rcf-lite 0.26.0 → 0.28.0

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28101.json

@@ -16,7 +16,8 @@
       "when": "the process boots and the facade's ready-check returns",
       "then": "a facadeReady event fires on the injected event sink with a payload containing endpointHost and bucketName, and the client is ready to accept verbs; the facade exposes named domain verbs and does not re-export the raw S3 client",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-28101-2",
@@ -25,10 +26,41 @@
       "when": "grep 'from \\'@aws-sdk/client-s3\\'' or 'from \\'aws4fetch\\'' walks the tree outside the facade directory",
       "then": "no match is found outside the facade directory; the facade's public surface exports named domain verbs only, no raw S3 client reference",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28101-3",
+      "description": "Facade refuses at boot when the elicited endpoint is unreachable. Given the elicited s3-endpoint-url resolves to a host the runner cannot reach (or refuses a ready-check inside the connection timeout), when the facade opens on boot, then the facade refuses with a named error kind (endpointUnreachable) carrying the endpoint host but no credential material, and facadeReady does not fire.",
+      "given": "s3-endpoint-url resolves to an unreachable host or times out on ready-check",
+      "when": "the facade opens on boot",
+      "then": "the facade refuses with endpointUnreachable carrying host but no credentials; facadeReady does not fire",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.createObjectStore"
+      },
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28101-4",
+      "description": "S3 adapter aws-sdk-client-s3. Given the elicited s3-adapter answers aws-sdk-client-s3, when the facade opens on process boot, then the facade constructs one `new S3Client(...)` from @aws-sdk/client-s3 v3 and the outbound HeadBucket request carries the SDK's default User-Agent header of shape `aws-sdk-js/<version> ...` (grep on the client's user-agent middleware output confirms the aws-sdk-js prefix); the aws4fetch package is NOT present in the facade module's imports; a grep across the applied source refuses any import of aws4fetch outside the facade.",
+      "given": "s3-adapter = aws-sdk-client-s3",
+      "when": "the facade opens on boot and issues its first HeadBucket ready-check",
+      "then": "the facade constructs one S3Client from @aws-sdk/client-s3 v3 and the outbound HeadBucket carries a User-Agent starting with `aws-sdk-js/`; aws4fetch is absent from the applied source",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "adrId": "ADR-2901-object-storage-s3-adapter",
+        "field": "decision"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28102.json

@@ -16,7 +16,12 @@
       "when": "putObject(key, contentType='application/octet-stream', body=<1 KiB Buffer>) then getObject(key)",
       "then": "the returned body's byte length equals 1024 and the returned content-type equals application/octet-stream; the events list captured on the sink contains an objectPut record with matching key, size 1024, contentType, timestamp; no body bytes appear in any event record",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-28102-2",
@@ -25,7 +30,12 @@
       "when": "deleteObject(key) followed by getObject(key)",
       "then": "the getObject rejects with a not-found shape (NoSuchKey on S3/R2/MinIO); an objectDeleted event fires on the sink with matching key and timestamp",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObject.html",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-28102-3",
@@ -34,10 +44,27 @@
       "when": "listObjects(prefix='probe/list/')",
       "then": "the returned keys include every put key with matching prefix, and the paginated envelope carries an isTruncated boolean",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-28102-4",
+      "description": "Key-shape refusal. Given a call to put, get, delete or list on the facade, when the key argument is an empty string, starts with a \"/\", contains \"..\" or \"//\", or exceeds 1024 bytes, then the facade refuses with a named error kind (invalidKey) before any client call, and no lifecycle event fires on the sink.",
+      "given": "a facade verb call with an invalid key shape",
+      "when": "the verb runs",
+      "then": "the facade refuses with error kind invalidKey; no client call is issued; no lifecycle event fires",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28103.json

