rcf-lite 0.26.0 → 0.28.0

package/blueprints/observability-logging/README.md

@@ -3,7 +3,7 @@
 Structured single-line JSON emission for a rcf-lite project. General enterprise practice, no vendor lock-in. Ships the shelf-canonical `logging` global topic on `ADR-1601-observability-logging-line-shape` (transferred from `application-api-rest-ADR-304`, retained there as superseded history). Provides the `logging` role for the companion-suggestion mechanism. From 1.1.0, declares `capabilities: [auditLog]` on `blueprint.json` so the application-admin-console probe pack activates the audit-log surface check `AC-21105-1` when this blueprint is applied on the project (one grammar; consumer blueprints read declared capabilities, never a role-to-capability inference).
 
 
-> Latest: **v1.2.0** (visual round T-4, 2026-09-06). `capabilities: [auditLog, sessionInventory]`. See [CHANGELOG.md](CHANGELOG.md).
+> Latest: **v1.3.0**. `capabilities: [auditLog]`; elicits: correlation-header-name, minimum-log-level, redaction-categories-additions, boot-identity-fields. See [CHANGELOG.md](CHANGELOG.md).
 
 ## Apply
 
@@ -27,7 +27,7 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
 Deliberately not contributed: a specific log-shipping transport (Elastic Common Schema over Logstash, Loki push endpoints, Datadog agent, Splunk HEC); a rotation policy for on-disk log files (the shipped emission target is stdout, and the surrounding platform owns the pipe); a metrics-export surface (out of scope, sits with the metrics-store companion when the shelf ships one); a distributed-tracing surface (spans, propagation, sampling; out of scope for v1). The choice of ECS library (Elastic's, `pino-elastic-common-schema`, a project-authored shim) stays project-side; the blueprint names the ECS-neutral field set the AC binds to.
 

package/blueprints/observability-logging/blueprint.json

@@ -1,40 +1,48 @@
 {
   "slug": "observability-logging",
-  "version": "1.2.0",
+  "version": "1.3.7",
   "category": "observability",
   "providesRoles": [
     "logging"
   ],
   "capabilities": [
-    "auditLog",
-    "sessionInventory"
+    "auditLog"
+  ],
+  "elicits": [
+    {
+      "id": "correlation-header-name",
+      "prompt": "Inbound correlation header name accepted and reflected on outbound requests (per ADR-1602; recommended default X-Correlation-Id, elicited alternative per project).",
+      "kind": "string",
+      "default": "X-Correlation-Id"
+    },
+    {
+      "id": "minimum-log-level",
+      "prompt": "Minimum log level per environment (per ADR-1604 vocabulary trace / debug / info / warn / error / fatal; the factory refuses emissions below this level).",
+      "kind": "enum",
+      "options": [
+        "trace",
+        "debug",
+        "info",
+        "warn",
+        "error",
+        "fatal"
+      ],
+      "default": "info"
+    },
+    {
+      "id": "redaction-categories-additions",
+      "prompt": "Additional PII redaction categories on top of the recommended defaults (credential, pii.email, pii.name, pii.address, token, bearer per ADR-1603). Kebab-cased or dotted-namespace names; comma-separated list, blank when none.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "boot-identity-fields",
+      "prompt": "Boot identity: JSON object with environment, serviceName and serviceVersion string values the factory carries on every emitted line (REQ-005). All three refuse construction when blank.",
+      "kind": "string",
+      "default": "{\"environment\":\"\",\"serviceName\":\"\",\"serviceVersion\":\"\"}"
+    }
   ],
   "contributions": [
-    {
-      "id": "observability-logging-REQ-001",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-001.json"
-    },
-    {
-      "id": "observability-logging-REQ-002",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-002.json"
-    },
-    {
-      "id": "observability-logging-REQ-003",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-003.json"
-    },
-    {
-      "id": "observability-logging-REQ-004",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-004.json"
-    },
-    {
-      "id": "observability-logging-REQ-005",
-      "kind": "req",
-      "path": "requirements/observability-logging-req-005.json"
-    },
     {
       "id": "observability-logging-US-15101",
       "kind": "us",
@@ -75,6 +83,11 @@
       "kind": "us",
       "path": "user-stories/observability-logging-us-15108.json"
     },
+    {
+      "id": "observability-logging-US-15109",
+      "kind": "us",
+      "path": "user-stories/observability-logging-us-15109.json"
+    },
     {
       "id": "TAC-1601-observability-logging-logger-factory",
       "kind": "tac",
@@ -115,6 +128,42 @@
       "recommendedDefault": true,
       "elicited": true,
       "standardsTraceClause": "generic enterprise practice"
+    },
+    {
+      "id": "ADR-1605-observability-logging-serialisation-refusal",
+      "kind": "adr",
+      "path": "adrs/adr-1605-observability-logging-serialisation-refusal.json"
+    },
+    {
+      "id": "observability-logging-REQ-001",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-001.json"
+    },
+    {
+      "id": "observability-logging-REQ-002",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-002.json"
+    },
+    {
+      "id": "observability-logging-REQ-003",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-003.json"
+    },
+    {
+      "id": "observability-logging-REQ-004",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-004.json"
+    },
+    {
+      "id": "observability-logging-REQ-005",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-005.json"
+    },
+    {
+      "id": "observability-logging-REQ-006",
+      "kind": "req",
+      "path": "requirements/observability-logging-req-006.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11"
 }

