rcf-lite 0.26.0 → 0.28.0

package/blueprints/observability-logging/contributions/user-stories/observability-logging-us-15109.json

@@ -0,0 +1,71 @@
+{
+  "usId": "observability-logging-US-15109",
+  "prdId": "PRD-001",
+  "reqId": "observability-logging-REQ-006",
+  "version": "1.0.0",
+  "status": "approved",
+  "title": "The audit-log stream carries actor, target, before and after fields per line with the ambient correlation identifier for consumer surfaces to join",
+  "asA": "operator of a consuming blueprint (application-admin-console) rendering an audit-log surface",
+  "iWant": "every audit event the applying application emits to land on the same shared logger stream with actor, target, before, after and correlationId fields on the top-level object",
+  "soThat": "the audit surface can read the stream directly, join each row to its originating request via the correlation identifier, and use the shared redaction and level-filter pipeline without a per-consumer adapter",
+  "acceptanceCriteria": [
+    {
+      "id": "AC-15109-1",
+      "description": "An audit event emission at info with a payload carrying { actor: 'principal:1', target: 'role:2', before: 'reader', after: 'admin' } produces one stdout line whose parsed object holds those four fields at the top level alongside message, level, timestamp, correlationId, environment, serviceName and serviceVersion; the correlationId equals the ambient request context's value. Template values the applying agent sets: The applying agent sets the elicited environment, serviceName and serviceVersion on the boot-identity-fields elicit; the AC substitutes those values for the illustrative literals.",
+      "given": "a running application in an ambient request context with correlationId 'req-777' and a caller issuing logger.info('role.granted', { actor: 'principal:1', target: 'role:2', before: 'reader', after: 'admin' })",
+      "when": "the emission passes through the factory",
+      "then": "stdout carries one line, JSON.parse yields an object with actor === 'principal:1', target === 'role:2', before === 'reader', after === 'admin', correlationId === 'req-777' and the shared minimum field set present",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15109-2",
+      "description": "An audit event emitted at debug with the elicited minimum-log-level set to info produces no stdout line, so the audit stream in production does not carry sub-threshold audit noise. Template values the applying agent sets: The applying agent sets the elicited minimum-log-level per environment; the AC substitutes the elicited threshold for the illustrative info.",
+      "given": "a running application with minimum-log-level info and a caller issuing logger.debug('role.hover', { actor: 'principal:1', target: 'role:2', before: 'reader', after: 'reader' })",
+      "when": "the emission is issued",
+      "then": "stdout carries no line for this emission",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "template",
+      "ownerRef": {
+        "tacId": "TAC-1601-observability-logging-logger-factory",
+        "field": "interfaces.Logger"
+      }
+    },
+    {
+      "id": "AC-15109-3",
+      "description": "An audit event whose actor value has category pii.email at the caller-side has that field replaced with [REDACTED:pii.email] on the emitted line; the caller-side object still holds the original address.",
+      "given": "a running application configured with the recommended redaction defaults and a caller issuing logger.info('login.success', { actor: 'alice@example.test', 'actor.pii.email': 'alice@example.test' })",
+      "when": "the emission passes through the redaction boundary",
+      "then": "the stdout line's `actor.pii.email` field value equals [REDACTED:pii.email] and the caller-side object still holds 'alice@example.test'",
+      "testable": true,
+      "scope": "runtime",
+      "disposition": "fixed",
+      "ownerRef": {
+        "tacId": "TAC-1602-observability-logging-redaction-boundary",
+        "field": "interfaces.createRedactionBoundary"
+      }
+    },
+    {
+      "id": "AC-15109-4",
+      "description": "The blueprint's guide 'Known mechanism-reach gaps' section names the class of a bare console.log or bare stdout write bypassing the factory. This AC verifies that the guide states the gap and names at least one project-side workaround (an ESLint rule or a build-time grep gate) that a consuming project can adopt to close it; the blueprint does not itself supply the gate.",
+      "given": "the applied blueprint's guide file",
+      "when": "the guide is opened",
+      "then": "the guide names the mechanism-reach gap explicitly and states at least one project-side workaround by name",
+      "testable": true,
+      "scope": "library",
+      "disposition": "fixed"
+    }
+  ],
+  "tacIds": [
+    "TAC-1601-observability-logging-logger-factory",
+    "TAC-1602-observability-logging-redaction-boundary"
+  ],
+  "createdAt": "2026-09-09T00:00:00Z",
+  "updatedAt": "2026-09-09T00:00:00Z"
+}

