rcf-lite 0.26.0 → 0.28.0

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21111.json

@@ -0,0 +1,76 @@
+{
+  "usId": "application-admin-console-US-21111",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-008",
+  "version": "1.0.1",
+  "status": "approved",
+  "title": "The users surface, the org switcher and the invite path honour the elicited tenancy shape",
+  "asA": "shelf consumer applying application-admin-console with the tenancy capability applied and a tenancy-shape chosen",
+  "iWant": "the directory, the switcher and org-scoped invites to obey the per-user, per-org or both shape",
+  "soThat": "the org boundaries the platform enforces are the boundaries the console renders and refuses across",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21111-1",
+      "description": "When tenancy-shape is `per-user`, every directory row carries exactly one data-org-id and the org switcher renders exactly one org for the current principal; a per-org action from the switcher list beyond the principal's org is refused with TENANCY_SHAPE_REFUSAL naming the shape.",
+      "given": "tenancy applied with tenancy-shape=per-user",
+      "when": "the users route and the org switcher render",
+      "then": "each users row carries exactly one data-org-id, the switcher lists exactly one org, and a switch to another org refuses with TENANCY_SHAPE_REFUSAL",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21111-2",
+      "description": "When tenancy-shape is `per-org`, every directory row carries the per-org membership attribute owned by `REQ-008.description`, and the switcher renders every org the current principal can reach; an org-scoped invite adds the invitee to the currently switched org without touching the other orgs the principal already belongs to.",
+      "given": "tenancy applied with tenancy-shape=per-org",
+      "when": "the users route renders and an admin invites into the currently switched org",
+      "then": "each users row carries the per-org membership attribute defined by `REQ-008.description`, the switcher enumerates every reachable org, and the invite POST records the invitee against exactly the switched org (verified in the audit stream)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "reqId": "application-admin-console-REQ-008",
+        "field": "description"
+      }
+    },
+    {
+      "id": "AC-21111-3",
+      "description": "When tenancy-shape is `both`, each directory row carries data-org-scope=single or data-org-scope=many and an org-scoped invite for a `many` principal presents an org-picker for the invitee's target orgs; a `single` principal cannot be invited into more than one org.",
+      "given": "tenancy applied with tenancy-shape=both",
+      "when": "the users route renders and an admin invites",
+      "then": "rows carry data-org-scope=single or data-org-scope=many, a `many` invitee shows an org-picker, and a `single` invitee cannot be given multiple orgs (the picker refuses)",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21111-4",
+      "description": "A cross-org action (deactivate, role-change) the elicited shape does not allow refuses at the console with TENANCY_SHAPE_REFUSAL naming the shape and the refused action; the underlying principal directory API is not called.",
+      "given": "any tenancy-shape applied and an admin attempts an action outside the shape",
+      "when": "the admin submits the action",
+      "then": "the console refuses with TENANCY_SHAPE_REFUSAL naming the shape and the action, and no request reaches the principal directory",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-21111-5",
+      "description": "The rendered directory always agrees with the applied shape: a users row rendered with the per-org membership attribute (owned by `REQ-008.description`) under tenancy-shape=per-user refuses to render (data-error=SHAPE_MISMATCH is written to the console log and the row is suppressed) rather than presenting the wrong shape.",
+      "given": "tenancy applied and a mismatched row surfaces from the principal directory",
+      "when": "the users route renders",
+      "then": "the row is suppressed and data-error=SHAPE_MISMATCH is emitted",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "reqId": "application-admin-console-REQ-008",
+        "field": "description"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-2201-application-admin-console-shell"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21112.json