package/blueprints/observability-logging/contributions/adrs/adr-1605-observability-logging-serialisation-refusal.json

@@ -0,0 +1,25 @@
+{
+  "adrId": "ADR-1605-observability-logging-serialisation-refusal",
+  "prdId": "PRD-001",
+  "tadId": "TAD-001",
+  "version": "1.0.0",
+  "status": "accepted",
+  "title": "Serialisation refusal split: BigInt folded to string, circular reference and function reference dropped with stderr notice",
+  "context": "REQ-001 previously described any non-JSON-representable value as dropped, while TAC-1601's internalStructure described a JSON.stringify replacer that folded BigInt to string. Both cannot hold: an operator debugging a BigInt-carrying payload sees either the folded value on stdout OR a dropped emission on stderr, not both. The refusal semantics of a circular graph and a function reference is different from a BigInt (the former genuinely cannot serialise; the latter has a well-defined decimal string form). Splitting the two clears the chain contradiction the family-pass review flagged as F-4 and lands a stable oracle every AC can assert.",
+  "decision": "BigInt values in a log payload are folded to their decimal string form on the emitted line (the replacer calls `.toString()` on the value; the field's runtime type on stdout is `string`). Circular references and function references cannot be folded and cause the emission to be dropped: the boundary catches the SerializationRefusedError, writes one stderr notice naming the offending field's dotted path, and returns to the caller without throwing. The three classes are separately observable: a BigInt is on-stdout as a string, a circular reference is off-stdout with one stderr notice, a function reference is off-stdout with one stderr notice.",
+  "consequences": "Callers that hand the logger a BigInt (an id from a database driver returning arbitrary-precision numerics) see the value on the emitted line; downstream tooling reads it as a JSON string, which is the industry-standard representation for BigInt on the wire. Callers that hand the logger a circular graph see the emission dropped and one stderr notice; the caller's next line still runs. The TAC-1601 internalStructure names all three behaviours consistently. The AC-15101-2 refusal path splits into two observable ACs: one for BigInt (asserting the folded string on stdout), one for a circular payload (asserting the dropped emission and the stderr notice).",
+  "alternativesConsidered": [
+    {
+      "name": "Drop every non-JSON-representable value including BigInt",
+      "summary": "Treat BigInt the same as a circular graph: catch the SerializationRefusedError, drop the emission, write one stderr notice.",
+      "reasonNotChosen": "BigInt has a stable decimal string form every JSON consumer accepts, so dropping the emission loses information the folded form would have preserved. The class this blueprint targets (small greenfield applications with database drivers returning bigints) hits BigInt often enough that a drop-on-every-encounter would surprise operators."
+    },
+    {
+      "name": "Fold every non-representable value into a placeholder",
+      "summary": "Replace circular references and function references with the literal string [UNSERIALISABLE:<class>] on the emitted line.",
+      "reasonNotChosen": "A function reference on a log payload is almost certainly a coding defect (the caller wrote the wrong argument); silently folding it to a placeholder lets the defect ship. A drop with one stderr notice surfaces the class where a developer will see it."
+    }
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/observability-logging/contributions/probes/correlation-id-flow.mjs