package/blueprints/observability-probe-endpoints/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+## 1.2.5 - 2026-09-11
+
+Anatomy suite tracks the strengthened shared helper (WARN-only shortcut removed, log objects and content lists no longer identifiers, retained anchor existence check). No probe changes required.
+
+## 1.2.4 - 2026-09-11
+
+shared anatomy helper tightened; probe-endpoints anatomy test passes shippedAcIds and browserOnlyAcIds into the helper and additionally checks every accountBoundSkipped row names exactly one declared env variable.
+
+# observability-probe-endpoints CHANGELOG
+
+## 1.2.3 - 2026-09-11
+
+Adds a contributions/probes/ pack (profile-boot-materialisation, kubernetes-startup-enabled, partial-profile-refusal) with a fixture-side profile registry and HTTP materialiser under packages/rcf-lite/test/fixtures/probe-pack-observability-probe-endpoints/. Probes run against the fixture on Node 24. No account gate.
+
+Anchoring: kubernetes-startup-enabled anchors AC-14102-4 with BOTH the enabled clause (three-path resolution; pre-ready GET /startup answers HTTP 503 body.status='fail'; post-markStartupReady GET answers HTTP 200 body.status='pass') AND the disabled clause (no enable flag: resolver returns two paths, GET /startup returns 404 with no /startup handler registered). profile-boot-materialisation observes bound-path behaviour for /live and /ready under the shipped kubernetes profile; the row de-claims (conformanceOnly, anchorAcId=null) with the limitation naming AC-14101-1 (port topology and handler-absence not observed). partial-profile-refusal observes an in-process refuseIfPartial refusal (stripped transport; startupEnabled without paths.startup) with the row de-claiming AC-14103-2 (process-level non-zero exit not observed at shelf); the shape presence check for the six shipped profiles de-claims AC-14103-1 (enum-membership per field not observed); the loadBalancer profile shape row de-claims AC-14103-3 (profile is not materialised and probed for handler absence). probe-utils normalisation and thrown-error rows carry an evidence object; the fallback anchorAcId is null.
+
+## 1.2.1 (register-sweep patch, 2026-09-10)
+
+- Register: neutral wording in shipped prose (no capability change).
+
+## 1.2.0 (2026-09-09)
+
+- Adds `elicits[]` with four apply-time answers: `probe-interface-profile` (enum kubernetes/loadBalancer/uptimeMonitor/systemd/dockerHealthcheck/reverseProxy/custom, default kubernetes; REQ-001), `probe-paths-override` (string JSON; REQ-002/003), `probe-listener-separate-port` (string; REQ-004), `kubernetes-startup-enabled` (enum off/on, default off; ADR-1503). Every option value is backed by a must-priority REQ description.
+- Adds `deliveredBy` to every REQ (REQ-001-008 -> TAC-1501/1502/1503/1504 interface names; REQ-006 -> ADR-1505).
+- Missing-profile semantics settle as fallback-to-Kubernetes-default (per ADR-1503), not refuse. REQ-001 names precedence (explicit declaration wins, absent falls back, unknown/malformed refused with stable codes PROBE_PROFILE_UNKNOWN / PROBE_PROFILE_MALFORMED). AC-14101-2 is on the fallback path; AC-14101-4 covers malformed.
+- The liveness failure without AC coverage gap is fixed: adds AC-14102-5 asserting a response-capable in-process liveness self-check predicate answers HTTP 503 with content-length 0 on fail; `template` because the predicate is project-owned.
+- The guide's `Boundary with observability-essentials` section reflects the current shelf: essentials v2 dropped its `scope: global` claims on `healthProbes` and `readinessSemantics`; probe-endpoints is the sole claimant on both topics; both orders compose cleanly. The pre-v2 conflict-resolution paths move to a historical migration note.
+- The systemd + TCP transport families with no AC gap is fixed: adds AC-14105-4 (systemd Type=notify: exactly-once READY=1 plus periodic WATCHDOG=1 at cadence; supervisor pull when the watchdog cadence lapses), AC-14105-5 (TCP transport: accept on pass, refuse on fail, zero bytes on the connection), AC-14105-6 (missing platform adapter refused at boot with PROBE_ADAPTER_MISSING).
+- Adds the missing coverage on AC-14106-3: `then` now uses the canonical lowercase `content-length` string owned by TAC-1502.responsibilities[2].
+- Re-sweeps every existing AC's `disposition` per section 7b: ACs whose text references profile names, dependency names, or the elicited separate-port option flipped to `template` with `templateFillIns`; the remaining ACs stay `fixed`.

package/blueprints/observability-probe-endpoints/README.md

@@ -1,4 +1,4 @@
-# observability-probe-endpoints blueprint (v1.1.0)
+# observability-probe-endpoints blueprint (v1.2.0)
 
 The tenth content blueprint on the rcf-build-lite blueprint mechanism, and the second in the `observability` category, sibling to the shipped `observability-essentials`. Scope: a health probe interface derived from an operator-declared target integration profile (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, plus a `custom:<name>` slot). Each profile fixes the probe transport, path or command surface, response contract, and semantic distinction between liveness and readiness for the supervisor at hand. Kubernetes is the shipped default (HTTPGet `/live` and `/ready` on the request-traffic listener); every HTTP profile ships with a `probeListener.separatePort` opt-in for probe-traffic isolation from user traffic. Response contracts are minimal by construction; the profile validator refuses any override that would add a field beyond the enumerated set. Targeted at rcf-lite projects that must integrate with a specific EXTERNAL supervising system whose conventions drive the probe wire shape; not targeted at the self-supervised all-in-one observability case (observability-essentials owns that).
 
@@ -29,9 +29,9 @@ The doc set is contributions (copied into the project tree by `rcf define bluepr
 
 ## What it contributes, and what it deliberately does not
 
-Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (ratified decision 5) and no code.
+Contributed kinds: REQ, US (with inline ACs), TAC, ADR. Adherence is expressed as ACs; the blueprint ships no test files (shipped policy 5) and no code.
 
-No FBS contributions, as a matter of principle (ratified policy 2026-08-19): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the elicitation surface, the six shipped profile contracts, the two-listener topology option, the auth-exempt-list emission, the response-contract secrecy rule, the profile-swap-is-config invariant); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
+No FBS contributions, as a matter of principle (policy): FBSs are the work of the implementing agent, not the blueprint; project constraints have to be applied at the time of creation. The blueprint contributes the WHAT (the elicitation surface, the six shipped profile contracts, the two-listener topology option, the auth-exempt-list emission, the response-contract secrecy rule, the profile-swap-is-config invariant); the implementing agent derives the HOW-tasks (FBS) in the host project, where the ACs contributed here get picked up by the project's own build sequencing.
 