@@ -16,10 +16,49 @@
       "when": "presignGetUrl(key, ttl=60) then fetch(url) immediately, then wait ttl+2 seconds and fetch(url) again",
       "then": "first fetch returns 200 with body bytes equal to the put payload; second fetch returns 403; the events list contains a presignedIssued record with key, ttl=60, timestamp; no URL or credential material appears in any event record",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ShareObjectPreSignedURL.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-28103-2",
+      "description": "Presigned URL beyond TTL returns 403. Given a presigned GET URL issued with TTL of 60 seconds, when a fetch runs against it more than 60 seconds after issuance, then the vendor returns HTTP 403 (SignatureDoesNotMatch or expired-URL family), and the facade's subsequent presign call for the same key issues a fresh URL with a fresh TTL boundary.",
+      "given": "a presigned GET URL issued with a 60-second TTL",
+      "when": "a fetch runs against it more than 60 seconds after issuance",
+      "then": "the vendor returns HTTP 403 (expired-URL family); a subsequent presign issues a fresh URL",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-query-string-auth.html",
+        "verifiedOn": "2026-09-09"
+      }
+    },
+    {
+      "id": "AC-28103-3",
+      "description": "Presigned TTL above ceiling refused at the facade edge. Given a presignGetUrl call with a TTL argument above the elicited presigned-ttl-ceiling-seconds, when the verb runs, then the facade refuses with a named error kind (presignTtlAboveCeiling); no vendor call issues.",
+      "given": "presignGetUrl call with TTL above the elicited ceiling",
+      "when": "the verb runs",
+      "then": "the facade refuses with presignTtlAboveCeiling; no vendor call issues",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.store.verbs"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28104.json

@@ -16,7 +16,8 @@
       "when": "putObject(key, contentType, body=<10 MiB Buffer>) then getObject(key)",
       "then": "the getObject returns a body of exact size 10485760 with byte equality to the put payload; the events list contains one objectPut record with size=10485760; no ListMultipartUploads on the bucket surfaces an in-flight upload after completion",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-28104-2",
@@ -25,10 +26,27 @@
       "when": "putObject(key, contentType, body=<10 MiB Buffer>) rejects mid-upload",
       "then": "the rejection propagates to the caller; a probe-side ListMultipartUploads(prefix=key) returns zero uploads; no completed object appears at key",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28104-3",
+      "description": "Multipart aborted on part failure. Given a multipart-upload with N parts where part K uploadPart returns a non-2xx (a mid-stream 5xx or client abort), when the uploader catches the failure, then it calls AbortMultipartUpload against the upload id, no CompleteMultipartUpload runs, no partial object survives at the target key, and the facade emits multipartAborted with { key, uploadId, failedPartNumber } on the event sink.",
+      "given": "a multipart-upload with N parts where uploadPart K returns non-2xx",
+      "when": "the uploader catches the failure",
+      "then": "AbortMultipartUpload runs; no CompleteMultipartUpload runs; no partial object survives; multipartAborted fires with {key, uploadId, failedPartNumber}",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2902-object-storage-s3-multipart-uploader",
+        "field": "interfaces.putMultipart"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2902-object-storage-s3-multipart-uploader"],
+  "tacIds": [
+    "TAC-2902-object-storage-s3-multipart-uploader"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28105.json