@@ -0,0 +1,173 @@
+// Correlation-id-flow probe for observability-logging.
+//
+// Positive-evidence shape: the probe VARIES its inputs (a distinct
+// correlation-id supplied on an inbound HTTP request header per call)
+// and observes the DERIVED outputs the fixture computes: the emitted
+// log line's correlationId + a fixture-computed sequence + a hash the
+// fixture calculates from the id and its own sequence. The response
+// body carries the fixture-computed sequence and hash; the response
+// header carries the id.
+// The probe RECOMPUTES the hash locally (SHA-256(id + ":" + sequence)
+// truncated to 16 hex chars) and asserts it equals the fixture's
+// value. The fixture never publishes the id into a value the probe
+// asserts against a copy of itself; the assertion is on the derived
+// hash and the sequence's monotonic step, both of which the fixture
+// computes from the varied input.
+//
+// AC-15102-1 has two clauses: (a) header present -> header value on
+// every emitted log line for the request; (b) header absent -> the
+// application mints a v4 UUID and the same value appears on every
+// log line for the request. This probe exercises BOTH clauses.
+//
+// The nested no-context emission proves the ambient store falls back
+// to correlationId=null when nothing set it, so the http-set path
+// isn't a lucky coincidence with a module-level default.
+
+import { createHash, randomUUID } from 'node:crypto';
+import { createLogger, createLoggerHttp } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-logging/src/logger-factory.mjs';
+
+export const anchorAcId = 'AC-15102-1';
+export const accountBound = false;
+const AC1 = 'A request arriving with the elicited correlation header';
+const AC3 = 'A log emission with no ambient correlation context';
+
+const HEADER = 'X-Correlation-Id';
+const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function expectedHash(id, sequence) {
+  return createHash('sha256').update(`${id}:${sequence}`).digest('hex').slice(0, 16);
+}
+
+export default async function runProbe() {
+  const outBuf = [];
+  const logger = createLogger({ environment: 'qa', serviceName: 'probe-svc', serviceVersion: '0.0.1', outSink: (s) => outBuf.push(s), errSink: () => {} });
+  const http = createLoggerHttp({ headerName: HEADER.toLowerCase(), logger });
+  const { port } = await http.listen(0);
+  const results = [];
+  const inputIds = [randomUUID(), randomUUID(), randomUUID()];
+  const observed = [];
+  try {
+    for (const inbound of inputIds) {
+      const res = await fetch(`http://127.0.0.1:${port}/hello`, {
+        method: 'POST',
+        headers: { [HEADER]: inbound, 'content-type': 'text/plain' },
+        body: 'body-' + inbound.slice(0, 4),
+      });
+      const bodyText = await res.text();
+      let body = null; try { body = JSON.parse(bodyText); } catch {}
+      observed.push({
+        supplied: inbound,
+        headerEcho: res.headers.get(HEADER.toLowerCase()),
+        bodySequence: body?.sequence,
+        bodyHash: body?.hash,
+        bodyCorrelationId: body?.correlationId,
+        bodyMintedFromAbsent: body?.mintedFromAbsent,
+        status: res.status,
+      });
+    }
+    const emittedLines = outBuf.join('').split('\n').filter(Boolean).map((l) => JSON.parse(l));
+
+    for (let i = 0; i < inputIds.length; i++) {
+      const supplied = inputIds[i];
+      const o = observed[i];
+      const line = emittedLines.find((l) => l.correlationId === supplied && l.sequence === o.bodySequence);
+      const localHash = (typeof o.bodySequence === 'number') ? expectedHash(supplied, o.bodySequence) : null;
+      const lineOk = Boolean(line) && line.hash === localHash;
+      const bodyOk = o.status === 200 && typeof o.bodySequence === 'number' && o.bodyHash === localHash && o.bodyMintedFromAbsent === false;
+      const headerOk = o.headerEcho === supplied;
+      results.push({
+        anchorAcId: 'AC-15102-1',
+        verdict: lineOk && bodyOk && headerOk ? 'pass' : 'fail',
+        detail: `${AC1}  -  observed supplied inbound '${HEADER}'='${supplied}' -> line.correlationId='${line?.correlationId}' sequence=${line?.sequence} line.hash='${line?.hash}' locallyRecomputedHash='${localHash}' body.sequence=${o.bodySequence} body.hash='${o.bodyHash}' header='${o.headerEcho}' mintedFromAbsent=${o.bodyMintedFromAbsent}; observes AC-15102-1 header-present clause via header echo and derived hash equality.`,
+        evidence: {
+          suppliedInput: supplied,
+          derivedLogLine: line ? { message: line.message, correlationId: line.correlationId, path: line.path, sequence: line.sequence, hash: line.hash } : null,
+          derivedResponseHeader: o.headerEcho,
+          derivedResponseBodySequence: o.bodySequence,
+          derivedResponseBodyHash: o.bodyHash,
+          locallyRecomputedHash: localHash,