 Deliberately not contributed: a public status page (observability-essentials owns `statusPageContract` for that audience); a notification outcome sink (observability-essentials owns that); an authenticated operator dashboard for granular internal state (project-authored on top of the readiness predicate); a metrics-export surface (a future `metrics-export` blueprint composes alongside); a distributed-tracing surface (a future `tracing` blueprint composes alongside); a log-shipping surface (application-api-rest's `logging` topic governs the wire-log shape of the HTTP tier); the readiness predicate implementation itself (project-authored; the blueprint fixes the boundary and each profile's default aggregation rule, not the per-dependency check code); the auth middleware installer (project-authored; the blueprint emits an exact-match exempt list the installer consumes); the vendor-CLI or client-library binding for any supervisor beyond the profile contract (project-authored inside a `custom:<name>` profile).
 
@@ -49,7 +49,7 @@ The probe surface always follows the operator-declared target integration profil
 
 ## Known mechanism-reach gaps
 
-- **Custom-profile contract adherence.** Projects that author a `custom:<name>` profile against the profile contract are expected to satisfy the same transport/paths/responseContract/semanticModel shape the shipped profiles do; the profile contract validator (TAC-1501) refuses a partial profile at boot, which is where the mechanism reach lands. What the validator cannot compel is that a project-authored custom profile's response shape is minimal in the AC-14105 and AC-14106 sense (a custom profile could in principle enumerate a rich field set the validator would accept as complete). Recorded here rather than smuggled in as an AC that would only apply to the shipped profiles. Promotion signal: a `custom-profile-shape-lint` addition to the profile contract validator that enforces the minimalism rule per field-set-size heuristic (harder than it sounds; some legitimate custom profiles do have wider fields); or a project-side grep gate. Project-side workaround until then: reviewers of a `custom:<name>` profile eyeball the enumerated field set against the pattern the shipped six carry.
+- **Custom-profile contract adherence.** Projects that author a `custom:<name>` profile against the profile contract are expected to satisfy the same transport/paths/responseContract/semanticModel shape the shipped profiles do; the profile contract validator (TAC-1501) refuses a partial profile at boot, which is where the mechanism reach lands. What the validator cannot compel is that a project-authored custom profile's response shape is minimal in the AC-14105 and AC-14106 sense (a custom profile could in principle enumerate a rich field set the validator would accept as complete). Recorded here rather than smuggled in as an AC that would only apply to the shipped profiles. Promotion signal: a `custom-profile-shape-lint` addition to the profile contract validator that enforces the minimalism rule per field-set-size heuristic (harder than it sounds; some legitimate custom profiles do have wider fields); or a project-side grep gate. Project-side workaround until then: at project-side check, compare the custom profile's enumerated field set against the pattern the shipped six carry.
 - **Kubernetes gRPC probe transport.** The `kubernetes` profile ships HTTPGet and TCPSocket transports (via TAC-1504's tcpAdapter selection) but not gRPC. A project on a gRPC-only mesh that wants the standard gRPC health protocol supersedes ADR-1503 with a project-level ADR selecting the gRPC transport, or authors a `custom:kubernetes-grpc` profile. Promotion signal: a shipped gRPC-transport handler in a v1.1 pass if enough rcf-lite projects reach for it. Project-side workaround: the `custom:<name>` slot is the mechanism escape hatch.
 
 ## Optional startup path (v1.1.0)

package/blueprints/observability-probe-endpoints/blueprint.json

@@ -1,7 +1,46 @@
 {
   "slug": "observability-probe-endpoints",
-  "version": "1.1.0",
+  "version": "1.2.5",
   "category": "observability",
+  "elicits": [
+    {
+      "id": "probe-interface-profile",
+      "prompt": "Target integration profile: name of the external supervising system the probe surface serves. Recommended default kubernetes (ADR-1503); the enumerated set is kubernetes, loadBalancer, uptimeMonitor, systemd, dockerHealthcheck, reverseProxy; a project-authored custom:<name> resolves to a project-supplied profile object.",
+      "kind": "enum",
+      "options": [
+        "kubernetes",
+        "loadBalancer",
+        "uptimeMonitor",
+        "systemd",
+        "dockerHealthcheck",
+        "reverseProxy",
+        "custom"
+      ],
+      "default": "kubernetes"
+    },
+    {
+      "id": "probe-paths-override",
+      "prompt": "Per-profile probe path overrides (empty for the profile defaults: /live and /ready for kubernetes, /health for loadBalancer and reverseProxy, exec entry for dockerHealthcheck, systemd notify for systemd). JSON object keyed by profile name.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "probe-listener-separate-port",
+      "prompt": "Separate-port listener option for probe traffic isolation from user traffic (per ADR-1504). Recommended default fused (probes on the request-traffic listener); set an integer TCP port to bind probes on their own listener.",
+      "kind": "string",
+      "default": ""
+    },
+    {
+      "id": "kubernetes-startup-enabled",
+      "prompt": "Enable the optional Kubernetes startup path /startup (per ADR-1503). Recommended default off; on emits a three-path set /live, /ready, /startup and generates a startup handler.",
+      "kind": "enum",
+      "options": [
+        "off",
+        "on"
+      ],
+      "default": "off"
+    }
+  ],
   "contributions": [
     {
       "id": "observability-probe-endpoints-REQ-001",
@@ -132,5 +171,6 @@
       "kind": "adr",
       "path": "adrs/adr-1505-observability-probe-endpoints-external-response-secrecy.json"
     }
-  ]
+  ],
+  "updatedAt": "2026-09-11"
 }

package/blueprints/observability-probe-endpoints/contributions/probes/kubernetes-startup-enabled.mjs

