error: refusedError,
+        refusalFired: refusedBelowFloor,
+        refusalCode: refusedBelowFloor ? 'below-floor' : 'accepted',
+      },
     });
 
     await store.deleteObject(key);
   } finally {
     await store.close();
   }
-  return results;
+  return { results, extra: { key } };
 }