rcf-lite 0.26.0 → 0.28.0

package/blueprints/object-storage-s3/contributions/probes/r2-real-account-smoke.mjs

@@ -1,64 +1,318 @@
 /**
  * R2 real-account smoke probe.
  *
- * Opens the facade against a real Cloudflare R2 bucket (endpoint URL,
- * bucket, and credential pair read via security-secrets-management),
- * puts a 1 KiB payload, gets it back, asserts byte equality, deletes
- * the temporary object.
+ * Against a real Cloudflare R2 account (credentials read via the
+ * fixture's secrets shim), the probe:
  *
- * accountBound: true. Skipped in CI without CI_HAS_CLOUDFLARE_ACCOUNT
- * per infra round 5 spec section 3.5.
+ *   1. mints a scratch bucket via S3 CreateBucket,
+ *   2. positively records the bucket present in an S3 ListBuckets
+ *      inventory diff (post-create),
+ *   3. opens the shipped facade against that scratch bucket, puts a
+ *      1 KiB payload, gets it back byte-equal, lists to prove the key
+ *      is present, deletes the object, lists again to prove it is
+ *      absent (real inventory diff; a failed list is a FAIL, never an
+ *      empty inventory),
+ *   4. deletes the scratch bucket via S3 DeleteBucket and confirms it
+ *      is absent from a post-run ListBuckets inventory diff, recording
+ *      the HTTP status of the DeleteBucket call and the ListBuckets
+ *      call on the row itself.
  *
- * Anchors AC-28108-1.
+ * Each result row carries its own evidence object; skip records
+ * follow the one-unset-variable-per-row rule.
+ *
+ * Row anchoring:
+ *  - The account-bound skip anchors AC-28108-1 (the skip acceptance).
+ *  - The object round trip + inventory diff anchor AC-28108-2 (the
+ *    live-account round trip).
+ *  - Bucket lifecycle rows (bucket create / bucket delete / post-run
+ *    bucket-inventory diff) are recorded as `conformanceOnly: true`
+ *    with `anchorAcId: null`: no shipped AC states bucket-lifecycle
+ *    behaviour, and REQ-002's verb contract is the four object-level
+ *    verbs (putObject / getObject / deleteObject / listObjects), not
+ *    CreateBucket / DeleteBucket / ListBuckets. The `limitation`
+ *    field on each row names REQ-002 and explains the gap so a
+ *    reader sees the property that was NOT observed alongside the
+ *    observation that WAS made.
+ *  - Endpoint-resolution failure after the preflight gates all pass
+ *    is a FAIL anchored to REQ-001 (facade opens on boot), never a
+ *    compound account skip.
+ *
+ * accountBound: true.
  */
 
-import { createObjectStore, credentialsFromShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs';
-import { secretsShim } from '../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs';
 import { probeKey } from './probe-utils.mjs';
 
 export const accountBound = true;
+export const DECLARED_ENV = Object.freeze([
+  'CI_HAS_CLOUDFLARE_ACCOUNT',
+  'R2_ACCOUNT_ID',
+  'R2_BUCKET',
+  'S3_ACCESS_KEY_ID',
+  'S3_SECRET_ACCESS_KEY',
+]);
 