@@ -0,0 +1,80 @@
+// Kubernetes-startup-enabled probe for observability-probe-endpoints.
+//
+// Anchors AC-14102-4. The AC has two clauses:
+//   - enabled: probeInterface.options.kubernetes.startup.enabled=true
+//     -> resolver returns a three-path set including /startup; first
+//     GET on /startup returns 503 body {status:fail}; a second GET
+//     after the predicate returns pass returns 200 body {status:pass}.
+//   - disabled (without the enable flag): resolver returns two paths
+//     and no /startup handler is registered.
+// This probe exercises BOTH clauses.
+
+import { randomUUID } from 'node:crypto';
+import { materialise, resolveProfile } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-probe-endpoints/src/profile-registry.mjs';
+import { primaryPort } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-14102-4';
+export const accountBound = false;
+const AC4 = 'When the operator sets probeInterface.options.kubernetes.startup.enabled: true on the';
+
+async function get(url, rid) {
+  const res = await fetch(url, { headers: { 'x-request-id': rid } });
+  const text = await res.text();
+  let parsed = null; try { parsed = JSON.parse(text); } catch {}
+  return { status: res.status, requestId: res.headers.get('x-request-id'), body: text, parsed };
+}
+
+export default async function runProbe() {
+  const results = [];
+
+  // ENABLED clause
+  const resolvedEnabled = resolveProfile('kubernetes', { startup: { enabled: true } });
+  const enabledPathCount = Object.keys(resolvedEnabled.paths ?? {}).length;
+  const enabledHasStartup = Boolean(resolvedEnabled.paths?.startup);
+  const inst = await materialise({ profile: resolvedEnabled, listenerPort: primaryPort() });
+  const suppliedStarting = randomUUID();
+  const suppliedReady = randomUUID();
+  let starting, ready;
+  try {
+    starting = await get(`http://127.0.0.1:${inst.requestPort}/startup`, suppliedStarting);
+    results.push({
+      anchorAcId: 'AC-14102-4',
+      verdict: enabledPathCount === 3 && enabledHasStartup && starting.status === 503 && starting.requestId === suppliedStarting && starting.parsed?.status === 'fail' && starting.parsed?.profile === 'kubernetes' ? 'pass' : 'fail',
+      detail: `${AC4} shipped kubernetes profile  -  ENABLED clause: paths=${JSON.stringify(Object.keys(resolvedEnabled.paths ?? {}))} startup path='${resolvedEnabled.paths?.startup}'; pre-ready GET /startup -> ${starting.status} body.status='${starting.parsed?.status}'; echoed requestId=${starting.requestId === suppliedStarting}.`,
+      evidence: { variedInput: suppliedStarting, suppliedInput: suppliedStarting, derived: { status: starting.status, requestId: starting.requestId, bodyExcerpt: starting.body.slice(0, 300) }, derivedStarting: { status: starting.status, requestId: starting.requestId, bodyExcerpt: starting.body.slice(0, 300) } },
+    });
+    inst.markStartupReady();
+    ready = await get(`http://127.0.0.1:${inst.requestPort}/startup`, suppliedReady);
+    results.push({
+      anchorAcId: 'AC-14102-4',
+      verdict: ready.status === 200 && ready.requestId === suppliedReady && ready.parsed?.status === 'pass' && ready.parsed?.profile === 'kubernetes' ? 'pass' : 'fail',
+      detail: `${AC4} shipped kubernetes profile  -  ENABLED clause: post-markStartupReady GET /startup -> ${ready.status} body.status='${ready.parsed?.status}'; echoed requestId=${ready.requestId === suppliedReady}.`,
+      evidence: { variedInput: suppliedReady, suppliedInput: suppliedReady, derived: { status: ready.status, requestId: ready.requestId, bodyExcerpt: ready.body.slice(0, 300) }, derivedReady: { status: ready.status, requestId: ready.requestId, bodyExcerpt: ready.body.slice(0, 300) } },
+    });
+  } finally { await inst.close(); }
+
+  // DISABLED clause: no enable flag; resolver must yield two paths and
+  // /startup must be a 404 (no handler registered).
+  const resolvedDisabled = resolveProfile('kubernetes');
+  const disabledPathCount = Object.keys(resolvedDisabled.paths ?? {}).length;
+  const disabledHasStartup = Boolean(resolvedDisabled.paths?.startup);
+  const inst2 = await materialise({ profile: resolvedDisabled, listenerPort: primaryPort() });
+  let disabledResp;
+  const disabledId = randomUUID();
+  try {
+    disabledResp = await get(`http://127.0.0.1:${inst2.requestPort}/startup`, disabledId);
+    results.push({
+      anchorAcId: 'AC-14102-4',
+      verdict: disabledPathCount === 2 && !disabledHasStartup && disabledResp.status === 404 ? 'pass' : 'fail',
+      detail: `${AC4} shipped kubernetes profile  -  DISABLED clause (no enable flag): paths=${JSON.stringify(Object.keys(resolvedDisabled.paths ?? {}))} (expect two paths); GET /startup -> ${disabledResp.status} (expect 404 with no /startup handler registered).`,
+      evidence: { variedInput: disabledId, suppliedInput: disabledId, derived: { status: disabledResp.status, requestId: disabledResp.requestId, bodyExcerpt: disabledResp.body.slice(0, 300) }, resolvedPaths: resolvedDisabled.paths, acceptedProfile: resolvedDisabled.name },
+    });
+  } finally { await inst2.close(); }
+
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_OBS_PROBE_PORT', 'RCF_FIXTURE_OBS_PROBE_SEPARATE_PORT'], boundPort: inst.requestPort,
+    variedInputs: { starting: suppliedStarting, ready: suppliedReady, disabled: disabledId },
+    derivedStarting: starting && { status: starting.status, requestId: starting.requestId, bodyExcerpt: starting.body.slice(0, 300) },
+    derivedReady: ready && { status: ready.status, requestId: ready.requestId, bodyExcerpt: ready.body.slice(0, 300) },
+    derivedDisabled: disabledResp && { status: disabledResp.status, requestId: disabledResp.requestId, bodyExcerpt: disabledResp.body.slice(0, 300) },
+  } };
+}

package/blueprints/observability-probe-endpoints/contributions/probes/partial-profile-refusal.mjs