@@ -11,15 +11,36 @@
   "acceptanceCriteria": [
     {
       "id": "AC-28105-1",
-      "description": "Given a lifecycle-event spy attached to the sink, when put, get, delete, and presign verbs run against a PII fixture (key users/1234/passport.jpg, body carrying the PII fixture text), then every event record on the sink carries only fields from the whitelist {event, key, size, contentType, ttl, timestamp, endpointHost, bucketName}; no field name matches userId or ssn or dob or email; no field value contains the PII fixture body text; no field value contains any part of the object body bytes.",
+      "description": "Given a lifecycle-event spy attached to the sink, when put, get, delete, and presign verbs run against a PII fixture (key users/1234/passport.jpg, body carrying the PII fixture text), then every event record on the sink carries only fields from the whitelist {event, key, size, contentType, ttl, ts (number of milliseconds since epoch), endpointHost, bucketName}; no field name matches userId or ssn or dob or email; no field value contains the PII fixture body text; no field value contains any part of the object body bytes.",
       "given": "the facade opened, a spy on the event sink, a PII fixture body PII-FIXTURE-DO-NOT-LOG",
       "when": "putObject(users/1234/passport.jpg, image/jpeg, <body containing PII-FIXTURE-DO-NOT-LOG>), then getObject, then presignGetUrl, then deleteObject",
       "then": "every event record on the sink has keys drawn from the whitelist above; no event value contains the string PII-FIXTURE-DO-NOT-LOG; no event value contains a userId, ssn, dob, or email field; the key users/1234/passport.jpg appears on records as the key field only (not decomposed into userId)",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2903-object-storage-s3-event-sink",
+        "field": "interfaces.onEvent"
+      }
+    },
+    {
+      "id": "AC-28105-2",
+      "description": "Repeat-emission secrecy at high fanout. Given every facade verb exercised across N iterations, when the accumulated event stream is inspected, then every one of the N records is restricted to the metadata whitelist on AC-28105-1 with no body bytes, no user id and no PII; a mutation SIMULATE_BODY_BYTES_IN_EVENT=true injects payload bytes into a putCompleted record and the sink observer FAILS naming the leaked field.",
+      "given": "every facade verb exercised N times",
+      "when": "the accumulated event stream is inspected",
+      "then": "every record is restricted to metadata whitelist; the body-byte mutation FAILS",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2903-object-storage-s3-event-sink",
+        "field": "interfaces.onEvent"
+      },
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-2903-object-storage-s3-event-sink"],
+  "tacIds": [
+    "TAC-2903-object-storage-s3-event-sink"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28106.json

@@ -11,12 +11,17 @@
   "acceptanceCriteria": [
     {
       "id": "AC-28106-1",
-      "description": "Given a fresh scratch project with no security-secrets-management applied, when rcf define blueprint add ./blueprints/object-storage-s3 runs, then the command exits 3 and stderr contains the stable message id object-storage-s3-no-secrets, the required predecessor blueprint name security-secrets-management, and the override flag --allow-no-secrets-yet; the scratch project's rcf tree does not carry object-storage-s3 contributions after the refusal.",
+      "description": "Given a fresh scratch project with no security-secrets-management applied, when rcf define blueprint add ./blueprints/object-storage-s3 runs, then the command exits 3 and stderr contains the stable message id object-storage-s3-no-secrets, the required predecessor blueprint name security-secrets-management, and the override flag --allow-no-secrets-yet; the scratch project's rcf tree does not carry object-storage-s3 contributions after the refusal. The applying agent constructs the facade by passing { secretRef, resolver } (never { accessKeyId, secretAccessKey }); a mutation that swaps in a resolved credential object FAILS the boundary check with a named error kind (rejectedResolvedCredentials).",
       "given": "a fresh rcf init scratch project with no security-secrets-management applied",
       "when": "rcf define blueprint add ./blueprints/object-storage-s3 runs against the scratch project",
       "then": "the command exits 3; stderr contains the string object-storage-s3-no-secrets; stderr names security-secrets-management and the --allow-no-secrets-yet flag; the scratch tree has zero object-storage-s3 requirements after the refusal",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-2901-object-storage-s3-facade",
+        "field": "interfaces.createObjectStore"
+      }
     },
     {
       "id": "AC-28106-2",
@@ -25,10 +30,13 @@
       "when": "rcf define blueprint add ./blueprints/object-storage-s3 --allow-no-secrets-yet runs against the scratch project",
       "then": "the command exits 0; the applied manifest entry for object-storage-s3 carries a source.notes string naming the security-secrets-management predecessor and the --allow-no-secrets-yet override; the contributions land on disk",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28107.json

@@ -16,7 +16,8 @@
       "when": "run-facade-round-trip.mjs, run-put-get-round-trip.mjs, run-presigned-url.mjs, run-multipart-upload.mjs, run-event-secrecy.mjs run in sequence",
       "then": "each shim exits 0; each per-blueprint report at .rcf/reports/blueprints/object-storage-s3/<probe>.json carries aggregateVerdict pass; every result carries an anchorAcId matching a contributed AC id",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-28107-2",
@@ -25,10 +26,15 @@
       "when": "each induced-failure switch is set in turn and the paired probe runs",
       "then": "the paired probe exits non-zero and the aggregate verdict lands as fail on the anchored AC; the fixture README documents the paired switch and probe for each of the four wired switches",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade", "TAC-2902-object-storage-s3-multipart-uploader", "TAC-2903-object-storage-s3-event-sink"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade",
+    "TAC-2902-object-storage-s3-multipart-uploader",
+    "TAC-2903-object-storage-s3-event-sink"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28108.json

