rcf-lite 0.26.0 → 0.28.0

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-001.json

@@ -2,14 +2,21 @@
   "reqId": "observability-logging-REQ-001",
   "prdId": "PRD-001",
   "title": "Every service surface emits structured single-line JSON log lines through the shared factory",
-  "description": "Every log emission from the applying application passes through the logger factory contract TAC-1601 produces, writes one JSON object per line to standard output, and includes at minimum the fields message (string), level (one of the level vocabulary in ADR-1604), timestamp (ISO-8601 with millisecond precision), correlationId (string, may be null when no ambient context), environment (string), serviceName (string) and serviceVersion (string). A log emission that fails to serialise (a value that is not JSON-representable, a circular reference) is caught, dropped with a one-time stderr notice, and the calling code path continues; a serialisation failure never crashes the service.",
+  "description": "Every log emission from the applying application passes through the logger factory contract TAC-1601 produces, writes one JSON object per line to standard output, and includes at minimum the fields message (string), level (one of the level vocabulary in ADR-1604), timestamp (ISO-8601 with millisecond precision), correlationId (string, may be null when no ambient context), environment (string), serviceName (string) and serviceVersion (string). This stream is the shelf provider of the `auditLog` capability: applied consumers (application-admin-console at AC-21105-1) read audit-relevant emissions from the same stream, so an audit-shaped payload with the caller-supplied actor, target, before and after fields folds onto the top level of the same JSON object. A log emission that fails to serialise (a function reference, a circular reference) is caught, dropped with a one-time stderr notice, and the calling code path continues; a BigInt value is folded to its decimal string form per ADR-1605 and the emission proceeds; a serialisation failure never crashes the service.",
+  "deliveredBy": {
+    "tacId": "TAC-1601-observability-logging-logger-factory",
+    "field": "interfaces.Logger"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
   "rationale": "Downstream log ingestion tooling (Elastic Common Schema pipelines, Loki, Datadog, Splunk) parses one JSON object per line. Multi-line stack traces or unstructured text break the pipeline and produce silent data loss. Threading every emission through one factory closes the drift class where a stray console.log lands unstructured text alongside structured lines.",
-  "tags": ["blueprint:observability-logging", "category:01-structured-emission"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:01-structured-emission"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-002.json

@@ -3,11 +3,18 @@
   "prdId": "PRD-001",
   "title": "The application accepts, propagates and reflects a correlation identifier on every log line",
   "description": "The application reads a correlation identifier from an inbound request header (name governed by ADR-1602; default X-Correlation-Id, elicited per project), threads it through the request-scoped context using the mechanism the TAC exposes, includes it on every log line emitted during that request, and reflects it on any outbound request initiated inside the same context. When no inbound identifier is present, the application mints a v4 UUID and treats it as the ambient value. Requests processed with no ambient context (a scheduled task boot, a background worker startup line) log with correlationId equal to null; the field is always present.",
+  "deliveredBy": {
+    "tacId": "TAC-1601-observability-logging-logger-factory",
+    "field": "interfaces.correlationHeader"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
   "rationale": "Correlation identifiers are the mechanism that stitches together the log lines of a single logical request across multiple services and multiple retries. Without acceptance-and-reflection at every hop, log search cannot follow the chain. Present-but-null is a legitimate ambient state (boot-time logs, cron); refusing to log without an identifier fights the operator when they need the emission most.",
-  "tags": ["blueprint:observability-logging", "category:02-correlation-id"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:02-correlation-id"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-003.json