@@ -0,0 +1,101 @@
+// Partial-profile-refusal probe for observability-probe-endpoints.
+//
+// AC-14103-2 requires the process to exit non-zero when a profile
+// missing a required field is loaded at boot. This probe catches an
+// in-process refusal via refuseIfPartial rather than spawning a
+// child process and observing its OS exit code. Rows de-claimed
+// (conformanceOnly, anchorAcId=null) with the limitation naming
+// AC-14103-2.
+//
+// AC-14103-1 requires every field's value to belong to its enumerated
+// set (not just presence). This row asserts presence only. Row
+// de-claimed with the limitation naming AC-14103-1.
+//
+// AC-14103-3 requires the loadBalancer profile to be materialised
+// and observed to expose exactly one /health handler and no /live
+// or /ready handlers. This row asserts the resolved config shape but
+// does not materialise and probe for extra handlers. Row de-claimed
+// with the limitation naming AC-14103-3.
+
+import { refuseIfPartial, resolveProfile } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-probe-endpoints/src/profile-registry.mjs';
+
+export const anchorAcId = 'AC-14103-2';
+export const accountBound = false;
+
+const SHIPPED_NAMES = ['kubernetes', 'loadBalancer', 'uptimeMonitor', 'systemd', 'dockerHealthcheck', 'reverseProxy'];
+
+const LIM_14103_2 = `AC-14103-2: requires the process to exit non-zero when a profile missing a required field is loaded at boot. This row catches an in-process refusal via refuseIfPartial rather than spawning a child process and observing its OS exit code.`;
+const LIM_14103_1 = `AC-14103-1: requires every field's value to belong to its enumerated set (not just presence: transport must be an enum value, paths/command/notify each carry typed contents, semanticModel is one of a small set). This row asserts presence of each field only.`;
+const LIM_14103_3 = `AC-14103-3: requires the loadBalancer profile to be materialised and observed to expose exactly one /health handler and no /live or /ready handlers. This row asserts the resolved config shape but does not materialise the profile and issue HTTP GETs against /live and /ready to prove absence of those handlers.`;
+
+export default async function runProbe() {
+  const results = [];
+
+  // AC-14103-2 refusal via refuseIfPartial: strip 'transport' from the
+  // kubernetes profile.
+  const bad = { ...resolveProfile('kubernetes') };
+  delete bad.transport;
+  let refusalMessage = null;
+  let refusalCode = null;
+  let refusalMissing = null;
+  try { refuseIfPartial(bad); } catch (e) { refusalMessage = e.message; refusalCode = e.code; refusalMissing = e.missingKey; }
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_14103_2,
+    verdict: refusalCode === 'PROBE_PROFILE_INCOMPLETE' && refusalMissing === 'transport' ? 'pass' : 'fail',
+    detail: `observed stripped-transport kubernetes profile refused via refuseIfPartial with code='${refusalCode}' missingKey='${refusalMissing}' message='${refusalMessage}'. Process-level non-zero exit not observed here.`,
+    evidence: { refusalMessage, refusalCode, missingKey: refusalMissing },
+  });
+
+  // Second refusal: kubernetes with startupEnabled=true but no paths.startup.
+  const bad2 = { ...resolveProfile('kubernetes') };
+  bad2.startupEnabled = true;
+  let refusalMessage2 = null;
+  let refusalCode2 = null;
+  let refusalMissing2 = null;
+  try { refuseIfPartial(bad2); } catch (e) { refusalMessage2 = e.message; refusalCode2 = e.code; refusalMissing2 = e.missingKey; }
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_14103_2,
+    verdict: refusalCode2 === 'PROBE_PROFILE_INCOMPLETE' && refusalMissing2 === 'paths.startup' ? 'pass' : 'fail',
+    detail: `observed kubernetes with startupEnabled but no paths.startup refused via refuseIfPartial with code='${refusalCode2}' missingKey='${refusalMissing2}' message='${refusalMessage2}'. Process-level non-zero exit not observed here.`,
+    evidence: { refusalMessage: refusalMessage2, refusalCode: refusalCode2, missingKey: refusalMissing2 },
+  });
+
+  // AC-14103-1 presence shape check for all six profiles.
+  const shape = [];
+  let allShapeOk = true;
+  for (const name of SHIPPED_NAMES) {
+    let resolved = null;
+    let err = null;
+    try { resolved = refuseIfPartial(resolveProfile(name)); } catch (e) { err = e.message; }
+    const surfaceOk = resolved && (resolved.paths || resolved.command || resolved.notify);
+    const ok = Boolean(resolved && resolved.transport && surfaceOk && resolved.responseContract && resolved.semanticModel);
+    if (!ok) allShapeOk = false;
+    shape.push({ name, transport: resolved?.transport, hasSurface: Boolean(surfaceOk), hasResponseContract: Boolean(resolved?.responseContract), hasSemanticModel: Boolean(resolved?.semanticModel), err });
+  }
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_14103_1,
+    verdict: allShapeOk ? 'pass' : 'fail',
+    detail: `observed presence-only shape check for all six shipped profiles: ${JSON.stringify(shape)}. Enum-membership per field is not observed here.`,
+    evidence: { acceptedProfile: 'all-six', resolvedTransport: 'mixed', resolvedPaths: {}, shape, shippedNames: SHIPPED_NAMES },
+  });
+
+  // AC-14103-3 loadBalancer shape observation (not materialised).
+  const lb = resolveProfile('loadBalancer');
+  const lbOk = lb.paths?.health && !lb.paths?.liveness && !lb.paths?.readiness && lb.semanticModel === 'singleHealthSignal';
+  results.push({
+    anchorAcId: null,
+    conformanceOnly: true,
+    limitation: LIM_14103_3,
+    verdict: lbOk ? 'pass' : 'fail',
+    detail: `The loadBalancer profile resolves to a single-endpoint HTTP GET  -  observed resolved paths=${JSON.stringify(lb.paths)} semanticModel='${lb.semanticModel}'; expected paths.health present with no paths.liveness/paths.readiness and semanticModel==='singleHealthSignal'. Materialised handler absence not observed here.`,
+    evidence: { acceptedProfile: lb.name, resolvedTransport: lb.transport, resolvedPaths: lb.paths, semanticModel: lb.semanticModel },
+  });
+
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_OBS_PROBE_PORT', 'RCF_FIXTURE_OBS_PROBE_SEPARATE_PORT'], shippedNames: SHIPPED_NAMES } };
+}