-export default async function runProbe() {
-  if (!process.env.CI_HAS_CLOUDFLARE_ACCOUNT) {
-    return [{
+const AC28108_1_FIRST8 = 'Given CI_HAS_CLOUDFLARE_ACCOUNT is unset, when the r2-real-account-smoke.mjs shim';
+const AC28108_2_FIRST8 = 'Given CI_HAS_CLOUDFLARE_ACCOUNT set alongside a real R2 endpoint';
+const REQ001_FIRST8 = 'The application accesses object storage through a single';
+const AC28108_2_INVENTORY_LIMITATION = 'AC-28108-2: Given CI_HAS_CLOUDFLARE_ACCOUNT set alongside a real R2 endpoint URL, bucket name, and credential pair (all from security-secrets-management), when the r2-real-account-smoke.mjs shim runs, then the facade opens against the R2 bucket, puts a 1 KiB payload, gets it back byte-equal, deletes the temporary object on exit, and the report carries aggregateVerdict pass with accountBoundSkipped absent or false. Not observed on this row: the object round-trip clause is observed on the byte-equal put/get row that anchors AC-28108-2 with the engine-returned ETag; this row records the per-object inventory diff (listObjects before delete, delete, listObjects after delete) which R2 does not surface a per-object engine-returned identifier for (S3 SDK $metadata.requestId returns null on Cloudflare R2 for object-level verbs).';
+const AC28108_2_BUCKET_LIMITATION = 'AC-28108-2: Given CI_HAS_CLOUDFLARE_ACCOUNT set alongside a real R2 endpoint URL, bucket name, and credential pair (all from security-secrets-management), when the r2-real-account-smoke.mjs shim runs, then the facade opens against the R2 bucket, puts a 1 KiB payload, gets it back byte-equal, deletes the temporary object on exit, and the report carries aggregateVerdict pass with accountBoundSkipped absent or false. Not observed on this row: the AC states an object-level round trip on an already-provisioned bucket; this row records bucket-level lifecycle (CreateBucket / DeleteBucket / ListBuckets), which the AC does not state.';
+
+function skipResult(reason) {
+  return {
+    results: [{
       anchorAcId: 'AC-28108-1',
       verdict: 'pass',
-      detail: 'accountBound: skipped (no CI_HAS_CLOUDFLARE_ACCOUNT)',
+      detail: `${AC28108_1_FIRST8} - accountBound: skipped (${reason})`,
       accountBoundSkipped: true,
-    }];
-  }
+      reason,
+      evidence: { skip: true, reason, envDeclared: [...DECLARED_ENV] },
+    }],
+    extra: { accountBoundSkipped: true, reason, envDeclared: [...DECLARED_ENV] },
+  };
+}
+
+function shortId() {
+  return Math.random().toString(36).slice(2, 8);
+}
+
+export default async function runProbe() {
+  const gate = process.env.CI_HAS_CLOUDFLARE_ACCOUNT;
+  if (gate == null || gate === '') return skipResult('CI_HAS_CLOUDFLARE_ACCOUNT unset');
+  if (gate !== 'true') return skipResult('CI_HAS_CLOUDFLARE_ACCOUNT (not "true")');
+  if (!process.env.R2_ACCOUNT_ID) return skipResult('R2_ACCOUNT_ID unset');
+  if (!process.env.R2_BUCKET) return skipResult('R2_BUCKET unset');
+  if (!process.env.S3_ACCESS_KEY_ID) return skipResult('S3_ACCESS_KEY_ID unset');
+  if (!process.env.S3_SECRET_ACCESS_KEY) return skipResult('S3_SECRET_ACCESS_KEY unset');
+
+  const { createObjectStore, credentialsFromShim } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/object-store.mjs');
+  const { secretsShim } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/secrets.mjs');
+  const { createBucketOps } = await import('../../../../packages/rcf-lite/test/fixtures/infra-s3-and-queue/src/bucket-ops.mjs');
+
   const r2 = await secretsShim.getSecret('r2Endpoint');
-  if (!r2) {
-    return [{
-      anchorAcId: 'AC-28108-1',
-      verdict: 'fail',
-      detail: 'CI_HAS_CLOUDFLARE_ACCOUNT set but r2Endpoint secret missing (R2_ACCOUNT_ID and R2_BUCKET required via security-secrets-management)',
-    }];
+  if (!r2 || !r2.endpoint) {