@@ -3,11 +3,18 @@
   "prdId": "PRD-001",
   "title": "PII fields are redacted by named category at the emission boundary, not at the call site",
   "description": "The logger factory exposes a redaction contract (ADR-1603 recommended-default categories: credential, pii.email, pii.name, pii.address, token, bearer; elicited additions per project). A field named or path-labelled with a category is replaced with the string [REDACTED:<category>] before the line is serialised, whether the log call site remembered to redact or not. Redaction happens at the emission boundary (TAC-1602): a rogue field name in a caller-supplied object is redacted by rule, not by hope. The redaction pass never mutates the caller's original object; the emission pipeline copies the object first.",
+  "deliveredBy": {
+    "tacId": "TAC-1602-observability-logging-redaction-boundary",
+    "field": "interfaces.createRedactionBoundary"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",
   "rationale": "PII leaks through logs are one of the most common data-exposure defects in production systems. Placing the redaction responsibility at the call site produces a coverage gap the size of the codebase; placing it at the boundary is the only scalable enforcement. Named categories keep the vocabulary auditable and let a project add its own categories at apply time.",
-  "tags": ["blueprint:observability-logging", "category:03-pii-redaction"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:03-pii-redaction"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-004.json

@@ -3,11 +3,18 @@
   "prdId": "PRD-001",
   "title": "Every environment has an operator-elicited minimum log level; the factory refuses to emit below it",
   "description": "The logger factory reads a minimum level per environment (ADR-1604 recommended default vocabulary: trace, debug, info, warn, error, fatal; the minimum level per environment is elicited at apply). Emissions below the minimum are dropped before serialisation; emissions at or above the minimum land on stdout. The environment name is supplied at boot (REQ-005) and the level filter is applied per line, not batched. Changing the minimum level mid-run through a documented hook (SIGHUP re-read, admin endpoint, config reload) is out of scope for v1; the minimum is fixed for the process lifetime.",
+  "deliveredBy": {
+    "adrId": "ADR-1604-observability-logging-level-vocabulary",
+    "field": "decision.levelVocabulary"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
   "rationale": "Production log volume is dominated by debug and trace lines; enabling them everywhere buries the signal. Development wants them; production does not. A per-environment operator-elicited minimum keeps the discipline explicit at apply time and lets the same code path serve both environments with the same call sites.",
-  "tags": ["blueprint:observability-logging", "category:04-level-vocabulary"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:04-level-vocabulary"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-005.json

@@ -3,11 +3,18 @@
   "prdId": "PRD-001",
   "title": "Every log line carries environment, service name and service version, all operator-elicited at boot",
   "description": "The three fields (environment, serviceName, serviceVersion) are supplied to the logger factory at boot from operator-elicited configuration (environment variables, config file, deployment manifest); the factory refuses to construct a logger when any of the three is missing or blank. Every emitted line carries all three at fixed field names so log ingestion can partition by environment and service without prose parsing.",
+  "deliveredBy": {
+    "tacId": "TAC-1601-observability-logging-logger-factory",
+    "field": "interfaces.createLoggerFactory"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
   "rationale": "A shared log destination sees lines from every environment and every service. Without machine-readable partitioning fields, filtering by environment or service requires string search on the message field, which is fragile and prone to false positives. Requiring the three fields at boot puts the discipline at the earliest possible surface.",
-  "tags": ["blueprint:observability-logging", "category:05-boot-fields"],
+  "tags": [
+    "blueprint:observability-logging",
+    "category:05-boot-fields"
+  ],
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-09-04T12:20:00Z",

package/blueprints/observability-logging/contributions/requirements/observability-logging-req-006.json

@@ -0,0 +1,16 @@
+{
+  "reqId": "observability-logging-REQ-006",
+  "prdId": "PRD-001",
+  "title": "The applied logger emits an audit-log stream backing the shelf auditLog capability with the correlation identifier already threaded",
+  "description": "The blueprint declares the auditLog capability on blueprint.json and delivers it through the same emission stream REQ-001 defines. An audit event lands as one JSON object per line carrying the shared minimum field set plus caller-supplied actor, target, before and after payload fields on the top level of the same object. The correlationId REQ-002 threads is present on every audit line so the consumer (application-admin-console AC-21105-1) can join a role-change audit entry to the request that produced it. The line is subject to the REQ-003 redaction pass and the REQ-004 minimum-level filter; an audit event emitted at info or above lands, an audit event emitted at debug or trace is filtered out in production per the elicited minimum-level-per-environment.",
+  "deliveredBy": { "tacId": "TAC-1601-observability-logging-logger-factory", "field": "interfaces.Logger" },
+  "category": "functional",
+  "domain": "observability",
+  "priority": "must",
+  "rationale": "The shelf routes auditLog through observability-logging (application-admin-console-ADR-2201, application-account-settings-ADR-2601). Without a must-priority REQ naming that capability token, the delivery is a prose promise: consumer probe packs can be shipped but the chain does not have a load-bearing anchor. Making it explicit closes the section 7c gap on the auditLog token.",
+  "tags": ["blueprint:observability-logging", "category:06-audit-log-capability"],
+  "version": "1.0.0",
+  "status": "approved",
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/observability-logging/contributions/tacs/tac-1601-observability-logging-logger-factory.json