@@ -16,7 +16,12 @@
       "when": "node blueprints/object-storage-s3/contributions/probes/run-r2-real-account-smoke.mjs runs",
       "then": "the shim exits 0; the report at .rcf/reports/blueprints/object-storage-s3/r2-real-account-smoke.json carries aggregateVerdict pass and a single result with accountBoundSkipped true",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "vendorCitation": {
+        "url": "https://developers.cloudflare.com/r2/api/s3/api/",
+        "verifiedOn": "2026-09-09"
+      }
     },
     {
       "id": "AC-28108-2",
@@ -25,10 +30,13 @@
       "when": "node blueprints/object-storage-s3/contributions/probes/run-r2-real-account-smoke.mjs runs",
       "then": "the shim exits 0; the temporary object is deleted after the round-trip; the report carries aggregateVerdict pass and no accountBoundSkipped:true field",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2901-object-storage-s3-facade"],
+  "tacIds": [
+    "TAC-2901-object-storage-s3-facade"
+  ],
   "createdAt": "2026-09-06T18:00:00.000Z",
-  "updatedAt": "2026-09-06T18:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/contributions/user-stories/object-storage-s3-us-28110.json

@@ -16,10 +16,27 @@
       "when": "node blueprints/object-storage-s3/contributions/probes/run-hetzner-object-storage-round-trip.mjs runs",
       "then": "the probe either round-trips a byte-equal 1 KiB payload via put/get/delete against the composed <bucket>.<location>.your-objectstorage.com endpoint or records accountBoundSkipped true; SIMULATE_HETZNER_ENDPOINT_MISSHAPEN true composes an invalid endpoint via the fixture-side shim and the probe FAILS naming the missing subdomain",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-28110-2",
+      "description": "Unknown Hetzner location refused. Given the elicited hetzner-location-code answered as a value outside the shipped enum {fsn1, hel1, nbg1}, when the endpoint-shape helper composes the endpoint URL, then the helper refuses with a named error kind (unknownHetznerLocation) naming the offending value and the shipped enum; the facade does not open against the unknown location.",
+      "given": "hetzner-location-code answered outside {fsn1, hel1, nbg1}",
+      "when": "the endpoint-shape helper composes the URL",
+      "then": "the helper refuses with unknownHetznerLocation naming the offending value and the shipped enum; the facade does not open",
+      "testable": true,
+      "scope": "runtime",
+      "ownerRef": {
+        "tacId": "TAC-2904-object-storage-s3-hetzner-endpoint-helper",
+        "field": "interfaces.composeHetznerEndpoint"
+      },
+      "disposition": "template"
     }
   ],
-  "tacIds": ["TAC-2904-object-storage-s3-hetzner-endpoint-helper"],
+  "tacIds": [
+    "TAC-2904-object-storage-s3-hetzner-endpoint-helper"
+  ],
   "createdAt": "2026-09-08T00:00:00.000Z",
-  "updatedAt": "2026-09-08T00:00:00.000Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/object-storage-s3/docs/topics.md

@@ -58,7 +58,7 @@ This table is maintained shelf-wide across every blueprint's `docs/topics.md`. R
 | platform-docker-compose-host | 38101-38899 | 39xx | shipped v1.0.0 | `containerHostContract` |
 | edge-cloudflare-tunnel | 39101-39899 | 40xx | shipped v1.0.0 | `edgeIngressBridge` |
 
-US 28101-28108 sit at the LOW end of the 28101-28899 band on purpose (watchpost run-4 lesson). A project-side story mechanically derived from an object-storage-s3 REQ id into the number 28110 would collide against a shipped US-28110; band headroom (28109-28899) leaves that space.
+US 28101-28108 sit at the LOW end of the 28101-28899 band on purpose. A project-side story mechanically derived from an object-storage-s3 REQ id into the number 28110 would collide against a shipped US-28110; band headroom (28109-28899) leaves that space.
 