+    // All preflight gates passed; endpoint resolution failure is a
+    // real facade-open failure, not an account-bound skip.
+    return {
+      results: [{
+        anchorReqId: 'object-storage-s3-REQ-001',
+        verdict: 'fail',
+        detail: `${REQ001_FIRST8} - endpoint could not be resolved from the secrets shim after all preflight gates passed; this is a facade-open failure, not an account skip`,
+        evidence: { endpointResolved: false, envDeclared: [...DECLARED_ENV] },
+      }],
+      extra: { envDeclared: [...DECLARED_ENV] },
+    };
   }
   const credentials = await credentialsFromShim(secretsShim);
-  const events = [];
-  const store = createObjectStore({
+  const scratchBucket = `qa-e-s3-${shortId()}`;
+  const endpointHostRedacted = new URL(r2.endpoint).host.replace(/^[0-9a-f]+/, '[account-id]');
+  const evidence = { endpointHostRedacted, scratchBucket, envDeclared: [...DECLARED_ENV] };
+  const results = [];
+  const teardown = { deleteObject: null, deleteBucket: null, bucketAbsentAfter: null };
+  const bucketOps = createBucketOps({
     endpointUrl: r2.endpoint,
-    bucket: r2.bucket,
-    credentialsRef: credentials,
     region: 'auto',
+    credentials: { accessKeyId: credentials.accessKeyId, secretAccessKey: credentials.secretAccessKey },
     forcePathStyle: false,
-    onEvent: (e) => events.push(e),
   });
-  const key = probeKey('probe/r2-smoke');
-  const body = Buffer.alloc(1024, 0x52);
+
+  let bucketCreated = false;
+  let store = null;
   try {
+    // 1) Create scratch bucket (anchor REQ-002: put verb).
+    const create = await bucketOps.createBucket(scratchBucket);
+    bucketCreated = true;
+    const createHttpStatus = create && create.$metadata && create.$metadata.httpStatusCode;
+    const createRequestId = create && create.$metadata && create.$metadata.requestId;
+
+    // 2) Inventory diff (REQ-002 list verb): post-create bucket must
+    // appear on ListBuckets. Failed list is a FAIL.
+    let bucketsAfterCreate;
+    let listAfterCreateHttpStatus;
+    let listAfterCreateRequestId;
+    try {
+      const list = await bucketOps.listBuckets();
+      bucketsAfterCreate = list.buckets;
+      listAfterCreateHttpStatus = list.raw && list.raw.$metadata && list.raw.$metadata.httpStatusCode;
+      listAfterCreateRequestId = list.raw && list.raw.$metadata && list.raw.$metadata.requestId;
+    } catch (err) {
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: AC28108_2_BUCKET_LIMITATION,
+        verdict: 'fail',
+        detail: `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - ListBuckets after CreateBucket threw: ${err && err.message}; failed inventory is a FAIL`,
+        evidence: { scratchBucket, error: err && err.message, endpointHostRedacted },
+      });
+      throw err;
+    }
+    const seenAfterCreate = bucketsAfterCreate.includes(scratchBucket);
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: AC28108_2_BUCKET_LIMITATION,
+      verdict: seenAfterCreate ? 'pass' : 'fail',
+      detail: seenAfterCreate
+        ? `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - scratch bucket ${scratchBucket} present in ListBuckets after CreateBucket (positive inventory diff on bucket-level lifecycle)`
+        : `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - scratch bucket ${scratchBucket} NOT in ListBuckets after CreateBucket; buckets=${JSON.stringify(bucketsAfterCreate)}`,
+      evidence: {
+        scratchBucket,
+        seenAfterCreate,
+        bucketCount: bucketsAfterCreate.length,
+        createBucketHttpStatus: createHttpStatus,
+        createBucketRequestId: createRequestId,
+        listBucketsHttpStatus: listAfterCreateHttpStatus,
+        listBucketsRequestId: listAfterCreateRequestId,
+        endpointHostRedacted,