+          responseStatus: o.status,
+        },
+      });
+    }
+
+    // AC-15102-1 header-absent clause: send with no correlation header,
+    // observe the fixture mints a v4 UUID and the same value appears on
+    // the emitted log line.
+    const absentRes = await fetch(`http://127.0.0.1:${port}/hello`, {
+      method: 'POST',
+      headers: { 'content-type': 'text/plain' },
+      body: 'no-header-body',
+    });
+    const absentBodyText = await absentRes.text();
+    let absentBody = null; try { absentBody = JSON.parse(absentBodyText); } catch {}
+    const mintedId = absentBody?.correlationId ?? '';
+    const mintedIsV4 = UUID_V4_RE.test(mintedId);
+    const echoedInHeader = absentRes.headers.get(HEADER.toLowerCase());
+    const linesAfter = outBuf.join('').split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    const absentLine = linesAfter.find((l) => l.correlationId === mintedId && l.sequence === absentBody?.sequence);
+    const absentOk = absentRes.status === 200
+      && mintedIsV4
+      && absentBody?.mintedFromAbsent === true
+      && echoedInHeader === mintedId
+      && Boolean(absentLine);
+    results.push({
+      anchorAcId: 'AC-15102-1',
+      verdict: absentOk ? 'pass' : 'fail',
+      detail: `${AC1}  -  observed inbound with NO '${HEADER}' header -> body.correlationId='${mintedId}' (v4?${mintedIsV4}) mintedFromAbsent=${absentBody?.mintedFromAbsent} header echo='${echoedInHeader}' log-line.correlationId='${absentLine?.correlationId}' sequence=${absentLine?.sequence}; observes AC-15102-1 header-absent clause via minted v4 UUID appearing on the emitted line.`,
+      evidence: {
+        // No header supplied on this request; the fixture mints a v4
+        // UUID and echoes it verbatim on the response header, the
+        // response body and the emitted log line. The minted id is
+        // recorded as a request id (engine-minted lane) because it is
+        // the engine's response identifier, not a probe-supplied
+        // input; a bare `suppliedInput` sentinel would break the
+        // identifier-pairing equality rule.
+        requestId: mintedId,
+        absentSuppliedInput: true,
+        derivedLogLine: absentLine ? { message: absentLine.message, correlationId: absentLine.correlationId, path: absentLine.path, sequence: absentLine.sequence, hash: absentLine.hash } : null,
+        derivedResponseHeader: echoedInHeader,
+        derivedResponseBodySequence: absentBody?.sequence,
+        derivedResponseBodyHash: absentBody?.hash,
+        responseStatus: absentRes.status,
+        mintedFromAbsent: absentBody?.mintedFromAbsent,
+        mintedIsV4,
+      },
+    });
+
+    const seqs = observed.map((o) => o.bodySequence);
+    const monotonic = seqs.every((n, i) => typeof n === 'number' && (i === 0 || n === seqs[i - 1] + 1));
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: 'AC-15102-1: concerns the correlation ID travelling from the inbound header (or minted UUID) to every emitted log line during the request. Sequence monotonicity is anti-echo signalling that the fixture computes derived state; it is not the AC-15102-1 property.',
+      verdict: monotonic ? 'pass' : 'fail',
+      detail: `observed fixture per-server sequence as ${JSON.stringify(seqs)}; monotonic step of 1 (anti-echo signal that fixture computes derived state).`,
+      evidence: { suppliedInputs: inputIds, derivedSequences: seqs, derivedResponseHeader: observed[0]?.headerEcho, suppliedInput: inputIds[0], bodyExcerpt: 'seq=' + JSON.stringify(seqs) },
+    });
+
+    outBuf.length = 0;
+    logger.info('bare');
+    const bare = JSON.parse(outBuf.join('').split('\n').filter(Boolean)[0]);
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: `AC-15102-3: the bare emission with no ambient correlation context is a single emitted log line whose only recorded value is the null correlationId itself. The row observes the property but carries no request or resource identifier the engine returned; identifier-plus-derived evidence is not available here (the strict-evidence contract tightening).`,
+      verdict: bare.correlationId === null ? 'pass' : 'fail',
+      detail: `${AC3}  -  observed bare emission (no runWithCorrelation) carries correlationId=${JSON.stringify(bare.correlationId)} (expected null per AC-15102-3); de-claimed to conformanceOnly per the strict-evidence contract because no engine-returned identifier is available for a bare emission.`,
+      evidence: { bareLineCorrelationId: bare.correlationId, bodyExcerpt: JSON.stringify(bare).slice(0, 200) },
+    });
+  } finally {
+    await http.close();
+  }
+  return {
+    results,
+    extra: {
+      envDeclared: ['RCF_FIXTURE_LOGGER_CORRELATION_HEADER'],
+      headerName: HEADER,
+      port,
+      variedInputs: inputIds,
+      observedRoundTrips: observed,
+    },
+  };
+}