 ADR/TAC suffixes for this blueprint use the 2901-2999 block, continuing the shelf pattern.
 

package/blueprints/object-storage-s3/guide/object-storage-s3.md

@@ -6,7 +6,7 @@ S3-shape object storage on any S3-compatible endpoint: Cloudflare R2 (the shippe
 
 ## Apply this blueprint
 
-`security-secrets-management` v1.0.1+ MUST be applied first per REQ-006 (Baz decision 6). The blueprint declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` and the T-5 capability mechanism (visual round spec 5.5.1) enforces the refusal at apply time. On a project that has not applied secrets-management:
+`security-secrets-management` v1.0.1+ MUST be applied first per REQ-006. The blueprint declares `requiresAppliedCapabilities: {capabilities: ["secretsProvider"], allowSkipFlag: "allow-no-secrets-yet", refusalMessageId: "object-storage-s3-no-secrets"}` and the capability mechanism enforces the refusal at apply time. On a project that has not applied secrets-management:
 
 ```sh
 rcf define blueprint add object-storage-s3
@@ -55,7 +55,7 @@ await store.deleteObject('uploads/report.pdf');
 const { keys, isTruncated } = await store.listObjects('uploads/');
 ```
 
-The facade is the sole importer of `@aws-sdk/client-s3` in your source tree per REQ-001. A project-side call site that reaches into the SDK directly is refused at author-side review.
+The facade is the sole importer of `@aws-sdk/client-s3` in your source tree per REQ-001. A project-side call site that reaches into the SDK directly is refused at the author-side check.
 
 ## Adapter choice per deploy target
 
@@ -216,7 +216,7 @@ The Cloudflare R2 smoke stays gated on `CI_HAS_CLOUDFLARE_ACCOUNT` and is not af
 
 - Storage region matters (European data-locality requirements or lower-latency reads from EU-hosted workloads). `fsn1`, `hel1`, `nbg1` cover Germany and Finland; R2 does not surface a per-region locality on the public shape.
 - Egress-pricing profile differs from R2's zero-egress-fee posture; a workload with high internal-only egress may prefer R2, while a workload with predictable public egress may prefer Hetzner's flat per-TB pricing.
-- The applying project already runs on Hetzner Cloud (deploy-hetzner-server v1.0.0 shipped in round 7 T-1) and pairing the storage on the same vendor account is operationally simpler.
+- The applying project already runs on Hetzner Cloud (deploy-hetzner-server v1.0.0 shipped in round 7) and pairing the storage on the same vendor account is operationally simpler.
 
 Reach for R2 for the zero-egress-fee posture, for AWS S3 for the widest feature surface (Object Lock, versioning, lifecycle policies), and for MinIO for local dev without any account.
 