@@ -8,12 +8,12 @@
   "purpose": "Owns the construction of every logger the application uses. Threads the operator-elicited boot fields (environment, serviceName, serviceVersion, minimum level, correlation header name, redaction categories) into a shared factory contract; every call site takes a logger from the factory and never constructs one directly. Provides a hermetic in-memory capture mode for tests.",
   "responsibilities": [
     "Construct a logger from operator-elicited boot fields; refuse construction when environment, serviceName or serviceVersion is missing or blank (AC-15105-1), and refuse when the minimum level is not one of the recommended-default vocabulary (AC-15106-1).",
-    "Emit each log call as one JSON line to standard output carrying the shared minimum field set (AC-15101-1), applying the level filter per line (AC-15104-1).",
+    "Emit each log call as one JSON line to standard output carrying the shared minimum field set message, level, timestamp, correlationId, environment, serviceName, serviceVersion (AC-15101-1), applying the level filter per line (AC-15104-1), refusing to let a caller-supplied payload field of the same name as one of the seven collide with the factory-authored value (AC-15101-4), and using an ISO-8601 timestamp with millisecond precision the AC-15101-5 oracle asserts.",
     "Expose an in-memory capture mode returning an ordered array of the structured objects the same emission would have written to stdout (AC-15107-1), with zero stdout side effects.",
-    "Catch serialisation failures (BigInt, function reference, circular object) at the boundary, drop the emission with one stderr notice naming the offending field, and return without throwing to the caller (AC-15101-2).",
+    "Split serialisation refusal per ADR-1605: fold a BigInt payload value to its decimal string form on the emitted line (AC-15101-3); drop a circular graph or a function reference with one stderr notice naming the offending dotted path and return to the caller without throwing (AC-15101-2).",
     "Read the ambient correlation context per emission and thread it onto the correlationId field (AC-15102-1), or null when no context is active (AC-15102-3)."
   ],
-  "internalStructure": "One module exporting createLoggerFactory({ environment, serviceName, serviceVersion, minimumLevel, correlationHeader, redactionCategories, now, sink }) -> { getLogger(name) -> Logger, capturedLines() }. The factory closes over boot fields, a now() clock (default () -> new Date()) and a pluggable sink (default process.stdout; test-mode sink is an in-memory array). Loggers are lightweight wrappers around the sink. Serialisation is JSON.stringify with a replacer function that folds BigInt to string and short-circuits on circularity via a WeakSet, throwing a controlled SerializationRefusedError caught at the boundary.",
+  "internalStructure": "One module exporting createLoggerFactory({ environment, serviceName, serviceVersion, minimumLevel, correlationHeader, redactionCategories, now, sink }) -> { getLogger(name) -> Logger, capturedLines() }. The factory closes over boot fields, a now() clock (default () -> new Date()) and a pluggable sink (default process.stdout; test-mode sink is an in-memory array). Loggers are lightweight wrappers around the sink. Serialisation is JSON.stringify with a replacer function that folds BigInt values to their decimal string form (per ADR-1605), refuses to serialise circular graphs (short-circuits via a WeakSet) and refuses to serialise function references; a refusal throws a controlled SerializationRefusedError which the boundary catches, writes one stderr notice naming the offending dotted path, and returns to the caller without throwing.",
   "interfaces": [
     {
       "name": "createLoggerFactory",
@@ -42,5 +42,5 @@
   "tradeoffs": "The factory owns the field vocabulary; a project that wants an additional top-level field beyond the shared minimum authors it as a payload field (which appears on the line) rather than as a factory-side hook. Capture mode is a first-class interface, not a test-only afterthought: the runtime sink is one strategy the same interface serves, so the capture path exercises the same serialisation logic as the runtime path. The v1 blueprint does not ship a dynamic level-change interface; the level is fixed for the process lifetime (REQ-004).",
   "notes": "Known mechanism-reach gap: the blueprint cannot prove every emission call site uses the factory. A project-side grep gate ('every log call is a factory-returned logger method, not a bare console.log') or a lint rule closes the class; the blueprint's guide names this gap.",
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15101.json