@@ -0,0 +1,77 @@
+{
+  "usId": "application-admin-console-US-21112",
+  "prdId": "PRD-001",
+  "reqId": "application-admin-console-REQ-009",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "Custom-auth provides-* boolean elicits each bind one applied-capabilities token on the sidecar",
+  "asA": "operator applying the admin-console on a project running its own auth (no shipped security-auth-* blueprint)",
+  "iWant": "each of the four custom-auth-provides-* boolean elicits to bind its capability token onto the sidecar's appliedCapabilities union with a per-token clause (true adds; false omits)",
+  "soThat": "the shell reads the exact capability union the elicited answers produce and no downstream surface guesses at what a custom auth has declared",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-21112-1",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-principal-directory]` is answered `true`, the sidecar written by the elicitation phase records `principalDirectory` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `principalDirectory` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-principal-directory`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-principal-directory` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `principalDirectory` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2202-application-admin-console-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    },
+    {
+      "id": "AC-21112-2",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-role-model]` is answered `true`, the sidecar written by the elicitation phase records `roleModel` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `roleModel` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-role-model`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-role-model` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `roleModel` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2202-application-admin-console-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    },
+    {
+      "id": "AC-21112-3",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-tenancy]` is answered `true`, the sidecar written by the elicitation phase records `tenancy` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `tenancy` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-tenancy`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-tenancy` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `tenancy` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2202-application-admin-console-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    },
+    {
+      "id": "AC-21112-4",
+      "description": "When the manifest elicit `blueprint.json.elicits[id=custom-auth-provides-audit-log]` is answered `true`, the sidecar written by the elicitation phase records `auditLog` as a member of `appliedCapabilities`; when the same elicit is answered `false`, the sidecar records no `auditLog` entry in `appliedCapabilities`, per REQ-009. Applying agent sets: the boolean answer to `custom-auth-provides-audit-log`.",
+      "given": "a project running its own auth with the elicit `custom-auth-provides-audit-log` presented at apply",
+      "when": "the elicitation phase runs and writes the sidecar",
+      "then": "the sidecar the shell reads records `auditLog` in `appliedCapabilities` when the answer is `true` and omits it when the answer is `false`",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2202-application-admin-console-capability-discovery",
+        "field": "responsibilities.runElicitationPhase"
+      }
+    }
+  ],
+  "tacIds": [
+    "TAC-2202-application-admin-console-capability-discovery"
+  ],
+  "tags": [
+    "blueprint:application-admin-console"
+  ],
+  "createdAt": "2026-09-10T00:00:00Z",
+  "updatedAt": "2026-09-10T00:00:00Z"
+}

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21815.json

@@ -16,12 +16,31 @@
       "when": "the pack drives GET /admin/sign-in",
       "then": "the DOM carries [data-surface=access-gated], no [data-surface=local-login], and a [data-role=principal-read] with the request.auth email",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+        "field": "interfaces.GET /admin/sign-in"
+      }
+    },
+    {
+      "id": "AC-21815-2",
+      "description": "When zeroTrustGate is applied but the incoming request lacks request.auth (the JWT validator upstream did not populate it), GET /admin/sign-in refuses with a 403 access-denied surface: no [data-role=principal-read] element is rendered, no principal email is echoed, and no protected data is served. The refusal reason is logged with the correlation id and the applied capability set.",
+      "given": "zeroTrustGate applied and a request arrives at /admin/sign-in with request.auth undefined",
+      "when": "the route renders",
+      "then": "the response status is 403, the DOM carries the access-denied surface, no [data-role=principal-read] element is present and no protected data is included",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+        "field": "interfaces.GET /admin/sign-in"
+      }
     }
   ],
   "tacIds": [
     "TAC-2214-application-admin-console-access-gated-signin-surface"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/contributions/user-stories/application-admin-console-us-21816.json