package/blueprints/observability-essentials/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+## 2.1.6 - 2026-09-11
+
+metrics-endpoint (status-page) probe now supplies an x-request-id header on the GET /status call and asserts the fixture echoes it; AC-7104-2 and AC-7104-3 rows record the echoed request id as the identifier alongside the derived rendered-state and rendered-order lists. AC-7104-1 (configured-path clause) is de-claimed to conformanceOnly because the shipped probe-server hard-codes '/status' rather than accepting a paths.status option, so the configuration-provenance property is not observed here.
+
+## 2.1.5 - 2026-09-11
+
+readiness-probe AC-7102-1 anchor now observes the configuration-sourced path clause and the distinct-from-liveness clause. The probe boots the fixture with an explicit non-default readiness path (/readiness-cfg-v2) alongside a distinct liveness path (/live-cfg-v2), asserts the fixture serves the configured readiness path AND that the shipped default /ready returns 404 (default absent) AND that a GET at the configured liveness path returns the liveness body shape (no checks{}). The fixture probe-server accepts { paths: { liveness, readiness } } and refuses boot with PROBE_INTERFACE_PATHS_NOT_DISTINCT when the two are equal.
+
+# observability-essentials CHANGELOG
+
+## 2.1.4 - 2026-09-11
+
+Adds a contributions/probes/ pack (liveness-probe, readiness-probe, metrics-endpoint) with a fixture-side probe server under packages/rcf-lite/test/fixtures/probe-pack-observability-essentials/. Probes run against the fixture on Node 24 with a real TCP dependency the readiness probe controls. No account gate.
+
+Anchoring: liveness-probe anchors AC-7101-5 (three-request flow: HTTP 503 empty body on unhealthy; HTTP 503 repeat while predicate stays fail; HTTP 200 body.status='pass' after predicate restored). The healthy warm-up row de-claims with the limitation naming AC-7101-1 (path-from-configuration clause not observed). readiness-probe anchors AC-7102-1 (200 with body.status='pass' when every declared dependency passes; 503 with body.status='fail' when at least one fails, verified by closing a TCP dependency the probe controls). The checks-object shape and checkedAt rows de-claim with limitations naming AC-7103-1 (boot-time missing/malformed declaration refusal not observed) and AC-7103-2 (evaluation-budget bound is a probe-authored 5000 ms constant, not fixture-configured). metrics-endpoint asserts the /status page exact component set, states and rendered order per AC-7104-1. probe-utils normalisation and thrown-error rows carry an evidence object; the fallback anchorAcId is null.
+
+## 2.1.2 - 2026-09-10
+
+Dimension-d single-definition-ownership cleanup on REQ-007: REQ description now references the JSON media-type header owned on TAC-801.responsibilities[1] rather than restating the header literal. Chain-consistency lint zero on pass 1 and pass 2.
+
+## 2.1.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 2.1.0 (2026-09-09)
+
+- Adds `elicits[]` with four apply-time answers: `liveness-probe-path` (string, default /live; REQ-001), `readiness-probe-path` (string, default /ready; REQ-002), `declared-dependency-set` (string, comma-separated; REQ-003), and `notification-outcome-substrate` (enum sqlite/postgres/custom, default sqlite; REQ-006). Every option value is backed by a must-priority REQ description (section 7c criterion a).
+- Adds `deliveredBy` to every REQ (REQ-001/002/003/007/010 -> TAC-801/TAC-802 interface names; REQ-004/005 -> TAC-803; REQ-006 -> TAC-804; REQ-008 -> ADR-804; REQ-009 -> ADR-803). Closes 8 pass-2 lint findings; per-blueprint lint reports zero on pass 1 and pass 2.
+- AC-7107-3 is a v2-baseline snapshot compatibility check against `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` with stable-coded PROBE_BODY_SHAPE_DRIFT on rename or removal.
+- The liveness self-check failure without AC coverage gap is fixed: adds AC-7101-5 asserting a response-capable in-process self-check predicate answers HTTP 503 with content-length 0 on fail and returns to 200 on pass; the AC is `template` because the predicate itself is project-owned.
+- The boot-refuse ACs for dependency declaration gap is fixed: adds AC-7103-4 (deps missing -> READINESS_DEPS_MISSING), AC-7103-5 (duplicate name -> READINESS_DEPS_DUPLICATE, template on the declared set), AC-7103-6 (blank/malformed name -> READINESS_DEPS_MALFORMED).
+- The durable outcome sink gap is fixed: adds AC-7106-4 asserting outcome records survive a sink restart (template on the elicited notification-outcome-substrate) and AC-7106-5 asserting a failed write signals NOTIFICATION_OUTCOME_WRITE_FAILED to the caller and does not fabricate a success record.
+- Re-sweeps every existing AC's `disposition` per section 7b: ACs marked `template` (those whose text references elicited paths, project-declared dependencies, or the elicited substrate) with `templateFillIns` naming which values the applying agent sets; the remaining ACs stay `fixed`.
+- adds `probeBodyShapeCompatibility` interface entry to TAC-802 that owns the cross-probe response body shape contract and names `PROBE_BODY_SHAPE_DRIFT`; updates AC-7107-3.ownerRef from ADR-803.decision.probeBodyShape (which the decision text did not carry) to TAC-802.interfaces.probeBodyShapeCompatibility; moves the v2 baseline snapshot from `packages/rcf-lite/test/blueprint/` to `blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json` so its placement matches its documentation-fixture nature (no suite test read it in the previous location).
+- extends REQ-006 description with a runtime clause per substrate option (`sqlite`, `postgres`, `custom`), literally named and each backed as the accepted values the notification-outcome-substrate elicit resolves at boot (AC-7106-4 exercises the restart path across substrates; AC-7106-5 exercises the failed-write path).