+      },
+    });
+
+    // 3) Open facade against scratch bucket and round-trip (AC-28108-2).
+    const events = [];
+    store = await createObjectStore({
+      endpointUrl: r2.endpoint,
+      bucket: scratchBucket,
+      credentialsRef: credentials,
+      region: 'auto',
+      forcePathStyle: false,
+      onEvent: (e) => events.push(e),
+    });
     await store.ready();
-    await store.putObject(key, 'application/octet-stream', body);
+    const key = probeKey('qa-e-s3/r2-smoke');
+    const body = Buffer.alloc(1024, 0x52);
+    const put = await store.putObject(key, 'application/octet-stream', body);
     const got = await store.getObject(key);
-    const pass = got.body.length === 1024 && got.body.equals(body);
-    return [{
-      anchorAcId: 'AC-28108-1',
-      verdict: pass ? 'pass' : 'fail',
-      detail: pass ? `R2 round-trip byte-equal against ${r2.endpoint}/${r2.bucket}` : 'R2 round-trip failed byte equality',
-    }];
+    const roundTripEqual = got.body.length === body.length && got.body.equals(body);
+    results.push({
+      anchorAcId: 'AC-28108-2',
+      verdict: roundTripEqual ? 'pass' : 'fail',
+      detail: roundTripEqual
+        ? `${AC28108_2_FIRST8} - R2 round-trip byte-equal against ${scratchBucket} through the shipped facade; putObject returned size=${put.size}, getObject body length=${got.body.length}`
+        : `${AC28108_2_FIRST8} - R2 round-trip failed byte equality; got ${got.body.length} expected ${body.length}`,
+      evidence: {
+        eTag: (put && put.eTag) || (got && got.eTag) || null,
+        vendorRequestId: (put && put.requestId) || (got && got.requestId) || null,
+        scratchBucket,
+        key,
+        putReturnedSize: put.size,
+        getSize: got.body.length,
+        byteEqual: roundTripEqual,
+        objectPutEvent: events.find((e) => e.event === 'objectPut') || null,
+        endpointHostRedacted,
+      },
+    });
+
+    // Real per-object inventory diff (AC-28108-2 covers the delete on
+    // exit). A failed list is a FAIL.
+    let listBefore;
+    try { listBefore = await store.listObjects(key); }
+    catch (err) {
+      results.push({
+        anchorAcId: 'AC-28108-2',
+        verdict: 'fail',
+        detail: `${AC28108_2_FIRST8} - listObjects before delete threw: ${err && err.message}`,
+        evidence: { scratchBucket, key, error: err && err.message },
+      });
+      throw err;
+    }
+    const seenBefore = listBefore.keys.includes(key);
+    const delRes = await store.deleteObject(key);
+    teardown.deleteObject = { key, ok: true, requestId: (delRes && delRes.requestId) || null };
+    let listAfter;
+    try { listAfter = await store.listObjects(key); }
+    catch (err) {
+      results.push({
+        anchorAcId: 'AC-28108-2',
+        verdict: 'fail',
+        detail: `${AC28108_2_FIRST8} - listObjects after delete threw: ${err && err.message}`,
+        evidence: { scratchBucket, key, error: err && err.message },
+      });
+      throw err;
+    }
+    const seenAfter = listAfter.keys.includes(key);
+    const inventoryPass = seenBefore && !seenAfter;
+    // R2 does not surface a per-object $metadata.requestId on the
+    // object-level list/delete verbs, so the inventory-diff row has
+    // no engine-returned scalar id. The AC-28108-2 object round-trip
+    // clause is anchored on the byte-equal put/get row above (which
+    // carries the engine-returned ETag). This row is conformanceOnly
+    // and records the per-object inventory diff as positive evidence
+    // toward AC-28108-2 without falsely counting as an anchor.
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: AC28108_2_INVENTORY_LIMITATION,
+      verdict: inventoryPass ? 'pass' : 'fail',
+      detail: inventoryPass