@@ -11,24 +11,78 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15101-1",
-      "description": "A log emission at any level from any call site produces exactly one line on stdout, that line parses as valid JSON, and the parsed object carries every field of the shared minimum set: message, level, timestamp, correlationId, environment, serviceName, serviceVersion.",
+      "description": "A log emission at any level from any call site produces exactly one line on stdout, that line parses as valid JSON, and the parsed object carries every field of the shared minimum set: message, level, timestamp, correlationId, environment, serviceName, serviceVersion. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
       "given": "a running application with the logger factory constructed and an ambient correlation context",
       "when": "any call site emits at any level",
       "then": "one stdout line results, JSON.parse succeeds, and the object has all seven minimum fields present with the correct types",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
     },
     {
       "id": "AC-15101-2",
-      "description": "A log emission whose payload contains a non-JSON-representable value (a BigInt, a function reference, a circular object) is caught at the boundary, dropped with one stderr notice naming the offending field, and the calling code path returns as if the emission had succeeded; the service does not crash.",
-      "given": "a running application and a caller passing a BigInt or a circular object as part of a log payload",
+      "description": "A log emission whose payload contains a circular reference or a function reference is caught at the boundary, dropped with one stderr notice naming the offending dotted path, and the calling code path returns as if the emission had succeeded; the service does not crash.",
+      "given": "a running application and a caller passing a circular graph or a function reference as part of a log payload",
       "when": "the emission is attempted",
-      "then": "stdout carries no line for this emission, stderr carries one notice naming the offending field, and the caller's next line of code executes without throwing",
+      "then": "stdout carries no line for this emission, stderr carries one notice naming the offending dotted path, and the caller's next line of code executes without throwing",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "internalStructure"
+      }
+    },
+    {
+      "id": "AC-15101-3",
+      "description": "A log emission whose payload contains a BigInt value has that value folded to its decimal string form on the emitted line per ADR-1605; the emission proceeds normally, stderr carries no notice, and the JSON.parse of the stdout line yields a string equal to the BigInt's decimal representation.",
+      "given": "a running application and a caller passing { id: 9007199254740993n } (a BigInt beyond safe-integer) on a log payload",
+      "when": "the emission is attempted",
+      "then": "stdout carries one line; JSON.parse of it yields id === '9007199254740993' as a string; stderr carries no notice",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "adrId": "ADR-1605-observability-logging-serialisation-refusal",
+        "field": "decision.bigIntFold"
+      }
+    },
+    {
+      "id": "AC-15101-4",
+      "description": "The seven shared minimum fields (message, level, timestamp, correlationId, environment, serviceName, serviceVersion) never collide with a caller-supplied payload field of the same name: a caller payload field named 'level' or 'timestamp' does not overwrite the factory-authored value on the emitted line. The factory-authored value wins; the caller-supplied value with the same name is dropped with one stderr notice naming the offending key. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
+      "given": "a running application and a caller issuing logger.info('m', { level: 'boom', timestamp: 'yesterday' })",
+      "when": "the emission is attempted",
+      "then": "the stdout line's level equals the factory-computed level string and timestamp equals the factory-supplied ISO-8601 stamp; stderr names 'level' and 'timestamp' as reserved keys",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15101-5",
+      "description": "Every emitted line's timestamp field parses as a valid ISO-8601 instant with millisecond precision and lies within a 5-second wall-clock window of the emission call site (a documented oracle for the timestamp promise). The factory refuses construction when the now() strategy returns something that fails to render as an ISO-8601 instant.",
+      "given": "a running application with the default now() strategy and a caller issuing an emission",
+      "when": "the emission is issued at wall-clock time T",
+      "then": "the stdout line's timestamp field parses via Date.parse to a Date whose absolute difference from T is at most 5 seconds, and the string matches /^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$/",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15102.json