package/blueprints/observability-essentials/README.md

@@ -1,4 +1,4 @@
-# Observability blueprint (v2.0.0)
+# Observability blueprint (v2.1.0)
 
 The fifth content blueprint on the rcf-build-lite blueprint mechanism (design brief v2, ratified; Phase 5 of the blueprint programme). Scope: two HTTP health probes (liveness and readiness, path-neutral from v2.0.0: liveness answering strictly on in-process state, readiness aggregating over an explicit boot-time-declared dependency set with strict-any-fail semantics), a public status page rendering a declared component list plus stable-fielded incident notices, and a durable notification-outcome sink recording every attempt's outcome for later query by recipient and window. Targeted at small greenfield rcf-lite projects. Historical uptime charts, metrics export, and distributed tracing are documented future variants; the v2.0.0 blueprint ships the current-state contract only.
 
@@ -31,9 +31,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the liveness probe contract, the readiness probe contract with its dependency-set declaration and cached-state evaluator, the public status page contract with its declared component list and stable notice fields, the notification outcome sink contract with its recordOutcome and queryByRecipient verbs); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the liveness probe contract, the readiness probe contract with its dependency-set declaration and cached-state evaluator, the public status page contract with its declared component list and stable notice fields, the notification outcome sink contract with its recordOutcome and queryByRecipient verbs); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: historical uptime charts and rolling reliability numbers on the status page (out of scope at v1.0.0; see 'Known mechanism-reach gaps' below and the guide 'when it does not fit'); a metrics-export surface (Prometheus scrape endpoints, StatsD emission, OpenTelemetry metrics); a distributed-tracing surface (span emission, propagation, sampling); a log-shipping surface (the application-api-rest blueprint's `logging` topic already governs the wire-log shape; this blueprint neither extends nor conflicts with it); an authenticated operator dashboard for granular internal state (the operator gets granular state through the readiness probe body and through project-authored authenticated surfaces, not through this blueprint); the durable substrate for the notification outcome sink (project-owned; the persistence-data-sqlite blueprint is the natural compose partner). An operator-panel-style authenticated drift surface is deliberately outside this blueprint's scope: `operatorPanel` is claimed by the hello-panel walkthrough exemplar and this blueprint does not overlap it.
 

package/blueprints/observability-essentials/assets/probe-samples/probe-response-baseline.v2.json

@@ -0,0 +1,17 @@
+{
+  "// Baseline documented for observability-essentials AC-7107-3": "captures the v2 baseline shape of the /live and /ready probe response bodies so a release-time compatibility check can compare a candidate against the current v2 snapshot. A candidate that renames or removes a field named here fails with PROBE_BODY_SHAPE_DRIFT; additions are allowed.",
+  "live": {
+    "status": "pass",
+    "checkedAt": "ISO-8601 timestamp string"
+  },
+  "ready": {
+    "status": "pass",
+    "checkedAt": "ISO-8601 timestamp string",
+    "dependencies": [
+      {
+        "name": "string",
+        "status": "pass|fail"
+      }
+    ]
+  }
+}