@@ -16,12 +16,31 @@
       "when": "the pack drives GET /admin/sign-in",
       "then": "the DOM carries [data-surface=local-login] and no [data-surface=access-gated]",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+        "field": "interfaces.GET /admin/sign-in"
+      }
+    },
+    {
+      "id": "AC-21816-2",
+      "description": "The local-login surface renders exactly the security-auth-* local form contract from v1.0.0: an id-labelled input for the credential, a submit control routed to the local sign-in POST and no [data-surface=access-gated] region on the same render.",
+      "given": "a project without zeroTrustGate applied",
+      "when": "GET /admin/sign-in renders",
+      "then": "the DOM carries an input, a submit control routed to the local sign-in POST and no [data-surface=access-gated] region",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-2214-application-admin-console-access-gated-signin-surface",
+        "field": "interfaces.GET /admin/sign-in"
+      }
     }
   ],
   "tacIds": [
     "TAC-2214-application-admin-console-access-gated-signin-surface"
   ],
   "createdAt": "2026-09-07T16:00:00.000Z",
-  "updatedAt": "2026-09-07T16:00:00.000Z"
+  "updatedAt": "2026-09-10T00:00:00Z"
 }

package/blueprints/application-admin-console/guide/application-admin-console.md

@@ -20,7 +20,7 @@ You want an anonymous product (no principal directory, no roles). The blueprint
 
 ## Mechanism-reach gaps
 
-The blueprint's README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack; the shipped v1.0.0 pack anchors the four load-bearing surface checks. Combine with the T-1 datatable pack to reach the users and audit shells' state-region contract.
+The blueprint's README lists the runtime-observable ACs the pack does NOT bind directly. Every gap is a candidate for a v1.1.0 minor bump extending the pack; the shipped v1.0.0 pack anchors the four load-bearing surface checks. Combine with the datatable pack to reach the users and audit shells' state-region contract.
 
 ## Promotion signals
 
@@ -28,9 +28,9 @@ The blueprint's README lists the runtime-observable ACs the pack does NOT bind d
 - The tenancy shape needs a real shelf provider: candidate for the `application-tenancy-orgs` blueprint (spec section 11).
 - A dedicated audit-log blueprint ships: candidate for the console to consume it directly via `capabilities: ["auditLog"]` rather than through the logging companion.
 
-## v1.1.0 minor: Access-gate consumption (Cloudflare round 6 T-4)
+## v1.1.0 minor: Access-gate consumption (Cloudflare round 6)
 
-Applying `edge-cloudflare-access` v1.0.0 alongside `application-admin-console` v1.1.0 flips the sign-in surface on `/admin/sign-in`. The admin-console reads `appliedCapabilities` at apply-time via the shipped `readAppliedCapabilities()` helper (the T-5 visual-round mechanism).
+Applying `edge-cloudflare-access` v1.0.0 alongside `application-admin-console` v1.1.0 flips the sign-in surface on `/admin/sign-in`. The admin-console reads `appliedCapabilities` at apply-time via the shipped `readAppliedCapabilities()` helper (the visual-round mechanism).
 
 - With `zeroTrustGate` in the applied set: the sign-in page renders `[data-surface=access-gated]` with no local login form. A `[data-role=principal-read]` element carries the principal email the `edge-cloudflare-access` JWT validator attached to `request.auth`. The shipped pack check `AC-21815-1` on `application-admin-console.pack.mjs` asserts the shape.
 - Without `zeroTrustGate`: the sign-in page renders `[data-surface=local-login]` with the local `security-auth-*` form unchanged from v1.0.0. Every v1.0.0 deployment continues to work; the minor is strictly additive.

package/blueprints/application-admin-console/probe-packs/application-admin-console.pack.mjs

@@ -6,7 +6,7 @@
 //   AC-21104-1 org switcher (fires when tenancy applied)
 //   AC-21105-1 audit-log surface (fires when auditLog applied)
 //
-// Every check drives the real Playwright browser the T-0 runner injects
+// Every check drives the real Playwright browser the runner injects
 // and reads its per-check applicability from the blueprint applied
 // sidecar (rcf/blueprints/application-admin-console.applied.json)
 // written by the apply verb: an absent capability records
@@ -181,7 +181,7 @@ export default {
       {
       id: 'AC-21815-1',
       severity: 'block',
-      description: 'Access-gated sign-in surface renders when zeroTrustGate is applied: [data-surface=access-gated] present, [data-surface=local-login] absent, and [data-role=principal-read] carries the principal email read from request.auth (T-4 admin-console v1.1.0 delta, Cloudflare round 6 spec 5.4.1)',
+      description: 'Access-gated sign-in surface renders when zeroTrustGate is applied: [data-surface=access-gated] present, [data-surface=local-login] absent, and [data-role=principal-read] carries the principal email read from request.auth (admin-console v1.1.0 delta, Cloudflare round 6 spec 5.4.1)',
       appliesTo: async ({ projectRoot }) => {
         const caps = await readAppliedCapabilities(projectRoot);
         return caps.includes('zeroTrustGate');