+        ? `conformanceOnly (${AC28108_2_INVENTORY_LIMITATION}) - object inventory diff proves create+delete: key present before delete, absent after (listObjects returned ${listBefore.keys.length} then ${listAfter.keys.length} keys)`
+        : `conformanceOnly (${AC28108_2_INVENTORY_LIMITATION}) - inventory diff mismatch: seenBefore=${seenBefore} seenAfter=${seenAfter}`,
+      evidence: {
+        scratchBucket,
+        key,
+        seenBefore,
+        seenAfter,
+        keysBeforeCount: listBefore.keys.length,
+        keysAfterCount: listAfter.keys.length,
+        endpointHostRedacted,
+      },
+    });
   } finally {
-    try { await store.deleteObject(key); } catch { /* best effort */ }
-    await store.close();
+    if (store) {
+      try { await store.close(); }
+      catch (err) { teardown.facadeClose = { ok: false, error: err && err.message }; }
+    }
+    if (bucketCreated) {
+      let deleteBucketErr = null;
+      let del = null;
+      try {
+        del = await bucketOps.deleteBucket(scratchBucket);
+        teardown.deleteBucket = {
+          bucket: scratchBucket,
+          ok: true,
+          httpStatus: del && del.$metadata && del.$metadata.httpStatusCode,
+          requestId: del && del.$metadata && del.$metadata.requestId,
+        };
+      } catch (err) {
+        deleteBucketErr = err;
+        teardown.deleteBucket = { bucket: scratchBucket, ok: false, error: err && err.message };
+      }
+      // Post-run bucket inventory
+      let postList = null;
+      try {
+        postList = await bucketOps.listBuckets();
+        const stillThere = postList.buckets.includes(scratchBucket);
+        teardown.bucketAbsentAfter = {
+          ok: !stillThere,
+          bucketCount: postList.buckets.length,
+          httpStatus: postList.raw && postList.raw.$metadata && postList.raw.$metadata.httpStatusCode,
+          requestId: postList.raw && postList.raw.$metadata && postList.raw.$metadata.requestId,
+        };
+      } catch (err) {
+        teardown.bucketAbsentAfter = { ok: false, error: err && err.message };
+      }
+      const facadeCloseOk = !teardown.facadeClose || teardown.facadeClose.ok !== false;
+      const teardownOk = teardown.deleteBucket && teardown.deleteBucket.ok
+        && teardown.bucketAbsentAfter && teardown.bucketAbsentAfter.ok
+        && facadeCloseOk;
+      results.push({
+        anchorAcId: null,
+        conformanceOnly: true,
+        limitation: AC28108_2_BUCKET_LIMITATION,
+        verdict: teardownOk ? 'pass' : 'fail',
+        detail: teardownOk
+          ? `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - scratch bucket ${scratchBucket} deleted and confirmed absent from post-run ListBuckets (deleteBucket http=${teardown.deleteBucket.httpStatus}, listBuckets http=${teardown.bucketAbsentAfter.httpStatus})`
+          : `conformanceOnly (${AC28108_2_BUCKET_LIMITATION}) - bucket teardown FAILED: deleteBucket=${JSON.stringify(teardown.deleteBucket)}; bucketAbsentAfter=${JSON.stringify(teardown.bucketAbsentAfter)}; facadeClose=${JSON.stringify(teardown.facadeClose)}${deleteBucketErr ? ` deleteBucketError=${deleteBucketErr.message}` : ''}`,
+        evidence: {
+          teardown,
+          scratchBucket,
+          deleteBucketHttpStatus: teardown.deleteBucket && teardown.deleteBucket.httpStatus,
+          deleteBucketRequestId: teardown.deleteBucket && teardown.deleteBucket.requestId,
+          postRunListHttpStatus: teardown.bucketAbsentAfter && teardown.bucketAbsentAfter.httpStatus,
+          postRunListRequestId: teardown.bucketAbsentAfter && teardown.bucketAbsentAfter.requestId,
+          facadeCloseOk,
+        },
+      });
+    }
+    bucketOps.close();
   }
+  return { results, extra: { evidence, envDeclared: [...DECLARED_ENV], teardown } };
 }