package/blueprints/observability-essentials/blueprint.json

@@ -1,7 +1,38 @@
 {
   "slug": "observability-essentials",
-  "version": "2.0.0",
+  "version": "2.1.6",
   "category": "observability",
+  "elicits": [
+    {
+      "id": "liveness-probe-path",
+      "prompt": "HTTP path the liveness probe binds to on the request-traffic listener (REQ-001; default /live).",
+      "kind": "string",
+      "default": "/live"
+    },
+    {
+      "id": "readiness-probe-path",
+      "prompt": "HTTP path the readiness probe binds to on the request-traffic listener (REQ-002; default /ready).",
+      "kind": "string",
+      "default": "/ready"
+    },
+    {
+      "id": "declared-dependency-set",
+      "prompt": "Comma-separated names of dependencies whose availability the readiness probe evaluates (REQ-003; blank when no dependencies are declared). Each name resolves to a checkFor(name) predicate.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "notification-outcome-substrate",
+      "prompt": "Durable substrate for notification-outcome records (REQ-006). Recommended defaults: sqlite (single-node), postgres (multi-node). The substrate must survive a process restart.",
+      "kind": "enum",
+      "options": [
+        "sqlite",
+        "postgres",
+        "custom"
+      ],
+      "default": "sqlite"
+    }
+  ],
   "contributions": [
     {
       "id": "observability-essentials-REQ-001",
@@ -150,5 +181,6 @@
       "kind": "adr",
       "path": "adrs/adr-805-observability-essentials-notification-outcome-model.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11"
 }

package/blueprints/observability-essentials/contributions/adrs/adr-801-observability-essentials-health-probes.json

@@ -6,7 +6,7 @@
   "status": "accepted",
   "title": "Historical: two HTTP health probes on the request-traffic listener with a stable JSON body shape (self-supervised design intent, superseded by observability-probe-endpoints as the shelf canonical path owner from v2.0.0)",
   "context": "Every deployed application runs under an orchestrator that needs a restart signal and under a load balancer that needs a routing signal. The two signals answer different questions: 'is this process wedged, restart it' versus 'is this process able to serve, route around it if not'. A single probe folded across both questions produces the outage-amplifying failure mode where a downstream dependency blip triggers a restart storm that dwarfs the original blip. The probes have to be structurally separate at the endpoint and semantically separate at the answer.",
-  "decision": "The application serves two probe endpoints on the same HTTP listener that serves request traffic: a liveness probe at /healthz (or the configured override) and a readiness probe at /readyz (or the configured override). Both respond with Content-Type application/json and a stable body shape: { status: 'pass' | 'fail', checkedAt: <ISO-8601> } for liveness, plus a { checks: { <depName>: { state, checkedAt } } } object for readiness. Liveness returns 200 whenever the event loop is responsive and never depends on any external condition; readiness returns 200 when every declared dependency's cached state is pass and 503 otherwise. Both endpoints are auth-exempt (see ADR-804). The probes bind to the request-traffic listener rather than a separate operator port so the load balancer's probe observes the same reachability the traffic will observe.",
+  "decision": "The application serves two probe endpoints on the same HTTP listener that serves request traffic: a liveness probe at /healthz (or the configured override) and a readiness probe at /readyz (or the configured override). Both respond with the response header owned on TAC-801-observability-essentials-liveness-probe.responsibilities[1] and a stable body shape: { status: 'pass' | 'fail', checkedAt: <ISO-8601> } for liveness, plus a { checks: { <depName>: { state, checkedAt } } } object for readiness. Liveness returns 200 whenever the event loop is responsive and never depends on any external condition; readiness returns 200 when every declared dependency's cached state is pass and 503 otherwise. Both endpoints are auth-exempt (see ADR-804). The probes bind to the request-traffic listener rather than a separate operator port so the load balancer's probe observes the same reachability the traffic will observe.",
   "consequences": "The orchestrator's restart action is coupled only to true process wedging: a downstream dependency outage never triggers a restart. The load balancer's rotation action is coupled to declared-dependency health only: an unready replica gets pulled from rotation without a restart the replica cannot recover from. The stable JSON shape lets third-party monitoring integrations wire once. A change to the probe path defaults or a rename of a top-level probe body field is a major version bump on this blueprint. Composing blueprints that hold a different opinion on the endpoint contract (a project that wants /health as a single endpoint answering both questions, a project that wants gRPC probes, a project that wants both probes on a separate admin port) conflict on the healthProbes topic; the expected resolution is one project-level ADR that fixes the endpoint contract. From essentials v2.0.0 this ADR is scope-local historical context: the shelf-wide healthProbes topic is claimed only by observability-probe-endpoints. The self-supervised body shape and the request-traffic-listener binding remain the intent for the essentials-alone case; the literal /healthz and /readyz path defaults were removed from TAC-801 and TAC-802 in the same bump.",
   "alternativesConsidered": [
     {