@@ -11,21 +11,23 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15102-1",
-      "description": "A request arriving with the elicited correlation header (default X-Correlation-Id per ADR-1602) causes every log line emitted during the handler and its callees to carry correlationId equal to the header value; a request arriving without the header causes the application to mint a v4 UUID and the same value appears on every log line for the request.",
+      "description": "A request arriving with the elicited correlation header (default X-Correlation-Id per ADR-1602) causes every log line emitted during the handler and its callees to carry correlationId equal to the header value; a request arriving without the header causes the application to mint a v4 UUID and the same value appears on every log line for the request. Template values the applying agent sets: The applying agent sets the elicited correlation header name on the correlation-header-name elicit; the AC substitutes the elicited value for the illustrative X-Correlation-Id token.",
       "given": "a running application with the correlation header configured and an inbound request",
       "when": "the request is processed (with or without the header set)",
       "then": "every log line emitted during the request carries the same correlationId value; header value wins when present; a v4 UUID is minted otherwise",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-15102-2",
-      "description": "An outbound HTTP request initiated from within a request-scoped handler carries the ambient correlationId as the same elicited header name.",
+      "description": "An outbound HTTP request initiated from within a request-scoped handler carries the ambient correlationId as the same elicited header name. Template values the applying agent sets: The applying agent sets the elicited correlation header name on the correlation-header-name elicit; the AC substitutes the elicited value for the illustrative X-Correlation-Id token.",
       "given": "an inbound request handler that issues an outbound HTTP call",
       "when": "the outbound request is sent",
       "then": "the outbound request headers include the correlation header with the ambient value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-15102-3",
@@ -34,10 +36,13 @@
       "when": "a boot-time or background emission occurs",
       "then": "the line carries correlationId: null",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
   "updatedAt": "2026-09-04T12:20:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15103.json

@@ -16,19 +16,51 @@
       "when": "the emission passes through the boundary",
       "then": "the stdout line's field value equals [REDACTED:pii.email] and the caller-side object still holds the original address",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
     },
     {
       "id": "AC-15103-2",
-      "description": "A project may add its own redaction categories at apply through the ADR-1603 elicited-additions parameter; a new category name (kebab or dotted-namespace) is accepted and applied by the boundary in the same round.",
+      "description": "A project may add its own redaction categories at apply through the ADR-1603 elicited-additions parameter; a new category name (kebab or dotted-namespace) is accepted and applied by the boundary in the same round. Template values the applying agent sets: The applying agent sets any project-added redaction categories on the redaction-categories-additions elicit; the AC substitutes the project's category names for the illustrative ssn token.",
       "given": "a project that elicited an additional category ssn on ADR-1603",
       "when": "an emission includes a field tagged ssn",
       "then": "the stdout line's field value equals [REDACTED:ssn]",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-15103-3",
+      "description": "A category name whose kebab or dotted-namespace grammar looks valid but is not present in the current recommended-default set and not in the elicited additions is left unredacted; the emitted payload field carries its original value.",
+      "given": "a running application configured only with the recommended defaults and a caller emitting a payload with a field tagged `custom.internal.token` (not in defaults, not in elicited additions)",
+      "when": "the emission is issued",
+      "then": "the stdout line's `custom.internal.token` field carries the caller value verbatim; no [REDACTED:...] rewrite happens for that field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1602-observability-logging-redaction-boundary",
+        "field": "interfaces.createRedactionBoundary"
+      }
+    },
+    {
+      "id": "AC-15103-4",
+      "description": "The redaction boundary reads a nested payload path: an object with a `user.pii.email` shape has the leaf redacted; the sibling `user.id` retains its original value. Template values the applying agent sets: the AC exercises the recommended-default category vocabulary configured on the boundary.",
+      "given": "a running application with recommended defaults and a caller emitting `{ user: { id: \"u-1\", pii: { email: \"a@b\" } } }`",
+      "when": "the emission is issued",
+      "then": "the stdout line has `user.id` equal to \"u-1\" and `user.pii.email` equal to \"[REDACTED:pii.email]\"",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1602-observability-logging-redaction-boundary",
+        "field": "interfaces.createRedactionBoundary"
+      }
     }
   ],
-  "tacIds": ["TAC-1602-observability-logging-redaction-boundary"],
+  "tacIds": [
+    "TAC-1602-observability-logging-redaction-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15104.json