package/blueprints/object-storage-s3/contributions/probes/run-event-secrecy.mjs

@@ -1,4 +1,10 @@
+/**
+ * Shim: run event-secrecy against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
+ */
 import runProbe from './event-secrecy.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
+
+const engine = await observeMinioEngine();
 runShim('event-secrecy', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-facade-round-trip.mjs

@@ -1,10 +1,10 @@
 /**
- * Shim: run facade-round-trip against the sample-app fixture and write
- * .rcf/reports/blueprints/object-storage-s3/facade-round-trip.json.
+ * Shim: run facade-round-trip against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
  */
-
 import runProbe from './facade-round-trip.mjs';
-import { runShim } from './probe-utils.mjs';
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
 
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+const engine = await observeMinioEngine();
 runShim('facade-round-trip', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs

@@ -1,11 +1,14 @@
 /**
- * Shim: run hetzner-object-storage-round-trip against the extended
- * infra-s3-and-queue fixture and write
- * .rcf/reports/blueprints/object-storage-s3/hetzner-object-storage-round-trip.json.
+ * Shim: run hetzner-object-storage-round-trip. Without the account
+ * gate the engine descriptor is `observed: false` naming the missing
+ * gate; a live run would carry a real request id + http status on the
+ * engine, but a real Hetzner branch is not exercised here (the probe
+ * account-bound-skips honestly).
  */
-
 import runProbe from './hetzner-object-storage-round-trip.mjs';
 import { runShim } from './probe-utils.mjs';
 
-const engine = { kind: 's3', image: 'hetzner-object-storage-cloud', healthy: true };
+const engine = process.env.CI_HAS_HETZNER_OBJECT_STORAGE === 'true'
+  ? { kind: 's3', vendor: 'hetzner-object-storage', observed: false, note: 'live run recorded per-request on the probe result rows' }
+  : { kind: 's3', vendor: 'hetzner-object-storage', observed: false, reason: 'CI_HAS_HETZNER_OBJECT_STORAGE unset' };
 runShim('hetzner-object-storage-round-trip', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-multipart-upload.mjs

@@ -1,4 +1,10 @@
+/**
+ * Shim: run multipart-upload against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
+ */
 import runProbe from './multipart-upload.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
+
+const engine = await observeMinioEngine();
 runShim('multipart-upload', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-presigned-url.mjs

@@ -1,4 +1,10 @@
+/**
+ * Shim: run presigned-url against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
+ */
 import runProbe from './presigned-url.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
+
+const engine = await observeMinioEngine();
 runShim('presigned-url', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-put-get-round-trip.mjs

@@ -1,7 +1,10 @@
 /**
- * Shim: run put-get-round-trip against the sample-app fixture.
+ * Shim: run put-get-round-trip against the sample-app fixture. The engine
+ * descriptor carries a REAL health observation (MinIO /minio/health/live
+ * fetch outcome), not a fabricated healthy flag.
  */
 import runProbe from './put-get-round-trip.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'minio/minio', healthy: true };
+import { runShim, observeMinioEngine } from './probe-utils.mjs';
+
+const engine = await observeMinioEngine();
 runShim('put-get-round-trip', engine, runProbe);

package/blueprints/object-storage-s3/contributions/probes/run-r2-real-account-smoke.mjs

@@ -1,4 +1,12 @@
+/**
+ * Shim: run r2-real-account-smoke. The engine descriptor carries a
+ * real observation (an S3 ListBuckets against the R2 endpoint from
+ * the fixture secrets shim, returning a real requestId + httpStatus)
+ * when the account gate is set, otherwise a not-observed descriptor
+ * that names the missing gate.
+ */
 import runProbe from './r2-real-account-smoke.mjs';
-import { runShim } from './probe-utils.mjs';
-const engine = { kind: 's3', image: 'cloudflare-r2', healthy: true };
+import { runShim, observeR2Engine } from './probe-utils.mjs';
+
+const engine = await observeR2Engine();
 runShim('r2-real-account-smoke', engine, runProbe);