package/blueprints/observability-logging/contributions/probes/line-shape-and-fields.mjs

@@ -0,0 +1,82 @@
+// Line-shape probe for observability-logging.
+// Anchors AC-15101-1 (with the row extended to type-check each of the
+// shared minimum fields, so a numeric or object value cannot pass a
+// presence-only check), AC-15101-3 (BigInt-safe folding) and
+// AC-15101-4 (reserved-key collision safety).
+import { randomUUID } from 'node:crypto';
+import { createLogger, LEVEL_ORDER, runWithCorrelation } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-logging/src/logger-factory.mjs';
+
+export const anchorAcId = 'AC-15101-1';
+export const accountBound = false;
+const AC1 = 'A log emission at any level from any';
+const AC3 = 'A log emission whose payload contains a BigInt';
+const AC4 = 'The seven shared minimum fields (message, level, timestamp,';
+
+export default async function runProbe() {
+  const outBuf = []; const errBuf = [];
+  const clock = () => '2026-09-11T12:00:00.000Z';
+  const log = createLogger({ environment: 'qa', serviceName: 'probe-svc', serviceVersion: '0.0.1', minLevel: 'trace', outSink: (s) => outBuf.push(s), errSink: (s) => errBuf.push(s), clock });
+  const perLevelIds = [];
+  for (const lvl of LEVEL_ORDER) {
+    const cid = randomUUID();
+    perLevelIds.push({ level: lvl, correlationId: cid });
+    runWithCorrelation(cid, () => log[lvl](`hello-${lvl}`));
+  }
+  const lines = outBuf.join('').split('\n').filter(Boolean);
+  const required = ['message', 'level', 'timestamp', 'correlationId', 'environment', 'serviceName', 'serviceVersion'];
+  const results = [];
+  const parsed = [];
+  let allOk = lines.length === LEVEL_ORDER.length;
+  let typeFailures = [];
+  for (const ln of lines) {
+    let obj = null; let ok = true;
+    try { obj = JSON.parse(ln); } catch { ok = false; }
+    parsed.push(obj);
+    if (!ok) { allOk = false; continue; }
+    for (const k of required) {
+      if (!(k in obj)) { allOk = false; typeFailures.push({ key: k, reason: 'missing' }); continue; }
+      // correlationId is explicitly nullable when the emission has no
+      // ambient correlation context (AC-15102-3). Every other field
+      // must be a non-empty string.
+      if (k === 'correlationId') {
+        if (obj[k] !== null && (typeof obj[k] !== 'string' || obj[k].length === 0)) { allOk = false; typeFailures.push({ key: k, reason: `correlationId must be null or non-empty string (got ${typeof obj[k]})` }); }
+      } else if (typeof obj[k] !== 'string' || obj[k].length === 0) {
+        allOk = false; typeFailures.push({ key: k, reason: `not-non-empty-string (got ${typeof obj[k]})` });
+      }
+    }
+    // timestamp additionally must ISO-8601 parse.
+    if (typeof obj.timestamp === 'string' && Number.isNaN(Date.parse(obj.timestamp))) { allOk = false; typeFailures.push({ key: 'timestamp', reason: 'not ISO-8601 parseable' }); }
+  }
+  results.push({
+    anchorAcId: 'AC-15101-1',
+    verdict: allOk ? 'pass' : 'fail',
+    detail: `${AC1} call site  -  observed ${lines.length} lines on stdout; each JSON.parses and carries the seven minimum fields as non-empty strings (timestamp parses ISO-8601); expected=${LEVEL_ORDER.length}; typeFailures=${JSON.stringify(typeFailures)}.`,
+    evidence: { linesExcerpt: lines.slice(0, 3), levelsSeen: parsed.filter(Boolean).map((o) => o.level), typeFailures, observedEmissions: perLevelIds, suppliedInput: perLevelIds[0]?.correlationId, line: parsed[0] },
+  });
+  outBuf.length = 0; errBuf.length = 0;
+  const bigCid = randomUUID();
+  runWithCorrelation(bigCid, () => log.info('bigint', { id: 9007199254740993n }));
+  const bLines = outBuf.join('').split('\n').filter(Boolean);
+  let bParsed = null;
+  try { bParsed = JSON.parse(bLines[0]); } catch {}
+  results.push({
+    anchorAcId: 'AC-15101-3',
+    verdict: bParsed && bParsed.id === '9007199254740993' && errBuf.join('').length === 0 ? 'pass' : 'fail',
+    detail: `${AC3} value  -  observed BigInt folded to '${bParsed?.id}' on the emitted line; stderr='${errBuf.join('').trim()}'.`,
+    evidence: { line: bParsed, bodyExcerpt: bLines[0], suppliedInput: bigCid },
+  });
+  outBuf.length = 0; errBuf.length = 0;
+  const collCid = randomUUID();
+  runWithCorrelation(collCid, () => log.info('coll', { level: 'boom', timestamp: 'yesterday', custom: 'ok' }));
+  const cLine = outBuf.join('').split('\n').filter(Boolean)[0];
+  let cParsed = null;
+  try { cParsed = JSON.parse(cLine); } catch {}
+  const errCombined = errBuf.join('');
+  results.push({
+    anchorAcId: 'AC-15101-4',
+    verdict: cParsed?.level === 'info' && cParsed?.timestamp === '2026-09-11T12:00:00.000Z' && errCombined.includes("'level'") && errCombined.includes("'timestamp'") ? 'pass' : 'fail',
+    detail: `${AC4} correlationId,  -  observed factory-authored level=${cParsed?.level} timestamp=${cParsed?.timestamp}; stderr excerpt='${errCombined.trim()}' names the reserved keys.`,
+    evidence: { line: cParsed, bodyExcerpt: cLine, stderr: errCombined, suppliedInput: collCid },
+  });
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_LOGGER_CORRELATION_HEADER'], capturedStdoutBytes: outBuf.reduce((n, s) => n + s.length, 0) } };
+}