package/blueprints/application-api-rest/CHANGELOG.md

@@ -0,0 +1,34 @@
+# application-api-rest CHANGELOG
+
+## 2.1.10 - 2026-09-11
+
+- Adds a contributions/probes pack meeting rule 7d: each probe drives a real HTTP round trip against the dependency-free sample-app fixture at packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/ and records the fixture-echoed x-fixture-request-id, response status, a distinctive body excerpt, the varied input and the derived output on every result row.
+- Probes: cursor-pagination-round-trip, problem-details-on-error, health-probes-distinct, request-id-echoed.
+- Cursor probe varies limits and derives forward/backward traversal from server-side cursor state (opaque UUID keys over a CURSOR_MAP, not positional JSON); malformed cursor and over-limit rows produce 400 with problem-details bodies anchored on AC-2109-3 and AC-2109-5.
+- Liveness returns 200 with zero dependency checks and readiness reports checked dependencies (matches AC-2108-1).
+- Detail texts open with the first eight words of the AC or REQ text they observe, then " - " and the derived observation.
+- Anatomy test pin bumped to 2.1.10; strict evidence predicate; notObservableHere.ac resolves against a shipped AC id.
+
+
+## 2.1.5 - 2026-09-10
+
+Template-AC fill-in clauses on AC-2102-2, AC-2104-6, AC-2106-4, AC-2108-4, AC-2112-1, AC-2118-3 and AC-2119-5 now enumerate the specific applying-project substitutions (declared property-name casing, documentation-exposure policy per environment, operation-to-auth-class mapping onto the four classes fixed on REQ-005, resolved startup-probe path, idempotency-key verb-and-class combinations, deploy documentation location and order, verification-pipeline definition) in place of the earlier generic phrasing, so applying projects have precise values to fill in. TAC-303-application-api-rest-contract-surface patch-bumped to 1.0.2: responsibilities[2] now names `x-idempotency-key` (`required` or `forbidden`) explicitly and references AC-2112-1.
+
+
+## 2.1.4 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-013: REQ description now references the request-id header owned on TAC-301.responsibilities[0] rather than restating the header literal. Chain-consistency lint clean.
+
+## 2.1.3 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 2.1.2 (2026-09-09)
+
+- Donor hand-sweep on all 118 ACs: flipped 24 additional ACs from fixed to template where the assertion carries a project-set literal (deprecation dates, per-endpoint auth-class binding, downstream dependency sets on readiness, resolved probe paths, declared page-size and maximum limits, filter parameter and sortable-key sets, key-required operation set, de-duplication TTL, per-class rate-limit values and window durations, per-endpoint rate-limit overrides, log-level per class, histogram bucket boundaries, per-endpoint CORS overrides, PII-redaction policy). Each flipped AC carries an Applying agent sets: <specific values> clause. Final split: 87 fixed / 31 template.
+- Adds vendorCitation to seven ACs whose assertions rest on RFC wire shapes: AC-2102-3 cites RFC 3339 (Date and Time on the Internet: Timestamps); AC-2111-1 through AC-2111-6 cite RFC 7807 (Problem Details for HTTP APIs). Both citation URLs point at datatracker.ietf.org and carry verifiedOn 2026-09-09 (fetched via WebFetch during this pass).
+
+## 2.1.1 (2026-09-09)
+
+- Hardening cleanup: chain-consistency lint clean; added deliveredBy to every REQ, added ownerRef and disposition to every AC per section 7b, closed case drifts on `content-type` and `idempotency-key` in REQ-002, REQ-010, AC-2102-4, AC-2102-5, AC-2112-1, AC-2112-2 and ADR-306 to match the owner spellings on TAC-301.
+- Added AC-2108-9 (readiness deadline: aggregate 503 naming the failed check id and the configured deadline while liveness continues at 200) on TAC-306.interfaces[0] (readiness check registry), so applying projects have an explicit acceptance criterion for the readiness-deadline path.