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-001.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-001",
   "prdId": "PRD-001",
   "title": "One facade module is the sole reader of the S3 client and opens on boot",
-  "description": "The application accesses object storage through a single facade module in the project's source tree that is the ONLY module in the tree that imports the S3 client (either @aws-sdk/client-s3 on Node targets or aws4fetch on Workers targets per ADR-2901). Every other module that touches object storage imports the facade and calls its named domain verbs; no other module holds the raw S3 client, an S3Client instance, or an aws4fetch AwsClient instance. On process boot, the facade opens the client against the elicited endpoint URL and bucket name, and once the first successful ready-check completes, emits a facadeReady lifecycle event carrying endpoint host and bucket name. The endpoint URL (a Cloudflare R2 URL, an AWS S3 URL, a MinIO URL, or any S3-compatible remote) and the bucket name are elicited at apply time.",
+  "description": "The application accesses object storage through a single facade module in the project's source tree that is the ONLY module in the tree that imports the S3 client (either @aws-sdk/client-s3 on Node targets or aws4fetch on Workers targets per ADR-2901). Every other module that touches object storage imports the facade and calls its named domain verbs; no other module holds the raw S3 client, an S3Client instance, or an aws4fetch AwsClient instance. On process boot, the facade opens the client against the elicited endpoint URL and bucket name, and once the first successful ready-check completes, emits a facadeReady lifecycle event carrying endpoint host and bucket name. The endpoint URL (a Cloudflare R2 URL, an AWS S3 URL, a MinIO URL, or any S3-compatible remote) and the bucket name are elicited at apply time. This blueprint declares the objectStorage applied capability at runtime: the facade module is the sole channel through which consumer code sees the S3-shaped store, and any downstream blueprint whose requiresAppliedCapabilities lists objectStorage is satisfied by an applied object-storage-s3 pinning the facade to its client and the elicited endpoint URL and bucket name. The s3-endpoint-url and s3-bucket-name are elicited at apply time and dereferenced once at boot. The s3-adapter is elicited between aws-sdk-client-s3 (AWS SDK v3 client for Node targets) and aws4fetch (small SigV4 fetch adapter for Workers targets). The presigned-ttl-ceiling-seconds is elicited within the ADR-2902 default cap.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "responsibilities.facade"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-002.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-002",
   "prdId": "PRD-001",
   "title": "Put, get, delete, list contract on typed keys",
-  "description": "The facade exposes named domain verbs (putObject, getObject, deleteObject, listObjects) that take a typed key (a project-defined key namespace, not a raw string on the public surface where a typed alternative fits), a content-type string on put, and return either the object body (get), a boolean success (put, delete), or a paginated key listing (list). Every read and write goes through the S3 client's public request surface; no facade verb accepts a raw request object or a general-purpose passthrough from consumer code. The put verb emits objectPut with key, size, contentType, timestamp; the delete verb emits objectDeleted with key, timestamp.",
+  "description": "The facade exposes named domain verbs (putObject, getObject, deleteObject, listObjects) that take a typed key (a project-defined key namespace, not a raw string on the public surface where a typed alternative fits), a content-type string on put, and return either the object body (get), a boolean success (put, delete), or a paginated key listing (list). Every read and write goes through the S3 client's public request surface; no facade verb accepts a raw request object or a general-purpose passthrough from consumer code. The put verb emits objectPut with key, size, contentType, timestamp; the delete verb emits objectDeleted with key, timestamp. Keys reach the facade as strings; the facade validates them at the boundary against a shipped key-shape check: reject empty keys, keys with a leading slash, keys that contain the literal traversal segments \"..\" or \"//\", and keys longer than 1024 bytes. The applying project may layer a stricter project-typed key on top of the string, but the facade's public verbs accept the shape-validated string as the primitive.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "responsibilities.crudVerbs"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-003.json