package/blueprints/observability-logging/contributions/probes/probe-utils.mjs

@@ -0,0 +1,47 @@
+// Shared helpers for observability-logging probes.
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-observability-logging');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/observability-logging');
+export const DECLARED_ENV = new Set(['RCF_FIXTURE_LOGGER_CORRELATION_HEADER']);
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  const raw = aggregate(normalised);
+  const aggregateVerdict = isSkipped(normalised) ? 'pass' : raw;
+  const report = { slug: 'observability-logging', probeName, runAt: new Date().toISOString(), engine, results: normalised, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: `probe threw: ${err?.message ?? err}`, evidence: { thrown: true, message: err?.message ?? String(err), name: err?.name ?? 'Error', probeName, runAt: new Date().toISOString(), engine } }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err?.stack ?? err}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}

package/blueprints/observability-logging/contributions/probes/redaction-boundary.mjs

@@ -0,0 +1,130 @@
+// Redaction-boundary probe for observability-logging.
+//
+// Emits one payload per recommended-default category (credential,
+// token, bearer, pii.email, pii.name, pii.address) inside its own
+// runWithCorrelation(randomUUID(), ...) so each emission carries a
+// real, per-emission correlation id. For each category the probe
+// records the supplied correlation id, the emitted line's correlation
+// id (proving pairing on the wire), the redacted field value and the
+// caller-payload-unmutated observation - anchoring AC-15103-1 for
+// every one of the six mandatory categories the AC names.
+//
+// AC-15103-4 requires the SPECIFIC shape `{ user: { id: "u-1",
+// pii: { email: "a@b" } } }` with `user.id` PRESERVED and
+// `user.pii.email` redacted. That emission is a separate row anchored
+// on AC-15103-4, again with a per-emission correlation id paired to
+// the emitted line.
+//
+// AC-15103-3 (unrecognised category left unredacted) requires a
+// specifically-shaped `custom.internal.token`-style field name. A
+// bare `note` field does not exercise the "valid-but-unconfigured
+// kebab/dotted grammar" the AC names. Row de-claimed with the
+// limitation naming AC-15103-3.
+import { randomUUID } from 'node:crypto';
+import { createLogger, runWithCorrelation } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-logging/src/logger-factory.mjs';
+
+export const anchorAcId = 'AC-15103-1';
+export const accountBound = false;
+const AC1 = 'A log payload containing a field named or';
+const AC4 = 'The redaction boundary reads a nested payload path:';
+const AC3_LIM_NOTE = `AC-15103-3: requires a valid-but-unconfigured category name (kebab or dotted-namespace grammar), e.g. custom.internal.token, that looks like a redaction path but is not in defaults or additions. A bare field name 'note' with no category-shaped label does not exercise the AC's grammar constraint.`;
+
+function deepClone(v) { return JSON.parse(JSON.stringify(v)); }
+function sameShape(a, b) { return JSON.stringify(a) === JSON.stringify(b); }
+
+const CATEGORIES = [
+  { path: 'credential', build: () => ({ credential: 'SAMPLE_CRED_VALUE' }), read: (l) => l.credential, expected: '[REDACTED:credential]' },