@@ -11,15 +11,46 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15104-1",
-      "description": "With the elicited minimum level set to info, an emission at trace or debug produces no stdout line; an emission at info, warn, error or fatal produces one stdout line each.",
+      "description": "With the elicited minimum level set to info, an emission at trace or debug produces no stdout line; an emission at info, warn, error or fatal produces one stdout line each. Template values the applying agent sets: The applying agent sets the elicited minimum-log-level per environment; the AC substitutes the elicited threshold for the illustrative info.",
       "given": "a running application with minimum level set to info",
       "when": "one emission is issued at each of the six levels",
       "then": "the stdout line count equals 4 (info, warn, error, fatal), and no line at trace or debug appears",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-15104-2",
+      "description": "A minimum level of `fatal` drops every emission strictly below fatal, so only fatal emissions land on stdout; emissions at trace, debug, info, warn and error all produce zero lines.",
+      "given": "a running application with minimum-log-level fatal",
+      "when": "one emission is issued at each of the six levels",
+      "then": "stdout carries exactly one line (fatal); no line for any of trace, debug, info, warn or error",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15104-3",
+      "description": "Toggling the minimum level between two constructions of the factory produces the corresponding filter change; the level is fixed for the process lifetime per REQ-004 and re-reading the elicit at boot is a new factory construction, never a mid-run hook.",
+      "given": "a factory constructed with minimum-log-level info; a second factory constructed in a subsequent process with minimum-log-level warn",
+      "when": "one emission is issued at info under each factory",
+      "then": "the first factory's emission lands on stdout; the second factory's emission does not; no mid-run flag flips the level in either process",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15105.json

@@ -11,24 +11,42 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15105-1",
-      "description": "The logger factory refuses to construct when environment, serviceName or serviceVersion is missing or blank; construction failure throws with a message naming the missing field.",
+      "description": "The logger factory refuses to construct when environment, serviceName or serviceVersion is missing or blank; construction failure throws with a message naming the missing field. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
       "given": "an application booting with one of the three fields absent",
       "when": "the logger factory is constructed",
       "then": "the construction throws, the error message names the missing field, and the process exits before any emission is possible",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
     },
     {
       "id": "AC-15105-2",
-      "description": "Every emitted line carries environment, serviceName and serviceVersion at fixed field names and equal to the values the operator supplied at boot.",
+      "description": "Every emitted line carries environment, serviceName and serviceVersion at fixed field names and equal to the values the operator supplied at boot. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
       "given": "a running application constructed with the three fields set",
       "when": "any emission is issued",
       "then": "the stdout line's three fields equal the operator-supplied values verbatim",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-15105-3",
+      "description": "The factory refuses to construct when environment, serviceName or serviceVersion is set to a whitespace-only string; the thrown error names the offending field and treats blank as absent.",
+      "given": "an application booting with serviceName equal to \"  \" (two spaces)",
+      "when": "the factory is constructed",
+      "then": "construction throws with a message naming serviceName as the offending blank field",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15106.json