@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "interfaces.store.verbs"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-004.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-004",
   "prdId": "PRD-001",
   "title": "Multipart-upload contract above an elicited threshold",
-  "description": "For payloads above the elicited threshold (default 8 MiB per ADR-2903), the facade's put path switches transparently to multipart-upload: initiate multipart upload, part-upload each chunk with a stable part number and returned ETag, complete-multipart-upload with the ordered part list. A part-upload failure aborts the in-flight upload (AbortMultipartUpload) before propagating the error; leaving an incomplete multipart upload behind is not the shipped path. On completion the objectPut lifecycle event fires with the final total size. Multipart re-upload semantics (per the R2 doc, a re-upload to the same part number replaces the previous with loss-on-fail) is a documented gotcha named in the README; the multipart-upload probe asserts an end-to-end round-trip of at least 10 MiB.",
+  "description": "For payloads above the elicited threshold (default 8 MiB per ADR-2903), the facade's put path switches transparently to multipart-upload: initiate multipart upload, part-upload each chunk with a stable part number and returned ETag, complete-multipart-upload with the ordered part list. A part-upload failure aborts the in-flight upload (AbortMultipartUpload) before propagating the error; leaving an incomplete multipart upload behind is not the shipped path. On completion the objectPut lifecycle event fires with the final total size. Multipart re-upload semantics (per the R2 doc, a re-upload to the same part number replaces the previous with loss-on-fail) is a documented gotcha named in the README; the multipart-upload probe asserts an end-to-end round-trip of at least 10 MiB. The multipart-threshold-bytes is elicited at apply time (default 8388608, 8 MiB, per ADR-2903); at or above the threshold the facade's put path switches to multipart-upload.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2902-object-storage-s3-multipart-uploader",
+    "field": "responsibilities.multipart"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-005.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-005",
   "prdId": "PRD-001",
   "title": "Lifecycle events at four moments with metadata-only fields",
-  "description": "The facade emits four lifecycle events on the injected event sink: facadeReady (endpoint host, bucket name, timestamp), objectPut (key, size, contentType, timestamp), objectDeleted (key, timestamp), presignedIssued (key, ttl, timestamp). No event record carries object body bytes, no body checksum, no user id fields beyond what appears in the key itself, no PII drawn from the object body, and no adapter internal state. The event sink is a synchronous callback the operator wires; the facade never invokes it with domain-row values or authentication tokens. TAC-2903 realises the event-sink contract; the event-secrecy probe asserts field-level whitelist compliance against a PII fixture.",
+  "description": "The facade emits four lifecycle events on the injected event sink: facadeReady (endpoint host, bucket name, ts), objectPut (key, size, contentType, ts), objectDeleted (key, ts), presignedIssued (key, ttl, ts). No event record carries object body bytes, no body checksum, no user id fields beyond what appears in the key itself, no PII drawn from the object body, and no adapter internal state. The event sink is a synchronous callback the operator wires; the facade never invokes it with domain-row values or authentication tokens. TAC-2903 realises the event-sink contract; the event-secrecy probe asserts field-level whitelist compliance against a PII fixture.",
   "category": "functional",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2903-object-storage-s3-event-sink",
+    "field": "responsibilities.lifecycle"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-006.json

@@ -2,7 +2,7 @@
   "reqId": "object-storage-s3-REQ-006",
   "prdId": "PRD-001",
   "title": "Credential-pair discipline via security-secrets-management; refuses composition without",
-  "description": "The credential pair (accessKeyId, secretAccessKey) required to sign S3 requests is a secretRef value delegated to security-secrets-management: an opaque string agreed between object-storage-s3 and security-secrets-management naming the secret entry, never the credential value itself. The apply verb refuses composition on a project that has NOT applied security-secrets-management with exit code 3 and the stable message id object-storage-s3-no-secrets on stderr, per infra round 5 spec section 5.2 (Baz decision 6). The refusal names the required predecessor blueprint (security-secrets-management) and the override flag (--allow-no-secrets-yet). The override records a note on the applied blueprint's source.notes so rcf define validate can later flag the surface as not-yet-activated. The compose-test path checks the pair through the applied secrets facade before the object-store facade opens.",
+  "description": "The credential pair (accessKeyId, secretAccessKey) required to sign S3 requests is a secretRef value delegated to security-secrets-management: an opaque string agreed between object-storage-s3 and security-secrets-management naming the secret entry, never the credential value itself. The apply verb refuses composition on a project that has NOT applied security-secrets-management with exit code 3 and the stable message id object-storage-s3-no-secrets on stderr (sibling reservation). The refusal names the required predecessor blueprint (security-secrets-management) and the override flag (--allow-no-secrets-yet). The override records a note on the applied blueprint's source.notes so rcf define validate can later flag the surface as not-yet-activated. The compose-test path checks the pair through the applied secrets facade before the object-store facade opens. The facade factory accepts only the opaque secretRef and a resolver callback: the applying project passes an unresolved secretRef ({ id, provider }) plus a resolver that dereferences it inside the facade module. The factory refuses a plain { accessKeyId, secretAccessKey } object at the boundary; the resolver runs once per boot inside the module and never leaks the resolved pair beyond the S3 client construction call.",
   "category": "security",
   "domain": "object-storage",
   "priority": "must",
@@ -14,5 +14,9 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2901-object-storage-s3-facade",
+    "field": "responsibilities.credential"
+  }
 }

package/blueprints/object-storage-s3/contributions/requirements/object-storage-s3-req-101.json

@@ -14,5 +14,9 @@
   "version": "1.1.0",
   "status": "approved",
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "deliveredBy": {
+    "tacId": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+    "field": "responsibilities.composeEndpoint"
+  }
 }