package/blueprints/application-api-rest/README.md

@@ -1,6 +1,6 @@
 # application-api-rest blueprint (v2.0.0)
 
-The second content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 3 of the blueprint programme). Scope: a REST service, single deployable, versioned wire contract, no UI in scope. Composes with the application-spa blueprint by design, including two deliberate scope:global conflicts.
+A content blueprint on the rcf-build-lite blueprint mechanism. Scope: a REST service, single deployable, versioned wire contract, no UI in scope. Composes with the application-spa blueprint by design, including two deliberate scope:global conflicts.
 
 ## Apply
 
@@ -27,9 +27,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT; the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 ## The four global decisions
 

package/blueprints/application-api-rest/assets/samples/request-response-pairs.md

@@ -1,5 +1,7 @@
 # Sample request-response pairs per verb class
 
+Owner: the `X-Request-Id` header these pairs display is owned on `TAC-301-application-api-rest-request-pipeline.responsibilities[0]`. The samples below demonstrate wire shape.
+
 Reference realisations of the wire contract (application-api-rest-REQ-002, application-api-rest-REQ-007, application-api-rest-REQ-009, application-api-rest-REQ-010) using the illustrative `widgets` resource from the OpenAPI skeleton. The shapes are normative; the resource is not. All timestamps RFC-3339 UTC, all properties camelCase, every response with an explicit Content-Type.
 
 ## GET, collection page (filtered, sorted, paginated)

package/blueprints/application-api-rest/blueprint.json

@@ -1,6 +1,6 @@
 {
   "slug": "application-api-rest",
-  "version": "2.1.0",
+  "version": "2.1.10",
   "category": "application",
   "contributions": [
     {
@@ -269,5 +269,6 @@
       "role": "errorHandling",
       "reason": "The error translator writes the wire envelope from the internal record; an error-handling companion supplies the record factory and the boundary that constructs it, and the shelf application-error-handling blueprint is the fallback when no library provider is registered."
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11T16:04:17Z"
 }

package/blueprints/application-api-rest/contributions/adrs/adr-301-application-api-rest-error-envelope.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-301-application-api-rest-error-envelope",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "RFC 7807 problem details as the error shape the service produces",
   "context": "Every error the service emits is part of its wire contract, including the failures nobody plans: auth rejections, rate limits, malformed input, unhandled exceptions. The wire error shape is a whole-project decision with room for exactly one answer, shared with whatever consumes the API; this record is the producer half. A client-tier blueprint applied to the same project contributes its own decision on the same topic, and blueprint composition surfaces that pairing for the operator to reconcile at add time. That surfacing is intended.",

package/blueprints/application-api-rest/contributions/adrs/adr-302-application-api-rest-auth-model.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-302-application-api-rest-auth-model",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Four declared auth classes enforced by middleware as the service's authentication model",
   "context": "A project has one authentication model; endpoints, clients, and operators all reason against it. The server half of that model must make every endpoint's auth posture declared, enumerable, and enforced in one place. A client-tier blueprint applied to the same project contributes its own decision on this topic (how the client authenticates and holds session), and blueprint composition surfaces the pairing at add time for the operator to reconcile into one project-level model. That surfacing is intended.",
@@ -12,7 +12,7 @@
     {
       "name": "Per-endpoint auth annotations without classes",
       "summary": "Each endpoint declares its own middleware stack of auth requirements.",
-      "reasonNotChosen": "Infinite postures means no enumerable audit story; every endpoint is a bespoke security review, and rate limiting and audit logging cannot attach to anything stable."
+      "reasonNotChosen": "Infinite postures means no enumerable audit story; every endpoint is a bespoke security assessment, and rate limiting and audit logging cannot attach to anything stable."
     },
     {
       "name": "Gateway-terminated auth only",