+  { path: 'token', build: () => ({ token: 'SAMPLE_TOKEN_VALUE' }), read: (l) => l.token, expected: '[REDACTED:token]' },
+  { path: 'bearer', build: () => ({ bearer: 'SAMPLE_BEARER_VALUE' }), read: (l) => l.bearer, expected: '[REDACTED:bearer]' },
+  { path: 'pii.email', build: () => ({ pii: { email: 'sample@example.com' } }), read: (l) => l.pii?.email, expected: '[REDACTED:pii.email]' },
+  { path: 'pii.name', build: () => ({ pii: { name: 'Sample Person' } }), read: (l) => l.pii?.name, expected: '[REDACTED:pii.name]' },
+  { path: 'pii.address', build: () => ({ pii: { address: '1 Sample St' } }), read: (l) => l.pii?.address, expected: '[REDACTED:pii.address]' },
+];
+
+export default async function runProbe() {
+  const outBuf = [];
+  const log = createLogger({ environment: 'qa', serviceName: 'probe-svc', serviceVersion: '0.0.1', outSink: (s) => outBuf.push(s), errSink: () => {} });
+  const results = [];
+  const emittedCategoryLines = [];
+
+  for (const cat of CATEGORIES) {
+    outBuf.length = 0;
+    const payload = cat.build();
+    const beforePayload = deepClone(payload);
+    const supplied = randomUUID();
+    await runWithCorrelation(supplied, async () => { log.info(`redact-${cat.path}`, payload); });
+    const emitted = JSON.parse(outBuf.join('').split('\n').filter(Boolean)[0]);
+    emittedCategoryLines.push({ path: cat.path, supplied, emitted });
+    const got = cat.read(emitted);
+    const payloadUnmutated = sameShape(payload, beforePayload);
+    const paired = emitted.correlationId === supplied;
+    results.push({
+      anchorAcId: 'AC-15103-1',
+      verdict: got === cat.expected && payloadUnmutated && paired ? 'pass' : 'fail',
+      detail: `${AC1}  -  category '${cat.path}': supplied correlationId='${supplied}' -> emitted line.correlationId='${emitted.correlationId}' (paired=${paired}); field value on line='${got}' (expect '${cat.expected}'); caller payload unmutated=${payloadUnmutated}. Observes both AC-15103-1 clauses (redacted output AND caller object not mutated) for this category.`,
+      evidence: {
+        path: cat.path,
+        suppliedInput: supplied,
+        derivedResponseHeader: emitted.correlationId,
+        valueOnLine: got,
+        payloadUnmutated,
+        line: { correlationId: emitted.correlationId, level: emitted.level, message: emitted.message },
+        bodyExcerpt: JSON.stringify(emitted).slice(0, 300),
+      },
+    });
+  }
+
+  // AC-15103-3 negative-control: a plain 'note' field with no category
+  // grammar passes through unredacted. Emitted in its own correlation
+  // context but only observed against AC-15103-3 (which requires the
+  // dotted-namespace grammar this row does not exercise) so it stays
+  // de-claimed to conformanceOnly.
+  outBuf.length = 0;
+  const notePayload = { note: 'this stays' };
+  const noteSupplied = randomUUID();
+  await runWithCorrelation(noteSupplied, async () => { log.info('note-passthrough', notePayload); });
+  const noteLine = JSON.parse(outBuf.join('').split('\n').filter(Boolean)[0]);
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: AC3_LIM_NOTE,
+    verdict: noteLine.note === 'this stays' && noteLine.correlationId === noteSupplied ? 'pass' : 'fail',
+    detail: `observed negative-control top-level field 'note'='${noteLine.note}' (no category tag at all -- passes through unredacted); supplied correlationId='${noteSupplied}' -> emitted line.correlationId='${noteLine.correlationId}'.`,