package/blueprints/observability-probe-endpoints/contributions/probes/probe-utils.mjs

@@ -0,0 +1,49 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+export const PROJECT_ROOT = resolve(HERE, '..', '..', '..', '..');
+export const FIXTURE_DIR = resolve(PROJECT_ROOT, 'packages/rcf-lite/test/fixtures/probe-pack-observability-probe-endpoints');
+export const REPORT_DIR = resolve(PROJECT_ROOT, '.rcf/reports/blueprints/observability-probe-endpoints');
+export const DECLARED_ENV = new Set(['RCF_FIXTURE_OBS_PROBE_PORT', 'RCF_FIXTURE_OBS_PROBE_SEPARATE_PORT']);
+
+export function aggregate(results) {
+  if (!Array.isArray(results) || results.length === 0) return 'fail';
+  if (results.some((r) => r.verdict === 'fail')) return 'fail';
+  if (results.some((r) => r.verdict === 'warn')) return 'warn';
+  return 'pass';
+}
+export function isSkipped(results) { return Array.isArray(results) && results.length > 0 && results.every((r) => r.accountBoundSkipped === true); }
+export async function writeReport({ probeName, engine, results, extra }) {
+  await mkdir(REPORT_DIR, { recursive: true });
+  const normalised = (Array.isArray(results) && results.length > 0)
+    ? results
+    : [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: 'no checks ran', evidence: { reason: 'no checks ran', probeName, runAt: new Date().toISOString(), engine } }];
+  const raw = aggregate(normalised);
+  const aggregateVerdict = isSkipped(normalised) ? 'pass' : raw;
+  const report = { slug: 'observability-probe-endpoints', probeName, runAt: new Date().toISOString(), engine, results: normalised, aggregateVerdict, ...(extra ?? {}) };
+  const path = resolve(REPORT_DIR, `${probeName}.json`);
+  await writeFile(path, JSON.stringify(report, null, 2) + '\n', 'utf8');
+  return { report, path };
+}
+export async function runShim(probeName, engine, mainFn) {
+  try {
+    const outcome = (await mainFn()) ?? { results: [] };
+    const { results, extra } = outcome;
+    const { report, path } = await writeReport({ probeName, engine, results, extra });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stdout.write(`report written to ${path}\n`);
+    if (report.aggregateVerdict === 'fail') process.exitCode = 1;
+  } catch (err) {
+    const results = [{ anchorAcId: null, harnessError: true, verdict: 'fail', detail: `probe threw: ${err?.message ?? err}`, evidence: { thrown: true, message: err?.message ?? String(err), name: err?.name ?? 'Error', probeName, runAt: new Date().toISOString(), engine } }];
+    const { report, path } = await writeReport({ probeName, engine, results });
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+    process.stderr.write(`probe error: ${err?.stack ?? err}\n`);
+    process.stderr.write(`report written to ${path}\n`);
+    process.exitCode = 1;
+  }
+}
+function portFrom(v) { if (v === undefined || v === '') return 0; const n = Number(v); return Number.isInteger(n) && n >= 0 && n <= 65535 ? n : 0; }
+export const primaryPort = () => portFrom(process.env.RCF_FIXTURE_OBS_PROBE_PORT);
+export const separatePort = () => portFrom(process.env.RCF_FIXTURE_OBS_PROBE_SEPARATE_PORT);

package/blueprints/observability-probe-endpoints/contributions/probes/profile-boot-materialisation.mjs