package/blueprints/application-api-rest/contributions/adrs/adr-303-application-api-rest-api-versioning.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-303-application-api-rest-api-versioning",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Major version in the URL path as the project's API versioning strategy",
   "context": "Versioning strategy is a whole-project decision: clients, caches, gateways, documentation, and support all key on it, and two strategies on one surface is chaos. The candidates are path versioning, header versioning, media-type versioning, and no versioning with additive-only evolution.",

package/blueprints/application-api-rest/contributions/adrs/adr-304-application-api-rest-logging.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-304-application-api-rest-logging",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "status": "accepted",
   "title": "Historical: structured JSON lines with request-scoped correlation as the project's primary logging shape (superseded by observability-logging-ADR-1601 as the shelf-canonical logging global-topic owner from api-rest v2.1.0)",
   "context": "A project has one primary logging shape; aggregation, alerting, retention, and redaction tooling are all built against it, and mixed shapes halve the value of every query. The decision covers the line format, the mandatory fields, and where correlation ids live.",

package/blueprints/application-api-rest/contributions/adrs/adr-305-application-api-rest-pagination.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-305-application-api-rest-pagination",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Cursor-based pagination as the collection traversal default",
   "context": "Every collection needs a pagination story, and the story must be the same everywhere or clients write one traversal routine per collection. The realistic candidates are offset/limit and cursor-based.",

package/blueprints/application-api-rest/contributions/adrs/adr-306-application-api-rest-idempotency.json

@@ -2,11 +2,11 @@
   "adrId": "ADR-306-application-api-rest-idempotency",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
-  "title": "Idempotency-Key with a server-side replay cache for duplicate-harmful mutations",
+  "title": "idempotency-key with a server-side replay cache for duplicate-harmful mutations",
   "context": "Clients retry; networks guarantee it. For mutations whose double application harms (creations, payments, state transitions), the service needs a mechanism that makes a retry safe without asking every client to build its own de-duplication.",
-  "decision": "Duplicate-harmful operations declare Idempotency-Key required in the contract. The server keys a replay cache on (endpoint, principal, key): first execution stores the response, repeats within the declared TTL (default 24 hours, project-configurable) replay it, same key with a different body is 422, concurrent duplicate is 409 while the original is in flight. The cache lives in the project's shared state store so replay works across instances (application-api-rest-REQ-010, application-api-rest-US-2112).",
+  "decision": "Duplicate-harmful operations declare idempotency-key required in the contract. The server keys a replay cache on (endpoint, principal, key): first execution stores the response, repeats within the declared TTL (default 24 hours, project-configurable) replay it, same key with a different body is 422, concurrent duplicate is 409 while the original is in flight. The cache lives in the project's shared state store so replay works across instances (application-api-rest-REQ-010, application-api-rest-US-2112).",
   "consequences": "Retries become free for clients and safe for the business. The costs: a state-store dependency for the cache, TTL-bounded storage per keyed mutation, and the declared-required set must be maintained as the surface grows; the contract validation that already checks auth classes checks the idempotency declaration the same way.",
   "alternativesConsidered": [
     {

package/blueprints/application-api-rest/contributions/adrs/adr-307-application-api-rest-openapi-generation.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-307-application-api-rest-openapi-generation",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "OpenAPI generated from source at build time, defended by drift validation",
   "context": "The contract document can be authored spec-first (hand-written spec, implementation follows) or generated from the implementation. Either can work; what cannot work is a hand-maintained spec beside a moving implementation with nothing enforcing agreement.",

package/blueprints/application-api-rest/contributions/adrs/adr-308-application-api-rest-rate-limiting.json