+    evidence: { note: noteLine.note, valueOnLine: noteLine.note, line: { correlationId: noteLine.correlationId, level: noteLine.level, message: noteLine.message, note: noteLine.note } },
+  });
+
+  // AC-15103-4-shaped emission: { user: { id: 'u-1', pii: { email: 'a@b' } } }.
+  outBuf.length = 0;
+  const acShapedPayload = { user: { id: 'u-1', pii: { email: 'a@b' } } };
+  const acShapedBefore = deepClone(acShapedPayload);
+  const acShapedSupplied = randomUUID();
+  await runWithCorrelation(acShapedSupplied, async () => { log.info('ac-15103-4-shape', acShapedPayload); });
+  const acShapedUnmutated = sameShape(acShapedPayload, acShapedBefore);
+  const acShapedLine = JSON.parse(outBuf.join('').split('\n').filter(Boolean)[0]);
+  const emailRedactedOk = acShapedLine.user?.pii?.email === '[REDACTED:pii.email]';
+  const idPreservedOk = acShapedLine.user?.id === 'u-1';
+  const acShapedPaired = acShapedLine.correlationId === acShapedSupplied;
+  results.push({
+    anchorAcId: 'AC-15103-4',
+    verdict: emailRedactedOk && idPreservedOk && acShapedUnmutated && acShapedPaired ? 'pass' : 'fail',
+    detail: `${AC4}  -  observed emitted line with payload { user: { id: 'u-1', pii: { email: 'a@b' } } }: user.id='${acShapedLine.user?.id}' (expect 'u-1' PRESERVED); user.pii.email='${acShapedLine.user?.pii?.email}' (expect '[REDACTED:pii.email]'); acShapedPayload unmutated=${acShapedUnmutated}; supplied correlationId='${acShapedSupplied}' -> emitted line.correlationId='${acShapedLine.correlationId}' (paired=${acShapedPaired}).`,
+    evidence: {
+      suppliedInput: acShapedSupplied,
+      derivedResponseHeader: acShapedLine.correlationId,
+      userIdOnLine: acShapedLine.user?.id,
+      userPiiEmailOnLine: acShapedLine.user?.pii?.email,
+      acShapedUnmutated,
+      line: { correlationId: acShapedLine.correlationId, level: acShapedLine.level, message: acShapedLine.message, user: acShapedLine.user },
+    },
+  });
+
+  return {
+    results,
+    extra: {
+      envDeclared: ['RCF_FIXTURE_LOGGER_CORRELATION_HEADER'],
+      categoriesObserved: emittedCategoryLines.map((c) => ({ path: c.path, supplied: c.supplied, emittedCorrelationId: c.emitted.correlationId, valueOnLine: c.path.includes('.') ? c.emitted.pii?.[c.path.split('.')[1]] : c.emitted[c.path] })),
+      acShapedExcerpt: acShapedLine,
+      acShapedUnmutated,
+    },
+  };
+}

package/blueprints/observability-logging/contributions/probes/run-correlation-id-flow.mjs

@@ -0,0 +1,3 @@
+import runProbe from './correlation-id-flow.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('correlation-id-flow', { kind: 'logger', driver: 'in-process fixture logger factory (Node 24)', healthy: true }, runProbe);

package/blueprints/observability-logging/contributions/probes/run-line-shape-and-fields.mjs

@@ -0,0 +1,3 @@
+import runProbe from './line-shape-and-fields.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('line-shape-and-fields', { kind: 'logger', driver: 'in-process fixture logger factory (Node 24)', healthy: true }, runProbe);

package/blueprints/observability-logging/contributions/probes/run-redaction-boundary.mjs

@@ -0,0 +1,3 @@
+import runProbe from './redaction-boundary.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('redaction-boundary', { kind: 'logger', driver: 'in-process fixture logger factory (Node 24)', healthy: true }, runProbe);