@@ -11,15 +11,33 @@
   "acceptanceCriteria": [
     {
       "id": "AC-15106-1",
-      "description": "The factory refuses to construct when the elicited minimum level is not one of the recommended-default vocabulary (trace, debug, info, warn, error, fatal); the thrown error names the offending value and lists the accepted set.",
+      "description": "The factory refuses to construct when the elicited minimum level is not one of the recommended-default vocabulary (trace, debug, info, warn, error, fatal); the thrown error names the offending value and lists the accepted set. Template values the applying agent sets: The applying agent sets the elicited minimum-log-level per environment; the AC substitutes the elicited threshold for the illustrative info.",
       "given": "an application booting with minimum level set to 'verbose'",
       "when": "the factory is constructed",
       "then": "the construction throws with a message naming 'verbose' as the offending value and listing the accepted vocabulary",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "template"
+    },
+    {
+      "id": "AC-15106-2",
+      "description": "The factory refuses to construct when the elicited minimum level is provided in the wrong case (e.g. \"INFO\", \"Warn\"); the thrown error names the offending value and lists the accepted lower-case vocabulary. The vocabulary is case-sensitive by design.",
+      "given": "an application booting with minimum level set to \"INFO\"",
+      "when": "the factory is constructed",
+      "then": "construction throws with a message naming \"INFO\" as the offending value and listing the accepted lower-case vocabulary trace/debug/info/warn/error/fatal",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "description": "Section 7a floor: two ACs. ADR-1604 and TAC-1601 name no US-15106-specific failure paths beyond unknown-level-value (AC-15106-1) and wrong-case (AC-15106-2); further boundary classes for construction-time level validation are not documented on this mechanism."
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15107.json

@@ -16,10 +16,41 @@
       "when": "the code under test emits any number of log lines",
       "then": "the returned array contains one entry per emission with the same object shape the runtime writes to stdout, and stdout carries no line",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-15107-2",
+      "description": "The in-memory capture mode maintains insertion order; emissions issued in the order A, B, C appear in the returned array as A, B, C at indexes 0, 1, 2, with the same shape a stdout sink would have written.",
+      "given": "a factory in capture mode with no ambient correlation context and a caller issuing three distinct emissions in order",
+      "when": "capturedLines() is read",
+      "then": "the returned array has length 3 with emissions in insertion order and each entry's shape matches the shared minimum field set",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
+    },
+    {
+      "id": "AC-15107-3",
+      "description": "Constructing the factory in capture mode does not open stdout: an assertion that captures the process's stdout file descriptor writes across the same test finds zero bytes written by the factory. The mechanism has no documented failure path beyond a caller misusing the capture-mode flag; the standard stdout-vs-capture confusion is caught by AC-15107-1.",
+      "given": "a test that constructs the factory in capture mode and intercepts stdout for the entire scope",
+      "when": "the code under test emits any number of lines",
+      "then": "the intercepted stdout carries zero bytes attributable to the factory; every emission is on the returned capture array",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.createLoggerFactory"
+      }
     }
   ],
-  "tacIds": ["TAC-1601-observability-logging-logger-factory"],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15108.json

@@ -16,10 +16,28 @@
       "when": "the factory is constructed",
       "then": "construction throws with a message naming 'PII Email' as the offending value",
       "testable": true,
-      "scope": "runtime"
+      "scope": "runtime",
+      "disposition": "fixed"
+    },
+    {
+      "id": "AC-15108-2",
+      "description": "The factory refuses to construct when the redaction categories list contains an entry that is a valid grammar shape but empty; the thrown error names the offending index and treats empty as invalid.",
+      "given": "a factory configured with redaction categories including an empty string entry ([\"credential\", \"\"])",
+      "when": "the factory is constructed",
+      "then": "construction throws with a message naming the offending index and the empty value",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1602-observability-logging-redaction-boundary",
+        "field": "interfaces.createRedactionBoundary"
+      }
     }
   ],
-  "tacIds": ["TAC-1602-observability-logging-redaction-boundary"],
+  "tacIds": [
+    "TAC-1602-observability-logging-redaction-boundary"
+  ],
   "createdAt": "2026-09-04T12:20:00Z",
-  "updatedAt": "2026-09-04T12:20:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z",
+  "description": "Section 7a floor: two ACs. ADR-1603 and TAC-1602 name no US-15108-specific failure paths beyond grammar-invalid shape (AC-15108-1 already binds the shape refusal at construction) and grammar-valid-but-empty entries (AC-15108-2); further boundary classes for redaction-category validation are not documented on this mechanism."
 }