@@ -0,0 +1,69 @@
+// Profile-boot-materialisation probe for observability-probe-endpoints.
+//
+// Resolves the shipped 'kubernetes' profile and materialises it on
+// 127.0.0.1 via the fixture registry; issues real HTTP GETs to the
+// resolved liveness and readiness paths with a probe-varied
+// x-request-id header per request. Records the response header echo
+// and body excerpt and asserts the resolved profile name equals
+// 'kubernetes' and the bound listener answers on the profile's
+// declared paths.
+//
+// AC-14101-1 additionally requires observation of fused/separate port
+// topology AND absence of handlers outside the resolved path set.
+// This row observes only bound-path behaviour; it does not check
+// port topology or verify no additional handlers were bound. Row
+// de-claimed (conformanceOnly, anchorAcId=null) with the limitation
+// naming AC-14101-1.
+
+import { randomUUID } from 'node:crypto';
+import { materialise, resolveProfile } from '../../../../packages/rcf-lite/test/fixtures/probe-pack-observability-probe-endpoints/src/profile-registry.mjs';
+import { primaryPort } from './probe-utils.mjs';
+
+export const anchorAcId = 'AC-14101-1';
+export const accountBound = false;
+const LIM_14101_1 = `AC-14101-1: requires a process configured with probeInterface.profile: kubernetes to bind probe handlers whose paths match the resolved profile AND to observe fused/separate port topology AND absence of handlers outside the resolved path set. This row observes bound-path behaviour (liveness and readiness respond 200 with body.status='pass') but does not verify port-topology or handler-absence clauses.`;
+
+async function get(url, rid) {
+  const res = await fetch(url, { headers: { 'x-request-id': rid } });
+  const text = await res.text();
+  let parsed = null; try { parsed = JSON.parse(text); } catch {}
+  return { status: res.status, requestId: res.headers.get('x-request-id'), contentType: res.headers.get('content-type'), body: text, parsed };
+}
+
+export default async function runProbe() {
+  const results = [];
+  const resolved = resolveProfile('kubernetes');
+  const inst = await materialise({ profile: resolved, listenerPort: primaryPort() });
+  const suppliedLive = randomUUID();
+  const suppliedReady = randomUUID();
+  let live, ready;
+  try {
+    live = await get(`http://127.0.0.1:${inst.requestPort}${inst.profile.paths.liveness}`, suppliedLive);
+    ready = await get(`http://127.0.0.1:${inst.requestPort}${inst.profile.paths.readiness}`, suppliedReady);
+    const liveOk = live.status === 200 && live.requestId === suppliedLive && live.parsed?.status === 'pass' && live.parsed?.profile === 'kubernetes' && live.parsed?.kind === 'liveness';
+    const readyOk = ready.status === 200 && ready.requestId === suppliedReady && ready.parsed?.status === 'pass' && ready.parsed?.profile === 'kubernetes' && ready.parsed?.kind === 'readiness';
+    const nameOk = inst.profile.name === 'kubernetes';
+    const pathsOk = inst.profile.paths.liveness === '/live' && inst.profile.paths.readiness === '/ready';
+    results.push({
+      anchorAcId: null,
+      conformanceOnly: true,
+      limitation: LIM_14101_1,
+      verdict: liveOk && readyOk && nameOk && pathsOk ? 'pass' : 'fail',
+      detail: `observed resolved profile.name='${inst.profile.name}' paths=${JSON.stringify(inst.profile.paths)} on port ${inst.requestPort}; live status=${live.status} echoed rid=${live.requestId === suppliedLive} body.status='${live.parsed?.status}' body.profile='${live.parsed?.profile}'; ready status=${ready.status} echoed rid=${ready.requestId === suppliedReady} body.status='${ready.parsed?.status}' body.profile='${ready.parsed?.profile}'.`,
+      evidence: {
+        acceptedProfile: inst.profile.name,
+        resolvedTransport: inst.profile.transport,
+        resolvedPaths: inst.profile.paths,
+        port: inst.requestPort,
+        variedInputs: { liveness: suppliedLive, readiness: suppliedReady },
+        derivedLive: { status: live.status, requestId: live.requestId, contentType: live.contentType, bodyExcerpt: live.body.slice(0, 300) },
+        derivedReady: { status: ready.status, requestId: ready.requestId, contentType: ready.contentType, bodyExcerpt: ready.body.slice(0, 300) },
+      },
+    });
+  } finally { await inst.close(); }
+  return { results, extra: { envDeclared: ['RCF_FIXTURE_OBS_PROBE_PORT', 'RCF_FIXTURE_OBS_PROBE_SEPARATE_PORT'], boundPort: inst.requestPort,
+    variedInputs: { liveness: suppliedLive, readiness: suppliedReady },
+    derivedLive: live && { status: live.status, requestId: live.requestId, contentType: live.contentType, bodyExcerpt: live.body.slice(0, 300) },
+    derivedReady: ready && { status: ready.status, requestId: ready.requestId, contentType: ready.contentType, bodyExcerpt: ready.body.slice(0, 300) },
+  } };
+}

package/blueprints/observability-probe-endpoints/contributions/probes/run-kubernetes-startup-enabled.mjs

@@ -0,0 +1,3 @@
+import runProbe from './kubernetes-startup-enabled.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('kubernetes-startup-enabled', { kind: 'http', driver: 'node:http fixture profile registry on 127.0.0.1', healthy: true }, runProbe);

package/blueprints/observability-probe-endpoints/contributions/probes/run-partial-profile-refusal.mjs

@@ -0,0 +1,3 @@
+import runProbe from './partial-profile-refusal.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('partial-profile-refusal', { kind: 'in-process', driver: 'profile registry refusal shim', healthy: true }, runProbe);

package/blueprints/observability-probe-endpoints/contributions/probes/run-profile-boot-materialisation.mjs

@@ -0,0 +1,3 @@
+import runProbe from './profile-boot-materialisation.mjs';
+import { runShim } from './probe-utils.mjs';
+runShim('profile-boot-materialisation', { kind: 'http', driver: 'node:http fixture profile registry on 127.0.0.1', healthy: true }, runProbe);