@@ -2,7 +2,7 @@
   "adrId": "ADR-308-application-api-rest-rate-limiting",
   "prdId": "PRD-001",
   "tadId": "TAD-001",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "status": "accepted",
   "title": "Rate limits keyed to auth classes with per-endpoint overrides",
   "context": "Rate limiting needs a policy anchor: something stable that limits attach to. Candidates are one global limit, per-endpoint hand-tuning, or the auth classes the surface already declares.",

package/blueprints/application-api-rest/contributions/probes/cursor-pagination-round-trip.mjs

@@ -0,0 +1,154 @@
+// cursor-pagination-round-trip probe for application-api-rest v2.1.10.
+//
+// AC-2109-1 envelope, AC-2109-2 traversal, AC-2109-3 opacity and
+// malformed cursor, AC-2109-5 declared max limit enforcement.
+//
+// anchorAcId: per-row.
+
+import { startFixture, evidenceFromResponse } from './probe-utils.mjs';
+
+export const anchorReqId = 'application-api-rest-REQ-007';
+export const accountBound = false;
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+export default async function runProbe() {
+  const { startServer } = await import('../../../../packages/rcf-lite/test/fixtures/probe-pack-application-api-rest/server.js');
+  const fixture = await startFixture({ startServer, port: 0 });
+  try {
+    const results = [];
+
+    // Row 1 (AC-2109-1): first-page envelope carries items, next, prev.
+    const firstRes = await fetch(`${fixture.baseUrl}/v1/widgets?limit=5`);
+    const firstBody = await firstRes.text();
+    const first = JSON.parse(firstBody);
+    const envelopeOk = Array.isArray(first.items)
+      && first.items.length === 5
+      && typeof first.next === 'string'
+      && first.prev === null;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-1',
+      verdict: firstRes.status === 200 && envelopeOk ? 'pass' : 'fail',
+      detail: `Every collection endpoint accepts ?cursor= and ?limit= and - GET /v1/widgets?limit=5 returned items[${first.items?.length ?? 0}] next=${typeof first.next}(${(first.next || '').slice(0, 12)}...) prev=${first.prev}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets?limit=5',
+        response: firstRes,
+        bodyText: firstBody,
+        extraFields: {
+          input: { limit: 5, cursor: null },
+          derived: { itemsLen: first.items?.length ?? 0, next: first.next, prev: first.prev, firstIds: (first.items || []).map((i) => i.id) },
+        },
+      }),
+    });
+
+    // Row 2 (AC-2109-2): traversal visits every item exactly once and next is null on the last page.
+    const visited = new Set();
+    let dupes = 0;
+    for (const it of first.items) { if (visited.has(it.id)) dupes += 1; visited.add(it.id); }
+    let cursor = first.next;
+    let pages = 0;
+    let last = first, lastRes = firstRes, lastBody = firstBody;
+    while (cursor && pages < 20) {
+      const r = await fetch(`${fixture.baseUrl}/v1/widgets?limit=5&cursor=${encodeURIComponent(cursor)}`);
+      const b = await r.text();
+      const p = JSON.parse(b);
+      for (const it of (p.items || [])) { if (visited.has(it.id)) dupes += 1; visited.add(it.id); }
+      last = p; lastRes = r; lastBody = b; cursor = p.next; pages += 1;
+    }
+    const traversalOk = last.next === null && dupes === 0 && visited.size === 12;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-2',
+      verdict: traversalOk ? 'pass' : 'fail',
+      detail: `next is null on the last page and - traversal via next visited ${visited.size} unique items over ${pages + 1} pages, dupes=${dupes}, final next=${last.next}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets (traversal tail)',
+        response: lastRes,
+        bodyText: lastBody,
+        extraFields: {
+          input: { limit: 5, followFromCursor: first.next },
+          derived: { uniqueVisited: visited.size, dupes, finalNext: last.next, pages: pages + 1 },
+        },
+      }),
+    });