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-001.json

@@ -2,7 +2,11 @@
   "reqId": "observability-probe-endpoints-REQ-001",
   "prdId": "PRD-001",
   "title": "The health probe interface is derived from an operator-declared target integration",
-  "description": "The application exposes health probes shaped for the external system that will probe it. The operator declares a target integration by name (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, or a project-authored `custom` profile). The profile fixes the probe transport (HTTP GET, TCP socket accept, exec command, or a supervisor notify call), the probe path or command surface, the response contract, and the port topology defaults. A probe surface not backed by a declared profile is refused at boot with a stable-coded error naming the missing declaration. Nothing in the process wires a probe on its own initiative; the profile drives every binding.",
+  "description": "The application exposes health probes shaped for the external system that will probe it. The operator declares a target integration by name (`kubernetes`, `loadBalancer`, `uptimeMonitor`, `systemd`, `dockerHealthcheck`, `reverseProxy`, or a project-authored `custom` profile). The profile fixes the probe transport (HTTP GET, TCP socket accept, exec command, or a supervisor notify call), the probe path or command surface, the response contract, and the port topology defaults. Precedence at boot: an explicit `probeInterface.profile` declaration wins; when the declaration is absent, the shipped Kubernetes default (ADR-1503) resolves and the process boots on that profile. A profile name that is neither in the enumerated set nor a resolvable `custom` profile is refused at boot with a stable-coded `PROBE_PROFILE_UNKNOWN` error naming the offending value; a `probeInterface` declaration that is syntactically malformed (a non-object, or an object missing required per-profile keys) is refused with `PROBE_PROFILE_MALFORMED` naming the offending shape. Nothing in the process wires a probe on its own initiative; the profile drives every binding.",
+  "deliveredBy": {
+    "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+    "field": "interfaces.resolveProbeProfile"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",
@@ -14,5 +18,5 @@
   "version": "1.0.0",
   "status": "approved",
   "createdAt": "2026-08-30T00:00:00Z",
-  "updatedAt": "2026-08-30T00:00:00Z"
+  "updatedAt": "2026-09-09T00:00:00Z"
 }

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-002.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A default Kubernetes profile ships with liveness /live and readiness /ready served over HTTP GET",
   "description": "When the operator selects the `kubernetes` target integration (the shipped default), the profile wires two HTTP GET probe handlers: a liveness handler at path `/live` and a readiness handler at path `/ready`. Both handlers return HTTP 200 for pass and HTTP 503 for fail. The liveness handler answers strictly on in-process event-loop responsiveness and never depends on any external condition. The readiness handler answers on the operator-declared readiness predicate for the profile (default: strict-any-fail over the declared dependency set). Both paths and the port topology are overridable at boot; the defaults hold when the operator does not override.",
+  "deliveredBy": {
+    "tacId": "TAC-1501-observability-probe-endpoints-profile-resolver",
+    "field": "interfaces.profileLoader"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-003.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "Each supported target integration profile names its own probe path, response contract, transport, and semantic distinction",
   "description": "Every profile the blueprint ships names four things: the probe path or command surface (an HTTP path for HTTP profiles, a TCP port for socket profiles, a shell command for exec profiles, a supervisor call for notify profiles); the response contract (HTTP status code range with an optional minimal JSON body for HTTP profiles, connect-and-close for TCP, exit-code zero for exec, one notify call for supervisor); the transport (HTTP GET, TCP SYN, spawned process, or unix socket for supervisor calls); and the semantic distinction between liveness and readiness (two endpoints for Kubernetes; one health signal for load balancers and uptime monitors that do not distinguish; a boot-time readiness notification followed by a periodic watchdog for systemd; a single command answer for Docker HEALTHCHECK). A profile that does not resolve all four is refused at boot with a stable-coded error naming the missing field.",
+  "deliveredBy": {
+    "tacId": "TAC-1502-observability-probe-endpoints-handler-set",
+    "field": "interfaces.buildHandlerSet"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-004.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "A separate-port listener option is offered per HTTP profile for probe traffic isolation from user traffic",
   "description": "Every HTTP-transport profile offers a `probeListener.separatePort` option: when unset, probe handlers bind to the same listener that serves user request traffic (the fused topology); when set to a port number, probe handlers bind to a dedicated HTTP listener on that port and the user-traffic listener does not serve probe paths. The separate-port listener binds the profile's probe path set only; no other route is served on that listener. The option is off by default and opt-in per environment.",
+  "deliveredBy": {
+    "tacId": "TAC-1503-observability-probe-endpoints-listener-topology",
+    "field": "interfaces.bindListenerTopology"
+  },
   "category": "functional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-005.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "The response contract exposed to the external supervisor matches only what that supervisor consumes",
   "description": "Every profile's response is exactly what the supervising system reads and nothing more. HTTP-transport profiles that consume status code only (load balancer, uptime monitor, reverse proxy) return an empty response body with the resolved status code. HTTP-transport profiles that consume a body (Kubernetes HTTPGet, where the kubelet ignores body but operators inspect it during triage) return a minimal JSON body of the shape `{ \"status\": \"pass\" }` or `{ \"status\": \"fail\" }` with no additional fields. TCP-transport profiles complete the SYN-ACK handshake on pass and refuse the connection on fail. Exec-transport profiles exit with code 0 on pass and a non-zero code on fail. Supervisor-notify profiles emit exactly the notify calls the supervisor expects (for systemd: `READY=1` at startup, `WATCHDOG=1` on the configured watchdog cadence).",
+  "deliveredBy": {
+    "tacId": "TAC-1502-observability-probe-endpoints-handler-set",
+    "field": "interfaces.buildHandlerSet"
+  },
   "category": "nonFunctional",
   "domain": "observability",
   "priority": "must",

package/blueprints/observability-probe-endpoints/contributions/requirements/observability-probe-endpoints-req-006.json

@@ -3,6 +3,10 @@
   "prdId": "PRD-001",
   "title": "No internal identifier is exposed on any external-visible probe response",
   "description": "The probe response, on every profile that emits a response payload, contains no dependency name, no environment name (dev, staging, live), no hostname, no replica id, no database identifier, no queue name, no internal URL, no build hash, no commit sha, no numeric metric value, no dependency count, no latency measurement, no error rate. The response is bounded to the fields REQ-005 enumerates for the profile and to the resolved status code. A profile that adds any field beyond that set is refused by the profile validator at boot with a stable-coded error naming the offending field.",
+  "deliveredBy": {
+    "adrId": "ADR-1505-observability-probe-endpoints-external-response-secrecy",
+    "field": "decision.externalResponseSecrecy"
+  },
   "category": "security",
   "domain": "observability",
   "priority": "must",