+
+    // Row 3 (AC-2109-3 opacity): the emitted token is not a decodable
+    // positional marker. It is an opaque UUID; base64url decode is not
+    // parseable as JSON and any positional info the client tries to
+    // recover fails.
+    const cursorStr = first.next;
+    const numericFallback = Number.parseInt(cursorStr, 10);
+    const parseableAsInt = Number.isFinite(numericFallback) && String(numericFallback) === cursorStr;
+    let base64JsonReadable = false;
+    try {
+      const decoded = Buffer.from(cursorStr, 'base64url').toString('utf8');
+      const parsed = JSON.parse(decoded);
+      if (parsed && typeof parsed === 'object') base64JsonReadable = true;
+    } catch { base64JsonReadable = false; }
+    const looksLikeUuid = UUID_RE.test(cursorStr);
+    const opaque = !parseableAsInt && !base64JsonReadable;
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-3',
+      verdict: opaque ? 'pass' : 'fail',
+      detail: `Cursors are opaque: they carry no client-decodable positional - cursor "${cursorStr}" parseableAsInt=${parseableAsInt} base64UrlJsonReadable=${base64JsonReadable} looksLikeUuid=${looksLikeUuid}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets?limit=5',
+        response: firstRes,
+        bodyText: firstBody,
+        extraFields: {
+          input: { cursor: cursorStr },
+          derived: { parseableAsInt, base64UrlJsonReadable: base64JsonReadable, looksLikeUuid, opaque },
+        },
+      }),
+    });
+
+    // Row 4 (AC-2109-3 malformed cursor -> problem+json).
+    const malformedRes = await fetch(`${fixture.baseUrl}/v1/widgets?limit=5&cursor=not-a-cursor`);
+    const malformedBody = await malformedRes.text();
+    let malformedJson = null;
+    try { malformedJson = JSON.parse(malformedBody); } catch {}
+    const malformedOk = malformedRes.status === 400
+      && (malformedRes.headers.get('content-type') || '').includes('application/problem+json')
+      && malformedJson && malformedJson.type && malformedJson.type.includes('cursor-invalid');
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-3',
+      verdict: malformedOk ? 'pass' : 'fail',
+      detail: `Cursors are opaque: they carry no client-decodable positional - malformed cursor "not-a-cursor" returned ${malformedRes.status} problem+json type=${malformedJson?.type ?? 'null'}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets?cursor=not-a-cursor',
+        response: malformedRes,
+        bodyText: malformedBody,
+        extraFields: {
+          input: { cursor: 'not-a-cursor' },
+          derived: { httpStatus: malformedRes.status, problemType: malformedJson?.type ?? null },
+        },
+      }),
+    });
+
+    // Row 5 (AC-2109-5 max-limit -> problem+json).
+    const overLimitRes = await fetch(`${fixture.baseUrl}/v1/widgets?limit=999`);
+    const overLimitBody = await overLimitRes.text();
+    let overLimitJson = null;
+    try { overLimitJson = JSON.parse(overLimitBody); } catch {}
+    const overLimitOk = overLimitRes.status === 400
+      && (overLimitRes.headers.get('content-type') || '').includes('application/problem+json')
+      && overLimitJson && overLimitJson.type && overLimitJson.type.includes('limit-exceeded');
+    results.push({
+      anchorAcId: 'application-api-rest-AC-2109-5',
+      verdict: overLimitOk ? 'pass' : 'fail',
+      detail: `The declared maximum limit is enforced: a request - ?limit=999 returned ${overLimitRes.status} problem+json type=${overLimitJson?.type ?? 'null'}`,
+      evidence: evidenceFromResponse({
+        route: '/v1/widgets?limit=999',
+        response: overLimitRes,
+        bodyText: overLimitBody,
+        extraFields: {
+          input: { limit: 999 },
+          derived: { httpStatus: overLimitRes.status, problemType: overLimitJson?.type ?? null },
+        },
+      }),
+    });
+
+    return { results };
+  } finally {
+    await fixture.close();
+  }
+}